Sem título

Página 1

Security

What is symmetrical encryption?

·

Secret key using numbers, words or random words that are applied to a

text of a message to change the content.

·

For example shifting each letter by a number of places in the alphabet

as long both sender and recipient knows the secret key they both can encrypt

and decrypt the message

Example of symmetrical encryption

·

Symmetric-key algorithms are into stream ciphers and block

ciphers. Stream ciphers encrypt the bits of the message one at a time,

and block ciphers take a number of bits and encrypt them as a single unit.

·

Examples: DES and Triple DES RC2 Serpent

·

Note:

Blocks of 64 bits have been commonly used. The Advanced Encryption Standard

(AES) algorithm approved by NIST in

December 2001 uses 128-bit blocks.

Cryptographic primitives

based on symmetric ciphers

·

Symmetric

ciphers are used to do other cryptographic

primitives

than just encryption.

·

Sometimes

time message can be changed while being encrypted so for this reasons a message

authentication code is added to cipher text so that any change to the text will

be noted by receiver for example using CBC-MAC

Pros and cons of symmetrical encryption

Advantages -Message

can be sent encrypted between 2 users so nobody can see.

Disadvantages-If key compromised then all data can be intercepted or

false messages sent, Short keys are easy to break patterns and longer keys are more secure but key distribution more

difficult

Difference between encryption and decryption

Encryption converts data into cipher text that can’t be understood by

unauthorized people.

Decryption converts the encrypted cipher text back to the original form.

So I can be understood.

Bit-level cipher and what it looks like

·

Used

to encrypt any type of data – not just text based

·

Encryption

key is just a bit pattern

·

Apply

an XOR between the data and the key

·

Forward

the result

·

Decryption

– repeat the process using the same key

Why use

Symmetric Keys:

·

Symmetric

keys are faster than public key

encryption because public keys use a lot of computers processors than symmetric

keys

·

Symmetric

key is used to provide privacy for bulk encryption and decryption of

information

·

Symmetric

keys are commonly used for confidential online communications

·

Different

session keys are used for each confidential communication session and session

keys are sometimes renewed at specified intervals

Data Encryption Standard

Short for Data Encryption Standard, a popular symmetric-key encryption method .DES uses a 56-bit key and uses the block cipher method, which breaks text into 64-bit blocks and then encrypts them.

Improved symmetrical algorithms

•

Triple-DES

–

DES algorithm applied three times with 2

differing keys

–

Was used to extend the life of DES

•

International Data Encryption Algorithm

–

Block encryption algorithm (1990)

–

128 bit key and still yet to be broken – but

weak keys that will allow an attack have been identified

Asymmetric encryption

Uses

a key-pair - two different keys:

·

one private, Kpriv - for decryption

·

one public, Kpub -

for encryption

M

= Kpriv( Kpub(M))‏

·

Distribution - either

–

Public key can be freely distributed

–

or a Key Distribution Service can be used

·

Hard to generate efficient key pairs

·

Example is RSA algorithm

Asymmetric

– E.g. RSA

·

Key

pairs based on factors of prime numbers

·

Difficult

to calculate effective key pairs

·

Extremely

difficult to crack

·

Slower

in operation that DES (100 – 10,000 Times)

·

Provides

a signature that cannot be reproduced

·

Keys

for commercial level security are 1024 bits long and are typically 1024 – 2048

bits long

·

Impossible

to brute force

Security

policy:

A Security policy is a set of rules that

define:

·

Procedures

– E.g. what constitutes authorized activity, appropriate monitoring mechanisms?

·

Responsibilities

– who is responsible for what?

·

Reporting

– When, What and to Whom?

·

Enforcement

– How to ensure policy is enacted?

Rules

·

Assumes

all clients are untrustworthy until trustworthiness can be proved

·

Assumes

all services are untrustworthy

·

Assumes

all networks are completely untrustworthy

·

Clients

are servers must be trusted to some degree -Within the concept of a security

policy

·

Concept

of security domain - Each domain has Its own security policy

Complex security

policies

•

The

access control list and capability list, security models are stateless.

Properties remain fixed unless explicitly

changed by the server

•

Complex

access control policies are state dependant. Authorization of access

Depends on subjects past history and

interaction with other subjects

•

Complex

access control policies have state

dependent security requirements

Security

concern:

Loss

of Confidentiality

•

Information

is revealed to one or more unauthorized principles

•

Measures-

authentication, authorization, secret signed

Loss

of Integrity

•

Information

is corrupt, accidentally or maliciously

•

Measures

- accountability , secret, sealed sequence

Loss

of Accountability

•

Information

or action cannot be accurately attributed

•

Measures

- authentication, authorization , secret, signed

Loss

of Service

•

Services

are denied to authorized principles

•

Measures

- accountability , sealed, signed

Auditing

•

Passive protection- acts as a last resort when other

mechanism such as authentication and authorization are not sufficient to

protect the security of the system

•

Can be performed outline in the firewall for early

detections of threats or offline when an attack

or problem has already occurred

•

Maintain log files that record all activity in the

system and the network.

Potential

security breaches/threats and how to

avoid?

 Physical damage, Forgery, Interception

 Masquerading, Modification, Replay

 Spoofing, Repudiation, Infiltration



Viruses, Trojan Horses, Logic Bombs

Distribute

environment Issues:

•

local

security is not practical due to scalability problems

•

In

security terms a user or system entity (e.g., a process) is referred to as a

principle

•

Principles

request operations by sending message to system objects

•

mediator

interacts between user and processes

•

Distributed

system runs on top of the a large number of loosely coupled Autonomous hosts,

that maybe running different OS’s with possible different security policies

Distributed

concepts “The 3 A’s”:



Authentication



Establishing the validity of a claimed identity



Authorization



Establishing the credentials of authenticated principle and their access rights



Accountability



Establishing proof of origin of actions

I.e.

who sent a message, who edited a file (and when)

Distributed

concepts “The 5 S’s”:



Secret



Cannot be interpreted by unauthorized principle



Sealed



Tampering can be detected



Signed



Identity of principle can be guaranteed



Stamped



Confirmation of receipt can be guaranteed



Sequence



Duplication and Replay are prevented

New Page