Authentication CHAPTER 17
|
|
- Corey Chase
- 6 years ago
- Views:
Transcription
1 Authentication CHAPTER 17
2 Authentication Authentication is the process by which you decide that someone is who they say they are and therefore permitted to access the requested resources. getting entrance to a computer lab getting past the bouncer at the bar logging into your web application
3 Authentication Factors Authentication factors are the things you can ask someone for in an effort to validate that they are who they claim to be.
4 Authentication Factors the things you can ask someone for Knowledge factors are the things you know Passwords, PIN, Challenge Question Ownership factors are the things that you possess Key, FOB, Card, Mobile Phone Inherence factors are the things you are Fingerprint, signature, DNA, gait
5 Single Factor Authentication Single-factor authentication is the weakest and most common category of authentication system where you ask for only one of the three factors. Know a password Posses an access card Fingerprint access on your mobile phone When better authentication confidence is required, more than one authentication factor should be considered
6 Multi Factor Authentication Multifactor authentication is where two distinct factors of authentication must pass before you are granted access. The way we all access an ATM machine is an example of two-factor authentication: you must have both the knowledge factor (PIN) and the ownership factor(card) Multifactor authentication is becoming prevalent in consumer products as well: your cell phone is used as the ownership factor alongside your pin as a knowledge factor.
7 Authentication for Websites Form-based Allows the developer to code a login form that gets the username and password. Allows the developer to only request the username and password once per session. This is the most common type of authentication Digest and Basic Authentication are browser-based dialog boxes to get the username and password (not widely used)
8 Third Party Authentication Let someone else worry about it Many popular services allow you to use their system to authenticate the user and provide you with enough data to manage your application. Third-party authentication schemes like OpenID and oauth are popular with developers and are used under the hood by many major websites including Amazon, Facebook, Microsoft, and Twitter, to name but a few.
9 OAuth 3 rd party Authentication requires some effort OAuth uses four user roles The resource owner is normally the end user who can gain access to the resource (though it can be a computer as well). The resource server hosts the resources and can process requests using access tokens. The client is the application making requests on behalf of the resource owner. The authorization server issues tokens to the client upon successful authentication of the resource owner. Often this is the same as the resource server.
10 OAuth
11 Authorization Not the same as authentication Authorization defines what rights and privileges a user has once they are authenticated. Authentication grants access vs Authorization defines what the user with access can (and cannot) do. The principle of least privilege is a helpful rule of thumb that tells you to give users and software only the privileges required to accomplish their work.
12 Back to Form-Based Authentication In general: Encryption means two-way encoding with a public or private key Hashing means one-way encoding (can't be decoded) Best practice is to store passwords in the database in hashed form so that if the database is breached, passwords aren't easily read. MD5 and SHA1 are older hashing algorithms which have been found to have flaws SHA256, SHA512 are newer and stronger (the number refers to the length of the hash produced.) PHP has a hash() function which can be used as follows: $password = hash("sha256", $password);
13 Using Salts for Added Security Passwords can be made even more secure by adding some random value to the password string before hashing it. There are several ways to do this: 1. Generate a random number and concatenate the password with it before hashing (the salt must then be stored.) 2. Concatenate another field, say users , with the password before hashing. As long as the comparison string is concatenated and hashed, the algorithm will generate the same hashed string.
14 BCrypt The slower a hashing algorithm works, the harder it is for hackers' automated cracking attempts to work. But, it can't be so slow that it becomes impractical to use. Bcrypt is based on a symmetric block cipher called Blowfish. We can make the algorithm work n times slower than it normally would by manipulating the cost factor (the 2-digit number following the second $ in the salt.)
15 Others PBKDF2 : Password-Based Key Derivation Function 2 Designed to be a key-stretching function but is suitable for password storage scrypt() : Relatively new (2012) Designed to ensure better security than its predecessor bcrypt()
16 Too Many Choices As of PHP 5.5, there is a password_hash() function which allows PHP to select the most trusted password hashing algorithm available without having to modify your code! The default uses the bcrypt algorithm and a randomly generated salt (The salt option has been deprecated in PHP 7.0, so it is preferable to start using the salt generated by default.) Because the default algorithm is meant to change over time, it is recommended that varchar(255) be used to store passwords (even though the current length only requires 60 characters.)
17 Secure Authentication Authentication is the process of determining whether a server or client is who and what it claims to be. When a browser makes an initial attempt to communicate with a server over a secure connection, the server authenticates itself by providing a digital secure certificate. If the digital secure certificate is registered with the browser, the browsers won t display the certificate by default. However, the user still has the option to view the certificate. In some rare cases, the server may request that a client authenticate itself by presenting its own digital secure certificate.
18 HTTPS Secure HTTP HTTPS is the HTTP protocol running on top of the Transport Layer Security (TLS). It s easy to see from a client s perspective that a site is secured by the little padlock icons in the URL bar used by most modern browsers
19 HTTPS Secure Handshakes
20 A Digital Secure Certificate
21 HTTPS Certificate Authorities A Certificate Authority (CA) allows users to place their trust in the certificate since a trusted, independent third party signs it.
22 Certificate Authorities A W3Techs survey from May 2015 SSL Strengths Refers to the length of the generated key that is created during encryption Stronger security costs more 40-bit 56-bit 128-bit (typical SSL strength for collecting personal information) 256-bit
23 HTTPS Self-Signed Certificates Self-signed certificates provide the same level of encryption, but the validity of the server is not confirmed.
24 Using HTTPS Secure Sockets Layer (SSL) An older Internet protocol that allows for data transmission between server and client through a secure connection Transport Layer Security (TLS) A newer protocol for transferring data via a secure connection. Often referred to as SSL Secure connection The browser encrypts data being sent to the server and the server then decrypts it The server encrypts data being sent to the browser and the browser then decrypts it
25 URLs for Secure Connections Request a secure connection: Return to a regular connection Requests must be full URLs
26 Redirection The server initiates a request from the browser to another URL The header function with the Location: string header('location:.'); // the current directory header('location:..'); // up one directory header('location:./admin'); // down one directory header('location: error.php'); header('location:
27 The $_SERVER Array Examples of URI references: //example.org/scheme-relative/uri/with/absolute/path/to/resource.txt /relative/uri/with/absolute/path/to/resource.txt relative/path/to/resource.txt../../../resource.txt
28 The $_SERVER Array $_SERVER['HTTP_HOST']=webdev.cislabs.uncw.edu $_SERVER['REQUEST_URI']=/~abc1234/file.php A utility file to build an absolute URL using the $_SERVER array: <?php // make sure the page uses a secure connection $https = filter_input(input_server, 'HTTPS'); if (!$https) { $host = filter_input(input_server, 'HTTP_HOST'); $uri = filter_input(input_server, 'REQUEST_URI'); $url = ' $host. $uri; header("location: ". $url); exit(); }?>
29 Requiring a Secure Connection require_once 'secure_conn.php'; Use on any pages that contain sensitive information
30 Reverting to HTTP require_once 'reg_conn.php'; After a user has logged out for example
31 Next Steps: CHAPTER 9 LOGIN/LOGOUT COOKIES AND SESSIONS
32 The Remaining Slides Contain Additional Information about Cryptography IN CASE YOU ARE INTERESTED...
33 Cryptography Secret Messages Being able to send a secure message has been an important tool in warfare and affairs of state for centuries. At a basic level we are trying to get a message from one actor (we will call her Alice), to another (Bob), without an eavesdropper (Eve) intercepting the message. Since a single packet of data is routed through any number of intermediate locations on its way to the destination, getting your data (and passwords) is as simple as reading the data during one of the hops unless you use cryptography.
34 Cryptography The problem
35 Cryptography The goal
36 Cryptography Some key terms A cipher is a message that is scrambled so that it cannot easily be read, unless one has some secret key. The key can be a number, a phrase, or a page from a book. What is important in both ancient and modern cryptography is to keep the key a secret between the sender and the receiver.
37 Cryptography Substitution ciphers A substitution cipher is one where each character of the original message is replaced with another character according to the encryption algorithm and key. Caesar Vigenère One Time Pad Modern Block Ciphers
38 Caesar Substitution ciphers The Caesar cipher, named for and used by the Roman Emperor, is a substitution cipher where every letter of a message is replaced with another letter, by shifting the alphabet over an agreed number (from 1 to 25). The message HELLO, for example, becomes KHOOR when a shift value of 3 is used
39 The problem with lousy ciphers Letter distribution is not flat The frequency of letters (and sets of two and three letters) is well known If you noticed the letter J occurring most frequently, it might well be the letter E
40 The problem with lousy ciphers Letter distribution is not flat Any good cipher must therefore try to make the resulting cipher text letter distribution relatively flat so as to remove any trace of the telltale pattern of letter distributions. Simply swapping one letter for another does not do that, necessitating other techniques.
41 Vigenère Early attempt to flatten letter distribution of ciphers The Vigenère cipher, named for the sixteenth-century cryptographer, uses a keyword to encode a message. The key phrase is written below the message and the letters are added together to form the cipher text as illustrated
42 One Time Pad Vigenère with an infinitely long key The one-time pad refers to a perfect technique of cryptography where Alice and Bob both have identical copies of a very long sheet of numbers, randomly created Claude Shannon famously proved that the one-time pad is impossible to crack However, it is impractical to implement on a large scale and remains a theoretical benchmark that is rarely applied in practice.
43 Modern Block Ciphers Ciphers in the computer age Block ciphers encrypt and decrypt messages using an iterative replacing of a message with another scrambled message using 64 or 128 bits at a time. The Data Encryption Standard (DES) and its replacement, The Advanced Encryption Standard (AES) are two-block ciphers still used in web encryption today.
44 DES illustration Pretty simple, no?
45 Symmetric Key Problem How to exchange the key? All of the ciphers we have covered thus far use the same key to encode and decode, so we call them symmetric ciphers. The problem is that we have to have a shared private key. How? Over the phone? In an ? Through the regular mail? In person?
46 Public Key Cryptography Solves the problem of key exchange Public key cryptography (or asymmetric cryptography) solves the problem of the secret key by using two distinct keys: a public one, widely distributed another one, kept private Algorithms like the Diffie-Hellman key exchange allow a shared secret to be created out in the open, despite the presence of an eavesdropper
47 A Good Explanation of Public Key Encryption
48 Digital Signatures Confirming the sender is authentic A digital signature is a mathematically secure way of validating that a particular digital document was created by the person claiming to create it (authenticity), Was not modified in transit (integrity), and cannot be denied (non-repudiation).
49 Digital Signatures Confirming the sender is authentic A digital signature is a mathematically secure way of validating that a particular digital document was created by the person claiming to create it (authenticity), Was not modified in transit (integrity), and cannot be denied (non-repudiation). The process of signing a digital document can be as simple as encrypting a hash of the transmitted message.
50 Digital Signatures Confirming the sender is authentic
51 The End
Distributed Systems. 25. Authentication Paul Krzyzanowski. Rutgers University. Fall 2018
Distributed Systems 25. Authentication Paul Krzyzanowski Rutgers University Fall 2018 2018 Paul Krzyzanowski 1 Authentication For a user (or process): Establish & verify identity Then decide whether to
More informationCS November 2018
Authentication Distributed Systems 25. Authentication For a user (or process): Establish & verify identity Then decide whether to allow access to resources (= authorization) Paul Krzyzanowski Rutgers University
More informationCryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
More informationAPNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
More informationCCNA Security 1.1 Instructional Resource
CCNA Security 1.1 Instructional Resource Chapter 7 Cryptographic Systems 2012 Cisco and/or its affiliates. All rights reserved. 1 Explain how cryptology consists of cryptography (encoding messages) and
More informationBut where'd that extra "s" come from, and what does it mean?
SSL/TLS While browsing Internet, some URLs start with "http://" while others start with "https://"? Perhaps the extra "s" when browsing websites that require giving over sensitive information, like paying
More information(2½ hours) Total Marks: 75
(2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.
More informationCPET 499/ITC 250 Web Systems Chapter 16 Security. Topics
CPET 499/ITC 250 Web Systems Chapter 16 Security Text Book: * Fundamentals of Web Development, 2015, by Randy Connolly and Ricardo Hoar, published by Pearson Paul I-Hai, Professor http://www.etcs.ipfw.edu/~lin
More informationChapter 21 How to create secure web sites
Chapter 21 How to create secure web sites Murach's PHP and MySQL, C21 2014, Mike Murach & Associates, Inc. Slide 1 Objectives Applied 1. Use a secure connection and the Secure Sockets Layer (SSL) protocol
More informationLecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
More informationCSE 3461/5461: Introduction to Computer Networking and Internet Technologies. Network Security. Presentation L
CS 3461/5461: Introduction to Computer Networking and Internet Technologies Network Security Study: 21.1 21.5 Kannan Srinivasan 11-27-2012 Security Attacks, Services and Mechanisms Security Attack: Any
More information9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
More informationCryptographic Concepts
Outline Identify the different types of cryptography Learn about current cryptographic methods Chapter #23: Cryptography Understand how cryptography is applied for security Given a scenario, utilize general
More informationCryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
More informationWorksheet - Reading Guide for Keys and Passwords
Unit 2 Lesson 15 Name(s) Period Date Worksheet - Reading Guide for Keys and Passwords Background Algorithms vs. Keys. An algorithm is how to execute the encryption and decryption and key is the secret
More informationComputer Security. 08r. Pre-exam 2 Last-minute Review Cryptography. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08r. Pre-exam 2 Last-minute Review Cryptography Paul Krzyzanowski Rutgers University Spring 2018 March 26, 2018 CS 419 2018 Paul Krzyzanowski 1 Cryptographic Systems March 26, 2018 CS
More informationEncryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
More informationSecurity: Cryptography
Security: Cryptography Computer Science and Engineering College of Engineering The Ohio State University Lecture 38 Some High-Level Goals Confidentiality Non-authorized users have limited access Integrity
More informationCSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.1 Introduction to Cryptography CSC 474/574 By Dr. Peng Ning 1 Cryptography Cryptography Original meaning: The art of secret writing Becoming a science that
More informationComputer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
More informationPROTECTING CONVERSATIONS
PROTECTING CONVERSATIONS Basics of Encrypted Network Communications Naïve Conversations Captured messages could be read by anyone Cannot be sure who sent the message you are reading Basic Definitions Authentication
More informationBasic Concepts and Definitions. CSC/ECE 574 Computer and Network Security. Outline
CSC/ECE 574 Computer and Network Security Topic 2. Introduction to Cryptography 1 Outline Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues 2 Basic Concepts and Definitions
More informationEncryption I. An Introduction
Encryption I An Introduction Reading List ADO and SQL Server Security A Simple Guide to Cryptography Protecting Private Data with the Cryptography Namespaces Using MD5 to Encrypt Passwords in a Database
More informationSecurity+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
More informationLecture 30. Cryptography. Symmetric Key Cryptography. Key Exchange. Advanced Encryption Standard (AES) DES. Security April 11, 2005
Lecture 30 Security April 11, 2005 Cryptography K A ciphertext Figure 7.3 goes here K B symmetric-key crypto: sender, receiver keys identical public-key crypto: encrypt key public, decrypt key secret Symmetric
More informationPrinciples of Information Security, Fourth Edition. Chapter 8 Cryptography
Principles of Information Security, Fourth Edition Chapter 8 Cryptography Learning Objectives Upon completion of this material, you should be able to: Chronicle the most significant events and discoveries
More informationPublic-key Cryptography: Theory and Practice
Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 1: Overview What is Cryptography? Cryptography is the study of
More informationComputers and Security
The contents of this Supporting Material document have been prepared from the Eight units of study texts for the course M150: Date, Computing and Information, produced by The Open University, UK. Copyright
More informationCryptography Lesson Plan
Cryptography Lesson Plan Overview - Cryptography Summary There is a large amount of sensitive information being stored on computers and transmitted between computers today, including account passwords,
More informationComputer Networking. What is network security? Chapter 7: Network security. Symmetric key cryptography. The language of cryptography
Chapter 7: Network security 15-441 Computer Networking Network Security: Cryptography, Authentication, Integrity Foundations: what is security? cryptography authentication message integrity key distribution
More informationCSCI 454/554 Computer and Network Security. Topic 2. Introduction to Cryptography
CSCI 454/554 Computer and Network Security Topic 2. Introduction to Cryptography Outline Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues 2 Basic Concepts and Definitions
More informationL13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
More informationUNIT - IV Cryptographic Hash Function 31.1
UNIT - IV Cryptographic Hash Function 31.1 31-11 SECURITY SERVICES Network security can provide five services. Four of these services are related to the message exchanged using the network. The fifth service
More informationDavid Wetherall, with some slides from Radia Perlman s security lectures.
David Wetherall, with some slides from Radia Perlman s security lectures. djw@cs.washington.edu Networks are shared: Want to secure communication between legitimate participants from others with (passive
More informationOverview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
More informationGlenda Whitbeck Global Computing Security Architect Spirit AeroSystems
Glenda Whitbeck Global Computing Security Architect Spirit AeroSystems History 2000 B.C. Egyptian Hieroglyphics Atbash - Hebrew Original alphabet mapped to different letter Type of Substitution Cipher
More informationOutline. Cryptography. Encryption/Decryption. Basic Concepts and Definitions. Cryptography vs. Steganography. Cryptography: the art of secret writing
Outline CSCI 454/554 Computer and Network Security Basic Crypto Concepts and Definitions Some Early (Breakable) Cryptosystems Key Issues Topic 2. Introduction to Cryptography 2 Cryptography Basic Concepts
More informationCryptography in Lotus Notes/Domino Pragmatic Introduction for Administrators
Cryptography in Lotus Notes/Domino Pragmatic Introduction for Administrators Belfast, 11-Nov-2010 Innovative Software Solutions. Thomas Bahn - graduated in mathematics, University of Hannover - developing
More informationDigital Certificates Demystified
Digital Certificates Demystified Ross Cooper, CISSP IBM Corporation RACF/PKI Development Poughkeepsie, NY Email: rdc@us.ibm.com August 9 th, 2012 Session 11622 Agenda Cryptography What are Digital Certificates
More informationProtecting Information Assets - Week 11 - Cryptography, Public Key Encryption and Digital Signatures. MIS 5206 Protecting Information Assets
Protecting Information Assets - Week 11 - Cryptography, Public Key Encryption and Digital Signatures MIS5206 Week 11 Identity and Access Control Week 10 continued Cryptography, Public Key Encryption and
More informationRef:
Cryptography & digital signature Dec. 2013 Ref: http://cis.poly.edu/~ross/ 2 Cryptography Overview Symmetric Key Cryptography Public Key Cryptography Message integrity and digital signatures References:
More informationSecurity & Privacy. Web Architecture and Information Management [./] Spring 2009 INFO (CCN 42509) Contents. Erik Wilde, UC Berkeley School of
Contents Security & Privacy Contents Web Architecture and Information Management [./] Spring 2009 INFO 190-02 (CCN 42509) Erik Wilde, UC Berkeley School of Information Abstract 1 Security Concepts Identification
More informationSecurity: Focus of Control. Authentication
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
More informationSEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security
SEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security Consider 2. Based on DNS, identified the IP address of www.cuhk.edu.hk is 137.189.11.73. 1. Go to http://www.cuhk.edu.hk 3. Forward the
More information14. Internet Security (J. Kurose)
14. Internet Security (J. Kurose) 1 Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer:
More informationModern cryptography 2. CSCI 470: Web Science Keith Vertanen
Modern cryptography 2 CSCI 470: Web Science Keith Vertanen Modern cryptography Overview Asymmetric cryptography Diffie-Hellman key exchange (last time) Pubic key: RSA Pretty Good Privacy (PGP) Digital
More informationCRYPTOLOGY KEY MANAGEMENT CRYPTOGRAPHY CRYPTANALYSIS. Cryptanalytic. Brute-Force. Ciphertext-only Known-plaintext Chosen-plaintext Chosen-ciphertext
CRYPTOLOGY CRYPTOGRAPHY KEY MANAGEMENT CRYPTANALYSIS Cryptanalytic Brute-Force Ciphertext-only Known-plaintext Chosen-plaintext Chosen-ciphertext 58 Types of Cryptographic Private key (Symmetric) Public
More informationOther Uses of Cryptography. Cryptography Goals. Basic Problem and Terminology. Other Uses of Cryptography. What Can Go Wrong? Why Do We Need a Key?
ryptography Goals Protect private communication in the public world and are shouting messages over a crowded room no one can understand what they are saying 1 Other Uses of ryptography Authentication should
More informationCryptography Symmetric Cryptography Asymmetric Cryptography Internet Communication. Telling Secrets. Secret Writing Through the Ages.
Telling Secrets Secret Writing Through the Ages William Turner Department of Mathematics & Computer Science Wabash College Crawfordsville, IN 47933 Tuesday 4 February 2014 W. J. Turner Telling Secrets
More informationChapter 3 Traditional Symmetric-Key Ciphers 3.1
Chapter 3 Traditional Symmetric-Key Ciphers 3.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 3 Objectives To define the terms and the concepts of symmetric
More informationIntroduction to Cryptography in Blockchain Technology. December 23, 2018
Introduction to Cryptography in Blockchain Technology December 23, 2018 What is cryptography? The practice of developing protocols that prevent third parties from viewing private data. Modern cryptography
More informationCSC 774 Network Security
CSC 774 Network Security Topic 2. Review of Cryptographic Techniques CSC 774 Dr. Peng Ning 1 Outline Encryption/Decryption Digital signatures Hash functions Pseudo random functions Key exchange/agreement/distribution
More informationComputer Security. Two main issues are current regarding security for computer communication systems
Computer Security Two main issues are current regarding security for computer communication systems Data encryption User authentication Encryption and authentication between single users can be performed
More informationIntroduction to Cyber Security Week 2: Cryptography. Ming Chow
Introduction to Cyber Security Week 2: Cryptography Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Understand the difference between
More informationClassical Cryptography. Thierry Sans
Classical Cryptography Thierry Sans Example and definitions of a cryptosystem Caesar Cipher - the oldest cryptosystem A shift cipher attributed to Julius Caesar (100-44 BC) MEET ME AFTER THE TOGA PARTY
More informationMost Common Security Threats (cont.)
Most Common Security Threats (cont.) Denial of service (DoS) attack Distributed denial of service (DDoS) attack Insider attacks. Any examples? Poorly designed software What is a zero-day vulnerability?
More informationDistributed Systems. 26. Cryptographic Systems: An Introduction. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 26. Cryptographic Systems: An Introduction Paul Krzyzanowski Rutgers University Fall 2015 1 Cryptography Security Cryptography may be a component of a secure system Adding cryptography
More informationCSC/ECE 774 Advanced Network Security
Computer Science CSC/ECE 774 Advanced Network Security Topic 2. Network Security Primitives CSC/ECE 774 Dr. Peng Ning 1 Outline Absolute basics Encryption/Decryption; Digital signatures; D-H key exchange;
More informationOutline. Data Encryption Standard. Symmetric-Key Algorithms. Lecture 4
EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 4 Department of Electrical and Computer Engineering Cleveland State University wenbing@ieee.org Outline Review
More informationLorenz Cipher. Menu. Class 4: Modern Cryptography. British Cipher Machine. German Code-Breaking Efforts. Some loose ends on WWII Maurice Burnett
Cryptography in World War II Jefferson Institute for Lifelong Learning at UVa Spring 2006 David Evans Class 4: Modern Cryptography Menu Some loose ends on WWII Maurice Burnett Modern Cryptography Modern
More informationSecurity: Focus of Control
Security: Focus of Control Three approaches for protection against security threats a) Protection against invalid operations b) Protection against unauthorized invocations c) Protection against unauthorized
More informationDashlane Security Whitepaper
Dashlane Security Whitepaper November 2017 Contents 1. General Security Principles... 2 a. Protection of User Data in Dashlane... 2 b. Local access to User Data... 2 c. Local Data Usage after deciphering...
More informationDistributed Systems. Fall 2017 Exam 3 Review. Paul Krzyzanowski. Rutgers University. Fall 2017
Distributed Systems Fall 2017 Exam 3 Review Paul Krzyzanowski Rutgers University Fall 2017 December 11, 2017 CS 417 2017 Paul Krzyzanowski 1 Question 1 The core task of the user s map function within a
More informationContents. SSL-Based Services: HTTPS and FTPS 2. Generating A Certificate 2. Creating A Self-Signed Certificate 3. Obtaining A Signed Certificate 4
Contents SSL-Based Services: HTTPS and FTPS 2 Generating A Certificate 2 Creating A Self-Signed Certificate 3 Obtaining A Signed Certificate 4 Enabling Secure Services 5 A Note About Ports 5 Connecting
More informationThe World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
More informationA New Symmetric Key Algorithm for Modern Cryptography Rupesh Kumar 1 Sanjay Patel 2 Purushottam Patel 3 Rakesh Patel 4
IJSRD - International Journal for Scientific Research & Development Vol. 2, Issue 08, 2014 ISSN (online): 2321-0613 A New Symmetric Key Algorithm for Modern Cryptography Rupesh Kumar 1 Sanjay Patel 2 Purushottam
More informationCryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 14: Folklore, Course summary, Exam requirements Ion Petre Department of IT, Åbo Akademi University 1 Folklore on
More informationRadius, LDAP, Radius, Kerberos used in Authenticating Users
CSCD 303 Lecture 5 Fall 2018 Radius, LDAP, Radius, Kerberos used in Authenticating Users Kerberos Authentication and Authorization Previously Said that identification, authentication and authorization
More information2.1 Basic Cryptography Concepts
ENEE739B Fall 2005 Part 2 Secure Media Communications 2.1 Basic Cryptography Concepts Min Wu Electrical and Computer Engineering University of Maryland, College Park Outline: Basic Security/Crypto Concepts
More informationCryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
More information1.264 Lecture 28. Cryptography: Asymmetric keys
1.264 Lecture 28 Cryptography: Asymmetric keys Next class: Anderson chapters 20. Exercise due before class (Reading doesn t cover same topics as lecture) 1 Asymmetric or public key encryption Receiver
More information1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and
More informationPassword. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
More informationHow to create secure web sites
2017, Mike Murach & Associates, Inc. 1/20/2019 A request made with a secure connection Chapter 21 How to create secure web sites The URL starts with https A lock icon is displayed C21, Slide 1 2017, Mike
More informationCryptographic Systems
CPSC 426/526 Cryptographic Systems Ennan Zhai Computer Science Department Yale University Recall: Lec-10 In lec-10, we learned: - Consistency models - Two-phase commit - Consensus - Paxos Lecture Roadmap
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
More informationP2_L8 - Hashes Page 1
P2_L8 - Hashes Page 1 Reference: Computer Security by Stallings and Brown, Chapter 21 In this lesson, we will first introduce the birthday paradox and apply it to decide the length of hash, in order to
More informationSecurity. Communication security. System Security
Security Communication security security of data channel typical assumption: adversary has access to the physical link over which data is transmitted cryptographic separation is necessary System Security
More informationCS61A Lecture #39: Cryptography
Announcements: CS61A Lecture #39: Cryptography Homework 13 is up: due Monday. Homework 14 will be judging the contest. HKN surveys on Friday: 7.5 bonus points for filling out their survey on Friday (yes,
More informationContents. SSL-Based Services: HTTPS and FTPS 2. Generating A Certificate 2. Creating A Self-Signed Certificate 3. Obtaining A Signed Certificate 4
Contents SSL-Based Services: HTTPS and FTPS 2 Generating A Certificate 2 Creating A Self-Signed Certificate 3 Obtaining A Signed Certificate 4 Enabling Secure Services 5 SSL/TLS Security Level 5 A Note
More informationData Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
More informationSSH PK Authentication and Auto login configuration for Chassis Management Controller
SSH PK Authentication and Auto login configuration for Chassis Management Controller Dell technical white paper Dell Engineering May 2016 Author: Elangovan G Revisions Date August 2013 May 2016 Description
More informationCOSC 301 Network Management. Lecture 15: SSL/TLS and HTTPS
COSC 301 Network Management Lecture 15: SSL/TLS and HTTPS Zhiyi Huang Computer Science, University of Otago COSC301 Lecture 15: SSL/TLS and HTTPS 1 Today s Focus WWW WWW How to secure web applications?
More informationPublic Key Cryptography, OpenPGP, and Enigmail. 31/5/ Geek Girls Carrffots GVA
Public Key Cryptography, OpenPGP, and Enigmail Cryptography is the art and science of transforming (encrypting) a message so only the intended recipient can read it Symmetric Cryptography shared secret
More informationCS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
More informationProving who you are. Passwords and TLS
Proving who you are Passwords and TLS Basic, fundamental problem Client ( user ) How do you prove to someone that you are who you claim to be? Any system with access control must solve this Users and servers
More informationMaking and Breaking Ciphers
Making and Breaking Ciphers Ralph Morelli Trinity College, Hartford (ralph.morelli@trincoll.edu) Smithsonian Institute October 31, 2009 2009 Ralph Morelli You are free to reuse and remix this presentation
More informationDashlane Security White Paper
Dashlane Security White Paper December 2017 Contents 1. General Security Principles... 2 a. Protection of User Data in Dashlane... 2 b. Local access to User Data... 2 c. Local Data Usage after deciphering...
More informationCryptography MIS
Cryptography MIS-5903 http://community.mis.temple.edu/mis5903sec011s17/ Cryptography History Substitution Monoalphabetic Polyalphabetic (uses multiple alphabets) uses Vigenere Table Scytale cipher (message
More informationIntroduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
More informationSecuring Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
More informationDigital Signatures. Public-Key Signatures. Arbitrated Signatures. Digital Signatures With Encryption. Terminology. Message Authentication Code (MAC)
Message Authentication Code (MAC) Key-dependent one-way hash function Only someone with a correct key can verify the hash value Easy way to turn one-way hash function into MAC is to encrypt hash value
More informationIntroduction Classical Confidentiality Modern Confidentiality Integrity Authentication
Cryptography Introduction Classical Confidentiality Modern Confidentiality Integrity Authentication Introduction Cryptography in the Real World Cryptography is the process of writing or reading secret
More informatione-commerce Study Guide Test 2. Security Chapter 10
e-commerce Study Guide Test 2. Security Chapter 10 True/False Indicate whether the sentence or statement is true or false. 1. Necessity refers to preventing data delays or denials (removal) within the
More informationLecture 1: Perfect Security
CS 290G (Fall 2014) Introduction to Cryptography Oct 2nd, 2014 Instructor: Rachel Lin 1 Recap Lecture 1: Perfect Security Scribe: John Retterer-Moore Last class, we introduced modern cryptography and gave
More informationNETWORK SECURITY & CRYPTOGRAPHY
Assignment for IT Applications in Management Project On NETWORK SECURITY & CRYPTOGRAPHY Course Instructor Submitted By: Mr. ANIL KUMAR ROHIT BARVE 2013240 Section E PGDM 2013-15 Table of Contents Chapter
More informationTransport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
More informationCryptography. some history. modern secret key cryptography. public key cryptography. cryptography in practice
Cryptography some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) modern secret key cryptography DES, AES public key cryptography RSA, digital signatures cryptography in practice
More informationChapter 8. Network Security. Cryptography. Need for Security. An Introduction to Cryptography 10/7/2010
Cryptography Chapter 8 Network Security Introduction to Cryptography Substitution Ciphers Transposition Ciphers One-Time Pads Two Fundamental Cryptographic Principles Need for Security An Introduction
More informationCryptography and Network Security. Saint Leo University. COM 450- Network Defense and Security. Instructor: Dr. Omar.
Saint Leo University COM 450- Network Defense and Security Instructor: Dr. Omar Group members: Ivanna, Tracey, Romario, Chevon March 13, 2018 Abstract This paper will look at different aspects of Cryptography,
More information