Ralph Durkee Independent Consultant Security Consulting, Security Training, Systems Administration, and Software Development
|
|
|
- Roy Quinn
- 6 years ago
- Views:
Transcription
1 Ralph Durkee Independent Consultant Security Consulting, Security Training, Systems Administration, and Software Development
2 PGP and GnuPG Rochester OWASP Agenda: Generic Public Key Encryption PGP Encryption Digital Signatures PGP Keys Key Management Example Application usage Discussion 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 2
3 Public Key a.k.a. Asymmetric Encryption 2 Keys used 1 Public Key Made publicly known 1 Private Key Carefully Protected May Encrypt with either key (Public or Private) Decrypt with the opposite key used for encryption 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 3
4 Symmetric Encryption a.k.a. Shared Secret Encrypt and Decrypt with same key Problems Have to securely pre negotiate a shared secret Sender can also decrypt messages. Security depends on the strength of the secret Need a unique secret for each communication path Benefits Symmetric Encryption is about times faster than Asymmetric Encryption 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 4
5 The Best of Both Worlds Hybrid A/Symmetric Encrypt. Combine the Best of Public Key with the Best of Symmetric Encryption 2. Start off with PK to avoid a shared Secret 3. Use PK to authenticate parties (May be either Party or Both) 4. Generate a one time random session key 5. Share the session key via PK 6. Switch to Symmetric Encryption for better performance, using the shared session key 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 5
6 Hybrid A/Symmteric Encryption Common Reoccurring Design Pattern Used in SSL IPSec SSH S/MIME And PGP 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 6
7 PGP E mail Encryption 1. Document is compressed 2. Random Session Key generated 3. Document is encrypted (symmetric) with the session key 4. Session Key is encrypted with the public key of every recipient. 5. Encrypted Key(s) and Document converted to ASCII Armor (RFC 2015) 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 7
8 Digital Signatures Digital signature is applied prior to encryption 1. Generate a Secure Hash of the entire document. 2. Secure Hash is kind of like a check sum, but much better as it is not easily calculated in reverse. 3. The Secure Hash is encrypted with the signers private key. 4. Anyone with public key can decrypt the hash 5. Decrypted Hash is compared against recalculated hash to verify that the document hasn t been modified. 6. Provides non repudiation as well as integrity. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 8
9 Algorithm Details PGP like IPSec and SSL is really a collection or suite of Algorithms Choices of Algorithms (RSA & DH/DSS) Choices of Symmetric Ciphers Choices of key lengths Added Info included in the message Also included with the keys 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 9
10 PGP Keys What s in a key ID Unique Identifier (0xDB93230C) Type Algorithm Used (RSA or DH/DSS) Size Key size in bits (usually 1024 and up) Created Date Key was created. Expire Date the Key expires Cipher Symmetric Algorithm (CAST, IDEA, 3DES, AES 128 & AES 256) Finger Print Secure Hash of the key (Good for validating key) Validity Valid only if signed Trust Implies auto trust of other keys signed 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 10
11 Key Management Getting Keys Getting a key is easy Via: E mail Key Servers e.g. wwwkeys.us.pgp.net Off from a web site PDA transfer Most any way a file can be received 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 11
12 Key Management Trusting Keys Methods of Validation Face to Face with Photo ID (best verification) Phone Call and read the Key Finger Print (Good if you know the person) Get key from multiple sources and verify (Good for verifying signatures from on downloaded files.) Signing the key ensure its integrity 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 12
13 PGP File Formats ASCII Armor for encrypted e mail and preferred for key exchanges. Clear Text Signed Text with in line PGP signature 8 bit Binary default for file encryption for both GnuPG and pgp.com Detached Signed Signature store in separate file (may be in ASCII or binary format). All formats have good interoperability across platforms. Even key rings are surprisingly portable 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 13
14 Sample Key ASCII Armor Format -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP 8.0 mqgibdrp1xurbadfhi5aw9xq2ulmczne7ay4vlv2iqvw8lkdzvve+tbse1shu8qb 1IBqQETXCM4H3c/jdJyqR+He4J7R3rfy/f/uAJhKyI5oklr+r43ardotsvvXoFXb 7qaQMw5H8lPINAHzUey86kNem1ewwSnrkicdRWOTuAokZJhGIc1U3cEUrwCg/9yJ immoduxdvtk01jy8be6lt9seamshlgadwz4sw3mdc9kkvxdrwery3sktclxpj8b1 YTvHr7S+n66VK4mEzIrycTL4vG0WGpeKI+ga17fe/swYNz3TPhlJhwX3cvPI/37d 2Gqdie55qbYNyOgAO1oSLGWRqUc4nGkuwxA83uEwLHNRAIr/S+2gPRKWhxdCPN1T 3NR/A/934ervK95h+HtJwMmDopiPK1im3q4TuOoJSp/l0khBGUIrXHQJoKUXCDNb... ieyegbecaayfajrp1xuacgkqlngy0nutiwxlzgcg0f031ddkprokmzpgnq+etlia sgman0iqlk4flhvqi290mw9jiedo+fdr =abqo -----END PGP PUBLIC KEY BLOCK /17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 14
15 PGP E Mail Formats PGP In line ASCII Armor or clear text signed Recommended for e mail without an attachment Simplest format, just another message Most compatible with MS Windows Mail Clients PGP/MIME RFC 1847, 2015, 2440 & 3156 Encapsulates the message and all attachments into single verifiable MIME. Most compatible with Unix Mail Clients Most Reliable due to encapsulation 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 15
16 Sample Clear Text Signed Format Subject: SANS NewsBites Vol. 6 Num. 14 To: Ralph Durkee (SD1168) <rd@rd1.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ********************************************************************** SANS NewsBites April 7, 2004 Vol. 6, Num. 14 ********************************************************************** TOP OF THE NEWS BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin) id8dbqfac/cg+lug5kfptkyrapmaaj4vvby62p9xv9awed2rrjvh8qjnoqcdeo3x NKG7+JbxZQ4OGe62FLBupRI= =kxtd -----END PGP SIGNATURE /17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 16
17 Sample PGP/MIME --=-- Content-Type: application/pgp-encrypted Version: 1 --=-- Content-Type: application/octet-stream -----BEGIN PGP MESSAGE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see qanqr1dbwu4d9+nmrmaishmqcac6ne2tmkp0fx2fkdmgo0co7aavzlzyrucrqghg... F82Z0qFvv3HKHMifQB0XNPM= =/4GH -----END PGP MESSAGE = /17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 17
18 PGP More E Mail Formats Third Format Separate encrypted Attachments Each encrypted separately Message body may be encrypted in line and/or as an attachment. Doesn t prevent tampering by removing or adding attachments. MS Outlook always sends PGP w/ attachments separately, body is in line and as an rtf attachment. Eudora prompts with warning that PGP/MIME is not compatible with some clients. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 18
19 Default File extensions by Platform File Format GnuPG PGP ASCII Armored.asc.asc Binary Encrypted.gpg.pgp Detached Signatures.sig.sig 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 19
20 PGP enabled Unix Mail Clients Client Mutt Ximian Evolution Sylpheed Mac GPGMail Mozilla Thundbird with Enigmail Kmail PGP/In line Yes Yes Yes Yes Yes Yes PGP/MIME Yes Yes Yes Yes Yes Yes 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 20
21 PGP enabled MS Windows Mail Clients Client MS Outlook Eudora PGP/In line Yes Yes PGP/MIME No Yes 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 21
22 PGP usages in Applications Application to User Typically just encrypted or signed e mail Example generated and e mailed SANS newsletter Application to Application Typically Encrypted and signed FTP, HTTP Encrypted files generated and transferred for data processing Web Services encryption and signing for specific sensitive content. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 22
23 PGP usages in Applications User to Application E mail example: PGP encrypted & signed e mail opens access to an SSH port. HTTPS to E mail example: forms receives information over SSL, PGP encrypts and e mails to user or to an application 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 23
24 Benefits of PGP for Application usage Sending Application only has public key for encryption Once original clear text information is securely removed, information can not be obtained from sending application. Works best for message based application May not be suitable for where high volume of information is exchanged and high performance is required. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 24
25 GnuPG Made Easy (GPGME) New GnuPG library for application usage. Intended to make Application integration easier. Mostly used by Mail User Agents currently Expected to help in future development of PGP enabled application 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 25
26 HTPS PGP Example of PGP integration Form receives sensitive information over HTTPS Rather than stored, The posted the information is PGP encrypt and e mail to an application (or a user) Doesn t provide end to end encryption since it is re encrypted Advantages, simple to implement and provides for distributed application. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 26
27 Example Implementation Perl web form piped to gpg (GnuPG) command line piped to mail. GnuPG options useful for applications e or encrypt s or sign r or recipient a or armour (ASCII rather than binary) batch (don t use interactive questions) no tty (don t output to the terminal) quiet (suppress messages) 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 27
28 PGP usage for Example PGP Public key of recipient application must be readable by web server user id. Public key and key ring should not be writable. Private key for recipient application should not exist on the front end web application. Clear text private key is needed for signing by the web server. Helps recipient validate message. From address for e mail should be web server, not the user posting the message. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 28
29 Threats, Risk Security Controls May be appropriate to allow unauthenticated access to https form Be prepared for malicious abuse of the web form either way Use a Security hardened platform Follow Operating System and Web Server security best practice guidelines such as Center for Internet Security ( Consider OWASP top 10 vulnerabilities and guidelines 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 29
30 Carefully Validate All Input Check for unexpected input field names Check maximum length for field values Check for non ASCII values in input fields Check for unexpected ASCII values in input fields. Limit number of field and total post length Is the server vulnerable to HTTP header be manipulated preset key environment variables (like PATH) to expected values. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 30
31 Other Risks Access controls Is form accessible via http as well? Can the HTTP get method be used? If authentication is required, can it be by passed? XSS May or may not be an issue depending on back end procesing Injection flaws Ensure input can not affect the processing by perl, shell or gpg Input should only be processed as data piped to gpg. 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 31
32 Discussion Any remaining Questions? Thought questions: What are the weakness of PGP? What attacks are likely if someone wanted to decipher PGP encrypted e mail? Is a Man in the middle attack possible? If not why not, or if so how could it be prevented? 04/17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 32
33 References GNU Privacy Guard International PGP PGP Corporation mutt patch: pgp menu traditional menu traditional.html RFC 3156 MIME Security with OpenPGP (updates 2015) RFC 2015 MIME Security with Pretty Good Privacy (PGP) RFC 2440 OpenPGP Message Format Key Servers /17/2006 Copyright Durkee Consulting, Inc rd1.net Slide 33
Public Key Cryptography, OpenPGP, and Enigmail. 31/5/ Geek Girls Carrffots GVA
Public Key Cryptography, OpenPGP, and Enigmail Cryptography is the art and science of transforming (encrypting) a message so only the intended recipient can read it Symmetric Cryptography shared secret
Pretty Good Privacy (PGP
PGP - S/MIME - Internet Firewalls for Trusted System: Roles of Firewalls Firewall related terminology- Types of Firewalls - Firewall designs - SET for E-Commerce Transactions. Pretty Good Privacy (PGP
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536)
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536) Prepared by Dr. Samia Chelloug E-mail: samia_chelloug@yahoo.fr Content
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown Chapter 15 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear,
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
Lecture 30. Cryptography. Symmetric Key Cryptography. Key Exchange. Advanced Encryption Standard (AES) DES. Security April 11, 2005
Lecture 30 Security April 11, 2005 Cryptography K A ciphertext Figure 7.3 goes here K B symmetric-key crypto: sender, receiver keys identical public-key crypto: encrypt key public, decrypt key secret Symmetric
Glenda Whitbeck Global Computing Security Architect Spirit AeroSystems
Glenda Whitbeck Global Computing Security Architect Spirit AeroSystems History 2000 B.C. Egyptian Hieroglyphics Atbash - Hebrew Original alphabet mapped to different letter Type of Substitution Cipher
Principles of Information Security, Fourth Edition. Chapter 8 Cryptography
Principles of Information Security, Fourth Edition Chapter 8 Cryptography Learning Objectives Upon completion of this material, you should be able to: Chronicle the most significant events and discoveries
ECE646 Fall Lab 1: Pretty Good Privacy. Instruction
ECE646 Fall 2012 Lab 1: Pretty Good Privacy Instruction PLEASE READ THE FOLLOWING INSTRUCTIONS CAREFULLY: 1. You are expected to address all questions listed in this document in your final report. 2. All
Security PGP / Pretty Good Privacy. SANOGXXX July, 2017 Gurgaon, Haryana, India
Email Security PGP / Pretty Good Privacy SANOGXXX 10-18 July, 2017 Gurgaon, Haryana, India Issue Date: [31-12-2015] Revision: [V.1] Security issues for E-mail Confidentiality Network admin can read your
Cryptography and Network Security. Sixth Edition by William Stallings
Cryptography and Network Security Sixth Edition by William Stallings Chapter 19 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear, the Board's access to other sources
WAP Security. Helsinki University of Technology S Security of Communication Protocols
WAP Security Helsinki University of Technology S-38.153 Security of Communication Protocols Mikko.Kerava@iki.fi 15.4.2003 Contents 1. Introduction to WAP 2. Wireless Transport Layer Security 3. Other WAP
Int ernet w orking. Internet Security. Literature: Forouzan: TCP/IP Protocol Suite : Ch 28
Int ernet w orking Internet Security Literature: Forouzan: TCP/IP Protocol Suite : Ch 28 Internet Security Internet security is difficult Internet protocols were not originally designed for security The
LAB :: PGP (Pretty Good Privacy)
LAB :: PGP (Pretty Good Privacy) GnuPG : GnuPG forms the heart of Gpg4win the actual encryption software. Kleopatra : The central certificate administration of Gpg4win, which ensures uniform user navigation
Most Common Security Threats (cont.)
Most Common Security Threats (cont.) Denial of service (DoS) attack Distributed denial of service (DDoS) attack Insider attacks. Any examples? Poorly designed software What is a zero-day vulnerability?
Sankalchand Patel College of Engineering, Visnagar Department of Computer Engineering & Information Technology. Question Bank
Sankalchand Patel College of Engineering, Visnagar Department of Computer Engineering & Information Technology Question Bank Subject: Information Security (160702) Class: BE Sem. VI (CE/IT) Unit-1: Conventional
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
APNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
IBM Systems and Technology Group
IBM Systems and Technology Group Encryption Facility for z/os Update Steven R. Hart srhart@us.ibm.com 2013 IBM Corporation Topics Encryption Facility for z/os EF OpenPGP Support X.509 vs. OpenPGP Certificates
Network Encryption Methods
Network Encryption Network Encryption Methods CSC362, Information Security Objectives understanding the impact of employing encryption at different protocol layers application layer encryption transport
COMPUTER SECURITY. Computer Security Secure Communication Channels (2)
COMPUTER SECURITY 7. Secure Communication Channels: 2 case studies (2) Technologies' case studies (2) WEP Wired Equivalent Privacy (3) IPsec Internet Protocol Security (11) SSL Secure Sockets Layer (25)
CRYPTOGRAPHY AND NETWROK SECURITY-QUESTION BANK
CRYPTOGRAPHY AND NETWROK SECURITY-QUESTION BANK UNIT-1 1. Answer the following: a. What is Non-repudiation b. Distinguish between stream and block ciphers c. List out the problems of one time pad d. Define
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
NETWORK SECURITY & CRYPTOGRAPHY
Assignment for IT Applications in Management Project On NETWORK SECURITY & CRYPTOGRAPHY Course Instructor Submitted By: Mr. ANIL KUMAR ROHIT BARVE 2013240 Section E PGDM 2013-15 Table of Contents Chapter
Uses of Cryptography
Uses of Cryptography What can we use cryptography for? Lots of things Secrecy Authentication Prevention of alteration Page 1 Cryptography and Secrecy Pretty obvious Only those knowing the proper keys can
ECE646 Fall Lab 1: Pretty Good Privacy. Instruction
ECE646 Fall 2015 Lab 1: Pretty Good Privacy Instruction PLEASE READ THE FOLLOWING INSTRUCTIONS CAREFULLY: 1. You are expected to address all questions listed in this document in your final report. 2. All
Pretty Good Privacy (PGP)
Pretty Good Privacy (PGP) -- PGP services -- PGP key management (c) Levente Buttyán (buttyan@crysys.hu) What is PGP? general purpose application to protect (encrypt and/or sign) files can be used to protect
SEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security
SEEM4540 Open Systems for E-Commerce Lecture 03 Internet Security Consider 2. Based on DNS, identified the IP address of www.cuhk.edu.hk is 137.189.11.73. 1. Go to http://www.cuhk.edu.hk 3. Forward the
Public-key Infrastructure
Public-key Infrastructure Cryptosystems Cryptosystems Symmetric Asymmetric (public-key) RSA Public key: n=3233, e=17 Private key: d=2753 Let m=65 Encryption: c = 65 17 (mod 3233) = 2790 Decryption: m =
Cristina Nita-Rotaru. CS355: Cryptography. Lecture 17: X509. PGP. Authentication protocols. Key establishment.
CS355: Cryptography Lecture 17: X509. PGP. Authentication protocols. Key establishment. Public Keys and Trust Public Key:P A Secret key: S A Public Key:P B Secret key: S B How are public keys stored How
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 14: Folklore, Course summary, Exam requirements Ion Petre Department of IT, Åbo Akademi University 1 Folklore on
ECE 646 Lecture 4A. Pretty Good Privacy PGP. Short History of PGP based on the book Crypto by Steven Levy. Required Reading
ECE 646 Lecture 4A Pretty Good Privacy PGP Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E Chapter 18.1 or 19.1 Pretty Good Privacy (PGP) On-line Chapters
CT30A8800 Secured communications
CT30A8800 Secured communications Pekka Jäppinen October 31, 2007 Pekka Jäppinen, Lappeenranta University of Technology: October 31, 2007 Secured Communications: Key exchange Schneier, Applied Cryptography:
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
Pretty Good Privacy PGP. Required Reading. Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E
ECE 646 Lecture 4 Pretty Good Privacy PGP Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 5/E or 6/E Chapter 18.1 or 19.1 Pretty Good Privacy (PGP) On-line Chapters
(2½ hours) Total Marks: 75
(2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.
Using Cryptography CMSC 414. October 16, 2017
Using Cryptography CMSC 414 October 16, 2017 Digital Certificates Recall: K pub = (n, e) This is an RSA public key How do we know who this is for? Need to bind identity to a public key We can do this using
Security Fundamentals
COMP 150-IDS: Internet Scale Distributed Systems (Spring 2015) Security Fundamentals Noah Mendelsohn Tufts University Email: noah@cs.tufts.edu Web: http://www.cs.tufts.edu/~noah Copyright 2012 & 2015 Noah
ECE 646 Lecture 4. Pretty Good Privacy PGP
ECE 646 Lecture 4 Pretty Good Privacy PGP Required Reading Stallings, Cryptography and Network Security: Principles and Practice, 6/E or 7/E Chapter 19.1 Pretty Good Privacy (PGP) On-line Chapters (available
Acronyms. International Organization for Standardization International Telecommunication Union ITU Telecommunication Standardization Sector
Acronyms 3DES AES AH ANSI CBC CESG CFB CMAC CRT DoS DEA DES DoS DSA DSS ECB ECC ECDSA ESP FIPS IAB IETF IP IPsec ISO ITU ITU-T Triple DES Advanced Encryption Standard Authentication Header American National
NetPGP BSD-licensed Privacy. Alistair Crooks c
NetPGP BSD-licensed Privacy Alistair Crooks agc@netbsd.org c059 6823 Privacy? Encryption and decryption Signing and verification Web of trust PKI Certifying Authority Today? pgp gnupg gpgme proprietary
Summary of PGP Services
Table 15.1 Summary of PGP Services Function Algorithms Used Description Digital signature Message encryption Compression Email compatibility DSS/SHA or RSA/SHA CAST or IDEA or Three-key Triple DES with
BCA III Network security and Cryptography Examination-2016 Model Paper 1
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 1 M.M:50 The question paper contains 40 multiple choice questions with four choices and student will have to pick the correct
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. 9 Encryption and Firewalls By Whitman, Mattord & Austin 2008 Course Technology Learning Objectives Describe the role encryption
PGP: What, Why, When, Which, How, and More... USC Linux Users Group 11/17/05 Phil Dibowitz
PGP: What, Why, When, Which, How, and More... USC Linux Users Group 11/17/05 Phil Dibowitz What We Will Cover (Briefly) What PGP is Why to use PGP When to use PGP Which kind of PGP to use and when (Traditional
Distributed Systems. 26. Cryptographic Systems: An Introduction. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 26. Cryptographic Systems: An Introduction Paul Krzyzanowski Rutgers University Fall 2015 1 Cryptography Security Cryptography may be a component of a secure system Adding cryptography
SSH PK Authentication and Auto login configuration for Chassis Management Controller
SSH PK Authentication and Auto login configuration for Chassis Management Controller Dell technical white paper Dell Engineering May 2016 Author: Elangovan G Revisions Date August 2013 May 2016 Description
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Symmetric, Asymmetric, and One Way Technologies
Symmetric, Asymmetric, and One Way Technologies Crypto Basics Ed Crowley Fall 2010 1 Topics: Symmetric & Asymmetric Technologies Kerckhoff s Principle Symmetric Crypto Overview Key management problem Attributes
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
Introduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
Digital Certificates Demystified
Digital Certificates Demystified Ross Cooper, CISSP IBM Corporation RACF/PKI Development Poughkeepsie, NY Email: rdc@us.ibm.com August 9 th, 2012 Session 11622 Agenda Cryptography What are Digital Certificates
CSE 3461/5461: Introduction to Computer Networking and Internet Technologies. Network Security. Presentation L
CS 3461/5461: Introduction to Computer Networking and Internet Technologies Network Security Study: 21.1 21.5 Kannan Srinivasan 11-27-2012 Security Attacks, Services and Mechanisms Security Attack: Any
Sharing Secrets using Encryption Facility - Handson
Sharing Secrets using Encryption Facility - Handson Lab Steven R. Hart IBM March 12, 2014 Session Number 14963 Encryption Facility for z/os Encryption Facility for z/os is a host based software solution
Web Application Security GVSAGE Theater
Web Application Security GVSAGE Theater B2B Tech Expo Oct 29, 2003 Durkee Consulting www.rd1.net 1 Ralph Durkee SANS Certified Mentor/Instructor SANS GSEC, GCIH, GGSC Network Security and Software Development
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
The question paper contains 40 multiple choice questions with four choices and students will have to pick the correct one (each carrying ½ marks.).
Time: 3hrs BCA III Network security and Cryptography Examination-2016 Model Paper 2 M.M:50 The question paper contains 40 multiple choice questions with four choices and students will have to pick the
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Lab: Securing with PGP
Objectives Understand the concept of public keys, signing, and encrypting email with PGP. Background GNUPG (or GNU Privacy guard) is a free implementation of the OpenPGP standard (RFC 4880) as a tool for
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
Securing Internet Communication: TLS
Securing Internet Communication: TLS CS 161: Computer Security Prof. David Wagner March 11, 2016 Today s Lecture Applying crypto technology in practice Two simple abstractions cover 80% of the use cases
ISACA CISA. ISACA CISA ( Certified Information Systems Auditor ) Download Full Version :
ISACA CISA ISACA CISA ( Certified Information Systems Auditor ) Download Full Version : http://killexams.com/pass4sure/exam-detail/cisa QUESTION: 390 Applying a digital signature to data traveling in a
The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
Nowadays, you can easily small attachments, up to 10MB, and large files can be posted on DVD.
Email Encryption: Just Do It! (Greg Bishop, Linux Supporters Group Adelaide) Sep 2017 1 1 Introduction When financial institutions eventually make encryption a routine procedure, you can begin to feel
Introduction to information Security
First lecture Introduction to information Security Why Computer and information Security Cryptography Secret key algorithms: DES/AES Public key algorithms: RSA One-way hash functions & message digests:
Secure Socket Layer. Security Threat Classifications
Secure Socket Layer 1 Security Threat Classifications One way to classify Web security threats in terms of the type of the threat: Passive threats Active threats Another way to classify Web security threats
GT.M Database Encryption
GT.M Database Encryption Protecting Data At Rest (DAR) [ 1 ] April 30, 2009 What it is Protects data at rest (DAR) Data records in database & journal files are encrypted [ 2 ] What it is not Data not at
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
Protecting Information Assets - Week 11 - Cryptography, Public Key Encryption and Digital Signatures. MIS 5206 Protecting Information Assets
Protecting Information Assets - Week 11 - Cryptography, Public Key Encryption and Digital Signatures MIS5206 Week 11 Identity and Access Control Week 10 continued Cryptography, Public Key Encryption and
CSC 474/574 Information Systems Security
CSC 474/574 Information Systems Security Topic 2.1 Introduction to Cryptography CSC 474/574 By Dr. Peng Ning 1 Cryptography Cryptography Original meaning: The art of secret writing Becoming a science that
WPA-GPG: Wireless authentication using GPG Key
Università degli Studi di Bologna DEIS WPA-GPG: Wireless authentication using GPG Key Gabriele Monti December 9, 2009 DEIS Technical Report no. DEIS-LIA-007-09 LIA Series no. 97 WPA-GPG: Wireless authentication
PASSWORDS & ENCRYPTION
PASSWORDS & ENCRYPTION Villanova University Department of Computing Sciences D. Justin Price Fall 2014 CRYPTOGRAPHY Hiding the meaning of a message from unintended recipients. Open source algorithms are
Due: October 8, 2013: 7.30 PM
Jackson State University Department of Computer Science CSC 437-01/539-01 Computer Security Fall 2013 Instructor: Dr. Natarajan Meghanathan Lab Project # 1: Lab Project on using PGP GNU Privacy Guard (GPG)
Cryptography and secure channel. May 17, Networks and Security. Thibault Debatty. Outline. Cryptography. Public-key encryption
and secure channel May 17, 2018 1 / 45 1 2 3 4 5 2 / 45 Introduction Simplified model for and decryption key decryption key plain text X KE algorithm KD Y = E(KE, X ) decryption ciphertext algorithm X
1.264 Lecture 28. Cryptography: Asymmetric keys
1.264 Lecture 28 Cryptography: Asymmetric keys Next class: Anderson chapters 20. Exercise due before class (Reading doesn t cover same topics as lecture) 1 Asymmetric or public key encryption Receiver
Authenticating on a Ham Internet
Authenticating on a Ham Internet The FCC regulations for amateur radio, part 97, rule that encryption cannot be used to obscure the meaning of communications. Many read the rules and assume that there
Web insecurity Security strategies General security Listing of server-side risks Language specific security. Web Security.
Web Security Web Programming Uta Priss ZELL, Ostfalia University 2013 Web Programming Web Security Slide 1/25 Outline Web insecurity Security strategies General security Listing of server-side risks Language
IPSec. Slides by Vitaly Shmatikov UT Austin. slide 1
IPSec Slides by Vitaly Shmatikov UT Austin slide 1 TCP/IP Example slide 2 IP Security Issues Eavesdropping Modification of packets in transit Identity spoofing (forged source IP addresses) Denial of service
Making Use of the Subliminal Channel in DSA
shardy@aculei.net http://www.aculei.net/ shardy The Fifth HOPE July 10, 2004 Outline 1 Digital Signatures What they are and what they do ElGamal signatures DSA signatures 2 Subliminal Channels Overview
CS Computer Networks 1: Authentication
CS 3251- Computer Networks 1: Authentication Professor Patrick Traynor 4/14/11 Lecture 25 Announcements Homework 3 is due next class. Submit via T-Square or in person. Project 3 has been graded. Scores
SSH. Partly a tool, partly an application Features:
Internet security SSH 1 Secure Shell: SSH Partly a tool, partly an application Features: Encrypted login and shell connections Easy, drop-in replacements for rlogin, rsh, rcp Multiple means of authentication
PUBLIC KEY CRYPTO WITH APPLICATIONS
PUBLIC KEY CRYPTO WITH APPLICATIONS Marc SCHAEFER 19th june 2002 OBL Bern: Public Key Cryptography Public Key Crypto with applications 1 Programme The general problem The available tools The concepts The
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
The nominative data coming from the population registry and used to generate the voting cards are never stored in the evoting system database.
System overview Legal compliance CHVote complies to the swiss federal chancellery ordinance on Electronic Voting (VEleS) for an evoting system offered up to 30% of the resident voters. The election process
Web Security 2 https://www.xkcd.com/177/ http://xkcd.com/1323/ Encryption basics Plaintext message key secret Encryp)on Func)on Ciphertext Insecure network Decryp)on Func)on Curses! Foiled again! key Plaintext
key distribution requirements for public key algorithms asymmetric (or public) key algorithms
topics: cis3.2 electronic commerce 24 april 2006 lecture # 22 internet security (part 2) finish from last time: symmetric (single key) and asymmetric (public key) methods different cryptographic systems
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
Introduction to Cryptography. Vasil Slavov William Jewell College
Introduction to Cryptography Vasil Slavov William Jewell College Crypto definitions Cryptography studies how to keep messages secure Cryptanalysis studies how to break ciphertext Cryptology branch of mathematics,
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
CS 393 Network Security. Nasir Memon Polytechnic University Module 12 SSL
CS 393 Network Security Nasir Memon Polytechnic University Module 12 SSL Course Logistics HW 4 due today. HW 5 will be posted later today. Due in a week. Group homework. DoD Scholarships? NSF Scholarships?
9/30/2016. Cryptography Basics. Outline. Encryption/Decryption. Cryptanalysis. Caesar Cipher. Mono-Alphabetic Ciphers
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng Basic concepts in cryptography systems Secret cryptography Public cryptography 1 2 Encryption/Decryption Cryptanalysis
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 24a December 2, 2013 CPSC 467, Lecture 24a 1/20 Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management and Trusted
Chapter 8 Web Security
Chapter 8 Web Security Web security includes three parts: security of server, security of client, and network traffic security between a browser and a server. Security of server and security of client
Cryptography Basics. IT443 Network Security Administration Slides courtesy of Bo Sheng
Cryptography Basics IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Outline Basic concepts in cryptography systems Secret key cryptography Public key cryptography Hash functions 2 Encryption/Decryption
Chapter 8. Network Security. Cryptography. Need for Security. An Introduction to Cryptography 10/7/2010
Cryptography Chapter 8 Network Security Introduction to Cryptography Substitution Ciphers Transposition Ciphers One-Time Pads Two Fundamental Cryptographic Principles Need for Security An Introduction
CYBER SECURITY MADE SIMPLE
CYBER SECURITY MADE SIMPLE Author: Christopher Gorog www.logiccentral.org www.newcyberfrontier.com Christopher Gorog, MBA, PMP, CISSP Lead Faculty for Cybersecurity at Colorado Technical University; Published
1.264 Lecture 27. Security protocols Symmetric cryptography. Next class: Anderson chapter 10. Exercise due after class
1.264 Lecture 27 Security protocols Symmetric cryptography Next class: Anderson chapter 10. Exercise due after class 1 Exercise: hotel keys What is the protocol? What attacks are possible? Copy Cut and