Encryption Dana Scherm Velma De Fee Encryption and

Encryption Dana Scherm Velma De. Fee

Encryption and Security: Definitions ® Encryption is a mechanism for hiding information by turning readable text into a stream of gibberish in such a way that someone with the proper key can make it readable again. http: //www. beagle-ears. com/lars/engineer/computer/crypto. htm

Why is it important? ® Encryption used to be a word that people linked with government and secret operations, however with the use of computers becoming more and more common, it is necessary for data to be disguised to help protect the user. ® It keeps outsiders from viewing important company documents ® It keeps information from being shared between users on the same server or network ® It can be used to make “keys” to where only certain people can view or access a document

History ® ® ® About 1900 BC: Egyptian scribe used non-standard hieroglyphs in an inscription. ® First documented example of written cryptograph 1500 BC: ancient Assyrian merchants used intaglio, a piece of flat stone carved into a collage of images and some writing to identify themselves in trading transactions. 100 -44 BC: Julius Caesar used a simple substitution with the normal alphabet (just shifting the letters a fixed amount) in government communications. 1790 Thomas Jefferson invented his wheel cipher. 1917 William Frederick Friedman was employed as a civilian cryptanalyst at Riverbank Laboratories and performed cryptanalysis for the US Government, which had no cryptanalytic expertise of its own. WFF went on to start a school for military cryptanalysts at Riverbank – later taking that work to Washington and leaving Riverbank http: //www. sans. org/reading_room/whitepapers/vpns/history_of_encryption_730? show=730. php

History Continued 1933 -1945: The Enigma machine was taken over and improved upon to become the cryptographic workhorse of Nazi Germany. ® 1976: A design by IBM based on the Lucifer cipher and with changes by the US NSA, was chosen to be the U. S. Data Encryption Standard. It has since found worldwide acceptance, largely because it has shown itself strong against 20 years of attacks. Even some who believe it is past its useful life use it as a component -- e. g. , of 3 -key triple-DES. ® 1991 Phil Zimmermann released his first version of PGP (Pretty Good Privacy) in response to the threat by the FBI to demand access to the cleartext of the communications of citizens. PGP offered high security to the general citizen and as such could have been seen as a competitor to commercial products like Mailsafe from RSADSI. ®

Cryptography ® The study of encryption-the hiding of information, converting it from its “normal, comprehensible form into an obscured guise, unreadable without special knowledge. ” www. wikipedia. com

The Enigma machine ® The first Enigma was invented by German engineer Arthur Scherbius at the end of World War I. This model and its variants were used most notably by Nazi Germany before and during World War II. A range of Enigma models was produced, but the German military model, the Wehrmacht Enigma, is the version most commonly discussed.

The Enigma Machine Continued ® How it works: ® http: //russells. freeshell. org/enigma/ ® When a key is pressed, an electrical current is sent through the machine. The current first passes through the plug board, then through the three rotors, through the reflector which reverses the current, back through the three rotors, back through the plug board and then the encrypted letter is lit on the display. After the display is lit up, the rotors rotate. The rotors rotate similar to an odometer where the right most rotor must complete one revolution before the middle rotor rotated one position and so on.

History of the Enigma Machine ® ® ® 1918: Albert Scherbius used his idea of “rotating rotors” to try to come up with a cipher machine. He took his ideas to the German military, but they weren’t interested. He then took his idea to a German Company called Gewerkschaft Securitas, where his patents were bought. 1920 s: First enigma machine was produced. The rotating rotors made it a better enciphering machine than any other because of its rotating rotors. 1925: modifications began, and eventually the German Army made modifications too. 1928: The Poles confiscated an Enigma machine in customs. It was on its way to the German Embassy in Warsaw. December 31, 1932: The Poles decrypted the german Enigma signals July 25, 1939: Poles gave the French and the British replicas of the Polish made Enigmas together with the drawings and information on the Enigma, the Bomba (the Polish version of the Enigma), and the decryption information.

Morse Code ® http: //www. scoutnet. nl/~inter/morse/mor seform. html • A type of character encoding that transmits telegraphic information using rhythm. • Uses standardized sequence of short and long elements to represent the letters, numerals, punctuation, and special characters of a given message. • The short and long elements can be formed by sounds, marks, or pulses in on/off keying. • Measured in Words Per Minute • Originally created for Samuel F. B. Morse’s electric telegraph in the early 1840 s • Also extensively used for early radio communication beginning in the 1890 s. • For the first half of the 20 th century, the majority of high-speed international communication was conducted in Morse code, using telegraph lines, undersea cables, and radio circuits. However the variable length of the Morst characters made it hard to adapt to automated circuits. • Morse code is designed to be read by humans without a decoding device, making it useful for sending automated digital data in voice channels. • For emergency signaling, Morse code can be sent by way of improvised sources that can be easily "keyed" on and off, making Morse code one of the most versatile methods of Telecommunication in existence. www. wikipedia. com

Types of Encryption: 3 Basic Types Manual encryption Completely provided by the user ® Demands user’s active participation ® Risky, but reliable ® Transparent encryption Performed at low-level during ALL operations permanently ® Difficult to implement correctly ® Generally doesn’t work well with networking ® Easy to use, most secure ® Semi-Transparent (“On the Fly encryption”) Operates not permanently, but before/after access ® May cause degradation of computer’s efficiency ® If data to be encrypted is too great, can cause loss of data ® ® http: //services. devadvisers. net/cryprite/042 ETYPE. HTM

Authentication and Encryption Authentication and encryption are two intertwined technologies that help to insure that your data remains secure. ® Authentication is the process of insuring that both ends of the connection are in fact who they say they are. This applies not only to the entity trying to access a service (such as an end user) but to the entity providing the service, as well (such as a file server or Web site). ® Encryption helps to insure that the information within a session is not compromised. This includes not only reading the information within a data stream, but altering it, as well. ® While authentication and encryption each has its own responsibilities in securing a communication session, maximum protection can only be achieved when the two are combined. For this reason, many security protocols contain both authentication and encryption specifications. ® http: //technet. microsoft. com/en-us/library/cc 750036. aspx

Authentication: Three Types • · Single factor authentication • Password • Easy to remember • Easy to crack • People are predictable…passwords are usually a pets name, • a birth date, etc. • · Two factor • Password + token (security device for users to keep in possession) • Safer and more complex than single factor • · Three factor • Password + token + biometric authentication (fingerprint, retinal scan) • Safer and more complex than single or double factor types; used for high • security purposes (ex. Government documents) • A token is a security device for authorized users to keep in possession. Some examples include: • Secur. ID Card, Challenge/response method, and USB token

Symmetric key (private key and public key) ® Private Key Encryption: Each party has the same key, only this key can decrypt the message. They must keep this key private in order for others to be unable to decrypt the message. ® Public Key Encryption: Each party has a different key, the first party encrypts the message, and the second party’s key is the only one that can decrypt the message. If the second party encrypts a message only the first party’s key can decrypt the message. Therefore, the keys may be put into the public because the ones that are owned by either party are the only copies. http: //publib. boulder. ibm. com/infocenter/wasinfo/v 6 r 0/index. jsp? topic=/com. ibm. websphere. express. doc/info/exp/ae/csec_pubki. html

SSL Secure Sockets Layer ® SSLs are “cryptographic protocols that provide security and data integrity for communications” over web sites. (www. wikipedia. com) ®A person running a web site may buy an SSL certificate in order to ensure that visitors to their website can trust them. ® It encrypts information that is given to a website and keeps others from viewing the personal information. ® You may have seen a verisign logo at the bottom of pages where you are entering personal information. They are a company that sells SSL certificates.

http vs. https HTTP (Hypertext Transfer Protocol) is an application-level protocol for distributed, collaborative, hypermedia information systems. ® It operates “at the highest layer of the TCP/IP Internet reference model and network security protocol, ” meaning that it works with the highest capability to meet all protocol standards when it comes to transferring information over the internet, as well as working to keep information secure from other users. Its security is not the highest because it works to “encrypt an HTTP message prior to transmission and decrypt a message upon arrival. ” This allows anyone to see it. ® HTTPS (Hypertext Transfer Protocol Secure) is a combination of http and a network security protocol. ® This means that it strengthens security to keep others from accessing your information. These connections are most likely going to be used during an online transaction and for “sensitive transactions in corporate information systems. ” ®

digital signature algorithm ® An algorithm for creating digital signatures

Hash value and hash functions ® Definition: any well-known procedure for reproducing data into some smaller integer ® Ideal hash function has four elements Easy to compute for any given message ® Difficult to find a hash function that has a given hash ® Difficult to modify ® Very rare to find two messages with the same hash ®

Visual of Hash Function

Government Standards ® Advanced Encryption Standard (AEP) ® Is an encryption standard adopted by the U. S. government. It comprises three block ciphers: ® AES-128, AES-192, and AES-256 ® Each AES cipher has a 128 -bit block size ® Key sizes of 128, 192, and 256 bits