Public Key Cryptography July 2011 Topics Symmetric and
Public Key Cryptography July 2011
Topics Symmetric and Asymmetric Cryptography Public Key Cryptography Digital Signatures Digital Certificates
The briefcase example with shared key
Private-Key Cryptography Traditional private/secret cryptography uses one key Shared by both sender and receiver If this key is disclosed, communications are compromised Symmetric : keys used in parties are equal No protection of sender from receiver forging a message & claiming is sent by sender
Symmetric Key Cryptography Plain-text input Cipher-text “The quick brown fox jumps over the lazy dog” Plain-text output “The quick brown fox jumps over the lazy dog” “Ax. Cv; 5 bm. Ese. Tfid 3)f. Gsm. W e#4^, sdgf. Mwir 3: dk. Je. Ts. Y 8 R s@!q 3%” Encryption Decryption Same key (shared secret)
Symmetric Pros and Cons Strength: Simple and really very fast (order of 1000 to 10000 faster than asymmetric mechanisms) Super-fast (and somewhat more secure) if done in hardware (3 DES, Rijndael) Weakness: Must agree the key beforehand Securely pass the key to the other party
Key Distribution Problem In symmetric key cryptosystems Over complete graph with n nodes, n. C 2 = n(n-1)/2 pairs secret keys are required. Example: n=100, 99 x 50 = 4, 950 keys are required Problem: Managing large number of keys and keeping them in a secure manner is difficult a e b c d Secret keys are required between (a, b), (a, c), (a, d), (a, e), (b, c), (b, d), (b, e), (c, d), (c, e), (d, e)
The briefcase example with unshared key • The briefcase has to be sent back and forward three times, which seems pretty inefficient.
Desirable properties Use briefcase example to come up with a specification that are desirable for any cipher system that is to be used between two entities who do not already share a symmetric key. 9
Topics Symmetric and Asymmetric Cryptography Public Key Cryptography Digital Signatures Digital Certificates
Public-Key Cryptography Probably most significant advance in the history of cryptography Uses two keys – a public & a private key One for encryption and another one for decryption Knowledge of the encryption key doesn’t give knowledge of the decryption key Asymmetric since parties are not equal Uses number theoretic concepts to function Complements rather than replaces private key crypto
Analogy
Public-Key Cryptography issues Developed to address two key issues: key distribution – how to have secure communications in general without having to trust a KDC with your key digital signatures – how to verify a message comes intact from the claimed sender
The Two Keys Alice’s Private key Bob Alice’s Public key Bob’s Private key Each party has two keys Charlie Bob’s Public key Charlie’s Private key Charlie’s Public key
Main uses of Each Key A public-key Public to anybody used to encrypt messages and verify signatures A private-key known only to the owner used to decrypt messages, and sign (create) signatures
How does 2 different keys work? Just an very simple example: Public Key = 4, Private Key = 1/4, message M = 5 Encryption: Ciphertext C = M * Public Key 5 * 4 = 20 Decryption: Plaintext M = C * Private Key 20 * ¼ = 5
An Example: Internet Commerce Bob wants to use his credit card to buy some brownies from Alice over the Internet. Alice sends her public key to Bob uses this key to encrypt his credit-card number and sends the encrypted number to Alice uses her private key to decrypt this message (and get Bob’s credit-card number).
Public Key Encryption Clear-text Input Cipher-text “The quick brown fox jumps over the lazy dog” “Py 75 c%bn&*)9|f. De^b. DFa q#xzj. Fr@g 5=&nmd. Fg$5 knv Md’rkveg. Ms” Encryption public Recipient’s public key Clear-text Output Decryption Different keys private Recipient’s private key
Hybrid Encryption Systems All known public key encryption algorithms are much slower than the fastest secret-key algorithms. In a hybrid system, Alice uses Bob’s public key to send him a secret shared session key. Alice and Bob use the session key to exchange information.
Topics Symmetric and Asymmetric Cryptography Public Key Cryptography Digital Signatures Digital Certificates
A Digital Signature Digital data that carries the intent of a signature related to a digital document Use to demonstrate the authenticity of a digital message or document A valid digital signature gives a recipient reason to believe that the message was created by a known sender, and that it was not altered in transit
Sender: Creating a Digital Signature Message or File Message Digest This is the document created by Charlotte Digital Signature (Typically 128 bits) 3 k. Jfgf*£$& Py 75 c%bn RSA SHA, MD 5 Asymmetric Encryption Generate Hash Calculate a short message digest from even a long input using a one -way message digest function (hash) priv Charlotte’s private key Signed Document
Receiver: Verifying a Digital Signature This is the document created by Charlotte Message Digest Generate Hash Py 75 c%bn 3 k. Jfgf*£$& Signed Document pub Charlotte's public key (from certificate) Digital Signature Asymmetric Decryption Equal? ? Py 75 c%bn
Topics Symmetric and Asymmetric Cryptography Public Key Cryptography Digital Signatures Digital Certificates
What is a Certificate ? The simplest certificate just contains: 2 ws. R 46%frd pub EWWrswe(*^ $G*^%#%# %Dvtrsd. FDfd 3%. 6, 7 A public key Information about the entity that is being certified to own that public key … and the whole is Digitally signed by someone trusted (like your friend or a CA) This public key belongs to Charlotte 3 k. Jfgf*£$&4 d ser 4@358 g 6 *gd 7 d. T Can be a person or a computer or a device. . Digital Signature Certificate 25
X. 509 Certificate X. 500 Subject Who is the owner, CN=Charlotte, O=CERN, C=CH Public Key The public key or info about it X. 500 issuer Who is signing, O=CERN, C=CH Expiration date See later why expiration date is important Serial Number Extensions Additional arbitrary information Info CA Digital Signature … of the issuer, of course Certificate 26
Elements of Digital Cert. A Digital ID typically contains the following information: Your public key, Your name and email address Expiration date of the public key, Name of the CA who issued your Digital ID
Certificate Validation Essentially, this is just checking the digital signature But you may have to “walk the path” of all subordinate authorities “In Big. Root We Trust” until you reach the root Unless you explicitly trust a subordinate CA (installed root CA certificate) Public key This public key belongs to Charlotte This public key belongs to CERN This public key belongs to Big. Root Check DS of CERN Check DS of Foobar Issued by: CERN Issued by: Big. Root CERN Digital Signature Big. Root Digital Signature` Big. Root Digital Signature Certificate
Q&A
- Slides: 29
