SEC 390 AtoZ of Public Key Infrastructure PKI

SEC 390 A-to-Z of Public Key Infrastructure (PKI) Rafal Lukawiecki rafal@projectbotticelli. co. uk www. projectbotticelli. co. uk Strategic Consultant Project Botticelli Ltd

2 Objectives Explain the basics of PKI without concentrating on any particular product Introduce commonly used terminology Point out those aspects of PKI that require careful planning and implementation Outline some social issues associated with PKI

3 Agenda A Briefest Summary of Cryptography (upgrades you to from 220 to level 280) 8% subset of SEC 290 Fundamentals of PKI (level 300 – you need to understand cryptography) Recommendations on PKI Deployment (level 300) Warning: this is another fast and furious A-to-Z type of a session. Attend at your own risk.

4 PKI “Public Key Infrastructure provides the components and services that enable practical deployment and operation of a system that uses certificates. ” A. Nash, “PKI”, RSA Press PKI is a group of solutions for key distribution problems and other issues: Key generation Certificate generation, revocation, validation Managing trust I consider Web-of-Trust systems (e. g. PGP) as a perfectly alternative and compatible implementation of PKI

5 A Summary of Cryptography (6 Slides Only)

6 What is Really Secure? Look for systems From well-know parties With published (not secret!) algorithms That generate a lot of interest That have been hacked for a few years That have been analysed mathematically Absolutely do not “improve” algorithms yourself Employ someone to attempt a break-in

7 What Does Cryptography Solve? Confidentiality ◄ Your data/service provides no useful information to unauthorised people Integrity ◄ If anyone tampers with your asset it will be immediately evident Authenticity ◄ We can verify that asset is attributable to its authors or caretakers Non-repudiation ◄ The author or owner or caretaker of asset cannot deny that they are associated with it Identity ◄ We can verify who is the specific individual entity associated with your asset

8 Symmetric Key Cryptography Plain-text input “The quick brown fox jumps over the lazy dog” Cipher-text Plain-text output “Ax. Cv; 5 bm. Ese. Tfid 3) f. Gsm. We#4^, sdgf. Mwi r 3: dk. Je. Ts. Y 8 Rs@!q 3 %” “The quick brown fox jumps over the lazy dog” Encryption Decryption Same key (shared secret)

9 Public Key Encryption Clear-text Input “The quick brown fox jumps over the lazy dog” Cipher-text Clear-text Output “Py 75 c%bn&*)9|f. De^ b. DFaq#xzj. Fr@g 5=&n md. Fg$5 knv. Md’rkveg Ms” “The quick brown fox jumps over the lazy dog” Encryption public Recipient’s public key Decryption Different keys private Recipient’s private key

10 Hybrid Encryption (Real World) Launch key for nuclear missile “Red. Heat” is. . . Symmetric encryption (e. g. DES) User’s public key (in certificate) Randomly. Generated symmetric “session” key RNG *#$fjda^j u 539!3 t t 389 E *&@ 5 e%32^kd Symmetric key encrypted asymmetrically (e. g. , RSA) Digital Envelope As above, repeated for other recipients or recovery agents Digital Envelope Other recipient’s or agent’s public key (in certificate) in recovery policy

11 Hybrid Decryption *#$fjda^j u 539!3 t t 389 E *&@ 5 e%32^kd Launch key for nuclear missile “Red. Heat” is. . . Symmetric decryption (e. g. DES) Symmetric “session” key Recipient’s private key Asymmetric decryption of “session” key (e. g. RSA) Digital envelope contains “session” key encrypted using recipient’s public key Digital Envelope Session key must be decrypted using the recipient’s private key

12 Fundamentals of PKI

13 Is PKI relevant? Who uses all of that stuff? Web’s HTTP and other protocols (SSL) VPN (PPTP, IPSec, L 2 TP…) Email (S/MIME, PGP, Exchange KMS) Files (W 2 K EFS, PGP and many others) Web Services (WS-Security) Good ID Smartcards (Certificates and Challenge/Response) Executables (. NET Assemblies, Drivers, Authenticode) Copyright protection (DRM) …

14 Public Key Distribution Problem We just solved the problem of symmetric key distribution by using public/private keys But… Scott creates a keypair (private/public) and quickly tells the world that the public key he published belongs to Bill People send confidential stuff to Bill does not have the private key to read them… Scott reads Bill’s messages

15 Eureka! We need PKI to solve that problem And a few others…

16 How to Verify a Public Key? Two approaches: 1. Before you use Bill’s public key, call him or meet him and check that you have the right one Fingerprint or hash of the key can be checked on the phone 2. Get someone you already trust to certify that the key really belongs to Bill By checking for a trusted digital signature on the key But there has to be one… And you have to have friends to trust in first place…

17 Trust Models Web-of-Trust (PGP) Peer-to-peer model Individuals digitally sign each other keys You would implicitly trust keys signed by some of your friends Trusted Authority + Path of Trust (CAs) Everyone trusts the root Certificate Authority (Verisign, Thawte, BT etc. ) CA digitally signs keys of anyone having checked their credentials by traditional methods CA may even nominate others to be CAs – and you would trust them automatically, too

18 Trust Models Issues and Future Web-of-trust is more, erh, trustworthy But it is time-consuming, requires lots of work and general public doesn’t understand it CAs tend to be a little bit like a big brother as we all have to trust them implicitly But it is a simpler model, easier to deploy and manage Combination strategy? Let’s trust a CA that verifies keys by traditional strong methods and peer-to-peer recommendations

19 Creating a Digital Signature Message or File 128 bits Message Digest This is a really long message about Bill’s… Digital Signature Jrf 843 kjfgf* £$&Hdif*7 o Usd*&@: <C HDFHSD(** Py 75 c%bn&*)9|f. De^b DFaq#xzj. Fr@g 5=&n md. Fg$5 knv. Md’rkveg Ms” Hash Function (SHA, MD 5) Calculate a short message digest from even a long input using a one-way message digest function (hash) Asymmetric Encryption private Signatory’s private key

20 Verifying a Digital Signature Jrf 843 kjf gf*£$&Hd if*7 o. Usd *&@: <CHD FHSD(** Asymmetric decryption (e. g. RSA) Py 75 c%bn&*) 9|f. De^b. DFaq #xzj. Fr@g 5= &nmd. Fg$5 kn v. Md’rkveg. Ms” ? == ? Signatory’s public key Everyone has access to trusted public key of the signatory Are They Same? Same hash function (e. g. MD 5, SHA…) This is a really long message about Bill’s… Py 75 c%bn&*) 9|f. De^b. DFaq #xzj. Fr@g 5= &nmd. Fg$5 kn v. Md’rkveg. Ms” Original Message

21 Hash (Digest) Functions MD 5 and SHA Just a hash value of between 128 bits (MD 5) and 512 bits of key (SHA 512) Great support in. NET Framework and in Crypto. API of Windows Just don’t ever use any function with 64 bits result

22 Message Authentication Codes “MACs” – Combination of a hash function and a symmetric encryption Integrity, authenticity but non-repudiation Must share the key! HMAC Digest + shared-secret encryption for up to 160 bit results MACTriple. DES Encryption using 8, 16 or 24 bytes of Triple. DES key on top of a hash 64 bit result (ouch!) Both of the above implemented in. NET Fx

23 Certificates The simplest certificate just contains: Information about the entity that is being certified to own a public key That public key And all of this is Digitally signed by someone trusted (like your friend or a CA)

24 X. 509 Certificate Authority Digital Signature of All Components Together: Serial Number Issuer X. 500 Distinguished Name Validity Period Subject X. 500 Distinguished Name OU=Project Botticelli… Subject Public Key Information The Key or Info About It Key/Certificate Usage Extensions

25 Authentication with Certificates 1. 2. Melinda gets Bill’s certificate She verifies its digital signature She can trust that the public key really belongs to Bill But is it Bill standing if front of her, or is that Scott? Melinda challenges Bill to encrypt for her a phrase etc. she just made up (“I really need more shoes”) 4. Bill has, of course, the private key that matches the certificate, so he responds (“*&$^%£$&£fhsdf*&EHFDhd 62^&£”) 5. Melinda decrypts this with the public key she has in the certificate (which she trusts) and if it matches the phrase she challenged Bill with then it must really be Bill himself! By the way, that’s the basic concept of how SSL works 3.

26 What’s in the Store? Certificates are “safe” No need to protect them too much, as they are digitally signed Store anywhere, a file or a “dumb” memory-only smartcard Private keys that match the public key are extremely vulnerable (key assets) You must protect them well Store in “Protected Storage” on your OS or a “smart” smartcard that will have crypto functionality on board

27 Certification Hierarchy Most organisations do not use just one root key for signing certificates Dangerous, if that one key is compromised Does not scale to large organisations Difficulty in managing responsibility Certificate Hierarchies Start with CA root cert Create more keys (e. g. for BT, Microsoft etc. ), sign with root key, mark as subordinate CAs Create more levels in your organisation (for departments etc. ) Validating a cert possibly involves validating a path of trust

28 Certificate Validation Essentially, this is just checking the digital signature But You may have to “walk the path” of all subordinate authorities until you reach the root Unless you explicitly trust a subordinate CA “In Xanadu We Trust” (installed root CA certificate) Check DS of OCG CA I: PB CA S: Rafal Check DS of Xanadu I: Xanadu Root S: PB CA I: Xanadu Root S: Xanadu Root

29 Certificate Revocation Keys get compromised, as a fact of life You or your CA issue a certificate revocation certificate Must be signed by CA, of course And you do everything you can to let the world know that you issued it This is not easy Certificate Revocation Lists (CRL) are used They require that the process of cert validation actively checks the CRL and keep it up-to-date There are some scalability issues Many people disable this function That is why short expiration policies are important

30 Storing Certificates and Keys Certificates need to be stored so that interested users can obtain them Keys need to be stored for data recovery purposes This weakens the system, but is a necessity This is a function of most certificate servers such as certificate services in Windows 2003 Server Those servers are also responsible for issuing, revoking, signing etc. of certs

31 Certificate Interchange Two main routes: Server-based store to the user Protected local store or smartcard to the user Microsoft dedicates significant part of Crypto. API to this function It works well and you may need to use it for custom apps PKCS #11 is an alternative interface used by Netscape Certs are normally packaged in a PKCS #11 (or #7) standard envelopes All PKCS #s are results of work by RSA Labs related to IETF as part of X. 509 PKI group (PKIX)

32 Developers: Which API? CAPI (Crypto API, Cryptographic API) is the underlying API provided by the operating system Mature Not too easy to use Good functionality . NET Framework System. Security. Cryptography Newer, but wraps some CAPI functions Extremely easy to use Not all needed functionality is present

33 . NET Framework API Comprehensive cryptographic library Easy, unified, stream-based architecture System. Security. Cryptography Open & extensible model (for new algorithms) Some implementations just CAPI wrappers, some completely managed by. NET Configuration classes for control Streaming model for block algorithms Supporting CBC (Cipher Block Chaining)

34 Crypto Object Model (subsection) Abstract Base Classes (only one shown) Abstract Algorithm Classes Algorithm Implementation Classes (fully implemented) Symmetric Algorithm Triple. DES Rijndael RC 2 Triple. DESCrypto Service. Provider (Crypto. API) Rijndael Managed (C#) RC 2 Crypto Service. Provider

35 Recommendations on PKI Deployment

36 CA Services If you decide against web-of-trust, you need to make an important decision: Use a well known CA Your certs will be universally recognised but you are dependent on the trustworthiness of the CA Establish your own CA No one except your explicitly nominated partners or clients will recognise your certs but you are in full control In addition, you may want to outsource CA services altogether

37 Identity Management Process Consider using Windows Server 2003 as it integrates active directory managament of users with PKI provisioning Microsoft is investing heavily in identity management across directory boundaries Between Active Directories Between heterogenous systems

38 Social Problem Real-life certificates are well understood What do you trust more: a passport or a driving license? Digital certificates are a long way from public understanding Is Verisign Class 1 better or worse than Class 5? What about BT Class 2 versus Thawte Class 3? Easier if you just deploy internal PKI Use real-life names, like “passport”, “company id” etc. if possible

39 Common Strength Recommendations (Jun 2003) Minimum Symmetric Key Asymmetric Key ECC Key Hash: SHA/MD 5 Common Cert Classes Recommended 96 bits (avoid DES as it 256 bits (Rijndael, RC 5 can do only 56, instead 128 bits, not DES) use AES-Rijndael or RC 5) 1024 (RSA) 4096 (RSA) 192 bits 256 bits 128 bits (absolutely not 64 256 bits or more bits) Class 2 Class 3 at least

40 Word About Smartcards Most smartcards are “dumb”, i. e. they are only a memory chip This is OK for a certificate store, but not recommended for storing a private key used in a challenge test (verifying identity) Anyway, they are still better than leaving keys on a floppy disk Cryptographically-enabled smartcards are more expensive but they give much more security Private key is secure and used as needed Additional protection (password, biometrics) is possible Hardware implements some algorithms Self-destruct is possible

41 Certificate Revocations It is a good idea to prepare one in advance if possible! Keep it really safe Particularly important in web-of-trust systems in case you lose access to your private key Please, please enable checking and updating of CRL (revocation list) on all of your systems Apply numerous security patches – this was a particularly “patchy” area recently

42 Summary Asymmetric encryption solved the extremely difficult problem of key symmetric key exchange It created a smaller, easier to solve problem of asymmetric key management… Which is solved with PKI Bringing additional benefits, such as trust and identity management

43 Resources and Reading Visit www. microsoft. com/security Review session slides on crypto & security For more detail, read: PKI, A. Nash et al. , RSA Press, ISBN 0 -07 -213123 -3 Applied Cryptography, B. Schneier, John Wiley & Sons, ISBN 0 -471 -12845 -7 Foundations of Cryptography, O. Goldereich, www. eccc. uni-trier. de/eccc-local/ ECCC-Books/oded_book_readme. html Handbook of Applied Cryptography, A. J. Menezes, CRC Press, ISBN 0 -8493 -8523 -7 Cryptography in C and C++, M. Welschenbach, Apress, ISBN 1 -893115 -95 -X (includes code samples CD)

45 evaluations… Please don’t forget to complete your online Evaluation Form

46 © 2003 Microsoft Corporation & Project Botticelli Ltd. All rights reserved. This presentation is for informational purposes only. MICROSOFT AND PROJECT BOTTICELLI MAKE NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.