Concepts of Using Cryptography | Security+ Certification Exam Cram 2 (Exam Cram SYO-101)

In many situations, using encryption can make a huge difference in how secure your environment is. This is true from the workstation level, to the server level, to even how data is transferred to and from your business partners . Encryption is continuously becoming more and more important. This situation is amplified when you take into account the increasing sophistication of users and available tools, as well as the propensity for mischief that these users may possess.

As it stands today, encryption still requires a lot of thought and preparation prior to implementation. More often than not, careful consideration should be given to answer many different questions, which could include the following:

How will encryption affect the performance on my network as well as my servers and workstations attached to that network?
In what way will my end users interact with encryption? What type of encryption will they experience on an end- user level? Will server or simply network encryption be all that is needed?
What additional costs will encryption bring to my organization and, in particular, the department that manages it? Will we need additional hardware, software, and training?
What real, tangible benefits will encryption bring to my organization? Can this be tempered against the costs to make encryption worthwhile?
Do the business partners or other organizations we communicate with use encryption? If so, what do they use and how do we integrate with them?
How will the encryption algorithm, software, and other methods we implement today scale with what we want to do tomorrow as well as the long- term IT and business goals of our organization?

As you can see from the preceding questions, a great deal of consideration and research needs to be done before you can even start to think about implementing encryption in an organization. The following subsections discuss and examine how encryption can work within environments to promote confidentiality of sensitive data, integrity of data and authentication, as well as digital signatures and access control.

Confidentiality

One of the key benefits that implementing encryption can bring to an organization is the promise of confidentiality . Confidentiality describes the act of limiting disclosure of private information. In fact, the ability of encryption to provide confidentiality is important to today's companies as well as to individuals in countries that restrict free speech and monitor the messages and emails sent and received over the Internet.

Like any open environment where sensitive information is shared, the most important thing to most people is keeping the information secret and not letting anyone know you are sending the data. It is not unheard of to have large corporations hire people as spies who try to capture competitors ' sensitive data being transmitted on their networks as a means to gain an edge.

Now think of the individual sitting in an Internet caf in a foreign country (often the only way these people can access the Internet). You have governments so afraid of what their citizens may see from the outside world that they restrict what people can see in addition to recording and monitoring what information they post. Encryption enables people to take this control away from the government. So, you can imagine that publicly available, strong encryption isn't very popular with these types of governments unless it's for their own use.

Pretty Good Privacy (PGP)

In the early 90s, the U.S. Government tried to suppress the use of Pretty Good Privacy (PGP), which was gaining popularity and exposure in the media. The government tried to force the software to be taken down and made unavailable to public consumption. (PGP is an email program that uses encryption and is available to anyone who wanted to download it within North America.)

Part of the government's argument against PGP was that it could not control the information people were sending. In cases where criminals were involved, they could use encryption and seemingly be able to hide their online activities and data from the prying eyes of the government. Eventually, the public's right to use encryption (and PGP, in particular) won out, but you can be sure the government has been busy working on ways to get around the problem of encryption.

Integrity

Ensuring that the data you send arrives at its intended destination unmodified is one of those things you take for granted in most cases. If you have sensitive data or you need to ensure that the recipient is assured that the data being delivered is actually what was sent from you, you will likely want to look into one of the other major benefits of encryption integrity .

Integrity is the assurance that data and information can only be modified by those authorized to do so. Integrity can take on many forms. On the one hand, integrity can be provided using encryption, assuming you have a secure algorithm. After the data arrives at the destination, it can be decrypted. If the key has been changed or the data modified, the recipient may not be able to open or decrypt the data, depending on the encryption algorithm used.

In the case of digital signatures (which you will learn about shortly), you can also provide verification that the data is in fact from you. Once again, if the digital signature on the data being sent can't be unencrypted, it may have been modified, and the recipient will know it is not from who it says it is from. This allows the recipient to either discard the data or possibly request another copy or confirmation directly with the sender.

Like confidentiality, integrity is certainly a huge aspect of what corporate America and other organizations around the world require when dealing with transferring data over unsecured networks. In many cases, contractors that deal with the U.S. Government (in particular, the armed forces) have to run a minimum specified level of encryption before they are even allowed to do any kind of work. This is because of the sensitive nature of the information transmitted. For some contractors, there must be a minimum level of overall security compliance that encompasses not only encryption but also certain security practices.

By selecting the right encryption algorithm or the right combination of algorithms and digital signature schemes, you can increase both the confidentiality and integrity of your data.

Digital Signatures

Digital signatures attempt to guarantee the identity of the person sending the data from one point to another. The digital signature acts as an electronic signature that is used to authenticate the identity of the sender as well as to ensure that the original content sent has not been changed.

Do not confuse a digital signature with a digital certificate (to be discussed later). Additionally, do not confuse digital signatures with encryption. Although digital signatures and encryption use related concepts, their intentions and operations are quite different. Finally, do not confuse a digital signature with the block of identification information, such as the sender's name and telephone number or the digitally created image often appended to the end of an email.

Digital signatures can easily be transported and are designed so they cannot be copied by anyone else. This ensures that something signed cannot be repudiated (nonrepudiation and digital signatures are discussed in further detail later).

A digital signature does not have to accompany an encrypted message. It can simply be used to assure the receiver of the sender's identity and that the message's integrity was maintained . The digital signature contains the digital signature of the Certificate Authority (CA) that issued the certificate for verification.

The point of this verification is to prevent or alert the recipient to any data tampering. Ideally, if a packet of data is digitally signed, it can only bear the original mark of the sender. If this mark is different, the receiver would know that the packet is different from what it is supposed to be and then the packet either is not unencrypted or is dropped altogether. This works based on the encryption algorithm principles you learned previously. If the receiver can't determine what the original data was in the encrypted packet (in this case, the signature), it becomes much harder to fake the data and actually get it past the receiver as legitimate data.

For example, assume you need to digitally sign a document sent to your stockbroker. You need to guarantee the integrity of the message and assure the stockbroker that the message is really from you. The exchange would occur as follows :

You type the email.
Using software built in to your email client, you obtain a hash of the message.
You use your private key to encrypt the hash. This encrypted hash is your digital signature for the message.
You send the message to your stockbroker.
Your stockbroker receives the message and, using his software, makes a hash of the received message.
The stockbroker uses your public key to decrypt the message hash.
A match of the hashes proves that the message is valid.

Authentication

Today, encryption has an increasing role in securing the authentication of users to workstations and networks. Authentication is a verification process that ensures the identity of a user or system. The digital signatures discussed previously are often used for authentication (for example, to identify the author of an email or to identify a Web transaction). Authentication and encryption each has its own responsibilities; however, by combining the two, one achieves maximum security.

Nonrepudiation

Nonrepudiation is intended to provide, through encryption, a method in which there is no refute from where data has come. It guarantees that the sender cannot later refute having been the sender and that the recipient cannot refute having been the receiver. This definition, however, does not take into account the possible compromise of the workstation or system used to create the private key and the encrypted digital signature. The following list outlines four of the key elements that nonrepudiation services provide on a typical client/server connection:

Proof of origin The host gets proof that the client is the originator of particular data or an authentication request from a particular time and location.
Proof of submission The client gets proof that the data (or authentication, in this case) has been sent.
Proof of delivery The client gets proof that the data (or authentication, in this case) has been received.
Proof of receipt The client gets proof that the data (or authentication, in this case) has been received correctly.

Digital Signatures and Nonrepudiation

Earlier in this chapter, we discussed digital signatures and how they provide integrity and authentication. However, digital signatures also provide nonrepudiation with proof of origin. Although authentication and nonrepudiation may appear to be similar, the difference is that with nonrepudiation, proof can be demonstrated to a third party.

A sender of a message signs a message using her private key. This provides unforgeable proof that the sender did indeed generate the message. Nonrepudiation is unique to asymmetric systems because the private (secret) key is not shared. Remember that in a symmetric system, both parties involved would share the secret key. Therefore, any party can deny sending a message by claiming the other party was the originator.

Access Control

Access control in an organization can take on many different forms. In most environments today, access control can encompass something as simple as limiting the directories to which the users have access as well as something as involved as defining what content users can and cannot view on the Internet. Access control can be an important aspect to implement in an organization when you want to have the best possible control over what your users can see and, potentially, what they can send from and bring into the network. The less potentially dangerous the data and connections coming in and out of your network are, the less chance there is of there being a security issue (in particular viruses). It makes sense that the less you let in or out, the less you worry about.

Access control is typically most effective when you combine it with encryptionfor example, in Windows 2000, using Kerberos to encrypt the authentication process or using Public Key Infrastructure (PKI) to secure remote connections to a server. Any way of controlling access (using a password, setting rights, establishing user policies, and so on) will help augment security; however, when you combine it with encryption, you get the benefits of confidentiality and integrity as well.

A newer and more popular way of implementing access control is the Extensible Markup Language (XML). XML documents can be written to provide a wide variety of services and are particularly useful in company intranets where having centralized services accessible through the Web is quite handy. Another version of XML that is specifically designed for access control is XML Access Control Language (XACL).

XACL is a newer development that allows granular access control using XML. The ability to control what the end user sees and can use makes XACL a very powerful tool and could prove to be something that extends to the Internet for companies providing services over the Web to customers of their sites or products. XML was designed to allow developers to take advantage of today's strong encryption algorithms. Therefore, any XML document created can use encryption to provide more robust access control as well as data integrity and confidentiality.