INTERNET SECURITY: CRYPTOGRAPHIC PRINCIPLES, ALGORITHMS AND PROTOCOLS

By H. DIKAT

INTERNETWORKING AND LAYERED MODELS NETWORKING TECHNOLOGY LOCAL AREA NETWORKS (LANS) WIDE AREA NETWORKS (WANS) CONNECTING DEVICES SWITCHES REPEATERS BRIDGES ROUTERS GATEWAYS THE OSI MODEL TCP/IP MODEL NETWORK ACCESS LAYER INTERNET LAYER TRANSPORT LAYER APPLICATION LAYER TCP/IP SUITE AND INTERNET STACK PROTOCOLS NETWORK LAYER PROTOCOLS INTERNET PROTOCOL (IP) ADDRESS RESOLUTION PROTOCOL (ARP) REVERSE ADDRESS RESOLUTION PROTOCOL (RARP) CLASSLESS INTERDOMAIN ROUTING (CIDR) IP VERSION 6 (IPV6, OR IPNG) INTERNET CONTROL MESSAGE PROTOCOL (ICMP) INTERNET GROUP MANAGEMENT PROTOCOL (IGMP) TRANSPORT LAYER PROTOCOLS TRANSMISSION CONTROL PROTOCOL (TCP) USER DATAGRAM PROTOCOL (UDP) WORLD WIDE WEB HYPERTEXT TRANSFER PROTOCOL (HTTP) HYPERTEXT MARKUP LANGUAGE (HTML) COMMON GATEWAY INTERFACE (CGI) JAVA FILE TRANSFER FILE TRANSFER PROTOCOL (FTP) TRIVIAL FILE TRANSFER PROTOCOL (TFTP) NETWORK FILE SYSTEM (NFS) ELECTRONIC MAIL SIMPLE MAIL TRANSFER PROTOCOL (SMTP) POST OF?CE PROTOCOL VERSION 3 (POP3) INTERNET MESSAGE ACCESS PROTOCOL (IMAP) MULTIPURPOSE INTERNET MAIL EXTENSION (MIME) NETWORK MANAGEMENT SERVICE SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP) CONVERTING IP ADDRESSES DOMAIN NAME SYSTEM (DNS) ROUTING PROTOCOLS ROUTING INFORMATION PROTOCOL (RIP) OPEN SHORTEST PATH FIRST (OSPF) BORDER GATEWAY PROTOCOL (BGP) REMOTE SYSTEM PROGRAMS TELNET REMOTE LOGIN (RLOGIN) SYMMETRIC BLOCK CIPHERS DATA ENCRYPTION STANDARD (DES) DESCRIPTION OF THE ALGORITHM KEY SCHEDULE DES ENCRYPTION DES DECRYPTION TRIPLE DES DES-CBC CIPHER ALGORITHM WITH IV INTERNATIONAL DATA ENCRYPTION ALGORITHM (IDEA) SUBKEY GENERATION AND ASSIGNMENT IDEA ENCRYPTION IDEA DECRYPTION RC5 ALGORITHM KEY EXPANSION ENCRYPTION DECRYPTION RC6 ALGORITHM AES (RIJNDAEL) ALGORITHM NOTATIONAL CONVENTIONS MATHEMATICAL OPERATIONS AES ALGORITHM SPECI?CATION HASH FUNCTION, MESSAGE DIGEST AND MESSAGE AUTHENTICATION CODE DMDC ALGORITHM COMPUTATION OF MESSAGE DIGESTS ADVANCED DMDC ALGORITHM MD5 MESSAGE-DIGEST ALGORITHM APPEND PADDING BITS APPEND LENGTH INITIALISE MD BUFFER DE?NE FOUR AUXILIARY FUNCTIONS (F, G, H, I) FF, GG, HH AND II TRANSFORMATIONS FOR ROUNDS 1, 2, 3 AND COMPUTATION OF FOUR ROUNDS (64 STEPS) SECURE HASH ALGORITHM (SHA-1) MESSAGE PADDING INITIALISE 160-BIT BUFFER FUNCTIONS USED CONSTANTS USED COMPUTING THE MESSAGE DIGEST HASHED MESSAGE AUTHENTICATION CODES (HMAC) ASYMMETRIC PUBLIC-KEY CRYPTOSYSTEMS DIF?E–HELLMAN EXPONENTIAL KEY EXCHANGE RSA PUBLIC-KEY CRYPTOSYSTEM RSA ENCRYPTION ALGORITHM RSA SIGNATURE SCHEME ELGAMALS PUBLIC-KEY CRYPTOSYSTEM ELGAMAL ENCRYPTION ELGAMAL SIGNATURES ELGAMAL AUTHENTICATION SCHEME SCHNORR’S PUBLIC-KEY CRYPTOSYSTEM SCHNORR’S AUTHENTICATION ALGORITHM SCHNORR’S SIGNATURE ALGORITHM DIGITAL SIGNATURE ALGORITHM THE ELLIPTIC CURVE CRYPTOSYSTEM (ECC) ELLIPTIC CURVES ELLIPTIC CURVE CRYPTOSYSTEM APPLIED TO THE ELGAMAL ALGORITHM ELLIPTIC CURVE DIGITAL SIGNATURE ALGORITHM ECDSA SIGNATURE COMPUTATION PUBLIC-KEY INFRASTRUCTURE INTERNET PUBLICATIONS FOR STANDARDS DIGITAL SIGNING TECHNIQUES FUNCTIONAL ROLES OF PKI ENTITIES POLICY APPROVAL AUTHORITY POLICY CERTI?CATION AUTHORITY CERTI?CATION AUTHORITY ORGANISATIONAL REGISTRATION AUTHORITY KEY ELEMENTS FOR PKI OPERATIONS HIERARCHICAL TREE STRUCTURES POLICY-MAKING AUTHORITY CROSS-CERTI?CATION X500 DISTINGUISHED NAMING SECURE KEY GENERATION AND DISTRIBUTION X509 CERTI?CATE FORMATS X509 V1 CERTI?CATE FORMAT X509 V2 CERTI?CATE FORMAT X509 V3 CERTI?CATE FORMAT CERTI?CATE REVOCATION LIST CRL FIELDS CRL EXTENSIONS CRL ENTRY EXTENSIONS CERTI?CATION PATH VALIDATION BASIC PATH VALIDATION EXTENDING PATH VALIDATION NETWORK LAYER SECURITY IPSEC PROTOCOL IPSEC PROTOCOL DOCUMENTS SECURITY ASSOCIATIONS (SAS) HASHED MESSAGE AUTHENTICATION CODE (HMAC) IP AUTHENTICATION HEADER AH FORMAT AH LOCATION IP ESP ESP PACKET FORMAT ESP HEADER LOCATION ENCRYPTION AND AUTHENTICATION ALGORITHMS KEY MANAGEMENT PROTOCOL FOR IPSEC OAKLEY KEY DETERMINATION PROTOCOL ISAKMP SSL PROTOCOL SESSION AND CONNECTION STATES SSL RECORD PROTOCOL SSL CHANGE CIPHER SPEC PROTOCOL SSL ALERT PROTOCOL SSL HANDSHAKE PROTOCOL CRYPTOGRAPHIC COMPUTATIONS COMPUTING THE MASTER SECRET CONVERTING THE MASTER SECRET INTO CRYPTOGRAPHIC PARAMETERS TLS PROTOCOL HMAC ALGORITHM PSEUDO-RANDOM FUNCTION ERROR ALERTS CERTI?CATE VERIFY MESSAGE FINISHED MESSAGE CRYPTOGRAPHIC COMPUTATIONS (FOR TLS) ELECTRONIC MAIL SECURITY: PGP, S/MIME PGP CON?DENTIALITY VIA ENCRYPTION AUTHENTICATION VIA DIGITAL SIGNATURE COMPRESSION RADIX-64 CONVERSION PACKET HEADERS PGP PACKET STRUCTURE KEY MATERIAL PACKET ALGORITHMS FOR PGP 5X S/MIME MIME ENHANCED SECURITY SERVICES FOR S/MIME INTERNET FIREWALLS FOR TRUSTED SYSTEMS ROLE OF FIREWALLS FIREWALL-RELATED TERMINOLOGY BASTION HOST PROXY SERVER SOCKS CHOKE POINT DE-MILITARISED ZONE (DMZ) LOGGING AND ALARMS VPN TYPES OF FIREWALLS PACKET FILTERS CIRCUIT-LEVEL GATEWAYS APPLICATION-LEVEL GATEWAYS FIREWALL DESIGNS SCREENED HOST FIREWALL (SINGLE-HOMED BASTION HOST) SCREENED HOST FIREWALL (DUAL-HOMED BASTION HOST) SCREENED SUBNET FIREWALL SET FOR E-COMMERCE TRANSACTIONS BUSINESS REQUIREMENTS FOR SET SET SYSTEM PARTICIPANTS CRYPTOGRAPHIC OPERATION PRINCIPLES DUAL SIGNATURE AND SIGNATURE VERI?CATION AUTHENTICATION AND MESSAGE INTEGRITY PAYMENT PROCESSING CARDHOLDER REGISTRATION MERCHANT REGISTRATION PURCHASE REQUEST PAYMENT AUTHORISATION PAYMENT CAPTURE