RSA SECURITY'S OFFICIAL GUIDE TO CRYPTOGRAPHY

By CHARLOTTE THOMAS

CONTENTS CHAPTER WHY CRYPTOGRAPHY? SECURITY PROVIDED BY COMPUTER OPERATING SYSTEMS HOW OPERATING SYSTEMS WORK DEFAULT OS SECURITY: PERMISSIONS ATTACKS ON PASSWORDS ATTACKS THAT BYPASS OPERATING SYSTEMS DATA RECOVERY ATTACK MEMORY RECONSTRUCTION ATTACK ADDED PROTECTION THROUGH CRYPTOGRAPHY THE ROLE OF CRYPTOGRAPHY IN DATA SECURITY CHAPTER SYMMETRIC-KEY CRYPTOGRAPHY SOME CRYPTO JARGON WHAT IS A KEY? WHY IS A KEY NECESSARY? GENERATING A KEY A RANDOM NUMBER GENERATOR A PSEUDO-RANDOM NUMBER GENERATOR ATTACKS ON ENCRYPTED DATA ATTACKING THE KEY BREAKING THE ALGORITHM MEASURING THE TIME IT TAKES TO BREAK YOUR MESSAGE SYMMETRIC ALGORITHMS: THE KEY TABLE SYMMETRIC ALGORITHMS: BLOCK VERSUS STREAM CIPHERS BLOCK CIPHERS STREAM CIPHERS BLOCK VERSUS STREAM: WHICH IS BETTER? DIGITAL ENCRYPTION STANDARD TRIPLE DES COMMERCIAL DES REPLACEMENTS ADVANCED ENCRYPTION STANDARD SUMMARY REAL-WORLD EXAMPLE: ORACLE DATABASES SYMMETRIC-KEY MANAGEMENT PASSWORD-BASED ENCRYPTION PROGRAMMING CONVENIENCE BREAKING PBE SLOWING DOWN AN ATTACK ON A PASSWORD GOOD PASSWORDS PASSWORD GENERATORS HARDWARE-BASED KEY STORAGE TOKENS CRYPTO ACCELERATORS HARDWARE DEVICES AND RANDOM NUMBERS BIOMETRICS REAL-WORLD EXAMPLES KEON DESKTOP OTHER PRODUCTS THE KEY DISTRIBUTION PROBLEM AND PUBLIC-KEY CRYPTOGRAPHY SHARING KEYS IN ADVANCE PROBLEMS WITH THIS SCHEME USING A TRUSTED THIRD PARTY PUBLIC-KEY CRYPTOGRAPHY AND THE DIGITAL ENVELOPE SECURITY ISSUES BREAKING A PUBLIC-KEY ALGORITHM SOME HISTORY OF PUBLIC-KEY CRYPTOGRAPHY HOW PUBLIC-KEY CRYPTOGRAPHY WORKS THE RSA ALGORITHM THE DH ALGORITHM THE ECDH ALGORITHM COMPARING THE ALGORITHMS SECURITY KEY SIZES PERFORMANCE TRANSMISSION SIZE INTEROPERABILITY CONTENTS PROTECTING PRIVATE KEYS USING THE DIGITAL ENVELOPE FOR KEY RECOVERY KEY RECOVERY VIA A TRUSTED THIRD PARTY KEY RECOVERY VIA A GROUP OF TRUSTEES KEY RECOVERY VIA THRESHOLD SCHEMES HOW A THRESHOLD SCHEME WORKS REAL-WORLD EXAMPLE THE DIGITAL SIGNATURE THE UNIQUENESS OF A DIGITAL SIGNATURE MESSAGE DIGESTS COLLISIONS THE THREE IMPORTANT DIGEST ALGORITHMS A REPRESENTATIVE OF LARGER DATA DATA INTEGRITY BACK TO DIGITAL SIGNATURES TRYING TO CHEAT IMPLEMENTING AUTHENTICATION, DATA INTEGRITY, AND NONREPUDIATION UNDERSTANDING THE ALGORITHMS RSA DSA ECDSA PROTECTING PRIVATE KEYS INTRODUCTION TO CERTIFICATES KEY RECOVERY PUBLIC-KEY INFRASTRUCTURES AND THE X 509 STANDARD PUBLIC-KEY CERTIFICATES UNIQUE IDENTIFIERS STANDARD VERSION 3 CERTIFICATE EXTENSIONS ENTITY NAMES CONTENTS ASN 1 NOTATION AND ENCODING THE COMPONENTS OF A PKI CERTIFICATION AUTHORITY REGISTRATION AUTHORITY CERTIFICATE DIRECTORY KEY RECOVERY SERVER MANAGEMENT PROTOCOLS OPERATIONAL PROTOCOLS REGISTERING AND ISSUING CERTIFICATES REVOKING A CERTIFICATE CERTIFICATE REVOCATION LISTS SUSPENDING A CERTIFICATE AUTHORITY REVOCATION LISTS TRUST MODELS CERTIFICATE HIERARCHIES CROSS-CERTIFICATION X 509 CERTIFICATE CHAIN THE PUSH MODEL VERSUS THE PULL MODEL MANAGING KEY PAIRS GENERATING KEY PAIRS MANAGING MULTIPLE KEY PAIRS UPDATING KEY PAIRS KEEPING A HISTORY OF KEY PAIRS DEPLOYING A PKI THE FUTURE OF PKI ROAMING CERTIFICATES ATTRIBUTE CERTIFICATES CERTIFICATE POLICIES AND CERTIFICATION PRACTICE STATEMENTS KEON CERTIFICATE SERVER KEON WEB PASSPORT NETWORK AND TRANSPORT SECURITY PROTOCOLS INTERNET PROTOCOL SECURITY IP SECURITY ARCHITECTURE IPSEC SERVICES THE AUTHENTICATION HEADER PROTOCOL INTEGRITY CHECK VALUE CALCULATION CONTENTS TRANSPORT AND TUNNEL MODES THE ENCAPSULATING SECURITY PAYLOAD PROTOCOL ENCRYPTION ALGORITHMS ESP IN TRANSPORT AND TUNNEL MODES SECURITY ASSOCIATIONS COMBINING SECURITY ASSOCIATIONS SECURITY DATABASES SECURITY POLICY DATABASE SECURITY ASSOCIATION DATABASE KEY MANAGEMENT INTERNET KEY EXCHANGE SECURE SOCKETS LAYER THE HISTORY OF SSL SESSION AND CONNECTION STATES THE RECORD LAYER PROTOCOL THE CHANGE CIPHER SPEC PROTOCOL THE ALERT PROTOCOL THE HANDSHAKE PROTOCOL THE CLIENT HELLO MESSAGE THE SERVER HELLO MESSAGE THE SERVER CERTIFICATE MESSAGE THE SERVER KEY EXCHANGE MESSAGE THE CERTIFICATE REQUEST MESSAGE THE SERVER HELLO DONE MESSAGE THE CLIENT CERTIFICATE MESSAGE THE CLIENT KEY EXCHANGE MESSAGE THE CERTIFICATE VERIFY MESSAGE THE FINISHED MESSAGE ENDING A SESSION AND CONNECTION RESUMING SESSIONS CRYPTOGRAPHIC COMPUTATIONS ENCRYPTION AND AUTHENTICATION ALGORITHMS APPLICATION-LAYER SECURITY PROTOCOLS S/MIME OVERVIEW S/MIME FUNCTIONALITY CRYPTOGRAPHIC ALGORITHMS CONTENTS S/MIME MESSAGES ENHANCED SECURITY SERVICES SECURE ELECTRONIC TRANSACTION (SET) BUSINESS REQUIREMENTS SET FEATURES SET PARTICIPANTS DUAL SIGNATURES SET CERTIFICATES PAYMENT PROCESSING HARDWARE SOLUTIONS: OVERCOMING SOFTWARE LIMITATIONS CRYPTOGRAPHIC ACCELERATORS AUTHENTICATION TOKENS TOKEN FORM FACTORS NONCONTACT TOKENS CONTACT TOKENS SMART CARDS SMART CARD STANDARDS TYPES OF SMART CARDS READERS AND TERMINALS JAVACARDS HISTORY AND STANDARDS JAVACARD OPERATIONS OTHER JAVA TOKENS BIOMETRIC SYSTEMS OVERVIEW RECOGNITION METHODS BIOMETRIC ACCURACY COMBINING AUTHENTICATION METHODS VENDORS DIGITAL SIGNATURES: BEYOND SECURITY LEGISLATIVE APPROACHES LEGAL GUIDELINES FROM THE AMERICAN BAR ASSOCIATION LEGAL CONCEPTS RELATED TO DIGITAL SIGNATURES CONTENTS TEAMFLY NONREPUDIATION AUTHENTICATION WRITTEN VERSUS DIGITAL SIGNATURES REQUIREMENTS FOR THE USE OF DIGITAL SIGNATURES PUBLIC KEY INFRASTRUCTURES CONTROL OF KEY REVOCATION TIME-STAMPING CURRENT AND PENDING LEGISLATION THE E-SIGN ACT DEALING WITH LEGAL UNCERTAINTIES DOING IT WRONG: THE BREAK-INS MEASURING LOSSES TYPES OF SECURITY THREATS UNAUTHORIZED DISCLOSURE OF DATA UNAUTHORIZED MODIFICATION OF DATA UNAUTHORIZED ACCESS DISCLOSURE OF NETWORK TRAFFIC SPOOFING OF NETWORK TRAFFIC IDENTIFYING INTRUDERS INSIDERS HACKERS TERRORISTS FOREIGN INTELLIGENCE SERVICES HACTIVISTS INTRUDER KNOWLEDGE CASE STUDIES DATA IN TRANSIT DATA AT REST IMPLEMENTATION INFORMATION SECURITY: LAW ENFORCEMENT DOING IT RIGHT: FOLLOWING STANDARDS SECURITY SERVICES AND MECHANISMS CONTENTS CONFIDENTIALITY INTEGRITY NONREPUDIATION STANDARDS, GUIDELINES, AND REGULATIONS THE INTERNET ENGINEERING TASK FORCE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY COMMON CRITERIA THE HEALTH INSURANCE PORTABILITY ACT DEVELOPER ASSISTANCE INSURANCE SECURITY RESEARCH