Bob then compares the decrypted message digest he received from Alice with the message
Steganography
Steganography is the art of using cryptographic techniques to embed secret messages within another message. Steganographic algorithms work by making alterations to the least significant bits of the
many bits that make up image files. The changes are so minor that there is no appreciable effect on the viewed image. This technique allows communicating parties to hide messages in plain sight—
such as embedding a secret message within an illustration on an otherwise innocent web page.
Steganographers often embed their secret messages within images or WAV files. These files are often so large that the secret message would easily be
missed by even the most observant inspector.
E-Commerce
As mentioned in the previous section, the rapid growth of electronic commerce led to the wide- spread adoption of SSL and HTTPS as standards for the secure exchange of information
through web browsers. Recently, industry experts have recognized the added security necessary for electronic transactions. In the next section, we’ll explore the Secure Electronic Transaction
SET protocol designed to add this enhanced security.
Secure Electronic Transactions
The Secure Electronic Transaction SET standard was originally developed jointly by Visa and MasterCard—the two largest providers of credit cards in the United States—as a means for
securing e-commerce transactions. When they outlined the business case for SET, the two ven- dors identified the following seven requirements:
Provide confidentiality of payment information and enable confidentiality of order infor- mation transmitted along with the payment information.
Ensure the integrity of all transmitted data. Provide authentication that a cardholder is a legitimate user of a branded payment card account.
Provide authentication that a merchant can accept branded payment card transactions through its relationship with an acquiring financial institution.
Ensure the use of the best security practices and system design techniques to protect all legitimate parties in an electronic commerce transaction.
Create a protocol that neither depends on transport security mechanisms nor prevents their use. Facilitate and encourage interoperability among software and network providers.
Material on SET is disappearing from the Internet since the original site, www.setco.org
, is no longer active. For more information on SET, try visiting www.ectag.org
.
SET utilizes a combination of RSA public key cryptography and DES private key cryptogra- phy in conjunction with digital certificates to secure electronic transactions. The original SET
standard was published in 1997.
Networking
The final application of cryptography we’ll explore in this chapter is the use of cryptographic algorithms to provide secure networking services. In the following sections, we’ll take a brief
look at two methods used to secure communications circuits, as well as IPSec and the ISAKMP protocol. We’ll also look at some of the security issues surrounding wireless networking.
Circuit Encryption
Security administrators use two types of encryption techniques to protect data traveling over networks—link encryption and end-to-end encryption.
Link encryption protects entire communications circuits by creating a secure tunnel between two points using either a hardware or a software solution that encrypts all traffic entering one
end of the tunnel and decrypts all traffic entering the other end of the tunnel. For example, a company with two offices connected via a data circuit might use link encryption to protect
against attackers monitoring at a point in between the two offices.
End-to-end encryption protects communications between two parties e.g., a client and a server and is performed independently of link encryption. An example of end-to-end encryp-
tion would be the use of Privacy Enhanced Mail to pass a message between a sender and a receiver. This protects against an intruder who might be monitoring traffic on the secure side of
an encrypted link or traffic sent over an unencrypted link.
The critical difference between link and end-to-end encryption is that in link encryption, all the data, including the header, trailer, address, and routing data, is also encrypted. Therefore,
each packet has to be decrypted at each hop so it can be properly routed to the next hop and then reencrypted before it can be sent along its way, which slows the routing. End-to-end
encryption does not encrypt the header, trailer, address, and routing data, so it moves faster from point to point but is more susceptible to sniffers and eavesdroppers. When encryption hap-
pens at the higher OSI layers, it is usually end-to-end encryption, and if encryption is done at the lower layers of the OSI model, it is usually link encryption.
Secure Shell SSH is a good example of an end-to-end encryption technique. This suite of programs provide encrypted alternatives to common Internet applications like FTP, Telnet,
and rlogin. There are actually two versions of SSH. SSH1 which is now considered insecure MONDEX
The MONDEX payment system, owned by MasterCard International, uses cryptographic tech- nology to allow electronic commerce users to store value on smart chips in proprietary pay-
ment cards. The value can then be instantly transferred to a vendor at the point of purchase.
supports the DES, 3DES, IDEA, and Blowfish algorithms. SSH2 drops support for DES and IDEA but adds support for several other algorithms.
IPSec
There are various security architectures in use today, each one designed to address security issues in different environments. One such architecture that supports secure communications is
the Internet Protocol Security IPSec standard. IPSec is a standard architecture set forth by the Internet Engineering Task Force IETF for setting up a secure channel to exchange information
between two entities. The two entities could be two systems, two routers, two gateways, or any combination of entities. Although generally used to connect two networks, IPSec can be used to
connect individual computers, such as a server and a workstation or a pair of workstations sender and receiver, perhaps. IPSec does not dictate all implementation details but is an open,
modular framework that allows many manufacturers and software developers to develop IPSec solutions that work well with products from other vendors.
IPSec uses public key cryptography to provide encryption, access control, nonrepudiation, and message authentication, all using IP protocols. The primary use of IPSec is for virtual private net-
works VPNs, so IPSec operates in either transport or tunnel mode. Tunnel mode is most often used when you set up VPNs between network gateways. In tunnel mode, the message and the orig-
inal IP header are encrypted. Then a new IP header that addresses the destination’s gateway is added. In contrast, in transport mode, only the message is encrypted, not the IP header.
The IP Security IPSec protocol provides a complete infrastructure for secured network communications. IPSec has gained widespread acceptance and is now offered in a number of
commercial operating systems out of the box. IPSec relies upon security associations, and there are four main components:
The Authentication Header AH provides assurances of message integrity and nonrepudi- ation. AH also provides authentication and access control and prevents replay attacks.
The Encapsulating Security Payload ESP provides confidentiality and integrity of packet contents. It provides encryption and limited authentication and prevents replay attacks.
ESP also provides some limited authentication, but not to the degree of the AH. Though ESP is sometimes used without AH, it’s rare to see AH used without ESP.
The IP Payload Compression IPcomp protocol allows IPSec users to achieve enhanced performance by compressing packets prior to the encryption operation.
The Internet Key Exchange IKE protocol provides for the secure exchange of crypto- graphic keys between IPSec participants. IKE establishes a shared security policy between
communication partners and authenticates andor produces keys for key-dependent ser- vices. All communication partners e.g., routerfirewallhost must be identified before traf-
fic is sent. This is accomplished through manual pre-shared keys or by a CA-controlled key distribution service ISAKMP.
OAKLEY is a key establishment protocol that was proposed for IPsec but was superseded by IKE. OAKLEY is based on the Diffie-Hellman algorithm and
designed to be a compatible component of ISAKMP.
IPSec provides for two discrete modes of operation. When IPSec is used in transport mode, only the packet payload is encrypted. This mode is designed for peer-to-peer communication.
When it’s used in tunnel mode, the entire packet, including the header, is encrypted. This mode is designed for gateway-to-gateway communication.
IPSec is an extremely important concept in modern computer security. Be cer- tain that you’re familiar with the four component protocols and the two modes
of IPSec operation.
At runtime, you set up an IPSec session by creating a security association SA. The SA rep- resents the communication session and records any configuration and status information about
the connection. The SA represents a simplex connection. If you want a two-way channel, you need two SAs, one for each direction. Also, if you want to support a bidirectional channel using
both AH and ESP, you will need to set up four SAs. Some of IPSec’s greatest strengths comes from being able to filter or manage communications on a per-SA basis so that clients or gate-
ways between which security associations exist can be rigorously managed in terms of what kinds of protocols or services can use an IPSec connection. Also, without a valid security asso-
ciation defined, pairs of users or gateways cannot establish IPSec links.
Further details of the IPSec algorithm are provided in Chapter 3, “ISO Model, Network Security, and Protocols.”
ISAKMP
The Internet Security Association and Key Management Protocol ISAKMP provides back- ground security support services for IPSec by negotiating, establishing, modifying, and deleting
security associations. As you learned in the previous section, IPSec relies upon a system of secu- rity associations SAs. These SAs are managed through the use of ISAKMP. There are four
basic requirements for ISAKMP, as set forth in Internet RFC 2408:
Authenticate communicating peers. Create and manage security associations.
Provide key generation mechanisms. Protect against threats e.g., replay and denial of service attacks.
Wireless Networking
The widespread rapid adoption of wireless networks poses a tremendous security risk. Many traditional networks do not implement encryption for routine communications between hosts
on the local network and rely upon the assumption that it would be too difficult for an attacker
to gain physical access to the network wire inside a secure location to eavesdrop on the network. However, wireless networks transmit data through the air, leaving them extremely vulnerable
to interception. The security community responded with the introduction of Wired Equivalent Privacy
WEP, which provides 40-, 64-, and 128-bit encryption options to protect communications within the wireless LAN. WEP is described in IEEE 802.11 as an optional component of the
wireless networking standard. Unfortunately, there are several vulnerabilities in this protocol that make it a less than desirable choice for many security administrators.
Remember that WEP is not an end-to-end security solution. It encrypts traffic only between a mobile computer and the nearest wireless access point. Once
the traffic hits the wired network, it’s in the clear again.
Another commonly used wireless security standard, IEEE 802.1x, provides a flexible frame- work for authentication and key management in wireless networks. It greatly reduces the bur-
den inherent in changing WEP encryption keys manually and supports a number of diverse authentication techniques.
Wireless Application Protocol WAP
Unlike WEP, Wireless Application Protocol WAP is not used for 802.11 wireless networking. Instead, WAP is used by portable devices like cell phones and PDAs to support Internet con-
nectivity via your telco or carrier provider. WAP is not a single protocol, but rather a suite of protocols:
Wireless Markup Language WML and Script Wireless Application Environment WAE
Wireless Transaction Protocol WTP Wireless Transport Layer Security Protocol WTLS; provides three classes of security
Wireless Datagram Protocol WDP Wireless Transport Layer Security Protocol WTLS provides the authentication mechanism
for WAP. It is a wireless version of TLS, which is a derivative of SSL v.3.0. WTLS provides for three types of authentication:
Class 1 Anonymous authentication Class 2 Server authentication
Class 3 Two-way client and server authentication The biggest problem with WAP is known as the “gap in wap.” This means that WAP is used
to protect data from the handheld device to the receiving station at the telco, but once on the telco’s servers, data returns to its pre-WAP state i.e., decrypted into plain text before being
reencoded or reencrypted into SSL for secured transmission from the telco’s servers to the ulti- mate Internet-based destination. This temporary state of insecurity grants the telco and other
potential eavesdroppers the ability to gain direct access to your data.
Cryptographic Attacks
As with any security mechanism, malicious individuals have found a number of attacks to defeat cryptosystems. It’s important that you, as a security administrator, understand the threats posed
by various cryptographic attacks to minimize the risks posed to your systems:
Analytic attack This is an algebraic manipulation that attempts to reduce the complexity of
the algorithm. Analytic attacks focus on the logic of the algorithm itself.
Implementation attack This is a type of attack that exploits weaknesses in the implementation of a cryptography system. It focuses on exploiting the software code, not just errors and flaws
but methodology employed to program the encryption system.
Statistical attack A statistical attack exploits statistical weaknesses in a cryptosystem, such as inability to produce random numbers and floating point errors. Statistical attacks attempt to
find a vulnerability in the hardware or operating system hosting the cryptography application.
Brute force Brute force attacks are quite straightforward. Such an attack attempts every pos-
sible valid combination for a key or password. They involve using massive amounts of process- ing power to methodically guess the key used to secure cryptographic communications. For a
non-flawed protocol, the average amount of time required to discover the key through a brute force attack is directly proportional to the length of the key. A brute force attack will always be
successful given enough time. However, enough time is relative to the length of the key. For example, a computer that could brute force a DES 56-bit key in 1 second would take 149 trillion
years to brute force an AES 128-bit key. Every additional bit of key length doubles the time to perform a brute force attack because the number of potential keys is doubled.
Known plaintext In the known plaintext attack, the attacker has a copy of the encrypted mes-
sage along with the plaintext message used to generate the ciphertext the copy. This knowl- edge greatly assists the attacker in breaking weaker codes. For example, imagine the ease with
which you could break the Caesar cipher described in Chapter 9 if you had both a plaintext and a ciphertext copy of the same message.
Chosen ciphertext In a chosen ciphertext attack, the attacker has the ability to decrypt chosen por-
tions of the ciphertext message and use the decrypted portion of the message to discover the key.
Chosen plaintext In a chosen plaintext attack, the attacker has the ability to encrypt plaintext mes-
sages of their choosing and can then analyze the ciphertext output of the encryption algorithm.
Meet-in-the-middle Attackers might use a meet-in-the-middle attack to defeat encryption algo-
rithms that use two rounds of encryption. This attack is the reason that Double DES 2DES was quickly discarded as a viable enhancement to the DES encryption in favor of Triple DES 3DES. In
the meet-in-the-middle attack, the attacker uses a known plaintext message. The plaintext is then encrypted using every possible key k1, while the equivalent ciphertext is decrypted using all possible
keys k2. When a match is found, the corresponding pair k1, k2 represents both portions of the double encryption. This type of attack generally takes only double the time necessary to break a single
round of encryption or 2
n
rather than the anticipated 2
n
2
n
, offering minimal added protection.
Man-in-the-middle In the man-in-the-middle attack, a malicious individual sits between two
communicating parties and intercepts all communications including the setup of the crypto- graphic session. The attacker responds to the originator’s initialization requests and sets up a
secure session with the originator. The attacker then establishes a second secure session with the intended recipient using a different key and posing as the originator. The attacker can then “sit
in the middle” of the communication and read all traffic as it passes between the two parties.
Be careful not to confuse the meet-in-the-middle attack with the man-in-the- middle attack. They sound very similar
Birthday
The birthday attack also known as a collision attack or reverse hash matching see our discussion of brute force and dictionary attacks in Chapter 2 seeks to find flaws in the one-
to-one nature of hashing functions. In this attack, the malicious individual seeks to substitute in a digitally signed communication a different message that produces the same message digest,
thereby maintaining the validity of the original digital signature.
Replay
The replay attack is used against cryptographic algorithms that don’t incorporate tem- poral protections. In this attack, the malicious individual intercepts an encrypted message
between two parties often a request for authentication and then later “replays” the captured message to open a new session. This attack can be defeated by incorporating a time stamp and
expiration period into each message.
Summary
Public key encryption provides an extremely flexible infrastructure, facilitating simple, secure com- munication between parties that do not necessarily know each other prior to initiating the commu-
nication. It also provides the framework for the digital signing of messages to ensure nonrepudiation and message integrity. This chapter explored public key encryption, which is made possible by the
public key infrastructure PKI hierarchy of trust relationships. We also described some popular cryptographic algorithms, such as link encryption and end-to-end encryption. Finally, we intro-
duced you to the public key infrastructure, which uses certificate authorities CAs to generate digital certificates containing the public keys of system users and digital signatures, which rely upon a com-
bination of public key cryptography and hashing functions.
We also looked at some of the common applications of cryptographic technology in solving everyday problems. You learned how cryptography can be used to secure electronic mail using
PGP, PEM, MOSS, and SMIME, web communications using SSL and S-HTTP, electronic commerce using steganography and SET, and both peer-to-peer and gateway-to-gateway net-
working using IPSec and ISAKMP as well as wireless communications using WEP.
Finally, we looked at some of the more common attacks used by malicious individuals attempting to interfere with or intercept encrypted communications between two parties. Such
attacks include birthday, cryptanalytic, replay, brute force, known plaintext, chosen plaintext, chosen ciphertext, meet-in-the-middle, man-in-the-middle, and birthday attacks. It’s important
for you to understand these attacks in order to provide adequate security against them.
Exam Essentials
Understand the key types used in asymmetric cryptography. Public keys are freely shared among communicating parties, whereas private keys are kept secret. To encrypt a message, use
the recipient’s public key. To decrypt a message, use your own private key. To sign a message, use your own private key. To validate a signature, use the sender’s public key.
Be familiar with the three major public key cryptosystems. RSA is the most famous public key cryptosystem; it was developed by Rivest, Shamir, and Adleman in 1977. It depends upon
the difficulty of factoring the product of prime numbers. El Gamal is an extension of the Diffie- Hellman key exchange algorithm that depends upon modular arithmetic. The elliptic curve
algorithm depends upon the elliptic curve discrete logarithm problem and provides more secu- rity than other algorithms when both are used with keys of the same length.
Know the fundamental requirements of a hash function. Good hash functions have five requirements. They must allow input of any length, provide fixed-length output, make it rela-
tively easy to compute the hash function for any input, provide one-way functionality, and be collision free.
Be familiar with the four major hashing algorithms. The Secure Hash Algorithm SHA and its successor SHA-1 make up the government standard message digest function. SHA-1 pro-
duces a 160-bit message digest. MD2 is a hash function that is designed for 8-bit processors and provides a 16-byte hash. MD4 and MD5 both produce a 128-bit hash, but MD4 has proven vul-
nerabilities and is no longer accepted.
Understand how digital signatures are generated and verified. To digitally sign a message, first use a hashing function to generate a message digest. Then encrypt the digest with your pri-
vate key. To verify the digital signature on a message, decrypt the signature with the sender’s public key and then compare the message digest to one you generate yourself. If they match, the
message is authentic.
Know the components of the Digital Signature Standard DSS. The Digital Signature Stan- dard uses the SHA-1 message digest function along with one of three encryption algorithms: the
Digital Signature Algorithm DSA, the Rivest, Shamir, Adleman RSA algorithm, or the Ellip- tic Curve DSA ECDSA algorithm.
Understand the public key infrastructure PKI In the public key infrastructure, certificate authorities CAs generate digital certificates containing the public keys of system users. Users
then distribute these certificates to people with whom they wish to communicate. Certificate recipients verify a certificate using the CA’s public key.
Know the common applications of cryptography to secure electronic mail. The emerging standard for encrypted messages is the SMIME protocol. Other popular e-mail security proto-
cols include Phil Zimmerman’s Pretty Good Privacy PGP, Privacy Enhanced Mail PEM, and MIME Object Security Services MOSS.
Know the common applications of cryptography to secure web activity. The de facto stan- dard for secure web traffic is the use of HTTP over Secure Sockets Layer SSL, otherwise
known as HTTPS. Secure HTTP S-HTTP also plays an important role in protecting individual messages. Most web browsers support both standards.
Know the common applications of cryptography to secure electronic commerce. The Secure Electronic Transaction SET protocol was developed jointly by Visa and MasterCard to pro-
vide end-to-end security for electronic commerce transactions.
Know the common applications of cryptography to secure networking. The IPSec protocol standard provides a common framework for encrypting network traffic and is built in to a num-
ber of common operating systems. In IPSec transport mode, packet contents are encrypted for peer-to-peer communication. In tunnel mode, the entire packet, including header information,
is encrypted for gateway-to-gateway communications.
Describe IPSec. IPSec is a security architecture framework that supports secure communica-
tion over IP. IPSec establishes a secure channel in either transport mode or tunnel mode. It can be used to establish direct communication between computers or to set up a VPN between net-
works. IPSec uses two protocols: Authentication Header AH and Encapsulating Security Pay- load ESP.
Explain common cryptographic attacks Brute force attacks are attempts to randomly find the correct cryptographic key. Known plaintext, chosen ciphertext, and chosen plaintext attacks
require the attacker to have some extra information in addition to the ciphertext. The meet-in- the-middle attack exploits protocols that use two rounds of encryption. The man-in-the-middle
attack fools both parties into communicating with the attacker instead of directly with each other. The birthday attack is an attempt to find collisions in hash functions. The replay attack
is an attempt to reuse authentication requests.
Review Questions
1. In the RSA public key cryptosystem, which one of the following numbers will always be largest?