Embed Size (px)
Citation preview
Agenda
+ PKI Defined
+ Terminology
+ Key Techncial Concepts
+ Key Infrastructure Concepts
+ Practical Uses
▪ What
▪ Who
▪ Why
+ Important Considerations of Being a CA
PKI – Public Key Infrastructure
The sum total of the hardware, software, people, processes, and policies that, together, using the technology of asymmetric cryptography, facilitate the creation of a verifiable association between a public key (the public component of an asymmetric key pair) and the identity (and/or other attributes) of the holder of the corresponding private key (the private component of that pair), for uses such as authenticating the identity of a specific entity, ensuring the integrity of information, providing support for nonrepudiation, and establishing an encrypted communications section
– PKI Assessment Guidelines v3.0 Information Security Committee
American Bar Association
Basic PKI Security Functions
+ Authentication
▪ Be sure you know who you are communicating with
+ Confidentiality
▪ Keep secrets secret
+ Integrity
▪ Be sure nothing is changed behind your back
+ Access Control
▪ Control who can access what
+ Non-repudiation
▪ Have the evidence in the event of a dispute
PKI Terminology and Concepts
+ Hashing functions
+ Symmetric encryption and decryption
▪ Session key
+ Asymmetric encryption and decryption
▪ Key pair
+ Digital signature
+ Digital certificate
+ Certification Authorities (CA)
+ Registration Authorities (RA)
+ Hierarchy of trust
Hash Functions
It was the best of times,it was the worst of times
It was the best of thymes,it was the worst of times
Small Difference
Large Difference
Examples: MD5 (128 bit), SHA-1 (160 bit)
3au8 e43j jm8x g84w
Hash Function
b6hy 8dhy w72k 5pqd
Hash Function
Symmetric Key Cryptography – Encryption
+ DES, AES, RC2, RC5
+ Problems: ▪ Alice and Bob must agree on the secret key without anyone else finding out
▪ Anyone who intercepts the key in transit can later read, modify, and forge all messages encrypted using that key
▪ Doesn’t Scale
Message Common key
Encrypted Message
Eavesdropper
A
Message
BEncrypt Decrypt
Asymmetric Key Cryptography – Encryption
+ RSA, ECC, IDEA
+ Problems:
▪ Key exchange has to be done in a secure way
▪ Encryption and decryption are extremely SLOW
Message Public key
Encrypted Message
Eavesdropper
A
Message
BEncrypt Decrypt
Private key
Public Key Encryption
= Private Key
= Public Key
= Symmetric Key
Encrypt with Bob’s Public Key
Symmetric keys encrypt data;Public keys encrypt symmetric keys
EncryptedSym Key
EncryptedSym Key
Encrypt Sym Key
EncryptedMessage
EncryptedMessage
Encrypt Message
Generate Sym Key
Message
Bob
Alice
EncryptedSym Key
EncryptedSym Key
EncryptedMessage
EncryptedMessage
Public-Key – Decryption
Public key and symmetric key cryptography are complementary technologies
Bob
Decrypt with Bob’s Private Key
= Private Key
= Public Key
= Symmetric Key
Decrypt Sym Key
Decrypt Message
Message
Public-Key – Signature & Verification
Sender
Receiver
Hashing + Encryption = Signature Creation
Hashing + Decryption = Signature Verification
Transmitted Message
Signature
MessageDigest
Hash Function
If these are the same, then the message has not changed
Alice
Bob
MessageDigest
Hash Function
Encrypt
SignatureExpected
Digest
Decrypt
Public-Key – Encryption
EncryptedSym Key
EncryptedSym Key
Encrypt Sym Key
EncryptedMessage
EncryptedMessage
Encrypt Message
Generate Sym Key
Message
Bob
Alice
PKI as DMV
Department of Transportation
Kansas DMVCalifornia DMV Wyoming DMV
CAs
Certs
CAs are like the government agenciesRAs are like the local registries offices
(root CA)
(intermediate CAs)
Certificate Authority
+ An organization that issues certificates
+ Usually a trusted third party
+ Backs the information in the certificate
Registration Authority
+ Performs functions for CA but does not issue certificates directly
+ Processes requests
+ Manages certificate lifecycle
▪ Issuance, recovery, revocation, renewal
+ Distributed
Certificate
A message which at least (1) identifies the certification authority issuing it, (2) names or identifies its subscriber, (3) contains the subscriber's public key, (4) identifies its operational period, and (5) is digitally signed by the certification authority issuing it
– Digital Signature Guidelines Information Security Committee
American Bar Association
Version: v3
Serial No: 001b6f945h75
Algorithms: MD5 RSA
Subject DN: John Doe Issuer DN: State of Kansas
Validity period: from 11-03-2005 to 11-05-2005
Public key: 30 81 89 02 81 81 00 ba 6e e5 9a 74 f5 e7 af a9 8a 9c de a8 e5 53 1b 73 c7 f7 8a 13 f3 44 91 09 dc 91 12 b7 1b b2 cf 09 f7 4b 13 7d …
Signature
Certificate ExtensionsKey Usage: digitalSignature dataEncipherment
keyCertSign nonRepudiation keyAgreementencipherOnlykeyEncipherment cRLSigndecipherOny
Extended Key Usage: serverAuth codeSigning
timeStamping clientAuth
emailProtection OCSPSigning
Certificate Policies: URL of CPS and Policy notice text
Subject Alternative Name: rfc822name, IP Address, DNS Name
CRL Distribution Point: URL of the Certificate Revocation List
Digital Certificates in Use
+ Secure e-mail
+ Virtual Private Network (VPN)
+ Wireless (Wi-Fi)
+ Web Servers (SSL/TLS)
+ Network Authentication
+ Code Signing
+ Server to Server
Who Uses PKI?
Current demand for Current demand for certificatescertificates+ Wireless (WiFi)
deployments
+ Corporate Banking
▪ Phishing Attacks
▪ Identity Theft
+ Government and Industry Mandates+ Physical/Logical access
▪ Windows Logon
+ Devices▪ Web Servers
▪ Cable and Satellite
▪ Domain Controllers
▪ VPN
+ Signed Code
▪ PC
▪ Mobile
+ eCommerce
▪ SSL
Why Use PKI?
+ Federal Government – HSPD-12▪ Calls for the creation of a NIST standard for gov employees and contractors
▪ Builds off of DOD CAC card and External Certification Authority program
+ DOCSIS (Data Over Cable Service Interface Specification)▪ Requires that certificates be imbedded in cable modems for device
authentication and code signing
+ HIPAA▪ Mandates the implementation of security measures to maintain patient privacy
▪ Email encryption of protected heath information (PHI)
+ FFIEC▪ Guidance to implement two-factor authentication for Internet Banking
▪ Mandatory compliance by 2006
+ Gramm-Leach-Bliley Act▪ Requires establishment of technical safeguards to ensure confidentiality and
integrity for any institution holding financial data
Specific PKI Implementations
+ The Commonweath of Pennsylvania Justice Network (JNET)
▪ Allows disparate law enforement agencies to share information securely
+ Barclays Bank
▪ Digital certificates issued to all online clients
▪ Account setup time reduced, trading volume increased
+ Department of Interior Buruea of Land Management
▪ Smart cards issued to employees for physical and logical access
▪ Certificate use expanded to form signing for paper reduction
+ State of New Jersey
▪ Allows residents, employees, business partners to share and access informaiton online
▪ Streamlined processes, reduced paper and realized cost savings
What is Difficult about Being a CA?
+ Understanding PKI risk management
▪ Controlling liability exposure
▪ Conforming to State and Federal Legislation
+ Policies and Practices
▪ Developing a comprehensive Certificate Policy (CP) and Certification Practices Statement (CPS)
▪ Maintaining trust
+ Security
▪ Technology
▪ Physical, personnel, administrative, etc.
+ Operating high availability infrastructure
▪ Maintaining hardware and software
VeriSign PKI Snapshot – 10 Years Later
+ Carrier Class
▪ Thousands of enterprise and government customers/CAs
▪ 10M+ certificates will be issued in 2005
▪ 471K+ SSL certificates in the database
+ Global Presence
▪ Support millions of user and device certificates
▪ More than 25 large-scale PKI affiliate data centers worldwide
+ VeriSign: the PKI company
▪ Our first business, our core competence
▪ Full expertise: standards, design, development, operation and support
▪ An integral part of our Intelligent Infrastructure Services
What Makes a Good PKI?
+ Legislative foundation
▪ Electronic Transactions definitions: Kansas Stat. No. 16-1602
▪ Use of electronic records and signatures: Kansas Stat. No. 16-1605
+ Documented Policies and Procedures
▪ State of Kansas Certificate Policy: IETC Policy 5200
▪ VeriSign CP and CPS: http://www.verisign.com/repository
+ Technology
▪ Kansas has outsourced the management of the State of Kansas root CA to VeriSign, the worlds leader in PKI
+ Personnel, Technical and Security Controls
▪ The Kansas PKI is part of the Kansas IT Governance infrastructure
▪ Kansas appointed personnel act as the RA for the Kansas CA
▪ VeriSign management the CA back-end infrastructure operations
