Fluent Essays

Question-1 : Do you believe that all data should be encrypted? Many computing professionals think this is a good idea. But a small number of computing experts feel that no data should be encrypted—that all data and software should be openly available to anyone who wants it. Explain your answer (whether you believe all data should or should not be encrypted).Question-2: In this module, you learned that random numbers (or, at least, pseudo random numbers) are essential in cryptography, but it is extremely difficult even for powerful hardware and software to generate them. Go online and conduct research on random number generators. What are the different uses of these tools besides cryptography? How do they work? Explain your answer using your own words in 2-3 paragraphs.Reference : 1.https://www.sophos.com/en-us/products/safeguard-encryption.aspx2. https://www.youtube.com/watch?v=-yFZGF8FHSg&feature=youtu.be merkow_ppt_11_f.ppt Unformatted Attachment Preview Information Security Principles and Practices, 2nd Edition Dr. Cindi Nadelman New England College Week 11 – ECS 6200 Chapter 11: Cryptography Objectives ◼ ◼ ◼ ◼ ◼ Explain common terms used in the field of cryptography Outline what mechanisms constitute a strong cryptosystem Demonstrate how to encrypt and decrypt messages using the transposition method Demonstrate how to encrypt messages using the substitution method Support the role of cryptography in e-commerce systems 2 Objectives cont. ◼ ◼ ◼ ◼ Explain the differences between symmetric and asymmetric cryptography Outline the mechanisms used for digital signatures Explain the purpose and uses of digital certificates Evaluate commercial implementations of public key infrastructure (PKI) products 3 Introduction ◼ Because most computer application-level security relies on cryptography, it is essential to have a strong understanding of cryptography technologies 4 Applying Cryptography to Information Systems ◼ ◼ Applied cryptography—the science of secret writing—enables the storage and transfer of information in forms that reveal it only to those permitted to see it, while hiding it from everyone else In the 20th century, international governments began to use cryptography to protect their private and sensitive information and for communications purposes 5 Applying Cryptography to Information Systems (cont.) ◼ Since the 1970s, academic interest in cryptography has grown at a tremendous rate, and private citizens have increasingly gained access to various cryptography techniques, permitting personal information protection and enabling the conduct of secure electronic transactions 6 Basic Terms and Concepts ◼ ◼ ◼ ◼ Cryptosystems disguise messages, allowing only selected people to see through the disguise Cryptography is the science (or art) of designing, building, and using cryptosystems Cryptanalysis is the science (or art) of breaking a cryptosystem Cryptology is the umbrella study of cryptography and cryptanalysis 7 Basic Terms and Concepts (cont.) ◼ Cryptographers rely on two basic methods: ❑ ❑ ◼ Transposition: Letters are rearranged into a different order Substitution: letters are replaced by other letters and/or symbols Plaintext is the message that is passed through an encryption algorithm and becomes ciphertext ❑ When ciphertext is passed through a decryption algorithm, it becomes plaintext again 8 Strength of Cryptosystems ◼ ◼ A strong cryptosystem is considered strong only until it’s been cracked Strong cryptosystems ❑ ❑ ❑ ◼ Produce ciphertext that always appears random to standard statistical tests Also resist all known attacks on cryptosystems Have been brutally tested to ensure their integrity Popular cryptosystems have the following common characteristics ❑ ❑ The algorithms used are public The key is kept secret ◼ The longer the key the stronger the cryptosystem 9 Cryptosystems Answer the Needs of Today’s E-Commerce ◼ ◼ Each employee must have an ID and password to access the email system, but beyond that, any guarantees of authenticity require trust in the users of the system To ensure that electronic commerce is secure, however, requires an implicit distrust in users of the Internet and public networks © Pearson Education 2014, Information Security: Principles and Practices, 2nd Edition 10 The Role of Keys in Cryptosystems ◼ ◼ Two basic types: symmetric and asymmetric Symmetric key cryptography (shared secret) ❑ ❑ ❑ It uses the same key to both encrypt and decrypt a message The most common form of symmetric key cryptography is the Data Encryption Standard, which uses 64 bits of data (8 bytes) with a 56-bit (7 byte) key 3DES ◼ ◼ ❑ ❑ Uses 128 bit key Used commonly by banks to encrypt PIN numbers AES: The replacement of DES One of the most significant challenges of symmetric key cryptography lies in sharing keys prior to needing them © Pearson Education 2014, Information Security: Principles and Practices, 2nd Edition 11 The Role of Keys in Cryptosystems ◼ Asymmetric key cryptography (public key) ❑ It uses two keys, public and private ◼ ❑ ❑ ❑ Typically, the key lengths that are used with strong asymmetric key cryptography are 1024 bits long (128 bytes) A message encrypted using one key can be decrypted using only the other and vice versa The public key is shared with everyone you want to communicate with privately, but the private key is kept secret The two keys that compose a pair are mathematically related, but neither can be derived from the other 12 The Role of Keys in Cryptosystems ◼ Asymmetric key cryptography (cont.) ❑ It enables you to communicate over any open channel with a high degree of confidence and permits you to trust in these ways: ◼ ◼ ◼ Authentication: Messages you receive are from their advertised source Privacy: Messages you send can be read only by their intended receiver(s) Message integrity: All messages sent and received arrive intact 13 Putting the Pieces to Work ◼ Background Technologies ❑ ❑ ❑ A hash is a transformation of data into distilled forms that are unique to the data With a computer program, a document is run through a one-way hashing formula to produce a small numeric value that’s unique but easily repeatable for that exact stream of data This process is also called digesting data or creating a message digest 14 Digesting Data ◼ Common hashing algorithms MD5 ❑ SHA1 ❑ ◼ Digital signatures Used to verify the identity of the sender ❑ Uses a message digest ❑ 15 Digesting Data (cont.) 16 Digital Certificates ◼ ◼ ◼ Similar to a driver’s license: Used to verify identity The digital certificate standard, X.509, governs how certificates are constructed and used between communicating parties X.509 is an International Telecommunications Union (ITU) recommended standard and has become a de facto industry standard for user authentication on open systems, such as the Internet 17 Digital Certificates (cont.) ◼ ◼ ◼ X.509 digital certificates are similar to notary seals in that they bind a person’s identity to cryptographic keys X.509 digital certificates are issued by a trusted party, called a certificate authority (CA) These CAs operate on behalf of those who want to operate a PKI using X.509 recommended standards © Pearson Education 2014, Information Security: Principles and Practices, 2nd Edition 18 Examining Digital Cryptography ◼ Hashing Functions ❑ The most common hashing functions create the message digest for digitally signed messages ◼ ❑ ❑ Hashing is also used to protect user passwords Hashing-type functions can also be used with symmetric key cryptography, and the result of the operation is called a message authentication code (MAC) Secure Hashing Algorithm (SHA) variants are the most common variants of hashing functions found in commercial software 19 Examining Digital Cryptography ◼ Block Ciphers ❑ ❑ ❑ ❑ DES and Triple-DES are the most common forms of symmetric key block cipher cryptosystems DES uses a 56-bit (7 bytes + checksum byte) key and Triple DES uses a 112-bit (14 bytes + 2 checksum bytes) key The Advanced Encryption Standard (AES) is based on the Rijndael algorithm AES was adopted by the U.S. Department of Commerce as the Federal Information Processing Standard (FIPS) in 2001 20 Examining Digital Cryptography ◼ Implementations of PPK Cryptography ❑ Secure Sockets Layer (SSL) ◼ ◼ ◼ The most popular form of PPK; the de facto standard for transporting private information across the Internet The goals of SSL are to ensure the privacy of the connection, authenticate a peer’s identity, and establish a reliable transport mechanism for the message using integrity checks and hashing functions Two signs that SSL is active during an Internet session: ❑ ❑ The URL begins with “https//. . .” rather than “http://. . .” A padlock appears on the status bar of the browser 21 Examining Digital Cryptography ◼ Implementations of PPK Cryptography (cont.) ❑ Transport Layer Security (TLS) Protocol ◼ The goals of TLS protocols are to provide ❑ ❑ ❑ ❑ Cryptographic security: TLS should be used to establish a secure connection between two parties Interoperability: Programmers should develop applications using TLS that will successfully exchange cryptographic parameters without knowledge of one another’s code Extensibility: Provide a framework into which new public key and bulk encryption methods can be incorporated as necessary Relative efficiency: Cryptographic operations tend to be highly CPU intensive, particularly public key operations 22 Examining Digital Cryptography ◼ Implementations of PPK Cryptography (cont.) ❑ Pretty Good Privacy (PGP) ◼ ◼ ◼ ◼ Distributed key management approach that does not rely on certificate authorities Users can sign one another’s public keys, adding some degree of confidence to a key’s validity Someone who signs another’s public key acts as an introducer for that person to someone else so that if someone trusts the introducer, they should also trust the person who’s being introduced PGP is often used to encrypt documents that can be shared via e-mail over the open Internet 23 Examining Digital Cryptography ◼ Implementations of PPK Cryptography (cont.) ❑ Secure/Multipurpose Internet Mail Extensions (S/MIME) ◼ ◼ ◼ Another standard for electronic-mail encryption and digital signatures S/MIME along with a version of PGP called Open PGP are used in Netscape Communications Corporation Web browsers S/MIME and Open PGP use proprietary encryption techniques and handle digital signatures differently 24 Examining Digital Cryptography ◼ Implementations of PPK Cryptography (cont.) ❑ Secure Electronic Transactions (SET) ◼ ◼ ◼ Addresses most consumer demands for privacy when using a credit card to shop online Uses a robust set of strictly controlled digital certificates to identify cardholders and merchants, and acquire secure payment gateways for messages passing through open channels like the Internet Uses multiple forms of symmetric key cryptography (such as DES) to provide confidentiality of payment card and transaction data 25 Summary ◼ ◼ ◼ Cryptography is needed by computer applications to implement the privacy and security that users demand The strength of a cryptosystem rests in the size and means used to protect cryptographic keys The same key can be used to both encrypt and decrypt information and is called a symmetric key, or different keys can be used for encryption and decryption and are called asymmetric keys 26 Summary ◼ ◼ Cryptography relies on two basic methods: transposition and substitution Digital signatures are used in asymmetric key cryptography to support authentication, integrity, and nonrepudiation services 27 ... Purchase answer to see full attachment