Download Chapter 08

Linux Networking and
Security
Chapter 8
Making Data Secure
Making Data Secure




Explain commonly used cryptographic systems
Understand digital certificates and certificate authorities
Use the PGP and GPG data-encryption utilities
Describe different ways in which cryptography is applied
to make computer systems more secure
Cryptography and Computer
Security



Computer security is about making certain that the only
people accessing resources or data are those whom
should have access
Cryptography is the science of encoding data so that it
cannot be read without special knowledge or tools; it is a
key part of network applications and normally hidden
from view
Network connections can be tapped to allow for viewing
of transmitted data - called sniffing the network, and
encryption can block this
Cryptography and Computer
Security
Basic Encoding Techniques

The process of cryptography is as follows:




Begin with the message to transmit - called the plaintext
Apply a technique or rule called a cipher to change the plaintext
The result is ciphertext, an encrypted message
The most elementary example of encryption is lettersubstitution where a different letter of the alphabet is
substituted for each letter in the message
Key Systems



Rules, known as algorithms, allow letter-substitution to
convert plaintext to ciphertext
The level of complexity of an algorithm can be increased
by using a key, a code necessary to encrypt or decrypt a
message correctly using the algorithm
Knowing the algorithm (the cipher) should not enable
readability; good security assumes an eavesdropper
knows the cipher, but the key must be kept secret
DES




The Data Encryption Standard (DES) was developed in
the 1970s and uses a 56-bit key to encrypt data using
various algorithms
56 bits provide for 256 possible keys
It now takes 20 hours to break a DES key
DES is being phased out, but it is still widely used since
relatively few people have the equipment to break the
key, 20 hours is still a relatively long time in the Internet
age, and it was a widely implemented U.S. standard
Skipjack and Triple DES

There were several responses to the cracking of DES:




DES keys were increased to 1024 bits
Creation of a new algorithm called Skipjack, which uses an 80 bit
key
Triple DES relies on DES, but encodes each message three
times using three different keys
Advanced Encryption Standard (AES) can provide roughly 1077
possible keys, and was approved for use by U.S. government
agencies in May 2002
Symmetric and Asymmetric
Encryption

Symmetric encryption algorithms



Use the same key and algorithm to encrypt and decrypt a
message
The key used is called a private key, because it must be kept
secret for the message to be secure
Asymmetric encryption algorithms


Use one key to encrypt and another to decrypt
The key you can reveal to everyone is called a public key
Symmetric and Asymmetric
Encryption
Symmetric and Asymmetric
Encryption
Symmetric and Asymmetric
Encryption
Symmetric and Asymmetric
Encryption
Signatures and Certificates


Authentication is the process of proving that you are in
fact the person you say you are
Signatures let you authenticate a public key


You sign another person’s public key with your own private key
to verify that the key really belongs to that person
Certificates provide the same type of verification as
signatures

A certificate is a numeric code that is used to identify an
organization
Signatures and Certificates
Signatures and Certificates
Fingerprints



A fingerprint is a smaller number that is derived from a
very lengthy public key
Fingerprints are created by hashing the public key, a
process by which a mathematical function is used that
converts larger numbers into smaller numbers
Two commonly used hashes:


Message digest hash (MD5) provides 128 bits
Secure hash algorithm (SHA-1) provides 160 bits
Using Cryptography in a Browser



Whenever you visit a Web page that has been
transmitted to your computer using encryption, you see a
small lock or key in the lower left corner of the browser
window
Most encrypted Web pages, such as order-entry
screens, shopping carts, and similar data, appear with a
URL that starts with https
The encrypted protocol for Web pages is Secure Socket
Layer (SSL)
Using Cryptography in a Browser
Using Cryptography in a Browser
Using Cryptography in a Browser
Using Cryptography in a Browser
Kerberos Authentication




Kerberos authentication is a special kind of
authentication for organizational networks
Kerberos was developed at MIT and is widely used
around the world
Kerberos secures a network by providing a system that
makes users prove who they are before they can use a
service and also makes services prove who they are
It uses both public-key cryptography and a symmetric
cipher
Kerberos Authentication
Kerberos Authentication
Kerberos Authentication
Using Encryption Utilities



Pretty Good Privacy (PGP) is the first utility to provide
public-key encryption to all
Although PGP software was formerly included in Linux, it
has been replaced with GPG
Gnu Privacy Guard (GPG) is a public-key encryption
utility and uses non-patented algorithms

GPG operates from the command line, but there are graphical
utilities to make it easier to use
Using Encryption Utilities
Using Encryption Utilities
Other Security Applications




RPM security can check a public-key signature on any
package to verify that it came from its stated creator
Cryptographic File System (CFS) enforces cryptographic
authentication on all users who want to share files
across the network
Transparent Cryptographic File System (TCFS) operates
transparently to users
IPSec and CIPE provide for IP packet encryption
Secure Shell

Secure Shell (SSH) is an encrypted version of Telnet,
which provides secure remote access


SSH allows other protocols to ride on top of it
A Virtual Private Network (VPN) is a secure
organizational network that uses an insecure public
network (Internet) for communications

VPNs are often created with the aid of specially designed
software that integrates many networking functions with
cryptographic protocols and system management software
Virtual Private Networks
Chapter Summary




Cryptography is the science of encoding data, typically using a
key, so that people without the key cannot read the data
Cryptography protects computer networks against sniffers,
programs that allow crackers to see data passing along a
network
Many different algorithms are used to encrypt data and they are
either symmetric or asymmetric
DES was a popular standard algorithm for years, until Triple
DES and AES began to replace it
Chapter Summary




Public-key encryption does not require that you openly
exchange a secret key with the recipient of an encrypted
message
RSA is the most familiar public-key algorithm
Signatures on a document show that the sender is the only one
who could have sent the document
Certificates are issued and signed by certificate authorities such
as VeriSign to vouch for the identity of the organization holding
the certificate
Chapter Summary




A hash is a mathematical function that creates a small number
from a very large number and it is used to create a fingerprint
Browsers such as Netscape and Mozilla use cryptography via
the Secure Sockets Layer (SSL) protocol to allow secure ecommerce transactions
Kerberos provides a network-wide user and service
authentication scheme to limit network access to authorized
users
PGP was the first freely available public-key encryption software
and remains an industry standard on which GPG is based
Chapter Summary



The Gnu Privacy Guard (GPG) is a free public-key encryption
utility that lets you manage keys and encrypt, sign and decrypt
documents
Keys should be signed only when the identity of the person
providing the key has been ascertained with certainty
The rpm utility can check a public key signature on any package
to verify that it came from the person or organization that claims
to have created it
Chapter Summary


Other security protocols built on the same principles of
cryptography as GPG include IPsec, CIPE, CFS and TCFS
The Secure Shell (SSH) provides encrypted remote access via
a utility that functions like Telnet. SSH also lets other protocols
work with it to create secure connections for many purposes