1.4 Public Key Infrastructure Flashcards
Public Key Infrastructure (PKI)
Policies, procedures, hardware, software, people
– Digital certificates: create, distribute, manage,
store, revoke
* This is a big, big, endeavor
– Lots of planning
* Also refers to the binding of public keys to
people or devices
– The certificate authority
– It’s all about trust
Symmetric encryption
A single, shared key
– Encrypt with the key
– Decrypt with the same key
– If it gets out, you’ll need another key
* Secret key algorithm
– A shared secret
* Doesn’t scale very well
– Can be challenging to distribute
* Very fast to use
– Less overhead than asymmetric encryption
– Often combined with asymmetric encryption
Asymmetric encryption
Public key cryptography
– Two (or more) mathematically related keys
* Private key
– Keep this private
* Public key
– Anyone can see this key
– Give it away
* The private key is the only key that can decrypt data
encrypted with the public key
– You can’t derive the private key from the public key
The key pair
Asymmetric encryption
– Public Key Cryptography
* Key generation
– Build both the public and private key at the same time
– Lots of randomization
– Large prime numbers
– Lots and lots of math
* Everyone can have the public key
– Only Alice has the private key
Key escrow
Someone else holds your decryption keys
– Your private keys are in the hands of a 3rd-party
– This may be within your own organization
* This can be a legitimate business arrangement
– A business might need access to employee information
– Government agencies may need to decrypt
partner data
* Controversial?
– Of course
– But may still be required
It’s all about the process
Need clear process and procedures
– Keys are incredibly important pieces of information
* You must be able to trust your 3rd-party
– Access to the keys is at the control of the 3rd-party
* Carefully controlled conditions
– Legal proceedings and court orders
Encrypting stored data
Protect data on storage devices
– SSD, hard drive, USB drive, cloud storage, etc.
– This is data at rest
* Full-disk and partition/volume encryption
– BitLocker, FileVault, etc.
* File encryption
– EFS (Encrypting File System), third-party utilities
Database encryption
Protecting stored data
– And the transmission of that data
* Transparent encryption
– Encrypt all database information with a symmetric key
* Record-level encryption
– Encrypt individual columns
– Use separate symmetric keys for each column
Transport encryption
Protect data traversing the network
– You’re probably doing this now
* Encrypting in the application
– Browsers can communicate using HTTPS
* VPN (Virtual Private Network)
– Encrypts all data transmitted over the network,
regardless of the application
– Client-based VPN using SSL/TLS
– Site-to-site VPN using IPsec
Encryption algorithms
There are many, many different ways to encrypt data
– The proper “formula” must be used during
encryption and decryption
* Both sides decide on the algorithm before encrypting the data
– The details are often hidden from the end user
* There are advantages and disadvantages between
algorithms
– Security level, speed, complexity of implementation, etc.
Cryptographic keys
There’s very little that isn’t known about the
cryptographic process
– The algorithm is usually a known entity
– The only thing you don’t know is the key
* The key determines the output
– Encrypted data
– Hash value
– Digital signature
* Keep your key private!
– It’s the only thing protecting your data
Key lengths
Larger keys tend to be more secure
– Prevent brute-force attacks
– Attackers can try every possible key combination
* Symmetric encryption
– 128-bit or larger symmetric keys are common
– These numbers get larger and larger as time goes on
* Asymmetric encryption
– Complex calculations of prime numbers
– Larger keys than symmetric encryption
– Common to see key lengths of 3,072 bits or larger
Key stretching
A weak key is a weak key
– By itself, it’s not very secure
* Make a weak key stronger by performing multiple
processes
– Hash a password. Hash the hash of the password.
And continue…
– Key stretching, key strengthening
* Brute force attacks would require reversing
each of those hashes
– The attacker has to spend much more time,
even though the key is small
Key exchange
A logistical challenge
– How do you share an encryption key across an insecure
medium without physically transferring the key?
* Out-of-band key exchange
– Don’t send the symmetric key over the ‘net
– Telephone, courier, in-person, etc.
* In-band key exchange
– It’s on the network
– Protect the key with additional encryption
– Use asymmetric encryption to deliver a symmetric key
Real-time encryption/decryption
There’s a need for fast security
– Without compromising the security part
* Share a symmetric session key using
asymmetric encryption
– Client encrypts a random (symmetric) key with a
server’s public key
– The server decrypts this shared key and uses it to
encrypt data
– This is the session key
* Implement session keys carefully
– Need to be changed often (ephemeral keys)
– Need to be unpredictable
Symmetric key from asymmetric keys
Use public and private key cryptography to
create a symmetric key
– Math is powerful
Trusted Platform Module (TPM)
A specification for cryptographic functions
– Cryptography hardware on a device
* Cryptographic processor
– Random number generator, key generators
* Persistent memory
– Unique keys burned in during manufacturing
* Versatile memory
– Storage keys, hardware configuration information
– Securely store BitLocker keys
* Password protected
– No dictionary attacks
Hardware Security Module (HSM)
Used in large environments
– Clusters, redundant power
– Securely store thousands of cryptographic keys
* High-end cryptographic hardware
– Plug-in card or separate hardware device
* Key backup
– Secure storage in hardware
* Cryptographic accelerators
– Offload that CPU overhead from other devices
