2. Agenda
⢠Basic Cryptosystem
⢠Types of Keys
⢠Key Life Cycle
⢠Pre Operational
⢠Creation
⢠Distribution
⢠Operation
⢠Post Operational
⢠Destruction
⢠Storage
⢠X509 Certificate Basics
3. An Example of a Basic Crypto System
⢠Three keys
⢠1 symmetric key
⢠1 public key
⢠1 private key
⢠Three algorithms
⢠1 symmetric cipher algorithm (block / stream)
⢠1 asymmetric cipher algorithm
⢠1 hashing algorithm
⢠Optional
⢠RNG (Random Number Generator)
4. Biggest Problem
Key Management
⢠Why?
⢠Easier to steal the key than to break the lock.
In general, majority of the attacks on a cryptosystem were on Key
Management.
5. Types of Keys
To mitigate key management issues, multiple keys were created according to
its designated purpose.
Private Signature Key Public Key Transport Key
Public Signature Key Symmetric Key Agreement Key
Symmetric Authentication Key Private Static Key Agreement Key
Private Authentication Key Public Static Key Agreement Key
Public Authentication Key Private Ephemeral Key Agreement Key
Symmetric Data Encryption Key Public Ephemeral Key Agreement Key
Symmetric Key Wrapping Key Symmetric Authorization Key
Symmetric Master Key Public Authorization Key
Private Key Transport Key Private Authorization Key
6. Cryptographic Strength & Key Size
Comparable Key Strength
Bits Symmetric
Algorithm
RSA ECC
80 2kTripleDEA 1024 160â223
112 3kTripleDEA 2048 224â255
128 AES-128 3072 256â383
192 AES-192 7680 384â511
256 AES-256 15360 512+
⢠Ephemeral or temporary keys
⢠Long life keys
OUP (Originator Usage Period)
Time during which cryptographic protection may be applied to data
8. Key Lifecycle - Preoperational
⢠Installing key policies
⢠Selecting algorithms
⢠Registering attributes
⢠Key parameters
Keys are registered (binding them to subjectâs identity).
In PKI, it is implemented using x509 certificate.
X.509 certificate binds a public key with subject name (user)
9. Key Lifecycle - Creation
⢠Avoid weak keys
⢠Avoid weak algorithms or weak implementations of algorithms
⢠Process of key generation
⢠Type, purpose and crypto applications of keys
10. Key Lifecycle â Creation (2)
Random Number Generators (RNG)
⢠Produce a sequence of 0s and 1s for use in cryptography
⢠Combined into sub-sequences or blocks of random numbers
⢠Types
⢠Deterministic
⢠Produces sequence based on a known value (seed)
⢠Nondeterministic
⢠Produces sequence based on an unpredictable source
11. Key Lifecycle - Distribution
⢠Based on the type of the key
⢠Requirements
⢠Availability of the keys
⢠Association of keys with intended use
⢠Integrity â detection of change during transit
⢠Confidentiality â split knowledge principle
⢠Distribution
⢠Private keys â split knowledge, trusted entities for distribution
⢠Public keys â X509 certificate
⢠Manual key distribution (encrypted using key wrapping keys)
⢠Wrapping keys are generally public keys
⢠If private keys are used, then a separate distribution channel should be
established
Keys used only for encrypting data in storage should not be distributed.
12. Key Lifecycle - Operation
⢠Backup and recovery mechanisms
⢠Compromised backups
⢠Controls for detecting a compromise
⢠Regeneration
⢠Updates and changes
⢠Crypto period expiration
⢠Suspected or real key compromise
⢠Rekeying
⢠Needs redistribution
⢠Updating the key
⢠No redistribution required
⢠Produced based on the old key
⢠Known to all parties
13. Key Lifecycle â Post-operation
⢠Key not operational
⢠Access to keys needed
⢠Decrypt data
⢠Verify signature
14. Key Lifecycle - Destruction
⢠Zeroization
⢠Replacing key material with â0â or âoâ or something meaning less
⢠Not just the key material at rest, other places should also be considered
15. Key Storage
⢠Provide Integrity
⢠Provide Confidentiality
⢠Association with application and objects
⢠Assurance of domain parameters
Keys are protected with additional level of access control.
Destroying of key material using zeroization, if required.
16. Key Escrow
⢠Multiple parties/agencies storing part of the key.
⢠Generally operates with two components held with two independent agents.
⢠Risks
⢠Collusion
⢠Failure of reassembling
Ex: SKIPJACK and LEAF method.
18. Digital Certificate
An electronic identity issued to a person, system, or an organization by a
competent authority after verifying the credentials of the entity.
In PKI, all digital certificates were issued based on the X.509 standard.
22. Continued âŚ..
PKI 202/203
⢠Trust Models
⢠CRL Models
⢠Working of SSL, SMIME
⢠Walk through using software
⢠Architectural Weaknesses
⢠Auditing a PKI Infrastructure
