CSCU Module 04 Data Encryption

Data Encryption Module 4

Simplifying Security. Simplifying  Security.

1

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

May 23, May 23, 2011

40 Percent of  of IT IT Workers Could Hold Employer Networks Hostage, Survey Finds Roughly 40 percent of IT of  IT workers believe they could hold an employer’s network hostage — even after leaving the company — by withholding or hiding encryption keys, according to a recent survey of 500 of  500 IT security specialists. The study, released Monday, May 23, also revealed that a third of survey of  survey respondents were confident that their knowledge and access to encryption keys and certificates could bring a company to a halt with little effort. Conducted in April 2011, the survey was sanctioned by Venafi, a network key and encryption provider. “It’s a shame that so many people have been sold encryption but not the means or knowledge to manage it,” said Jeff Hudson, Jeff  Hudson, CEO of Venafi, of  Venafi, in a statement. “IT departments must track where the keys are and monitor and manage who has access to them. ... It’s no longer rocket science. Yet recent, costly breaches at Sony, Epsilon and elsewhere reinforce the need for both more encryption and effective management.” http://www.govtech.com

2

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Objectives Common Terminologies

Usage of Encryption

What Is Encryption?

Digital Certificates

Objectives of Encryption

Working of Digital Certificates

Types of Encryption

Digital Signature

Encryption Standards

How Digital Signature Works?

Symmetric vs. Asymmetric Encryption

Cryptography Tools

3

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

4

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Common Terminologies Plaintext Plaintext or cleartext is unencrypted readable text

Cipher Text Cipher text is encrypted and unreadable until it is decrypted to plaintext with a key

Encryption Key An encryption key is a piece of information that is used to encrypt and decrypt data

5

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

 What Is Encryption? Encryption is the process of  converting data into a cipher text that cannot be understood by the unauthorized people To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it Encryption is used to protect sensitive information during transmission and storage

Bob

Plain text (‘Morpheus’)

Encrypted DATA (‘3*.,~’@!w9”)

Encrypted DATA is received by Alice

6

Alice receives the plain data after decryption

Alice

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Objectives of Encryption Data Integrity

Authentication

The receiver of a message can check whether the message was modified during transmission , either accidentally or deliberately

The receiver of a message can verify the origin of the message No other user should be able to send a message to the recipient as the original sender (data origin authentication)

Non‐repudiation

The sender of a message cannot deny that he/she has sent the message

7

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Usage of Encryption It helps to safely store sensitive information on a computer or external storage media

Encryption is used to protect user credentials such as user name and passwords

Encryption provides a secure medium for users to connect to their friends’ or employees’ network from outside of the home or office

It provides a higher level of  trust when receiving files from other users by ensuring that the source and contents of the message are trusted

It is also used as a resource for web‐based information exchange to protect important information such as credit card numbers

Encryption provides assurance of a sender’s identity

8

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

9

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Types of Encryption Symmetric Encryption

Symmetric Encryption

Encryption Dear John, This is my A/C number 7974392830

Symmetric encryption (secret ‐key, shared‐key, and private‐key) uses the same key for encryption and decryption

Plain text

 

Decryption

Guuihifhofn kbifkfnnfk Nklclmlm #^*&(*)_(_

Dear John, This is my A/C number 7974392830

Cipher   text

Plain text

Asymmetric Encryption

Asymmetric Encryption

Encryption

Asymmetric encryption (public key) uses different encryption keys for encryption and decryption. These keys are known as public and private keys

Dear John, This is my A/C number 7974392830

Plain text

 

Decryption

Guuihifhofn kbifkfnnfk Nklclmlm #^*&(*)_(_

 

Cipher text

Dear John, This is my A/C number 7974392830

 

Plain text

Hash function

Hash Function Hash function (message digests or one‐way encryption) uses no key for encryption and decryption

Hash function

Plain text

10

Cipher text

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Symmetric vs. Asymmetric Encryption Symmetric Encryption

Asymmetric Encryption

Symmetric encryption uses only one key for both encryption and decryption The key cannot be shared freely

Asymmetric Encryption uses a public key for encryption and a private key for decryption

Symmetric encryption requires that both the sender and the receiver know the secret key

In asymmetric encryption, the public key can be freely shared, which eliminates the risk of compromising the secret key

Using symmetric encryption, data can be encrypted faster

The encryption process using Asymmetric Encryption is slower and more complex

This algorithm is less complex and faster

Asymmetric encryption ensures confidentiality, integrity, authentication, and non‐repudiation

Symmetric encryption ensures confidentiality and integrity

11

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

12

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Encryption Standards

Data Encryption Standard (DES)

Advanced Encryption Standard (AES)

Data Encryption Standard (DES) is the name of the Federal information Processing Standard (FIPS) 46‐3, which describes the data encryption algorithm (DEA)

Advanced Encryption Standard (AES) is a symmetric‐key encryption standard adopted by the U.S. government

The DEA is a symmetric cryptosystem originally designed for implementation in hardware

It has a 128‐bit block size, with key sizes of 128, 192 and 256 bits, respectively, for AES‐128, AES‐192 and AES‐256

DEA is also used for single‐user encryption, such as to store files on a hard disk in encrypted form

13

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

14

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Digital Certificates A digital certificate is an electronic card that provides credential information while performing online transactions It acts as an electronic counterpart to a drivers license, passport, or membership card and verifies the identity of all users involved in online transactions A digital certificate generally contains: Details of owner’s public key

Owner’s name

Digital signature of the CA (issuer)

Expiration date of  public key

Name of the Certificate Authority (CA) who issued the digital certificate

Serial number of digital signature

15

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

How Digital Certificates Work Certification Authority (CA)

Validation Authority (VA)

Updates Information

Request for Issuing Certificate

Public Key Certificate

Public Key Certificate

Registration Authority (RA)

Determined Result

User Applies for Certificate

User

Message in public key certificate signed with digital signature

Public Key Private Key

16



  Validation of electronic signature



  Inquires about public key certificate validity to validation authority

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

17

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Digital Signature Digital signature implements asymmetric cryptography to simulate the security properties of a signature in digital, rather than written form

Digital signature schemes involve two encryption keys: a private key for signing the message and a public key for verifying signatures

Digital standards follow the open standards as they are not tied to an individual or manufacturer

It is often used to implement electronic signatures and can be used by any type of  message

It is independent of the signature verification between the sender and the receiver

18

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

How Digital Signature Works SIGN

Confidential Information

ACCEPT

Append the signed hash code to message

Hash value   Sender signs hash code using his PRIVATE key

SEAL

Encrypt message using one‐time symmetric key

OPEN

Encrypt the symmetric key using recipient’s PUBLIC key

Decrypt message using one‐time symmetric key

Recipient decrypt one‐time symmetric key using his PRIVATE key

VERIFY

DELIVER

Mail electronic envelopes to the recipient

Unlock the hash value using sender’s PUBLIC key

19

Rehash the message and compare it with the hash value attached with the mail

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Flow

Encryption

Digital Certificates

 

Types of  Encryption

Encryption Standards

Digital Signature

Cryptography Tools

20

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Cryptography Tool: TrueCrypt TrueCrypt creates a virtual encrypted disk within a file and mounts it as a real disk Encrypts an entire partition or storage device such as USB flash drive or hard drive Encrypts a partition or drive where Windows is installed (pre‐boot authentication) Encryption is automatic, real‐time (on‐the‐fly), and transparent

http://www.truecrypt.org

21

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Cryptography Tools Folder Lock

PixelCryptor

http://www.newsoftwares.net 

http://www.codegazer.com

AxCrypt

EncryptOnClick

http://www.axantum.com

http://www.2brightsparks.com

Cryptainer LE

SafeHouse Explorer

http://www.cypherix.co.uk 

http://www.safehousesoftware.com

Advanced Encryption Package

Kruptos 2 Professional

http://www.intercrypto.com

http://www.kruptos2.co.uk 

22

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Module Summary    Encryption

is the process of converting data into a cipher text that cannot be understood by the unauthorized people

   Symmetric

encryption uses only one key for both encryption and decryption, whereas asymmetric encryption uses a public key for encryption and a private key for decryption

   Encryption

provides a higher level of trust when receiving files from other users by ensuring that the source and contents of the message are trusted



A digital certificate is an electronic card that provides credential information when performing online transactions



A digital signature implements asymmetric cryptography to simulate the security properties of a signature in digital, rather than written form

23

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.