Title: Protocols for Secure Communications
Course: IN 2001 Principle of Information Assurance > Section: Module 8: Chapter Eight

Protocols for Secure Communications
1. Many of the software currently used to protect the confidentiality of information are not true cryptosystems.
2. Instead, they are applications to which cryptographic protocols have been added.  This is perhaps particularly true of Internet protocols.

Securing Internet Communication with S-HTTP and SSL
1. Netscape developed the Secure Socket Layer (SSL) protocol to use public-key encryption to secure a channel over the public Internet, thus enabling secure communications.
2. Secure Hypertext Transfer Protocol (S-HTTP) is an extended version of the Hypertext Transfer Protocol that provides for the encryption of individual messages between a client and server across the Internet.  S-HTTP is the application of SSL over HTTP, which allows the encryption of all information passing between two computers through a protected and secure virtual connection.

Securing E-Mail with S/MIME, PEM, and PGP
1. Several encryption cryptosystems have been adapted to inject some degree of security into Web communications.
2. S/MIME builds on the format of the Multipurpose Internet Mail Extensions (MIME) encoding format by adding encryption and authentication.
3. Privacy Enhanced Mail (PEM) was proposed by the Internet Engineering Task Force (IETF) as a standard to function with the public-key cryptosystems.
4. PEM uses 3DES symmetric key encryption and RSA for key exchanges and digital signatures.
5. Pretty Good Privacy (PGP) was developed by Phil Zimmerman and uses the IDEA Cipher along with RSA for key exchange.

Securing Web Transactions with SET, SSL, and S-HTTP
1. Just as PGP, PEM and S/MIME work to secure e-mail operations, a number of related protocols work to secure Web browsers, especially at electronic commerce sites.
2. Among these are Secure Electronic Transactions (SET), Secure Socket Layer (SSL), Secure Hypertext Transfer Protocol (S-HTTP), Secure Shell (SSH-2) and IP Security (IPSec).
3. Secure Electronic Transactions (SET) was developed by MasterCard and VISA in 1997 to provide protection from electronic payment fraud.
4. SET uses DES to encrypt credit card information transfers and RSA for key exchange.
5. SET provides the security for both Internet-based credit card transactions and credit card swipe systems in retail stores.

Securing Wireless Networks with WEP and WPA
1. Wireless local area networks are thought by many in the IT industry to be inherently insecure. Without some form of protection, these signals can be intercepted by anyone with a wireless packet sniffer.
2. Wired Equivalent Privacy (WEP)
  - WEP was an early attempt to provide security with the 8002.11 network protocol
  - It is now considered too cryptographically weak to provide any meaningful protection from eavesdropping
  - An intruder who collects enough data can threaten a WEP network in just a few minutes by decrypting or altering the data being transmitted or by forging the WEP key to gain unauthorized access to the network
  - WEP also lacks a means of validating user credentials to ensure that only those who should be on the network are allowed to access it
3. Wi-Fi Protected Access (WPA)
  - WPA was created to resolve the issues with WEP.
  - TKIP is a suite of algorithms that attempts to deliver the best security that can be obtained given the constraints of the wireless network environment.
  - TKIP adds four new algorithms to WEP:
    - “A cryptographic message integrity code, or MIC, called Michael, to defeat forgeries;
    - A new IV sequencing discipline, to remove replay attacks from the attacker’s arsenal;
    - A per-packet key mixing function, to de-correlate the public IVs from weak keys; and
    - A rekeying mechanism, to provide fresh encryption and integrity keys, undoing the threat of attacks stemming from key reuse
  - While it offers dramatically improved security over WEP, WPA is not the most secure wireless protocol design. Some compromises were made in the security design to allow compatibility with existing wireless network components
  - Protocols to replace TKIP are currently under development
4. Next Generation Wireless Protocols
  - Robust Secure Networks (RSN), a protocol planned for deployment as a replacement for TKIP in WPA, uses the Advanced Encryption Standard (AES), along with 802.1x and EAP. RSN extends AES with the Counter Mode CBC MAC Protocol (CCMP)
  - AES supports key lengths up to 256 bits, but it is not compatible with older hardware
  - However, a specification called Transitional Security Network (TSN) allows RSN and WEP to coexist on the same wireless LAN
  - A number of protocols are being considered by the IEEE 802.11 group as a replacement for WPA
  - These include two based on the Advanced Encryption Standard (AES): The AES – Counter Mode Encapsulation and The AES – Offset Codebook Encapsulation
5. Bluetooth
  - Bluetooth is a de facto industry standard for short range wireless communications between devices
  - The Bluetooth wireless communications link can be exploited by anyone within the approximately 30 foot range, unless suitable security controls are implemented
  - It has been estimated that there will be almost a billion Bluetooth-enabled devices by the end of the decade
  - The only way to secure Bluetooth enabled devices is to incorporate a twofold approach: 1) turn off Bluetooth when you do not intend to use it and 2) do not accept an incoming communications pairing request unless you know who the requestor is.

Securing TCP/IP with IPSec and PGP
1. IP Security (IPSec) is the cryptographic authentication and encryption product of the IETF’s IP Protocol Security Working Group.
2. It is used to create virtual private networks (VPNs) and is an open framework for security development within the TCP/IP family of protocol standards.
3. IPSec works in two modes of operation:
  - In transport mode, only the IP data is encrypted, not the IP headers
  - In tunnel mode, the entire IP packet is encrypted and is then placed as the payload in another IP packet
4. IPSec
  - IPSec combines several different cryptosystems in its operations:
    - Diffie-Hellman key exchange for deriving key material between peers on a public network
    - Public-key cryptography for signing the Diffie-Hellman exchanges to guarantee the identity of the two parties
    - Bulk encryption algorithms, such as DES, for encrypting the data
    - Digital certificates signed by a certificate authority to act as digital ID cards
    - IP layer security is obtained by using an application header protocol or an encapsulating security payload protocol
    - The application header (AH) protocol provides system-to-system authentication and data integrity verification, but it does not provide secrecy for the content of a network communication
    - The encapsulating security payload (ESP) protocol provides secrecy for the contents of network communications as well as system-to-system authentication and data integrity verification
5. PGP
  - Pretty Good Privacy (PGP) is a hybrid cryptosystem originally designed in 1991 by Phil Zimmermann
  - PGP combined some of the best available cryptographic algorithms to become the open source de facto standard for encryption and authentication of e-mail and file storage applications
  - Both freeware and low-cost commercial versions of PGP are available for a wide variety of platforms
  - The PGP security solution provides six services: authentication by digital signatures, message encryption, compression, e-mail compatibility, segmentation and key management