Title: Cryptographic Tools
Course: IN 2001 Principle of Information Assurance > Section: Module 8: Chapter Eight

Cryptographic Tools
1. To be actually useful, these cryptographic capabilities must be embodied in tools that allow IT and information security practitioners to apply the elements of cryptography in the everyday world of computing.

Public-Key Infrastructure (PKI)
1. Public-key infrastructure (PKI) is an integrated system of software, encryption methodologies, protocols, legal agreements and third-party services that enables users to communicate securely.
2. PKI systems are based on public-key cryptosystems and include digital certificates and certificate authorities (CAs).  PKI systems can be used to:
  - Issue digital certificates
  - Issue keys
  - Provide tools to secure information
  - Provide verification and return of certificates
3. PKI protects information assets using:
  - Authentication
  - Integrity
  - Privacy
  - Authorization
  - Nonrepudiation
  - Digital signatures
4. When an asymmetric cryptographic process uses the sender’s private key to encrypt a message, the sender’s public key must be used to decrypt the message—when the decryption happens successfully, it provides verification that the message was sent by the sender and cannot be refuted.
5. This is known as nonrepudiation, which is the foundation of digital signatures.
6. Digital signatures are encrypted messages that are independently verified by a central facility (registry) as authentic.

Digital Signatures
1. Currently, asymmetric encryption processes are used to create digital signatures.
2. When an asymmetric cryptographic process uses the sender’s private key to encrypt a message, the sender’s public key must be used to decrypt the message.
3. When the decryption happens successfully, it provides verification that the message was sent by the sender and cannot be refuted.
4. This process is known as nonrepudiation and is the principle of cryptography that underpins the authentication mechanism collectively known as a digital signature.
5. Digital signatures are encrypted messages that can be mathematically proven authentic.
6. Digital signatures should be created using processes and products that are based on the Digital Signature Standard (DSS).

Digital Certificates
1. A digital certificate is an electronic document, similar to a digital signature, that is attached to a file and certifies that the file is from the organization it claims to be from and has not been modified from the original format.
2. A certificate authority is an agency that manages the issuance of certificates and serves as the electronic notary public to verify their worth and integrity.

Hybrid Cryptography Systems
1. In practice, pure asymmetric key encryption is not widely used except in the area of certificates.
2. Asymmetric key encryption is more often used in conjunction with symmetric key encryption—thus as part of a hybrid encryption system.
3. The most common hybrid encryption system is based on the Diffie-Hellman Key Exchange method, which is a method for exchanging private keys using public-key encryption.
4. With Diffie-Hellman, asymmetric encryption is used to exchange session keys.
5. These are limited-use symmetric keys for temporary communications; they allow two organizations to conduct quick, efficient, secure communications based on symmetric encryption.
6. Diffie-Hellman provided the foundation for subsequent developments in public-key encryption.

Steganography
1. Steganography is a process of hiding information and has been in use for a long time.
2. The word “steganography” is derived from the Greek words steganos meaning “covered” and graphein meaning “to write.”
3. The most popular modern version of steganography involves hiding information within files that appear to contain digital pictures or other images.
4. Most computer graphics standards use a combination of three color values (red, blue, and green (RGB)) to represent a picture element, or pixel.
5. Each of the three color values usually requires an 8-bit code for that color’s intensity (e.g., 00000000 for no red and 11111111 for maximum red).
6. This inability to perceive difference on part of humans provides the steganographer with one bit per color (or three bits per pixel) to use for encoding data into an image file.
7. Some applications are capable of hiding messages in .bmp, .wav, .mp3 and .au files, as well as in unused storage space on CDs and DVDs.