Upload
jemimah-obrien
View
220
Download
1
Embed Size (px)
Citation preview
Key Management
Authentication Using Public-Key Cryptography
KA+, KB
+: public keysA
lice
Bo
b
KB+(A, RA)1
2 KA+(RA, RB,KA,B)
3 KA,B(RB)
What if KB+ is faked?
Security Management
Problem: how do you get keys in the first place?
Key distribution: securely associate an entity with a key- Example: Public Key Infrastructure (PKI), a system that manages
public key distribution on a wide-scale
Key establishment: establish session keys- Use public key cryptography (we already know how to do it)
Components of a PKI
Digital Certificate
Signed data structure that binds an entity (E) with its corresponding public key (KE
+)- Signed by a recognized and trusted authority, i.e.,
Certification Authority (CA)
- Provide assurance that a particular public key belongs to a specific entity
How?- CA generates KCA
-(E, KE+)
- Everyone can verify signature using KCA+
Certification Authority (CA)
People, processes responsible for creation, delivery and management of digital certificates
Organized in a hierarchy (use delegation – see next)
CA-1 CA-2
Root CA
Registration Authority
People, processes and/or tools that are responsible for
- Authenticating the identity of new entities (users or computing devices)
- Requiring certificates from CA’s.
Certificate Repository
A database which is accessible to all users of a PKI, contains:
- Digital certificates,
- Certificate revocation information
- Policy information
Example
Alice generates her own key pair.
public keyAlice
private keyAlice
Bob generates his own key pair.
Both sent their public key to a CA and receive a digital certificate
public keyBob
private keyBob
Example
Alice gets Bob’s public key from the CA
private keyAlice
public key
Bob
private keyBob
public keyAlice
Bob gets Alice’s public key from the CA
Certificate Revocation
Process of publicly announcing that a certificate has been revoked and should no longer be used.
Approaches:- Use certificates that automatically time out
- Use certificate revocation list
Authorization Management
Authorization Management
Granting authorization rights
Related with access control which verifies access rights
Capabilities (1)
How to grant a capability?
How to verify a capability?
Capabilities (2)
Capability: - Unforgeable data structure for a specific resource R
- Specify access right the holder has with respect to R
An example:
48 bits 24 bits 8 bits 48 bits
Server port Object Rights Check
Capabilities (3)
Generation of a restricted capability from an owner capability
Owner
Delegation: Motivation Example
A user Alice has read-only access rights on a large file F
Alice wants to print F on printer P no earlier than 2am- Method A: Alice sends the entire file F to the printer P;
- Method B: Alice passes the file name to P and printer P copies the file F to its spooling directory when F is actually needed.
- For method B, Alice needs to delegate her read-only access rights on F to printer P
Delegation: Neuman Scheme
The general structure of a proxy as used for delegation:
Delegation: Neuman Scheme
Using a proxy to delegate and prove ownership of access rights
In practice S+proxy, S-
proxy can be a public-private key pair and N can be a nonce