IS - 13 - Key Management in Asymmetric Ciphers

Information Security

• Department of Computer Science

• Dr. Ali Sayyed

• National University of Computer & Emerging Sciences

Key Management in Asymmetric Ciphers

• Uses a pair of keys for encryption (public key) and decryption (private key).

Key Management

• Asymmetric Ciphers:

  • Public Key:

    • Encrypts data.

    • Can be shared with anyone.

  • Private Key:

    • Decrypts data.

    • Must be kept secure.

• Need for Key Management:

  • Public key must be securely distributed.

  • Validate the authenticity of the public key.

  • A trust system is required to confirm public key ownership.

  • Keys may need revocation or expiration to maintain security, especially if a private key is compromised.

Distribution of Public Keys

• Key Management Techniques:

  • Public Announcement

  • Publicly Available Directory

  • Public-key Authority

  • Public-key Certificates

Public Announcement

• Users can distribute public keys directly to recipients or broadcast them widely.

  • Examples include appending to emails or posting on websites.

• Major Weakness:

  • Forgery risk where anyone can create a key pretending to be someone else.

Uncontrolled Public-Key Distribution

• Diagrams showing distribution among Alice (A), Bob (B), and the Public Key (PU).

Publicly Available Directory

• Increased security by registering with a trusted public directory.

• Directory Properties:

  • Contains {name, public-key} entries.

  • Secure registration of participants.

  • Key updates can be done anytime.

  • Periodic publication.

  • Electronic access.

Publicly Available Directory Vulnerabilities

• Prone to tampering or forgery issues.

  • Without verification, attackers can impersonate legitimate entities by uploading their key.

  • Improper key revocation can leave old or compromised keys available.

Public-Key Authority

• Enhances security with tighter control over the key distribution process.

• Requires knowledge of the directory's public key for users.

• Users securely interact with the directory for public keys.

Public-Key Certificates

• Bind identity to a public key, allowing exchange without contacting a public-key authority.

• Essential Features of Certificates:

  • Contains public key and identifier.

  • Signed by a Certificate Authority (CA).

  • Users can present their key to CA to obtain a certificate.

  • Any participant can read and verify certificates for validity.

SSL/TLS Certificates

• Ensures:

  • Encryption

  • Authentication

  • Data Integrity

• Roles:

  • Client: Browser or device.

  • Server: Hosts the website.

  • Authority: Trusted Certificate Authorities (e.g., Let's Encrypt).

SSL/TLS Handshake Process

• Steps:

  1. Client Hello: Browser initiates connection with a "Hello" message.

  2. Server Hello: Server responds with its SSL/TLS certificate.

  3. Certificate Validation: Client verifies the certificate.

  4. Key Exchange: Client generates and sends a pre-master key.

  5. Asymmetric Encryption: Both parties derive a session key from the pre-master key.

  6. Further Communication: Session key is used for all further communications.

Public-Key Distribution of Secret Keys

• Public keys enable secure communication to start.

• Public-key encryption is often too slow for general use, so secret keys for conventional encryption are distributed instead.

Simple Session Key Distribution

• Example distribution where A and B exchange public keys for securely establishing a session key.

Diffie-Hellman Key Exchange

• Method proposed by Diffie & Hellman in 1976 for establishing a common key known only to both participants.

• Relies on the computational difficulty of discrete logarithms.

Diffie-Hellman Key Setup

• Agreed Public Numbers: Prime number (p) and generator (g).

• Private Numbers: Chosen private keys by Alice (a) and Bob (b).

• Key Exchange Calculations: Exchange values of A and B.

Security of the Diffie-Hellman Exchange

• Relies on modular exponentiation and difficulty of discrete logarithms.

• Utilized in protocols like TLS and SSH.

Diffie-Hellman Example Setup

• Specific numerical example of how to establish a shared secret key.

ECC (Elliptic Curve Cryptography)

• More efficient than traditional public-key cryptography.

• Utilizes elliptic curve mathematics, enabling smaller key sizes for equivalent security.

• Not as extensively analyzed yet.

Adding Points on Elliptic Curves

• Specific properties of elliptic curves are crucial for secure communication.

• Describes how to add points on the curve combinatorially.

ECC in Action

• Key Generation, Encryption, Decryption: Steps detailing how ECC facilitates secure message transmission.

Comparable Key Sizes for Equivalent Security

• Charts illustrating various symmetric and ECC key sizes with their respective security levels.