Ch. 15 Cryptographic Key Management and Distribution

15.1 Symmetric Key Distribution using Symmetric Encryption

  • Key Distribution Options

    • A can physically deliver to B

    • A third party can select and deliver to A and B

    • If A and be have previously used a key, one can send to the other encrypted with the key

    • If A and B each has an encrypted connection with C, C can deliver a key to A and B on encrypted links

      • This option is most popular and secure

      • Key Distribution Center

  • Third-Party Key Distribution Options

    • Uses a TCP Session Key

    • KTC (Key Translation Center) transfers symmetric keys for future communication. A generates or acquires a key, A encrypts the key and sends it to the KTC, KTC re encrypts it with the master key it shares with B then sends it back to A where A sends it to B

    • KDC (key distribution center) generates and distributes keys. A sends a request for a key to be used with B. KDC generates a key and sends it to both

  • Key Hierarchy

    • Master keys - rarely used, generate intermediate keys

      • Intermediate keys - occasionally used, generate ephemeral keys

        • Ephemeral Keys - Often used (and as a result, destroyed and remade). Used to encrypt data

15.2 Symmetric Key Distribution using Asymmetric Encryption

  • Simple Secret Key Distribution

    • A generates a key pair and uses it to create a secret key shared with B

    • Anyone can make a key pair claiming to be A (MITM)

  • Secret Key Distribution with Authentication and Confidentiality

    • A uses B’s private key to send a message containing an ID of A and a nonce (N1) to identify this transaction uniquely

    • B replies with A’s nonce and an N2 nonce proving it is B

    • A returns N2 encrypted with Bs publik key to ensure B that this is A

    • A selects a secret key and shares with B

15.3 Distribution of Public Keys

  • Public Announcement of Public Keys

    • Public key is public so A should be able to announce that it is A and this is its key

    • Anyone can pretend to be A

  • Publicly Available Directory

    • An authority maintains a directory with {name, public key} for each participant

    • Each participant registers a public key with the authority

    • A participant may replace the existing key with a new one at any time

    • Participants can access the directory electronically

  • Public Key Authority

    • Same as last but the authority has a known public key and a secret private key as well

  • Public-Key Certificates    

    • Instead of asking the authority for a key every time you want to connect to someone, everyone is issued a certificate from the authority

    • The authority maintains the certificates but they are held by individuals

15.4 X.509 Certificates

  • Certificates

    • Assumed to be created by a CA

    • Version - Currently there are 7, but no changes have been made to the fields since version 3

    • Serial number - unique number

    • Signature algorithm identifier - The algorithm used to sign the certificate

    • Issuer name - the X.500 name

    • Period of Validity - Consists of 2 dates: First and last

    • Subject name - the name of the user

    • Issuer unique identifier - An optional-bit string field used to identify the CA

    • Subject unique identifier - used to identify uniquely the subject

    • Extensions - extension fields. Used in v 3

    • Signature - Covers all the other fields as well as a digital signature

  • X.509 Version 3

15.5 Public-Key Infrastructure

  • Requirements

    • Any participant can read a certificate to determine the name and public key of the certificate’s owner

    • Any participant can verify that the certificate originated from the CA and is not counterfeit

    • Only the CA can create and update certificates

    • Any participant can verify the currency of the certificate

  • Components

    • End Entity - Any item that can be identified in the subject name of a public key certificate

    • CA - An authority trusted to create and assign public key certificates

    • Registration Authority (RA) - An optional component that can be used to offload many of the administrative functions that a CA ordinarily assumes

    • Repository - Denotes any method for storing and retrieving PKI-related information

    • Relying party - Any user or agent that relies on data in a certificate in making decisions