Digital Signatures, Cryptography, Interoperability and Intercompatibility
Digital Signatures, Cryptography, Interoperability and Security Requirements for Conducting E-Commerce Transactions:
E-commerce success relies on user trust.
Electronic communications can be easily forged.
Security requirements for e-commerce:
Authentication: Verifying the identities of buyers, sellers, and financial institutions.
Integrity: Ensuring data transmitted (orders, queries, payments) isn't maliciously altered.
Non-repudiation: Protecting merchants from order denials and customers from payment denials.
Privacy: Securing customer identities and purchase information; some prefer anonymity like cash payments.
Safety: Ensuring the security of providing credit card numbers online.
Methods to fulfill security requirements include digital signatures employing Public Key Infrastructure (PKI).
Digital Signatures:
Digital signatures authenticate electronic documents similarly to handwritten signatures on printed documents.
They use Public Key Infrastructure (PKI) technology.
A Digital Signature Certificate (DSC) is a digital equivalent of a handwritten signature.
It establishes the sender's identity and ensures data integrity.
DSCs are typically valid for 1-2 years and can be renewed.
Digital signatures cannot be forged.
Recipients can verify the sender's identity and that the message hasn't been altered.
Digital signatures enable authentication and non-repudiation of digital messages.
A digital signature contains:
Owner's public key.
Owner's name.
Expiration date of the public key.
Name of the issuer (Certification Authority - CA).
A serial number of the digital signature.
Digital signature of the issuer.
The Information Technology Act, 2000, gives legal validity to digital signatures, equivalent to handwritten signatures, if they are based on asymmetric cryptosystems and issued by a licensed Certifying Authority in India.
Directors, auditors, company secretaries, bank officials, and authorized signatories need DSCs.
CA's check information carefully before issuing a DSC.
Digital certificates are publicly available.
Uses of Digital Signature Certificate (DSC):
DSCs are legally recognized, considered equivalent to physically signed documents under the Indian Information Technology Act 2000.
Uses include secure authentication and signing documents/transactions.
DSCs provide non-repudiation for dispute resolution.
Mandatory when the payer bears the risk of forged payments.
Major uses:
Accessing membership-based websites without usernames/passwords.
Digitally signing emails for identity verification and content integrity.
Enabling total transparency in e-governance.
Facilitating e-filing with the MCA (Ministry of Corporate Affairs).
Providing legal recognition equivalent to handwritten signatures.
Proving ownership of a domain name.
Establishing SSL/TLS encrypted sessions for website security.
Filing tax returns securely; mandatory for certain businesses/individuals.
Participating in e-tendering processes on government sites.
Essential for all e-procurement processes.
Useful in foreign trade, required for transactions related to the DGFT website to validate identity and prevent fraud.
Kinds of Digital Signatures:
Three types: Class-1, Class-2, and Class-3, each with different security levels.
Class-2: required for authorized company signatories under MCA21 and by CAs/CSs/CWAs/tax practitioners under MCA21.
Class-3: Required for companies filing e-tenders for organizations like IFFCO, IREPS, ONGC and for signing contract notes of stock broking companies, and also for websites having live IP to authenticate and secure transactions
Digital Certificate:
Considered a strong tool for cybersecurity.
Uses a complex algorithm to generate public and private key pairs.
When a user appends a DSC, the private key hashes the document/transaction content and encrypts it.
To create a digital signature, a sender runs a plaintext message through a hash function (mathematical calculation), appends the result (digital signature) to the transmission, then encrypts with sender's private key.
The recipient decrypts the signature using the sender's public key;
If the result matches the received copy of the message, it ensures the message has been sent by the claimed originator.
Encrypting it at the signor's end protects the digitally signed documents from hacking.
Benefits of Public-key System:
More secure, private, and reliable because of secure key management.
More convenient as it eliminates the extra step necessary to decide on a common key.
Beneficial for communication among strangers and disseminating information on a large scale.
Provides authentication via digital signatures, which are not possible in secret-key systems.
Offers non-repudiation, essential for critical transmissions.
Limitations of public-key systems:
Slower because of extra encryption/decryption steps.
A solution is using "digital envelopes", combining public and secret keys cryptography.
Messages are encrypted with secret-key cryptography, and the encrypted message and secret key are transmitted through public-key cryptography.
Allows the actual messages to be sent using the speed of secret-key cryptography, but prevent the secret-key from being intercepted using public-key encryption.
Two parties could then continue using their secret key for as long as they deemed appropriate, because they have already paid the one-time overhead cost of sending the secret key.
These two methods of public-key encryption can be used to authenticate both participants in communication.
The merchant encrypts a message using the customer's public key, ensuring only the customer can read it.
Then the merchant encrypts the result using the merchant's private key, proving the merchant's identity.
The customer decrypts in reverse order using the merchant's public key to authenticate the merchant.
Then the customer uses the customer's private key to decrypt the next level of encryption.
Critical Issues in Cryptography:
Secure protocols can be prone to failures and attacks, leading to sensitive data loss.
Important for those who encrypt data in bill payment transactions.
Risks include:
A cryptography algorithm falling because it contains patterns from the plaintext and the algorithm can be guessed.
Decryption key being guessed, succumbing to attacks.
Using lower-bit keys to encrypt data makes the key easier to crack via brute-force attack.
Loss or corruption of a private key.
Key is compromised but failure to replace or remove the compromised key.
The lower the number of bits, the easier it is to crack the key; bits and higher are considered safe.
Testers may not check every aspect of cryptography due to complexity; basic understanding of risks is essential.
Physical safeguarding of files and documents containing sensitive information is a must for confidentiality also involves safe key selection.
Public Key Infrastructure (PKI) integrates public-key cryptography with digital certificates and certificate authorities to authenticate parties in a transaction.
Wireless PKI (WPKI) is a security protocol for wireless transmissions, authenticates users via digital certificates, and encrypts messages using public-key cryptography; WPKI also ensures non-repudiation.
Encryption:
E-commerce relies on a secure environment so concerns about outsiders should be addressed through cryptography.
Encryption technology was traditionally deployed most widely to protect the confidentiality of military and diplomatic communication.
Online customers must be assured they are not exposed to spoofing and that they are dealing with a legitimate site.
Doing e-Commerce involves risks (such as spoofing and eavesdropping) and possible threats (such as privacy).
Cryptography provides Both PGP and SSL security. SSL, server security, and digital certificates will provide the authentication, privacy and data integrity through encryption needed to overcome threats associated with Internet-based transactions
Encryption is the only way to ensure secure e-Commerce transactions and applications containing customer's personal information.
Cryptography protects e-commerce, reassures businesses/consumers, safeguards information, guarantees financial data remains secure for payments.
Encryption is necessary to handle payments, to establish a secure channel that can guarantee a customer's financial data remains secure.
Cryptography addresses privacy and access control by rendering communications illegible to unauthorized parties and can provide effective authentication with digital signatures.
Primary forms of cryptography:
Various cryptographic techniques have been developed for user authentication, secret communication, and non-repudiation. They are essential tools in building secure payment systems over open networks that have little or no physical security.
Secret-key cryptography:
Every letter and number in the encrypted data may have complex coding, which may include as many as 64 characters for each letter or number. The newer types of keys include graphics as well.
Secret-key cryptography has been used for all kinds of communications since long. In this method, one "key" is used to both encrypt and decrypt the data. A key can be anything from a secret-decoder ring found in a cereal box to a highly complex mathematical algorithm; keys really only differ in the ease with which they can be broken by third parties. In secret-key cryptography, the sender and receiver must have the same key in order for the transmission to work correctly. However, this technique has two major shortcomings.
Any two people who want to communicate must first agree on the key to use, making it difficult to send information to strangers; large-scale communication becomes difficult.
Key management problem: system for storing and transmission of keys. Initial communication to agree on a key can be intercepted/eavesdropped.
If a third party catches the key that is being used, then all further communications between the two parties are no longer secure and private. Also, the third party could impersonate communications because is believed that no one else knows the key.
Initial parties might not know if the key was stolen, causing a repudiation problem: either party could later deny messages sent with secret-key encryption, claiming the key was stolen or faked.
If a key is compromised electronically and intercepted, it could be used to read encrypted messages or to steal money.
There is always an inherent lack of security and trust in a purely secret-key environment.
Key management problem restricted its use on a large scale as a secure data encryption technique.
Public-key cryptography:
Invented in 1976 by Whitfield Diffie and Martin Hellman.
Instead of one key, users have a public/private key pair.
The public key is shared widely; the private key is kept secret.
Private and public keys are mathematically derived and linked together.
The sender encrypts with the receiver's public key, and only the receiver's private key can decrypt it.
Solved problems of secret-key cryptography:
No worry about key interception.
Assurance of safe, private, and reliable electronic transmissions.
Solved repudiation problem---each individual safeguards their private key.
Main limitation: if a third party figures out how an individual’s private key is derived from the public key, the whole security system will be lost, and it can be cracked.
Cryptography
A hash function is a mathematical calculation that gives the message a hash value, and the sender of the message completes a calculation (performed by a hash function) involving the actual file structure to be transmitted, and his/her private key. The result of this is appended to the transmission.
The recipient decrypts the signature using the sender's public key.
If the result matches with the copy of the message received, the recipient can ensure the message was sent by the claimed originator.
The digitally signed document is encrypted by the signor and provides protection against hacking.
Most systems now use RSA encryption, but there are several alternatives. A RSA signature verifies the sender's identity, but also verifies that the contents of the transmission have not been altered in any way.
Public-key digital signatures authentication requires that the prover have a secret signing key.
Channels through which data pass are not secure, data must be encrypted to secure information. A key makes the data incomprehensible to everyone except the sender and the intended recipients.
Unencrypted data is plain text, but encrypted data is called ciphertext, and only the intended recipient should possess the corresponding key to decrypt the ciphertext into plaintext.
Cryptography may be said to be as old as communication itself.
Cryptography is the process of making information unintelligible to the unauthorized reader.
Decryption is the reverse process of encryption, to make the information readable again
Cryptography techniques make use of secret codes or key to encrypt information. The same secret is used by the receiver to decrypt the information A key is a very large number or a very large collection of numbers, a string of zeros
Introduction to EDI for E-Commerce
E-commerce entails the exchange of information by Electronic Data Interchange (EDI).
The growth of e-Commerce will continue to be an important part of business growth if it can overcome concerns with stolen identity, secure banking/payments/transactions.
Cryptography can assure confidentiality, non-repudiation, and integrity of information in transit and storage, and to authenticate the asserted identity of individuals and computer systems.
Trust in e-Commerce is a real concern.
Cryptography facilitates individual/businesses privacy, and rational economic competitiveness.
This does not apply to government departments/agencies designated for performing sensitive strategic roles
The policy applies to all Central and State Government Departments, including sensitive Departments/Agencies while performing non-strategic & non-operational role), statutory organizations, executive bodies, business and commercial establishments, including public sector undertakings and academic institutions and all citizens including Personnel of Government/Business performing non-official/personal functions).
Cryptography protects privacy and increases security of the Internet
Users need to know how to improve e-Commerce security.
E-Commerce must
Assure online applications and recent innovations in the science of encryption, a new market for cryptographic products in E-commerce & E-Governance civilian applications.
e-mail and electronic fund transfer use encryption to secure the information. Conversion of data into a ciphertext helps avoid unauthorized access
Interoperability
Achieved through service providers and application designers
Interoperability is the ability of a system or product to work with other systems or products without special effort on the part of the customer.
Products achieve interoperability either by using published interface standards or a "Broker" that converts one product's interface into another on the fly.
Examples of standards include TCP/IP, HTTP, and HTML for the World Wide Web.
The Object Request Broker (ORB) exemplifies the second approach
Interoperability means two systems must be able to exchange data that is understood by the user
Levels of Interoperability
Foundational interoperability-allows the data exchange from one information technology system to be received by another, but does not require the ability for the receiving information technology system to interpret the data.
Structural interoperability-defines the structure or format of data exchange. It ensures that data exchanges between information technology systems can be interpreted at the data-field level.
Semantic interoperability-It provides interoperability at the highest level that two or more systems must exchange information to use the information.
How to Achieve Software Interoperability
Product testing tests that products actually intercommunicate as desired
Product engineering-implementation of the standard to make the software interoperable
Industry/community partnership-sponsors standard workgroups
Common technology-speeds up and reduces complexity
Standard implementation-Requires common agreement arrived at via an industrial, national or international standard
E-Commerce Assessment
Risk assessment provides the business with a clear understanding of the risks facing its e-commerce system, and the potential impact if a security incident arises
Will cover access rule for employee, consultants, managed service providers, suppliers, customers, auditors, or agencies.
It also takes into account how electronic transactions are verified.
Identifying Risks in E-Commerce:
Physical threats: like fire or flood, threats posed to the IT infrastructure
Data threats: Viruses and Trojans, pose threats to software, files, databases, etc
Errors by people: Accidental deletion of data, such as an employee clicking on links received on social networking sites
Technical failure: Software BugsInfrastructure Failures: Server crashes
Credit card and payment fraud.
Malicious attacks from inside or outside your business.
Hacker threats: hackers using botnets that include infected remote-controlled computers
Risk to corporate information and intellectual property: From internal staff and trading partners
Hacker exploitation of errors in Software Application: Where corporate image or web messages are changed with virus attacks can lead to commercial embarrassment and damage to a business' corporate image
Potential Impact of A Security Breach
Denial of service is increasing, unless swift action is taken any problems will be immediately broadcast to the world
E-commerce customers have little loyalty, if site is not available they will move on to one of your competitors, technical failure can have a significant impact on your key trading partners.
Some threats that they pose to E-Commerce system included: Corrupting or deleting data on the servers, steal confidential data by enabling hackers to record user keystrokes, Harm customer relations by forwarding viruses to them.
Interoperability and Intercompatibility
Based on a common set of services and standards to ensure all parties are genuine
Make communications more effective and efficient
Cyber Laws in India
Laws are the only savior to combat cyber crime and maintain the safety of national information
The cyber Crime in India is tackled with the Information Technology Act of 2000, sharpened by the Amendment Act of 2008
Cyber Crime is hardly reported, and there are practical difficulties in storing and appreciating Digital Evidence
Objectives of The Act
Objective-Grant legal recognition for electronic transactions carried out by means of electronic data interchange and other means of electronic communication commonly referred to as Electronic Commerce",