Cryptography and Key Management

Study Notes

Public key systems are slower than private key systems because they must publish the encryption key without revealing the decryption key.
Public key systems are often used for shorter data.
Key distribution involves one party choosing the key and transmitting it to another user.

Public key systems are significantly slower than private key systems.
The primary reason for this difference is that public key encryption needs to publish the encryption key without revealing the decryption key.
Public key systems are often used for short data and signatures, and key distribution.

Simple methods of public key management involve publishing the public key, such as in newsgroups or yellow pages.
These methods lack security, despite convenience.
Anyone can forge announcements.
For example, a user could falsely claim to be another user and publish a key, making messages intended for the original user accessible to the imposter.
Trusted authorities are needed to manage keys to verify identities during registration.

Passive attacks involve observing messages over a channel to obtain message contents or monitor traffic flows.
Active attacks include saving messages for reuse later, to avoid replay attacks or masquerade as different users in the network.
Security measures are needed to verify message sources.

Public keys can be distributed using:
- Public announcement
- Publicly available directories
- Public key authorities
- Public key certificates

Users broadcast their public keys to the community.
Vulnerability: A major issue is key forgery, where anyone can create a key, falsely claiming to be someone else and broadcasting it to the network.
This enables an attacker to impersonate another user and send/receive messages.
This flaw persists until a forgery is detected.

This approach improves security by registering keys in a directory.
The directory needs to be trusted, and includes entries for participants and their public keys.
Participants can update their keys in the directory periodically.
The directory should be accessible electronically.
Still vulnerable to forgery.

This method improves security by consolidating control over key distribution, ensuring public keys are from a trusted authority.
A central authority maintains a dynamic directory of all participant's public keys.
Users retrieve desired keys securely from the directory when needed.
A limitation is requiring real-time access to the directory for key retrieval, making it a potential bottleneck.

This is an alternative to using a public key authority.
Certificates allow participants to exchange keys without contacting an authority.
Anyone can read a certificate to find the owner's name and public key.
Users can verify the certificate's authority, creation/update time of the certificate, and timestamp.
The timestamp is crucial to prevent the reuse of voided keys.
The certificate structure is: C = EKRauth[T, IDA, KUA]. This uses the private key of the Certificate Authority (CA) to encrypt the certificate.