Our last article provided an overview of what Asymmetric Cryptography Infrastructure looks like. It is far different than that of a Symmetric Cryptography Infrastructure, in that two sets of keys are being used; as opposed to just one set. In this regard, it is the Public Key/Private Key combination which is utilized. Thus it affords it a much higher level security than that of a Symmetric Cryptography Infrastructure.
Also, an overview of the technical details of the Public Key/Private Key combinations was provided, as well as some of the disadvantages of utilizing an Asymmetry Cryptography Infrastructure. The biggest disadvantage is that it can be much slower to use. The primary reason for this are the number of Public Key/Private Key combinations which can be generated, and the sheer number of sending and receiving parties which can use them.
In this article, we continue the theme of Asymmetric Cryptography, focusing on the following topics:
The Mathematical Algorithms Used. The Public Key Infrastructure.For a primer into Public Key Infrastructure, click here:
http://resources.infosecinstitute.com/understanding-pki/#gref
The Mathematical Algorithms UsedThere are a number of key Mathematical Algorithms that serve as the crux for Asymmetric Cryptography, and of course, use widely differing Mathematical Algorithms than the ones used with Symmetric Cryptography. The Mathematical Algorithms used in Asymmetric Cryptography include the following:
The RSA Algorithm The Diffie-Hellman Algorithm The Elliptical Wave Theory Algorithm The RSA Algorithm
Regarding the RSA Algorithm, this is probably the most famous and widely used Asymmetric Cryptography Algorithm. In fact, this very algorithm serves as the foundation for the tools of Bio Cryptography, in which the principles of Cryptography can be used to protect a Biometric Template further. The RSA Algorithm originates from the RSA Data Corporation, and it is named after is inventors who created it, namely Ron Rivest, Ali Shamir, and Leonard Adelman.
The RSA Algorithm uses the power of prime numbers to create both the Public Keys and the Private Keys. However, using such large keys to encrypt large amounts of information and data are totally infeasible, from the standpoint of the processing power and Central Server resources.
Instead, ironically, the encryption is done using Symmetric Cryptography Algorithms. In this regard, the Private Key then gets further encrypted by the Public Key which is used by the sending party.
Once the receiving party obtains their Ciphertext from the sending party, the Private Key which has been generated by the Symmetric Cryptography Algorithms is then decrypted. From this point, the Public Key that was generated by the RSA Algorithm can then be subsequently used to decrypt the rest of the Ciphertext.
The Diffie-Hellman Algorithm
Regarding the Diffie Hellman Asymmetric Algorithm, it is named after its inventors as well, who are White Diffie and Martin Hellman. It is also known as the “DH Algorithm.” However, interestingly enough, this algorithm is nor used for the encryption of the Ciphertext, rather, its main objective is to find a solution for sending the Public Key/Private Key combination through a secure channel.
Here is how the Diffie-Hellman Algorithm specifically works:
The receiving party has possession of the Public Key and the Private Key which has been generated, but this time, they have been created by the Diffie-Hellman Algorithm. The sending party receives the Public Key generated by the receiving party and thus uses the DH Algorithm to generate another set of Public Keys, but on a temporary basis. The sending party now takes this newly created, temporary Public Key/Private Key combination sent by the receiving party to generate a random, secret number-this becomes known specifically as the “Session Key.” The sending party uses this newly established session key to encrypt the Ciphertext message further and sends this forward to the receiving party, with the Public Key which has been temporarily generated. When the receiving party finally receives the Ciphertext message from the sending party, the session key can now be derived mathematically. Once the above step has been completed, the receiving party can now decrypt the rest of the Ciphertext message. The Elliptical Wave Theory Algorithm
With the Elliptical Wave Theory Algorithm, it is a much newer type of an Asymmetric Mathematical Algorithm. It can be used to encrypt a very large amount of data, and its main advantage is that it is very quick, and thus, does not require a lot of Central Server overhead or processing power. As its name implies, Elliptical Wave Theory first starts off with a parabolic curve which is composed over a normal, “x,” “y,” Coordinate Plane.
After the series of “x” and “y” coordinates are plotted, various lines are then drawn through the image of the curve, and this process continues until many more curves are created, and their corresponding interesting lines are also created.
Once this particular process has been completed, the plotted “x” and “y” coordinates of each of the intersected lines and parabolic curves are then extracted. Once this extraction has been completed, then all of the hundreds and hundreds of “x” and “y” coordinates are then added together to create the Public and Private Keys.
However, the trick to decrypting a Ciphertext message encrypted with the Elliptical Wave Theory Algorithm is that the receiving party has to know the particular shape of the original elliptical curve, and all of the “x” and “y” coordinates of the lines where intersect with the various curves and the actual starting point at which the addition of the “x” and “y” coordinates were first created.
The Public Key Infrastructure
Since the Public Key has become so important in both the encryption and the decryption of the Ciphertext messages between the sending and the receiving parties and given the nature of its public role in the overall communications process, extensive research has been conducted.
This has primarily been geared create an infrastructure that would make the process of creating and sending of the Public Key/Private Key combination much more robust and secure. In fact, this type of infrastructure happens to be a very sophisticated form of Asymmetric Cryptography, which is known as the “Public Key Infrastructure,” or “PKI” for short.
The basic premise of the PKI is to help create, organize, store, and distribute as well as maintain the Public Keys. However, in this infrastructure, both of the Public and Private Keys are referred to as “Digital Signatures,” and they are not created by the sending and the receiving parties. Rather, they are created by a separate entity known as the “Certificate Authority,” or “CA” for short.
This particular entity is usually an outside third party that hosts the technological infrastructure that is needed to initiate, create, and distribute the Digital Certificates. At a very simplistic level, the PKI consists of the following components:
The Certificate Authority
This is the outside third party which creates, issues, and distributes the Digital Certificates.
The Digital Certificate:
As mentioned, this consists of both the Public Key and the Private Key, which are issued by the relevant Certificate Authority. This is also the entity that the end user would go to in case he or she needed to have a Digital Certificate verified. These Digital Certificates are typically kept in the Central Server of the business or the corporation.
The LDAP or X.500 Directories:
These are the databases that collect and distribute the Digital Certificates from the CA.
The Registration Authority, also known as the “RA”:
If the place of business or corporation is very large (such as that of a multinational corporation or business, this entity then usually handles and processes the requests for the required Digital Certificates and then transmits those requests to the CA to process and create the required Digital Certificates.
Ethical Hacking Training Resources (InfoSec)
Regarding the CA, it can be viewed as the governing body of the entire Public Key Infrastructure. To start using the PKI to communicate with others, it is the CA that issues the Digital Certificates, which consist of both the Public and the Private Keys.
Conclusion
Each Digital Certificate that is governed by Certificate Authority consists of the following technical specifications:
The Digital Certificate Version Number
Typically, this is either Version numbers 1, 2, or 3.
The Serial Number
This is the unique ID number that separates and distinguishes a particular Digital Certificate from all of the others (in fact, this can even be likened to each Digital Certificate having its very own Social Security number).
The Signature Algorithm Identifier
This contains the information and data about the Mathematical Algorithm used by the CA to issue the particular Digital Certificate.
The Issuer Name
This is the actual name of the Certificate Authority, which is issuing the Digital Certificate to the place of business or corporation.
The Validity Period
This contains both the activation and the deactivation dates of the Digital Certificates, in other words, this is the lifetime of the Digital Certificate as determined by the Certificate Authority.
The Public Key
This is created by the Certificate Authority.
The Subject Distinguished Name
This is the name that specifies the Digital Certificate owner.
The Subject Alternate Name E-Mail
This specifies the Digital Certificate’s owner E-Mail address (this is where the actual Digital Certificates go to).
The Subject Name URL
This is the specific Web address of the place of business or corporation to whom the Digital Certificates are issued to.
Our next article will examine how the Public Key Infrastructure actually works, as well as the various PKI Policies and Rules which need to be implemented.
Sourceshttps://www.math.washington.edu/~morrow/336_09/papers/Yevgeny.pdf
http://pajhome.org.uk/crypt/rsa/contrib/RSA_Project.pdf
http://homepages.math.uic.edu/~leon/mcs425-s08/handouts/RSA.pdf
http://math.arizona.edu/sites/math.arizona.edu/files/webfm/undergrad/uta/Spring12UTATalkSalterbergJake.pdf
http://math.arizona.edu/sites/math.arizona.edu/files/webfm/undergrad/uta/Spring12UTATalkSalterbergJake.pdf
http://homepage.smc.edu/morgan_david/linux/a25-rsa.pdf
http://www.math.uchicago.edu/~may/VIGRE/VIGRE2007/REUPapers/FINALAPP/Calderbank.pdf
http://paper.ijcsns.org/07_book/201307/20130702.pdf
https://www.cs.utexas.edu/~byoung/cs361/lecture52.pdf
https://www.math.brown.edu/~jhs/MathCrypto/SampleSections.pdf
http://cs.indstate.edu/~skallam/doc.pdf
https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture13.pdf
https://arxiv.org/ftp/math-ph/papers/0212/0212051.pdf
https://accelconf.web.cern.ch/accelconf/l98/PAPERS/TH4041.PDF
https://pdfs.semanticscholar.org/6439/5a36e7eedfdf60f885ad013ac125dc6e37de.pdf
http://csrc.nist.gov/archive/pki-twg/baseline/pkicon20b.PDF
http://www.oasis-pki.org/pdfs/PKI_Basics-A_technical_perspective.pdf