PGP, SSH, and

1

• PGP, SSH, and
• Transport Layer Security

2
Symmetric Key Cryptography
data (plaintext)
data (plaintext)
data (ciphertext)
key
key
3
Public-Key Cryptography
data (plaintext)
data (plaintext)
data (ciphertext)
public key
private key
4
Cryptographic Hash (Message Digest)
5
Keyed Hash(Message Authentication Code)
Question What is gained if a sender, instead of
transmitting simply a message m, transmits the
message concatenated with the hash of m
concatenated with a key?
Question What is gained if we use public-key
crypto as below?
6
Public Key Distribution

• Problem Who is to say that the public key posted
  on a web page really belongs to user U?

CERTIFICATE
PKI
Name John TheDude Public key for John
TheDude Certifying Authorithy
RespectableOrganization Digital Signature
7
PGP Pretty Good Privacy

• Collect public keys from known people.
• Give public key to others.
• Get public key signed by others.
• Sign others public keys.
• Construct key ring.

8
PGP Message Encryption
9
Secure Shell (SSH)

• Substitutes rsh, rlogin, telnet, rcp, ftp,

S pub
E(Data, S pub)
Host C (client)
Host S (server)
C pub
S pub
C secret
S secret

• Uses a data compression algorithm.

10
SSH Tunneling(port forwarding)
application port
port 22
11
Transport Layer Security (TLS, SSL, HTTPs)

• Addresses the need for confidentiality,
  authentication, and integrity.
• Builds on the functionality of TCP (reliability,
  flow control, congestion control, etc.).
• Uses a dynamic negotiation of crypto protocols to
  allow for increased compatibility.

• Two main parts
• Handshake protocol.
• Secure data transmission protocol.

12
The TLS Handshake

• Crypto algorithms use session keys, IVs, etc.
• For each session, there is a need for both
  parties to agree on the parameters used.
• The handshake represents this negotiation step
  and it happens without cryptographic protection.
• The handshake is costly (from 2 RTT to a dozen
  messages).

13
TLS and Certificates
Certificate Authorithy
Web brower (client)
Verify request
E-Commerce site certificate
CA public key
Verify response
E-Commerce site
E-Commerce site certificate