14-12-2012, 05:35 PM
Placement of Encryption
Placement.ppt (Size: 419 KB / Downloads: 32)
have two major placement alternatives
link encryption
encryption occurs independently on every link
implies must decrypt traffic between links
requires many devices, but paired keys
end-to-end encryption
encryption occurs between original source and final destination
need devices at each end with shared keys
when using end-to-end encryption must leave headers in clear
so network can correctly route information
hence although contents protected, traffic pattern flows are not
ideally want both at once
end-to-end protects data contents over entire path and provides authentication
link protects traffic flows from monitoring
can place encryption function at various layers in OSI Reference Model
link encryption occurs at layers 1 or 2
end-to-end can occur at layers 3, 4, 6, 7
as move higher less information is encrypted but it is more secure though more complex with more entities and keys
Traffic Analysis
is monitoring of communications flows between parties
useful both in military & commercial spheres
can also be used to create a covert channel
link encryption obscures header details
but overall traffic volumes in networks and at end-points is still visible
traffic padding can further obscure flows
but at cost of continuous traffic
Key Distribution
symmetric schemes require both parties to share a common secret key
issue is how to securely distribute this key
often secure system failure due to a break in the key distribution scheme
Key Hierarchy
typically have a hierarchy of keys
session key
temporary key
used for encryption of data between users
for one logical session then discarded
master key
used to encrypt session keys
shared by user & key distribution center
Random Numbers
many uses of random numbers in cryptography
nonces in authentication protocols to prevent replay
session keys
public key generation
keystream for a one-time pad
in all cases its critical that these values be
statistically random, uniform distribution, independent
unpredictability of future values from previous values
Summary
have considered:
use and placement of symmetric encryption to protect confidentiality
need for good key distribution
use of trusted third party KDC’s
random number generation issues