Munish Gandhi's Profile

Authentication allows

Nonrepudiation

Figure D.1    Symmetric-key encryption

highly efficient

Figure D.2    Public-key encryption

requires more computation and is therefore not always appropriate for large amounts of data.

longer keys provide stronger encryption

Different ciphers may require different key lengths to achieve the same level of encryption strength.

RSA public-key encryption cipher must use a 512-bit key (or longer) to be considered cryptographically strong, whereas symmetric key ciphers can achieve approximately the same level of strength with a 64-bit key

Figure D.3    Using a digital signature to validate data integrity

An X.509 v3 certificate binds a distinguished name (DN) to a public key. A DN is a series of name-value pairs, such as uid=doe, that uniquely identify an entity--that is, the certificate subject.

Every X.509 certificate consists of two sections:

The data section includes the following information:

version

certificate's serial number

user's public key

DN of the CA

period during which the certificate is valid

DN of the certificate subject

certificate extensions

The signature section includes the following information:

cryptographic algorithm, or cipher,

CA's digital signature

The CA's digital signature,

RC4 with 128-bit encryption and MD5 message authentication

RC4 ciphers are the fastest of the supported ciphers.

RC2 with 128-bit encryption and MD5 message authentication

RC2 ciphers are slower than RC4 ciphers.

DES, which supports 56-bit encryption, with SHA-1 message authentication

RC4 with 40-bit encryption and MD5 message authentication

Exportable cipher suites

No encryption, MD5 message authentication only.

Weakest cipher suite

data sent using this cipher suite is not encrypted and may be accessed by eavesdroppers.

this cipher is one of the second strongest ciphers after Triple DES

This cipher suite is supported by SSL 3.0

An SSL session always begins with an exchange of messages called the SSL handshake. The handshake allows the server to authenticate itself to the client using public-key techniques, then allows the client and the server to cooperate in the creation of symmetric keys used for rapid encryption, decryption, and tamper detection during the session that follows.

Figure 2    How a Netwscape client authenticates a server certificate

The "man in the middle" is a rogue program that intercepts all communication between the client and a server with which the client is attempting to communicate via SSL. The rogue program intercepts the legitimate keys that are passed back and forth during the SSL handshake, substitutes its own, and makes it appear to the client that it is the server, and to the server that it is the client.