#7 Security in Application

Electronic Mail (E-mail) Security

Electronic mail is one of the most heavily used network-based applications. With the explosively growing reliance on e-mail,there grows a demand for security e-mail systems. In an e-mail system, there are a sender and a receiver. However, usually the receiver is not on-line. So in an e-mail system, usually there is no massage interchange when the sender sends an e-mail. On the order hand, some e-mail system (a.g SMTP) only can deliver ASCll codes.

Security provided in E-mail


• Confidentiality
• Data origin authentication
• Message integrity
• Non-repudiation of origin.
• Key management


MIME


MIME = Mutlipurpose Internet Mail Extension.
• Extends the capabilities of RFC 822 to allow e-mail to carry non-textual content, non-ASCII character sets, long message.
• Uses extra header fields in RFC 822 e-mail to specify form and content of extensions.
• Supports a variety of content types, but e-mail still ASCII-coded for compatibility.
• Specified in RFCs 2045-2049.
How e-mail transported?
MUA = Mail user agent (mail client)
MTA = Mail transport agent (mail server)


E-mail Security Threats

Two main group:
• Threats to the security of e-mail itself.
• Threats to an organisation that are enable by the use of e-mail.
Loss of confidentially
• Email are sent it clear over open network.
• Email stored on potentially insecure clients and mail servers.
• Ensuring confidentiality may be important for email sent withi an organisation.

Loss of integrity
• No integrity protection on email, body can be altered in transit or on maul server.

Lack of data origin authentication
• Email could also be altered in transit.
• Sharing of email password common.

Lack of non-repudiation
• Can i rely and act on the content?(integrity)
• If so, can the sender later deny having sent it?Who is liable if i have acted?

• Example of stock-trading via email.


Threats enables by email
• Its easier to distribute information by email than it is by paper and snail mail.
• Disclosure may be deliberate (and malicious) or unintentional.
• Disclosure may be internal or external (email crosses LANs as well as the internet)
• Disclosure may be of personal, inappropriate, commercially sensitive or proprietary information.
• Can lead to loss of reputation and ultimately dismissal of staff.

S/MIME

SEcure/Multipurpose Internet Mail Extension (S/MIME) is another enchaced email system. Similar to PGP which uses sidnature scheme, session key and secret key encryption. S/MIME version 3 message specification is given in RFC2633.

It appears likely that S/MIME will emerge as the industry standard for commercial and organization use, while PGP will remain the choice for personal use.


PGP

Pretty good privary or PGP was developed by Phil Zimmermman. PGP uses public key encryption, signature scheme,hash function, secret key enryption, compression fuction and email compatibility. Functionality similar to S/MIME is an encryption for confidentiality and signature for non-repudiation/ authenticity.
One level of processing only, so less flexible than S/MIME. Sign before encrypt, so signature on unencrypted data. PGP processed data is base64 encoded and carried inside RFC822 message body.

Web Security

Web security included 3 parts:
1. Security of server.
2. Security of client
3. Network traffic security between a browser and a server.


Security pf server and security of client are problems of computer security. Network security can considered at different level , for examples network level: use IPSec, Transport level:Use SSL (Secure socket layer) or TLS (Transport layer security) and Application level: Use PGP,S/MIME,SET(Secure Electronic Transaction).

Secure Socket Layer (SSL)

SSL is develop by Netscape. The main part of SSL contains several protocol:SSL Handshake protocol, SSL change cipher spec protocl,SSL alert protocol, and SSL record protocol.

Secure Shell (SSH)

1. Initially designed to replace insecure SSH, telnel utilities.
2. Secure remote administration (mostly of Unix system).
3. Extended to support secure file transfer and email.
4. Latterly, provide a general secure channel for network application.
5. SSH-1 flawed, SSH-2 better secure security (and different architecture).

Secure Electronic Transaction (SET)
SET is an open encryption and security specification designed to protect credit card transaction on the internet . SSL secures communications between a client and a server.



Set secure issues

Two pairs of PKs parentity
1. One pair for signing.
2. One pair for exchanging keys.

How the web Works-HTTP - Hypertext transfer protocol (HTTP)
- Clients request 'document' through URL
- Server Respons with 'document'
- Document are not interpreted by http
- Stateless protocol, request are indepent.

How the Web works: other elements

-Hyper-text markup language (html).
-Other application specific document.
-E.G., MIME, graphics, video/audio, postscript, Java applets, etc.
-Browsers.
-Display html documents and embedded graphics.
-Run Java program.
-Start helper applications.

How to secure the web
~Athentication
1. Basic (username,password)
- Can be used along with cookie.
2. Digest
~ Access control via address
~Multi layered:
1- S-http(secure http), just for http
- Proposed by CommerceNet,pretty much dead.
2. SSL(TLS),generic for TCP
- https;http over SSl
3. IPsec

HTTP Authentication - Client doesnt know which method
- Client attempts access (GET,PUT) normally
- Server returns
~401 unauthorized
~Realm protection space
- Client tries again with


From Basic Authentication to Forms and Cookies
• Not all sites use basic authentication
• Many instead ask the user to type username/password into a HTML form
• Server looks up the user and sends back a cookie
• The browser (client) resends the cookie on subsequent requests


HTTP Access Control - Digest
1. Server sends www-authenticate parameters:
~ Realm
~ Domain
~ Nonce, new for each 401 response
- E.G. H(client-IP:timestamp:server-secret)
~ Algorithm
- E.G., MD5
2. Client sends authorization response:
~ Same nonce
~ H(A1), where a1=user:realm:password, and other information
~ Steal H(A1)
- Only good for realm

HTTPS

• HTTPS = Secure Hypertext Transfer Protocol
• HTTPS is a communications protocol designed to transfer encrypted information between computers over the World Wide Web (WWW)
• Essentially an implementation of HTTP
• Commonly used Internet protocol using an SSL
• Used to enable online purchasing or the exchange of private information and resources over insecure networks


Why HTTPS combines with SSL and How?
• HTTPS combines with SSL to enable secure communication between a client and a server
• Steps:
- Client requests a secure transaction and informs the encryption algorithms and key sizes that it support (by assessing a URL with HTTPS)
- Server sends the requested server certificate (encrypted server’s public key, list of supported ciphers and key sizes in order of priority)
- Client then generates a new secret symmetric session key basedon the priority list sent by the server. Client compares the certificate issued by CA and confirmed that certificate is belongs to the server intended for communication
• Steps:
- If valid and certificate confirmed, client encrypts a copy of the new session key it generated with the server public key obtained from the certificate. Then, client sends the new encrypted key to server
- Server decrypts the new session key with its own private key.
- Upon completed, both client and server have the same secret session key and use to secure communication and data transport.


Secure File Transfer Protocol (S/FTP)
• S/FTP is an interactive file transfer program
• Similar to ftp
• Performs all operations over an encrypted ssh transport
• Use many features of ssh such as public key authentication and compression
• S/FTP connects and logs into the specified host, then enters an interactive command mode