Overview

Content

Security setup: certificates

Remote access: SSH

Secure Internet transactions: SSL

Security for individuals: PGP

To conclude this book, this chapter shows how to put together materials from the previous ones in order to build cryptographic applications that provide communication security. We illustrate this with a few popular examples.

The main objective is to set up a notion of secure communication session. One example is the (public-key-less) Bluetooth technology which was outlined in Section 5.6.2. We will see some other examples here.

The session usually starts by peer authentication, exchange of public-key materials, and goes on with an authenticated key agreement protocol. This ensures that both peers share a common secret key. The secret key is derived into several symmetric secret keys. Then message security, i.e. message integrity, message authentication, and message confidentiality, is ensured by means of MAC and symmetric encryption. Session security additionally requires to ensure the sequentiality of messages, i.e. no adversary can replay a message, swap messages, or erase a message. This is usually achieved by means of a synchronized message counter. Some additional security properties may be required, such as

• Timeliness of message delivery: a message sender is ensured that his message will be delivered to the right receiver on time;

• Termination fairness: peers are ensured to terminate the session in the same state (either termination success or premature abortion);

• Anonymity: a peer is ensured that her identity does not leak;

• Untraceability