Computers and Privacy part 3

RSA Public Key Cryptography

Several algorithms are used today for public-key asymmetric encryption. The most widely known is called the RSA algorithm, named after its inventors, Ronald Rivest, Adi Shamir, and Len Adleman. This method is based on multiplying two prime numbers to come up with the key pair. Further mathematical functions are performed after the multiplication to create the actual key pair. It's a simple matter to use a computer to come up with a rather large prime number, but it's a difficult computation task to take the result of this multiplication and the subsequent operations performed and determine which two prime numbers were used to generate it.

If you want to learn more about RSA, visit the Web site for the company founded to market this technology: www.rsasecurity . com. The RSA Security Web site is an excellent resource for encryption techniques overall, but also has a lot of information pertaining to the RSA algorithm, which has been licensed to a large number of software and hardware security providers.

Because of the difficulty in cracking RSA-encrypted data, it has been adopted by a large number of vendors, including Sun, Microsoft, and Novell, and is the most widely used cryptosystem today.

Digital Certificates

Digital certificates are used to bind a person's name (or an identity) to a public key. Certificates, then, must come from a trusted authority. The certificate itself is determined to be valid (that is, it was issued by the certificate authority [CA] it claims to represent) by a digital signature. Because the public key of a CA can be known to anyone, it is a simple computational matter to use the CA's public key to determine that the digital signature is valid. After this is done, the certificate itself can be assumed to contain a valid identity (a user, a corporation, or another entity) associated with a public key. Using a digital certificate, you then can obtain the public key for a person and use it to encrypt data to be sent to that person, who then can use his own private key to read your message.

CAs can be trusted companies on the Internet, or you can act as your own CA in your company. Included with Windows 2000 Advanced Server and the family of Windows 2003 servers, for example, is Microsoft's Certificate Services, which can be used within a company that wants to manage its own digital certificates. If you have branch offices and want to use digital certificates to certify public keys used for communicating over the Internet, you can set up your own certificate servers in your enterprise. Or you can use a commercial company (such as VeriSign) and obtain certificates from a third party.

In practice, it also is possible for a hierarchy of certificate servers to be set up, with a single root server being the most trusted certificate server in your enterprise. Then, child certificate servers are created, which can be validated by the end user because the child certificate server itself has a Certificate from the root server (or another server in the hierarchy leading back to the root server) that validates its certificate. It's all a game of trust, however. If the secret key of the root server's key pair becomes compromised, it's possible to impersonate the certificate server and all security is lost. Most certificates also are issued with an expiration date, which can be used to ensure that new certificates, created using a new key pair, are in use.

For this reason, should you choose to operate your own certificate server(s) in your network, you need to take extreme security precautions to safeguard the private key. Likewise, if you use a third- party commercial certificate service, you need to read the policy of that company to determine how it verifies the identity of the end users that it issues certificates to. For example, a CA might simply verify the email address of the requestor and issue a certificate. For a software publisher, the CA might conduct some kind of background check and require further evidence before it issues certificates to the company. Before you decide to use a commercial service for issuing digital certificates, be sure you investigate the company's policies for both issuing and revoking certificates.

Pretty Good Privacy (PGP)

One of the most popular encryption programs on the Internet for a number of years now has been PGP, originally developed by Phillip Zimmerman. PGP uses public-key cryptography and has been ported to many computer platforms, including Unix, Linux, and, of course, all versions of Windows from Windows NT and Windows 95 onward.

PGP Corporation currently markets the commercial version of PGP. PGP is available in a Universal Series version for network gateways, Whole Disk Encryption for desktop and enterprise systems, command-line for servers and mainframes, and home and professional desktop versions. PGP also maintains a Global Directory of PGP keys, replacing the PGP Keyserver service. A 30-day trial of the home desktop version is available.

PGP has been established as an Internet proposed standard through the Request for Comments (RFC) process. RFC 2440, "OpenPGP Message Format," was written in 1998 and details the specification.

An international site devoted to PGP also can be used to download PGP. Visit the PGPi Project International PGP home page at www pgpi. org/ to learn more about PGP International. The downloads available from this site include support for the following platforms:

Amiga Atari BeOS EPOC (Psion, and so on) MacOS

Newton OS/2 PalmOS Unix MS-DOS

Windows 3.x Windows 95/98/NT Windows Me Windows 2000 Windows XP

As you can see, various operating systems are supported by the International PGP site, which is working to establish PGP as a standard for encryption on the Internet. In addition to the standard PGP package, which provides for a number of applications, such as document encryption and email, a number of other products also are available, such as PGPdisk (for encrypting disks) and PGPphone (for making secure phone calls on the Internet).

The PGPi Project also is making PGP available in various languages, and also is currently translating the documentation. PGPi is a nonprofit organization dedicated to further developing and distributing PGP technology throughout the world. In addition, for some platforms, the source code is available so that you can examine it before compiling it on your system.

Computers and Privacy Part 1

When computers were standalone systems that were easily controlled by a central administrative group, keeping data out of the hands of those who didn't need to see it was already difficult. Usernames and passwords were designed to restrict individual users and their actions, as well as track the actions they performed. File and resource protections enforced by operating systems made it simple to keep most prying eyes out of sensitive files, but where there's a will, there's usually a way, and even operating system resource-protection techniques have their vulnerabilities.

For example, many passwords are either easy to guess or easy to obtain. If you don't enforce a strict security policy in your network, often users will use passwords that are so simple it makes a joke out of using passwords at all. Passwords such as the name of the local football team, a spouse, a child, or even a pet are often used because they're easy to remember. It is a good idea to create passwords using both uppercase and lowercase letters and alphabetic and numeric characters. These techniques can go a long way toward preventing a hacker from using a simple dictionary attack against your network. This kind of attack simply involves using a program that cycles through all the words in a dictionary to see whether any match up to your password. Hackers don't use just any dictionary, but instead can find huge lists of possible passwords (names, city names, baseball teams, and others we've just mentioned) to use. Another type of dictionary attack can be performed on Unix systems if the hacker steals the password file. Because the encryption scheme is known for most Unix systems, the program can simply encrypt every word found in a dictionary and compare it to the encrypted version in the simple /etc/passwd file!

When you consider the environment today, with large-scale networks and connections to the Internet, the security issues become even more complex and difficult to manage using simple schemes, such as username/password authentication. Encrypting the actual data files themselves, especially when they are to be transferred across an untrusted network link, can solve a large part of this problem.

Encryption techniques should be seriously considered in an environment in which security is considered an important part of the network and not assumed to be taken care of by the standard username/password mechanism.

What Is Encryption?

Encryption is the process of performing some function on a set of data that attempts to render it in a format that makes it unreadable or unusable by anyone but the intended recipient. A key is required to read something that has been encrypted. This might be a secret key, as is the case with single-key encryption, or it might be a key that can be known by many different people, as is the case with public-key encryption. Some cryptographic methods use the same key for encrypting and decrypting information, whereas others use a separate key for these functions.

Digital signatures and certificates are part of another interesting concept that has become increasingly important in networks today. You'll learn more about that later. First, take a quick look at basic encryption techniques.

Single-Key Encryption Symmetric Encryption

As its name implies, single-key encryption uses the same key to encrypt and decrypt information. The Data Encryption Standard (DES) is a technology developed by IBM in the 1970s and adopted as a federal government standard in the United States in 1976. DES was thought for many years to be extremely secure. It is still in use in many networks and businesses today. You'll find it in various forms, typically using more than one pass at encryption to secure the data. For example, a technique called triple-DES uses three different keys successively to encrypt and then re-encrypt the data. A 56-bit key is used, which results in a little over 72 quadrillion possible key values. You would think with such a large number of possible keys, and using multiple passes, that the data secured by DES would truly be secure.

That might have been true a few years ago. However, when you consider that the typical desktop PC today is a lot more powerful than the computers available back in the 1970s when DES was first developed, it's obvious that even this strong form of encryption is vulnerable to being broken, if only by a brute-force method in which every possible key value is tried. The National Institute of Standards and Technology (NIST) has decided not to recertify DES as a standard.

Online Store Benchmarking

This part of our web metrics program assessed and measured the current state of websites on which our products were sold. This initial assessment would then be compared to the same web- sites in the same measurement methods after improvement recommendations had been implemented.

This methodology uses parts from inspection methodology. Because it uses category experts as reviewers instead of actual customers, it does not measure usability. It does, however, measure how well a website is optimized for category and product profitability. This environmental scan is necessary to set the bar for improvement.

The strategy was to use an objective process to measure each site, provide recommendations and e-planograms to the online merchants based on what we learned, and then re-measure the effectiveness after the recommendations were implemented.

It was important that the results be reproducible, so back up copies of specific key findings were made in case the website changed. It was also critical to have a knowledgeable category expert conduct the evaluation because a nuance to one person could result in missed opportunities that would have gone overlooked. Benchmarking methodologies assess the current state of a website and how well it is optimized for sales.

Objectives

The online store benchmark program had four main objectives:

• Understand online store design and content in key areas that shape the user experience.
• Identify gaps and weaknesses in online store deployment and customer expectations.
• Define problem areas and issues related to performing key navigation and ordering tasks.
• Make recommendations for improved customer usability and chances for increased sales based on documented findings and conclusions.

The benchmarking must accommodate different types of store designs and configurations, because all online stores are different. The benchmarking must also accommodate the morphing online marketplace and have relevance to the online merchant.

Strategies

We defined the following strategies to accomplish our objectives:

• Establish objective evaluation criteria, and rate the store's effectiveness in selling key products.
• Quantify which important online sales features are present in key focus category areas.
• Develop search strategy and methodologies based on known customer expectations of the purchasing process.
• Recommend improvements of the site that will result in increased sales and enhance customer usability.
• Aggregate results, and relatively rank all stores evaluated.

Track effectiveness of the store over time, and define ROI of this process based on the increased sales or consumer loyalty index ratings.

The benchmarking program was designed as an ongoing, iterative process instead of a one-time program. Because Internet selling was growing at a rapid rate, it was important to monitor this business. Also, online stores carry a broader product mix than traditional channels. The sites reflect changed navigation models and product profitability.

The Benchmarking Process

We developed and used the following process:

1. Establish search criteria.
2. Develop a metrics scorecard.
3. Conduct the evaluation.
4. Map out purchase process flow issues.
5. Purchase products.
6. Total the scores.
7. Recommend improvements.

Recommendations were supported by annotated screen captures. Recommendations were detailed in an overall recommendations/assessment document that lists good and confusing aspects of navigation by area and category. It also noted best practices that reinforced what appeared to work well within the site.

A meeting was conducted with the online merchant to share key findings and deliver recommendations on online store improvement as it related to category profitability. Store executives, buyers, merchandisers, and members of the IT department attended the meeting, because all have an influence on the online store design.