Department of Information Engineering1 Major Concerns in Electronic Commerce Authentication –there...

1Department of Information Engineering

Major Concerns in Electronic Commerce

• Authentication

– there must be proof of identity of the parties in an electronic transaction;

• Non-repudiation

– there must be proof of agreement to the terms of transaction and prevention of denial of commitment;

• Integrity

– there must be protection that the content of a message has not been tampered with or modified;


Major Concerns in Electronic Commerce

• Confidentiality

– there must be protection that the content and information of a transaction is kept private and secret from unauthorised third party; and

• Legal commitment

– functions and actions of an electronic transaction must have legal backing. A digital signature must be as legally binding as a handwritten signature. The submissibility of electronic records to Law Courts must be established.


E-commerce

• Communication on Internet is insecure

– like postal service, sometimes your letter may go through places where bandits abound, and these bandits may

• read your confidential information

• modified your confidential information

• What can you do?

– locked the letter in a box

– modern day cryptography works in a similar but more interesting way


Symmetric keys

• How to communicate in secrecy?

• Sender

– lock the confidential message in a box

• Receiver

– the box can only be opened by the receiver using the same key

• Symmetric key

– the key to lock and to unlock are the same

– a key is a string of numbers


Encryption and Decryption

• What is encryption?

– turns a readable text into something that is unreadable

– locking

• What is decryption?

– The reverse process of encryption

– turns a unreadable text into a readable one

– unlocking


How

• By substitution (used by the Romans in Julius Caesar time)

• By transposition (changing the position)

a b c d e . . . . . . x y z

a b c d e . . . . . . x y z a b

P O S I T I O N

O P I S I T N O


Encryption and Decryption

• Example

• encryption

– a) substitution (shift by 13 letters)

michael --> zvpunry

– b) transposition

zvpunry -->vzuprny

• decryption

– shift 13 letters and tranpose


Key distribution problem

• OK, you can send the messages securely, but how the problem is

– you must find a secure way to send the key to the receiver in the first place !!

– key distribution problem


Public key cryptography

• Public key

– a very important idea first reported in the 70s

– asymmetric key

• one key to lock - public key

• one key to unlock - private key

– anybody can have your public key

• but they can only lock

• only you can do the unlocking with the private key

– solve the key distribution problem !!


Comparison

• Symmetric key algorithm

– fast

– has key distribution problem

• public key algorithm

– slow

– solve key distribution problem

• in practice, secure communication is achieved by

– using public key to distribute the symmetric key

– then use the symmetric key to communicate


Additional property of public key

• We have a pair of keys

– public key and private key

• you can either use

– public key to lock, private key to unlock, or

– private key to lock, public key to unlock


Digital signature

• In business world, important documents must be signed. How to sign an electronic document?

• A sends an e-document to B

• B signs (encrypts) it using his private key and return the document to A

• Why?

• Because if later B repudiates that he has signed the document, A can show the court by decrypting the encrypted document using B’s public key !!


Digital signature

• The logic

– If a document can be decrypted using B`s public key, then who encrypted the document?

– MUST be B, because if a document can be decrypted a public key, then the document can only be encrypted using a private key

– only B has the private key !!

– So in the court, B cannot repudiate he has not signed the document


Digital certificate

• Authentication problem

– suppose you receive the public key of B on Internet, how can you be so sure that the public key is really from B?

– e.g. you find a web page called www.newmicrosoft.com

– the web site claims it is a sister company of microsoft

– the web has a public which you can use to secure the communication

– should you use the key to send your payment ?


Digital certificate

• You open a internet bank and receive a message from a person who called himself Li Ka Shing

– Mr. Li sends you his public key, request you to transfer 100 million dollars e-cash to his account

– should you follow his instruction?

• The type of problem is called authentication

– how to certify the identity of the person/company


Digital certificate

• digital certificate

– B publicizes his email address and his public key on Internet, and let this document be signed by a trusted authority - the certificate authority (CA)

– CA checks B’s real identify in the traditional way (paper certificate, ID card number, …)

– CA is trustworthy, and you can check whether the document is signed by CA by using CA’s public key

– but how can you be sure that the public key of CA is really from CA?

– The key can be certified by yet another CA, or can be published on newspaper or from other trusted source


PKI

• What is PKI (public key infrastructure)?

– PKI is an infrastructure to support e-commerce and is based on public key

– to ensure the trustworthiness of public key obtained from Internet, we need the key to be certified by a CA

– in Hong Kong, the Post Office is going to play the role of a CA

– so if you run a company and you want people on Internet to have confidence on your public key, you should publish your key information on Internet, and let the Hong Kong Post Office to digitally sign it


Integrity

• Although your secret code cannot be decrypted, your enemy can intercept it and change a few bits

• after you decrypt the code, you may get a totally different message

• how to prevent this to happen?

– Send a message digest together with the message

• What is a message digest?

– It is a hashed message and has very few bits (typically between 128 - 256 bits)


Message digest

• The simplest hashing function - remainder

• e.g. Let a = 1, b = 2, . . ., z = 26

• to hash `apple` into a number between 0-9

– add up the letters (a=1, p=16, l=12, e=5)

– apple = 1 + 16 + 16 + 12 + 5 = 50

– divide it by 10, the remainder must be between 0-9

– hashed value = remainder of 50/10 = 0

– send the message `apple` together with the hash value 0

– if someone changes the a in apple to o (i.e. opple), you can detect it because the hash code is different

• o=15, o+p+p+l+e = 64, hash code = 4


Message digest

• The hash function used in real-life is of course more complicated

– compressed a document (no size limitation) into 16-32 digits

– any small change in the document (even a space) will give a different hashed value

– this hashed value is called the message digest


Message digest

Document

Agreement to purchase

...

message digest

Document

Agreement to purchase

...

compute themessage digest

sender receiver

message digest

Same?


Message digest

• Because the message digest is a unique identifier of the original document

– can digitally signed the message digest (which is shorter) instead of the entire document (which is longer) for authentication

– a shorter message is easier to compare visually


Message digest on your name card

• Use of message digest on name card

– public key is usually over 1000 bits long

– cannot print it on name card, better get it from Internet

– print the message digest of public key (call finger print) on name card instead (only 16 characters long)

– download the public key, and compute the fingerprint

• if the computed one is same as the one on name card, then the public key is authentic


Summary

• Issues and solutions of e-commerce

– How to send your confidential data securely?• use public and symmetric keys

– How can you trust a public key?• make sure the public key is certified by a CA

– How to sign document on Internet?• use digital signature

– how to know whether the document has been modified?• use message digest

Department of Information Engineering1 Major Concerns in Electronic Commerce Authentication –there...

Documents

Transcript of Department of Information Engineering1 Major Concerns in Electronic Commerce Authentication –there...