Cyberstudy
PDF p.73 In progress Not in the PDF's table of contents

Transport Encryption and Key Exchange

Open PDF at p.73 23 flashcards

Summary

PDF p.73

Transport encryption protects data-in-motion using various products like WPA, IPsec, and TLS. These products use key exchange mechanisms to securely share symmetric encryption keys via public key cryptography. This ensures data confidentiality, integrity, and authenticity during transmission.

In plain words

Supplementary — not from your PDF

Data on the move is protected by WPA (Wi-Fi), IPsec (VPNs) and TLS (web, email). Because asymmetric crypto is slow, it's used to exchange a symmetric session key, which then encrypts the actual traffic.

Detailed explanation

PDF p.73
  • Transport Encryption
    • Purpose: Protects data-in-motion.
    • Examples
      • Wi-Fi Protected Access (WPA): Secures wireless network traffic.
      • Internet Protocol Security (IPsec): Secures traffic between endpoints over public/untrusted networks (VPN).
      • Transport Layer Security (TLS): Secures application data (e.g., web, email) over public/untrusted networks.
  • Key Exchange Mechanism
    • Inefficiency of Asymmetric Ciphers: Not used directly for network data encryption due to high computational overhead.
    • Process
      • 1. Public Key Acquisition: Alice obtains Bob's public key (RSA or ECC) via Bob's digital certificate.
      • 2. Session Key Encryption: Alice encrypts her message using a symmetric cipher (e.g., AES) and generates a session key.
      • 3. Session Key Encryption with Public Key: Alice encrypts the session key with Bob's public key.
      • 4. Digital Envelope: Alice sends the encrypted session key and ciphertext to Bob.
      • 5. Session Key Decryption: Bob uses his private key to decrypt the session key.
      • 6. Message Decryption: Bob uses the session key to decrypt the ciphertext.
  • Integrity and Authenticity
    • Hash-based Message Authentication Code (HMAC): Combines the secret key with a hash of the message to ensure integrity and authenticity.
    • Authenticated Encryption (AE): Symmetric cipher mode that ensures both confidentiality and integrity/authenticity.

Important terms

taken from the text above
Wi-Fi Protected Access (WPA)
Secures wireless network traffic.
Internet Protocol Security (IPsec)
Secures traffic between endpoints over public/untrusted networks (VPN).
Transport Layer Security (TLS)
Secures application data (e.g., web, email) over public/untrusted networks.
Inefficiency of Asymmetric Ciphers
Not used directly for network data encryption due to high computational overhead.
Public Key Acquisition
Alice obtains Bob's public key (RSA or ECC) via Bob's digital certificate.
Session Key Encryption
Alice encrypts her message using a symmetric cipher (e.g., AES) and generates a session key.
Session Key Encryption with Public Key
Alice encrypts the session key with Bob's public key.
Digital Envelope
Alice sends the encrypted session key and ciphertext to Bob.
Session Key Decryption
Bob uses his private key to decrypt the session key.
Message Decryption
Bob uses the session key to decrypt the ciphertext.
Hash-based Message Authentication Code (HMAC)
Combines the secret key with a hash of the message to ensure integrity and authenticity.
Authenticated Encryption (AE)
Symmetric cipher mode that ensures both confidentiality and integrity/authenticity.
WPA Wi-Fi Protected Access TLS Transport Layer Security HMAC Hash-based Message Authentication Code AE Authenticated Encryption

Examples & real-world scenarios

Supplementary — not from your PDF
  • HTTPS: TLS protecting web traffic.
  • A site-to-site VPN using IPsec.
  • HMAC or authenticated encryption making sure data wasn't altered.

Scenario

Staff at a hotel use public Wi-Fi. A company VPN (IPsec or TLS-based) wraps their traffic in encryption, so the untrusted network only sees encrypted packets going to the VPN gateway.

Common mistakes

Supplementary — not from your PDF
  • Thinking TLS encrypts everything with the server's public key. It exchanges a session key, then uses symmetric encryption.
  • Forgetting integrity. Encryption without authentication can still be tampered with.

Practical skills

Supplementary — not from your PDF
  • Explain the 'digital envelope' in plain words.

What I should remember

Key Points PDF p.73
  • Transport Encryption
    • Protects Data-in-Motion: Ensures secure transmission.
    • Examples: WPA, IPsec (VPN), TLS.
  • Key Exchange Mechanism
    • Asymmetric Ciphers: Inefficient for direct encryption.
    • Process
      • 1. Public Key Acquisition: Alice gets Bob's public key.
      • 2. Session Key Encryption: Alice encrypts message with symmetric cipher.
      • 3. Session Key Encryption with Public Key: Encrypts session key with Bob's public key.
      • 4. Digital Envelope: Sends encrypted session key and ciphertext.
      • 5. Session Key Decryption: Bob decrypts session key.
      • 6. Message Decryption: Bob decrypts ciphertext.
  • Integrity and Authenticity
    • HMAC: Ensures message integrity and authenticity.
    • Authenticated Encryption (AE): Ensures confidentiality and integrity/authenticity.