Part 1: General - Computer Security Resource Center - National ...
Share Embed Flag
Download ePaper

Part 1: General - Computer Security Resource Center - National ...

Part 1: General - Computer Security Resource Center - National ... Part 1: General - Computer Security Resource Center - National ...

csrc.nist.gov
from csrc.nist.gov More from this publisher
31.07.2013 Views

X.509 public key certificate March, 2007 The public key for a user (or device) and a name for the user (or device), together with some other information, rendered un-forgeable by the digital signature of the certification authority that issued the certificate, encoded in the format defined in the ISO/ITU-T X.509 standard. 2.2 Acronyms The following abbreviations and acronyms are used in this standard: 2TDEA Two key Triple DEA 3TDEA Three key Triple DEA AES Advanced Encryption Standard specified in [FIPS197]. ANS American National Standard ANSI American National Standards Institute CA Certification Authority CRC Cyclic Redundancy Check DRBG Deterministic Random Bit Generator DSA Digital Signature Algorithm specified in [FIPS186-3]. ECC Elliptic Curve Cryptography ECDSA Elliptic Curve Digital Signature Algorithm specified in [ANSX9.62]. FFC Finite Field Cryptography FIPS Federal Information Processing Standard. HMAC Keyed-Hash Message Authentication Code specified in [FIPS198]. IFC Integer Factorization Cryptography IV Initialization Vector. MAC Message Authentication Code NIST National Institute of Standards and Technology PKI Public Key Infrastructure POP Proof of possession RA Registration Authority RNG Random Number Generator RSA Rivest, Shamir, Adelman (an algorithm) TDEA Triple Data Encryption Algorithm; Triple DEA TLS Transport Layer Security 29

March, 2007 3 Security Services Cryptography may be used to perform several basic security services: confidentiality, data integrity, authentication, authorization and non-repudiation. These services may also be required to protect cryptographic keying material. In addition, there are other cryptographic and noncryptographic mechanisms that are used to support these security services. In general, a single cryptographic mechanism may provide more than one service (e.g., the use of digital signatures can provide integrity, authentication and non-repudiation) but not all services. 3.1 Confidentiality Confidentiality is the property whereby information is not disclosed to unauthorized parties. Secrecy is a term that is often used synonymously with confidentiality. Confidentiality is achieved using encryption to render the information unintelligible except by authorized entities. The information may become intelligible again by using decryption. In order for encryption to provide confidentiality, the cryptographic algorithm and mode of operation must be designed and implemented so that an unauthorized party cannot determine the secret or private keys associated with the encryption or be able to derive the plaintext directly without deriving any keys. 3.2 Data Integrity Data integrity is a property whereby data has not been altered in an unauthorized manner since it was created, transmitted or stored. This includes the insertion, deletion and substitution of data. Cryptographic mechanisms, such as message authentication codes or digital signatures, can be used to detect (with a high probability) both accidental modifications (e.g., modifications that sometimes occur during noisy transmissions or by hardware memory failures), and deliberate modifications by an adversary with a very high probability. Non-cryptographic mechanisms are also often used to detect accidental modifications, but cannot be relied upon to detect deliberate modifications. A more detailed treatment of this subject is provided in Appendix A.1. In this recommendation, the statement that a cryptographic algorithm "provides data integrity" means that the algorithm is used to detect unauthorized alterations. 3.3 Authentication Authentication is a service that is used to establish the origin of information. That is, authentication services verify the identity of the user or system that created information (e.g., a transaction or message). This service supports the receiver in security relevant decisions, such as “Is the sender an authorized user of this system?” or “Is the sender permitted to read sensitive information?” Several cryptographic mechanisms may be used to provide authentication services. Most commonly, authentication is provided by digital signatures or message authentication codes; some key agreement techniques also provide authentication. When multiple individuals are permitted to share the same authentication information (such as a password or cryptographic key), it is sometimes called role-based authentication. See [FIPS140- 2]. 30

X.509 public key<br />

certificate<br />

March, 2007<br />

The public key for a user (or device) and a name for the user (or<br />

device), together with some other information, rendered un-forgeable<br />

by the digital signature of the certification authority that issued the<br />

certificate, encoded in the format defined in the ISO/ITU-T X.509<br />

standard.<br />

2.2 Acronyms<br />

The following abbreviations and acronyms are used in this standard:<br />

2TDEA Two key Triple DEA<br />

3TDEA Three key Triple DEA<br />

AES Advanced Encryption Standard specified in [FIPS197].<br />

ANS American <strong>National</strong> Standard<br />

ANSI American <strong>National</strong> Standards Institute<br />

CA Certification Authority<br />

CRC Cyclic Redundancy Check<br />

DRBG Deterministic Random Bit Generator<br />

DSA Digital Signature Algorithm specified in [FIPS186-3].<br />

ECC Elliptic Curve Cryptography<br />

ECDSA Elliptic Curve Digital Signature Algorithm specified in [ANSX9.62].<br />

FFC Finite Field Cryptography<br />

FIPS Federal Information Processing Standard.<br />

HMAC Keyed-Hash Message Authentication Code specified in [FIPS198].<br />

IFC Integer Factorization Cryptography<br />

IV Initialization Vector.<br />

MAC Message Authentication Code<br />

NIST <strong>National</strong> Institute of Standards and Technology<br />

PKI Public Key Infrastructure<br />

POP Proof of possession<br />

RA Registration Authority<br />

RNG Random Number Generator<br />

RSA Rivest, Shamir, Adelman (an algorithm)<br />

TDEA Triple Data Encryption Algorithm; Triple DEA<br />

TLS Transport Layer <strong>Security</strong><br />

29

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!