Part 1: General - Computer Security Resource Center - National ...

March, 2007
3 Security Services
Cryptography may be used to perform several basic security services: confidentiality, data
integrity, authentication, authorization and non-repudiation. These services may also be required
to protect cryptographic keying material. In addition, there are other cryptographic and noncryptographic
mechanisms that are used to support these security services. In general, a single
cryptographic mechanism may provide more than one service (e.g., the use of digital signatures
can provide integrity, authentication and non-repudiation) but not all services.
3.1 Confidentiality
Confidentiality is the property whereby information is not disclosed to unauthorized parties.
Secrecy is a term that is often used synonymously with confidentiality. Confidentiality is
achieved using encryption to render the information unintelligible except by authorized entities.
The information may become intelligible again by using decryption. In order for encryption to
provide confidentiality, the cryptographic algorithm and mode of operation must be designed and
implemented so that an unauthorized party cannot determine the secret or private keys associated
with the encryption or be able to derive the plaintext directly without deriving any keys.
3.2 Data Integrity
Data integrity is a property whereby data has not been altered in an unauthorized manner since it
was created, transmitted or stored. This includes the insertion, deletion and substitution of data.
Cryptographic mechanisms, such as message authentication codes or digital signatures, can be
used to detect (with a high probability) both accidental modifications (e.g., modifications that
sometimes occur during noisy transmissions or by hardware memory failures), and deliberate
modifications by an adversary with a very high probability. Non-cryptographic mechanisms are
also often used to detect accidental modifications, but cannot be relied upon to detect deliberate
modifications. A more detailed treatment of this subject is provided in Appendix A.1.
In this recommendation, the statement that a cryptographic algorithm "provides data integrity"
means that the algorithm is used to detect unauthorized alterations.
3.3 Authentication
Authentication is a service that is used to establish the origin of information. That is,
authentication services verify the identity of the user or system that created information (e.g., a
transaction or message). This service supports the receiver in security relevant decisions, such as
“Is the sender an authorized user of this system?” or “Is the sender permitted to read sensitive
information?” Several cryptographic mechanisms may be used to provide authentication
services. Most commonly, authentication is provided by digital signatures or message
authentication codes; some key agreement techniques also provide authentication. When
multiple individuals are permitted to share the same authentication information (such as a
password or cryptographic key), it is sometimes called role-based authentication. See [FIPS140-
2].
30