Practical Cryptography

Fred Avolio

This can be done as a 90 minute, 2 hour, half day, or 1 day course.

SSL, VPN, PGP … as in all things technical or bureaucratic, the rapidly changing acronyms surrounding e-commerce can present a challenge to information professionals charged with securing business transactions. Separating the wheat from the chaff, this course will explain cryptographic basics, concentrating on the tools and methods necessary for privacy for business (or personal) transactions and how they are and will be used in electronic commerce. This tutorial will not be about specific commercial products, nor will it provide a nuts and bolts explanation of cryptographic techniques. It is specifically aimed at the individual who cares less about the mathematics behind the techniques, but more about the what, why, and how of cryptographic tools needed to support business on the Internet. It is a fundamentals course, rather than an advanced technology course. And it is practical.

The session will briefly cover the challenges to e-commerce and the deployment of strong cryptography. Methods for privacy will be presented, using privacy in e-mail and virtual private networks as examples. Included will be a discussion of corporate and global Public Key Infrastructures as well as Certificates and the related Certification Authorities. We will end with a discussion of future directions.

• Overview and History
  • Brief history of the Internet
  • Top 10 Anagrams for "Information Superhighway"
  • Brief history of Internet attacks
  • Threats, Vulnerabilities, and Concerns
• Basics and Defining Terms
  • Authentication, Privacy, Authorization,
  • Integrity, Nonrepudiation
  • Crypto terms and types
  • Business requirements for privacy
• Public Key Infrastructure
  • What it is, why we need it, and why is Al Gore so exited about it
  • What is missing, why this is important to fix
• Certificates, Certification, and Certification Authorities
  • What they are, how they work, what businesses can do in the mean time.
• US Crypto policy: Use and export
• Recovering Encrypted Files
  • Key Recovery, Data Recovery, Trusted Third Parties, Key Escrow
• Crypto in use today
• Private Messaging (E-mail)

• E-mail "Firewalls"
• Files and Directories
• Strong User Authentication
  • Different methods
  • Strengths and Weaknesses
• Virtual Private Networks
  • IPSEC, ISAKMP, and other hard-to-pronounce acronyms
  • Firewall-to-firewall
  • Traveling users
  • SSH
  • Moving to virtual enclaves—encrypted cliques
• Protecting Web Sites
  • Protection from tampering
  • Guaranteeing content
• Cryptography for Electronic Commerce
  • SSL and its friends
  • Methods for the provider
  • Emerging and existing standards
• Where do we go from here?
• The need for multidimensional security solutions