The nature of Input

All software regardless of purpose, size or cost is designed to conduct three functions; take input, process data and produce output. The environment and purpose of the software determine how the input is generated and the design and operation determine how it is used with resident data and what actions are preformed upon said data. The output may be used by people or other programs or stored in a database. 

The cost of securing an application increases exponentially after the application has been developed, thus securing an application is far less expensive during its development.

The secure software development life cycle processes as defined by the following article from homeland security as a survey of current standards and methodologies.

“This article presents overview information about existing processes, standards, life-cycle models, frameworks, and methodologies that support or could support secure software development. The initial report issued in 2006 has been updated to reflect changes.”[DN][i]

Software testing is useful for developing processes that aid in the maturity of an organizations ability to determine software failures; security testing directly increases the software value however since time to market is king it’s often an afterthought or built in during subsequent revisions to the desired applications. 

The primary method used to test the security of developed software is called “Fuzz Testing”, Fuzzing is designed to test the method in which input fails in a given application and how to rectify the underlying issue that caused the failure.[NJ][ii]

Other methods of software testing include Black-box, Grey-Box, Decision Table, all-pairs, state transition tables, equivalence partitioning and Boundary Value Analysis; with respect to security we are only concerned with Black Box as the defining characteristic is that there is no foreknowledge of the system under test, where the faults may be decomposed in a disassembled such as IDA Pro or GDB.[BCS][iii]

Ultimately the nature of input is unknown and as such may never be predicted, since the manipulation of input is constrained by the mechanics of the machine in question be they; memory, language, stacks used, constructs, storage media or communications channels dictate which vulnerabilities may occur and although we may mitigate the failures in the mechanics of a program change will always introduce new areas to exploit. 

Software Security defined by the (ISC)2 is ensuring that due care and diligence have been observed in the design and implementation of a given platform; according to the Software Engineering Institute (SEI), Capability Maturity Model for Integration and SCAMPI may even be integrated with ISO 21827 [ZM][iv]; even then these methods only ensure that the software under test functions within the limits of the designed test cases for the allotted standards to be tested.

The nature and defining characteristic of software security is that when it does fail due to invalid input within its procedures; it does so gracefully without affecting other system components or memory areas within the system in question.

 

References

---

[i] [DN] Davis, Noopur, Carol Woody (CMU, Software Engineering Institute 2009) Secure Software Development Life Cycle Processes [Online] World Wide Web, Available from: https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/sdlc/326-BSI.html (Accessed On June 23rd 2011)

[ii] [NJ] Neystadt, John (Microsoft, 2008 ) Automated Penetration Testing with White-box fuzzing [Online] World Wide Web, Available from: http://msdn.microsoft.com/en-us/library/cc162782.aspx (Accessed on June 23rd 2011)

[iii] [BCS] n.a. (BCSSIGST, 2001) Standard for Software Component Testing [Online] PDF Document Available from: http://www.testingstandards.co.uk/Component%20Testing.pdf (Accessed on June 23^rd 2011)

[iv] [ZM] Zimme, Mark K. (Booz |Allen | Hamilton, 2004) Secure and Mature: Combining CMMI SCAMPI with an ISO/IEC 21827 (SEI-CMM) Appriasial [Online] PDF Document, Available from: http://www.sei.cmu.edu/library/assets/zimmie-secure.pdf (Accessed on June 23rd 2011)

A Brief Synopsis of Micropayments

A micro-payment is defined by visa as any transaction of a value below $20 U.S.D.[V][i].  The World Wide Web consortium also maintains the micro-payments initiative which has recently been closed; one major reason for the cessation was that organizations such as Paypal and Ebay have developed far more pervasive systems using existing W3C standards [W3C][ii]. 

Micali et all defined a micro-payment as:

A payment Scheme consists of a set of protocols involving at least three basic parties: An individual, buyer or user, the merchant and the bank. These could be individual entities – such people, device or computer programs or collections of entities.[MSRR][iii]

Transactions across the internet must be encrypted and are usually conducted utilizing transport layer security and x.509 based certificates. Security is a necessity of any financial transaction regardless of location. Companies such as PayPal process hundreds of thousands of transaction requests per day as micropayments are their primary business [PP][iv]. The core of a PayPal transaction is an embedded XML request that transfers the transaction to PayPal for processing directly on pay pals web-servers. Merchants including Ebay use paypal as a payment processor. Paypal uses standard Transport layer security to ensure that the session for the transaction is secured. The core value of PayPal is that as an intermediary they protect the identity and details of the purchaser from the merchant for the duration of the transaction. 

One major trend in micro-payments is the use of Peer to Peer technologies to support the transaction as opposed to traditional XML or XMLRPC over encrypted links to facilitate transactions; one example is PPay a recently developed peer to peer based transaction protocol that uses a “floating self managed currency” [YB][v] Another not yet widely adopted online currency is the BitCoin which is based upon the ideas of PPay but utilizes a proprietary PKI based mechanism to transfer generated hashes between parties as a form of virtual currency. [NS][vi]

 

The goal of Bit coin is to facilitate transactions without the need for a broker or bank such as Paypal or Visa but to have the parties agree to exchange “bitcoins” for goods and services. Bitcoin achieves security by using encrypted connections to transfer hashes generated by using the public key of the receiver and the private key of the sender using PGP and AES as it’s incredibly secure and due to the nature in which bit coins are generated they are very difficult to if not impossible to fabricate. However bitcoins are not a micropayments but a virtual currency similar with a novel micropayment protocol; similar to eGold or Flooz. Both eGold and Flooz failed due to low market adoption rates and that eGold was used for laundering and fraud.

The security considerations of all micropayments are traditionally referred to as fraud and or “Salami slicing” or “penny shaving” where the nature of the fraud involves various individual small manipulations of a system to amount to a large amount of fraud. Penny shaving was an actual practice at one point where the party would shave the edge of a penny to collect the copper whilst still retaining the ability to spend the penny. Although “Salami” techniques involve small thefts they are still considered fraud and computer abuse in most industrialized countries. The concern with micropayment and micropayment systems is the ability for “salami techniques” to be applied to them by using identity theft or fabrication and potential attacks on any transaction systems. As long as currency has value people will find ways to “game the system” regardless of any consideration for law; whether or not the currency is virtual or real is now a moot point.

References:

---

[i] [V] n.a. (Visa inc., June 24^th 2010) Visa launches a new way to pay online [Online] PDF Document, Available from: https://www.payclick.com.au/getattachment/e693f4a2-3e0b-4811-841e-5c43ef5aa19b/payclick-Press-Release-24-June-2010.aspx (Accessed on June 20th 2011)

[ii] [W3C] n.a. (W3C, Micropayments Initiative, 2010) Micropayments Overview [Online] World Wide Web, Available from: http://www.w3.org/ECommerce/Micropayments/ (Accessed on June 20^th 2011)

[iii] [MSRR] Micali, Sylvio; Rivest, Ronald L (MIT, Cambridge, Laboratory for Computer Science, 1997) Micropayments Revisited [Online] PDF Document Available from: http://people.csail.mit.edu/rivest/MicaliRivest-MicropaymentsRevisited.pdf (Accessed on June 20th 2011)

[iv] [PP] n.a.(Paypal Inc. n.d.) What is Paypal [Online] World Wide Web, Available from: https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/popup/OLCWhatIsPayPal-outside (Accessed June 20th 2011)

[v] [YB] Yang, Beverly; Garcia-Molina, Hector (Stanford Unverisity, 2003) PPay: Micropayments for Peer to Peer systems [Online] PDF Document Available from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.85.7457&rep=rep1&type=pdf (Accessed on June 20^th 2011)

[vi] [NS] Nakamoto, Satoshi (Bitcoin.org, n.d.) Bitcoin: A Peer-to-Peer Electronic Cash System [Online] PDF Document, Available from: www.bitcoin.org/bitcoin.pdf (Accessed on June 20th 2011)

Watermarks and Copyright

What is Watermarking?

Watermarking is defined as placing information or data within a media file of any kind, Picture, Audio or Video. The watermarks are placed within the file in such a manner as to not affect the files function. Thus the Watermarked MP3, Picture or Video still function as Audio, Pictures or Video Files with the watermark in place. [VS]ⁱ

How does watermarking Work?

Steganography

Petitcolas states that modern steganography originates in 1665[PF]ⁱⁱ; the notion of hiding information in plain sight dates back to antiquity as militaries of all empires had to communicate across potentially “insecure” messengers; the term “Marathon” is actually from Greece where a solder named Pheidippides ran form Marathon to Athens a distance of 40 km and is said to have died after the run from marathon to Athens to give word that they had beaten the Persians. The Spartans used a “Cipher” stick as a means to encode and decode messages in either cloth or paper wrapped around it, if the paper or cloth had a pattern on it other than the message than we may assume that the message may have been steganographic in nature. Steganography is essentially the art of hiding information that is significant in the areas of data files usually in pictures, but they can also be audio or video files.

Least Significant Bit Manipulation

In binary, the lest significant bit is the on the right hand side, as it is either only a 1 or a 0 regardless of how large the number is. Changing the LSB has negligible impact on a JPG or BMP or GIF file if it’s done across multiple bytes of the image equally spaced throughout the image.[SB] ⁱⁱⁱ

Algorithms and Transformations

Most steganographic techniques involve the use of complex algorithims or transformations where the desired data to be hidden is planted in the file by either a propritary algorithm or a transform to the data that affects an insignificant portion of the file.

Masking and Filtering

Masking and filtering are alternate methods used to also hide information in images or data in transit where statistical analysis may be used. [DB]^iv [TZ] ^v

CDMA Blind Wavelet

There are many methods that one may use to watermark a file; recently, Maity et al. proposed the use of CDMA based blind wavelet transforms to the LL and HL bands of a media file; ie; a movie with CDMA encoded Text is a reliable method to hide information as well. The encoder and decoder would have to work on the same media files. [MS]^vi

If i wished to hide information in an image or mp3 or Video file, i would first encrypt the message using AES via PGP, if it intended audience is a known associate of mine I'd grab their public key. Then using an application and codebook based transfer i would send a first message to the intended audience with a an encytped hint along the lines of the software needed to unencrypt the next message or I'd encrypt the photo and send it for analysis.

Stego Magic is free, I came across in this archive:

http://members.cox.net/ebmmd/stego/stego/softwarewindows.html

I would use it as it's the easiest client to use, however I'd add the ascii armoured text to the file as the steganographic message. The password would either be encrypted and sent; or would be transferred in an out of band channel.

My messages would be limited in size however Twitter get's the news out with only 140 characters, I'm sure I could manage to communicate with the same amount. 

By encrypting the message I would be creating a 2^nd layer of anti-forensics; the first layer would be fact that it's hidden in plain sight in a picture; the second aspect would be that it uses AES on top of being hidden. An interesting side note is that XINE, an open-source media player has a plug-in to render HD content in ASCII; it make's for excellent key's for symmetric one way encryption; so you can use a movie reference as a secret message containing an out of band key that uses a reproduce-able 1080P based signal rendered in Ascii as it's decryption key. The difficult part is getting the reference in SMPTE timing but that's what codebooks are for.

Refrences

i [VS] Van Schyndel, R.G.; Tirkel, A.Z.; Osborne, C.F.; (Department of Physics, Monash University, Clayton, Vic, IEEE international Confrence on Image Processing Proceedings ICIP-94, November 1994) A digital Watermark [Online] World Wide Web, Available from: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=413536 (Accessed on July 16^th 2011)

ii [PF] Petitcolas, Fabien (Peticolas.net, January 2011) Hisotry of Steganography and Cryptography [Online] World Wide Web, Available from: http://www.petitcolas.net/fabien/steganography/history.html (Accessed on June 16th 2011)

iii [SB] Si, Brigitte (Athabasca University, 2004) Introduction to Steganography [Online] World Wide Web, Available from: http://www.infosyssec.com/infosyssec/Steganography/basics.htm (Accessed on June 16th 2011)

iv[DB] Dunbar, Brett (SANS, January 18^th 2002) A detailed look at Steganographic techniques and their use in an Open-Systems Environment http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.157.3117&rep=rep1&type=pdf [Onlline] PDF Document, Available from: (Accessed on June 16^th 2011)

v [TZ] Radhakrishnan, Regunathan; Kharrazi, Mehdi; Memon, Nasir; ( SpringerLink, The journal of VLSI Signal Processing, Volume 41, Number 3, P 293-303 ) Data Masking: A New Approach for Steganography? [Online] PDF Document, Available from: http://www.springerlink.com/content/p7r415u7876037jx/ (Accessed on June 16^th 2011) DOI: 10.1007/s11265-005-4153-1

vi [MS] Maity, S.P; Kundu, M.K; Maity Seba (ACM, 2009) Dual purpose FWT domain spread spectrum image watermarking in real time [Onine] PDF Document, Available from : http://portal.acm.org/citation.cfm?id=1507867 (Accessed on June 16^th 2011)

Universal Solution considerations for Insecure Communications Media

Sometimes the largest hammer is used to conduct the finest tuning.

Ipsec is defined in RFC's 2401, 2409, 4301 and 4308. [IETF]ⁱ; IPSec's goal is to secure two communicating parties or networks via either an application to gateway or gateway to gateway communications. Where possible virtual private networks are created by the use of IPSec within organizations that maintain multiple campuses or offices. IPSec secures the entire TCP/IP stack by encapsulating all communications above layer 3 for either host to gateway or gateway to gateway or even network to network communications between two gateways.

XML is a standard upon which the “web 2.0” functions; it's a subset of SGML and it's goal is to act as a standard to serve and process content, the “Semantic web” as Burns-lee describes it is composed primarily of servers interchanging and presenting data from various servers of SGML. XML is defined by the W3C and is a standard used to define and markup data to improve interoperability between web-pages and browsers in a standardized format.[W3C]ⁱⁱ Most websites dynamic or otherwise on the internet today use XML with one or more dynamic content languages. XML may be secured by various methods including using TLS or by using the ECDSA algorithm which is based in ECC based digital signatures [IETF]ⁱⁱⁱ and XMLRPC is a formal data interchange standard.

S/MIME is a method used to secure Internet e-mail operations between compatible mail transfer agents as to ensure that the mime components of e-mail messages may not be compromised by anyone with access to the data in transit by using Public Key Infrastructure and X.509 based certificates. It's outlined in PCKS#7[RSA]^iv and the IETF standards 3369, 3370, 3850 and 3851.[IETF]^v S/MIME uses PKI to secure packets of e-mail in transit form one MTA to another MTA.

TLS is another standard widely implemented used primarily to secure web-sessions between a client and a server that also rely upon public key infrastructure. XML is usually secured with the use of TLS on the server serving content to web-sessions or clients. TLS is defined in RFC 5246.[IETF]^vi

Ipsec, TLS, ECDSA and S/MIME are standards and protocols that utilize efficient encryption to prevent external parties from viewing content in transit across a network of given nodes that may be hostile. This is refereed to as the Byzantine general problem. These protocols are not redundant but they are also not exclusive; each protocol serves a specific function with respect to communications between two parties.

IPSec will encapsulate S/MIME, TLS and SSL connections although doing so is not very efficient use of the given communications bandwidth on the network in question.

S/MIME and TLS will encapsulate XML based content in transit but it relies upon the client's level of trust with respect to public key infrastructure. ECDSA can be implemented to secure XMLRPC components with dynamically presented content where the origins are varied separate systems.

The common theme among all of these standards and protocols with the exception of XML is that they are designed to secure communications across an Ipv4 network, IPSec was originally designed for IP v6 as the IETF projected IP v4 address exhaustion in 1998. IP v6 is defined in RFC 2460 and is a newer and backwards compatible networking protocol with IP v4 that incorporates native IPSec support.^vii It's a replacement for Layer 3 communications within TCP/IP designed to meet the address assignment problems with IP v4.

Therefore we may assume that IP v6 can facilitate the adoption of a universal security standard; however even IP v6 has security considerations that must be addressed since it's not in widespread use and adoption rates are slow IP v6 contains many issuse's that need to be addressed. Vogel et al state that PKI for IP v6 is not widely adopted nor is IPSec adequate protection for integrity, Dual stack facilitates attackers hiding behind IP v4 NAT and gateways; there are also 16 methods to generate an address in IP v6 as such it may also be subject to spoofing attacks, in addition to this v6 uses computationally weak cryptographic checksums for integrity.[VD]^viii

Thus there may exist even within IP v 6 the need for TLS and S/MIME as standards to add further layers of security onto business critical functions such as messaging and web-sessions.

The nature of a single security solution being universal to the entire Internet would require formal implementation and standardization of “Insecure Provably secure network coding”[WY]^ix and “Perfectly Secure Message Transmission”[WY]^x and “Secure communication in multi-cast channels”[WY]^xi, once ratified these methods in conjunction with the existing methods in IP v6 would become a perfectly secure universal communications standard at the Nework Layer. There still lie issues with Identity management, this is an NP-Hard problem as the “Chinese delivery room” is still within the bounds of consideration for Identity when a computer is bieng used by a human; basically regardless of the level of effort every authentication system given enough time, effort and resources can be compromised in some way; allowing an attacker to impersonate or abuse another's identity and on-line addresses.

The issues that surround network security are around the enforcement of Law with respect to the source of most intrusions; since the Internet is global in nature failed states and states that do not maintain anti-fraud or computer abuse laws pose a threat to those that do; as the industrialized nations have no recourse outside of the communications network to peruse damages. Therefore it behooves us to ensure that the triumvirate of the Confidentiality, Integrity and Authenticity of all network communications are maintained for all authorized communications with respect to all parties engaging in business or research on line; this is one of the main reasons behind the development of the “Internet 2”; since Internet 1 has issues with both security and abuse.

i[IETF] Hoffman, P; (IETF, Network Working Group, 2005) Cryptographic Suites for IPSec [Online] World Wide Web, available from: http://tools.ietf.org/html/rfc4308 (Accessed on June 14^th 2011)

ii[W3C] Bray, Tim; Paoli, Jean; Spearberg-Mcqueen C. M.; Maler, Eve; Yergeau, Francois (W3C, 26^th November 2008) Extensible Markup Language (XML) 1.0 (Fifth Edition) [Online] World Wide Web, Available from: http://www.w3.org/TR/2008/REC-xml-20081126/ (Accessed on June 14^th 2011)

iii[IETF] Blake-Wilson, S; Karlinger, G; Kobayashi, T.; Wang, Y.; (IETF, UNCC, NTT, CIO Austria, BCI, April 2005) Using the Elliptic Curve Signature Algorithm (ECDSA) for XML Digital Signatures [Online] Availble from: http://www.ietf.org/rfc/rfc4050 (Accessed on June 14^th 2011)

iv[RSA]Kaliski Burton S Jr. Ph.D; Kingdon, Kevin W.; (RSA, May 13^th 1997) Extensions and Revisions to PKCS #7 [Online] PDF Document, Available from: http://www.rsa.com/rsalabs/node.asp?id=2129 (Accessed on June 14^th 2011)

v[IETF] Ramsdell, B; (IETF, Sendmail Inc. July 2004) Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Message Specification [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc3851 (Accessed on June 14^th 2011)

vi[IETF] Dierks, T; Rescorla, E. (IETF, RFTM, August 2008) The Transport Layer Security (TLS) Protocol Version 1.2 [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc5246 (Accessed on June 14^h 2011)

vii[IETF] Deering, S; Hinden, R (IETF, Cisco, Nokia, December 1998) Internet Protocol, Version 6 (IPv6) Specification [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc2460 (Accessed on June 14^th 2011)

viii [VD] Vogel, Dennis; Grossetete Patrick (Cisco, North American IP v 6 summit, 2003) IP v 6 Security Considerations [Online] PDF Docment, Available from: http://www.cuba.ipv6tf.org/pdf/na_ipv6_summit.pdf (Accessed on June 14^th 2011)

ix[WY] Wang, Yonnge; (UNCC, November 23^rd 2010) Insecure “Provably Secure Network” and Homorphic Authentication Schemes for Network Coding [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

x[WY] Wang, Yonnge; Desmedt, Yvo;(UNCC, November 23^rd 2010) Perfectly Secure Message Transmission Revisited. [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

xi[WY] Wang, Yonnge; (IEEE Transaction on Information Theory 54(6):2582—2595, June 2008) Secure communication in multi-cast channels [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

One to Rule them All!

Single Sign on as a concept is the idea that once you login to your GINA on a Microsoft platform or to your Sesson on a Linux / Unix based platform that any and all other applications or instances that you interface with during your session of use may challenge your authentication and determine your identity.

Identity management is one if not the largest problem in IT Security as the computer only uses a user id and some kind of token to assume that it's a given individual logging in. Weather or not the password for a given account has been compromised is a debate for another conversation all together.

SSO as an idea is rooted in DAP, directory access protocol was developed by the international telecommunications union in and international standards organization in 1988 for accessing the X.500 based directory service[ITU-T]ⁱ; although not popular at the time due to the complexity of implementing fully OSI complaint networks it acted as a foundation for the Lightweight Directory Access Protocol which became the standard to which the entire industry developed producrts.

The first prominent and popular directory service was the Novell Directory Service (NDS for short) Netscape had their own directory service with a fully accredited LDAP implementation, Sun had and still has SunOne, IBM has and still has Tivoli directory server; and eventually Microsoft developed Active Directory; all of these products had the exact same operational specification that is they were all fully LDAP complaint; however the nomenclature of the organizational units, concanical names and trees were proprietary as to facilitate vendor lock in.

LDAP is an open standard used to act as a database of identity's and methods to authenticate against them. LDAP is based upon X500; and as a standard is designed to identify a user so that the user may modify objects within a network or directory[VK]ⁱⁱ.

Within the world of Microsoft there is Active Directory the LDAP schema is proprietary to Microsoft view of LDAP; Active directory incorporates Kerberos, LDAP, Distributed Com and Remote Procedure Calls (DCOM & RPC) standards into an authentication and access framework. That is to say an Active directory server cannot interchange information in it's directory with say a SunOne or Tivoli server. The idea behind this is that to facilitate repeat business during the software life cycle within an organization by locking your clients into your directory services you are also locking in their entire respective application stack including middle ware and communications suites on both the client and server sides of the authentication coin. IBM has lotus notes, Sun has OpenOffice and Microsoft has MS Office with Outlook; although all of these suites may be classified as Middle ware; their servers must also provide methods to authenticate clients for access; the widest model being a network file server that must have some kind of discretionary or group based access control.

So what are Liberty and Shibboleth? These are open platforms designed to facilitate the same level and needs of authentication according to the exact same standards as the above products and companies but these aim to be “Open” thus not locking any organization in to a specific vendor for any given software products whilst achieving the same functionality and operations of a single point of sign on. Another way to achieve the use of these frameworks would be to implement a localized version of Open LDAP on an open source platform using say Samba, Kerberos and POSTGRESQL as a back end and front end interfaces to the network to facilitate network access. Liberty has recently been adopted and re-branded as Kantara.ⁱⁱⁱ

Single sign on acts as a way to authenticate a single user to a network of systems for use. This includes file access across NIS or CIFS or other network shares and systems; as well as authenticating that user for E-mail potentially against a totally different server or product suite. These suites of SSO are aimed at complete Identity management; that's a lofty goal for any organization and only time will tell if industry adopts these standards of digital identity management and Free's themselves of the locks that bind them to commercial behemoth's. 

i[ITU] N.A.(ITU-T, 2008) Information technology – Open Systems Interconnection – The Directory: Abstract service definition [Online] PDF Document, Available online:http://www.itu.int/itu-t/recommendations/rec.aspx?rec=X.511 accessed on June 9^th 2010

ii[VK] Vassiliki Koutsonikola, Athena Vakali, (Aristotle University, IEEE Internet Computing, vol. 8, no. 5, pp. 66-72, Sep./Oct. 2004, doi:10.1109/MIC.2004.44) LDAP: Framework, Practices, and Trends, [Online] PDF Document available from: http://www.computer.org/portal/web/csdl/doi?doc=doi/10.1109/MIC.2004.44 (Accessed on June 9^th 2010)

iii[KT] n.a. (Kantara, 2011) About Kantara [Online] World Wide Web Available from: http://kantarainitiative.org/wordpress/about/ (Accessed on June 9^th 2010)

Ports and Pipes

To compare Secure Sockets Layers and Transport Layer Security and Internet Protocol Security let us first discuss their origins and intent.

Transport Layer Security (TLS) is the child of the Secure Socket's Layer protocol. TLS was defined formally by the IETF in 2008 in RFC 5246.[IETF]ⁱ It's origins are rooted in SSL 1.0 as developed in 1996 by Netscape as a means to secure browser sessions. The main goals of TLS are defined as setting up a secure channel between two parties based upon certification exchange that is extensible and inter operable in nature and that is computationally efficient. That is to say it's designed to secure a single channel between a server and a host.

TLS operates at the Transport layer by means of encapsulation by encrypting the underlying protocol after a standardized handshake and authorization have occurred often over Public Key Infrastructure using certificates that have been obtained commercially from one of the public certificate authorities these include organizations like Verisign and are most commonly issued to businesses wishing to secure their website or application. The HTTP protocol has a default header “HTTPS” and both SSL and TLS encrypted web sites operate on the default TCP port of 443. TLS 1.0 is preferable to SSL 1.0, 2.0 or 3.1 versions as it's the most secure cipher and the latest incarnation of the standard; as each iteration of the standard has been revised various security issues have been addressed.

Internet Security Protocol (IPSec) is a suite of protocols where key exchange and payload encapsulation was ratified by the IETF in RFC 2406 in 1998 [IETF]ⁱⁱ and various methods of payload or point to point encryption may be supported within the suite and standard. IPSec may use either IKE or AH and SA methods to exchange secure information and with IPSec only layers 1 through 3 are visible in plain text on a network. It's designed to encrypt communications between either a host to a network, or a gateway to a gateway; ie; two geographical locations via gateways. All implementations of IPSec are colloquially reffed to as a “Virtual Private Network” or VPN, large businesses use VPN's in place of dedicated networks as they offer the same functionality at a fraction of the cost.

TLS and IPSec operate at different layers within the OSI model; TLS operates from Layer 4 up; ie the transport and session layers in a TCP/IP based session are encrypted in TLS using a signed X.509 certificate and escrow authentication; the most common of which is the now infamous “Security Notice” that users see when attempting to connect to a server that is using a self signed certificate; as opposed to a certificate obtained from a certification authority; which would require no notice as the authorities chain exist in the on line web of trust. IPSec operates from Layer 3 and up; it encrypts the entire contents of the packet including session, protocol, transport and application layers. The method of encryption may be certificate based or it may use a popular form of Internet Key Exchange as one defined by ISAKMPⁱⁱⁱ based authentication frameworks, these include KINK or IPSECKEY based DNS records or pres hared secrets such as those used by TACAS and Radius.

TLS is designed to provide a secure port on a client to a server, IPSec can provide either as secure pipe or channel but it's usually used to create a pipe through which IP traffic flows across an unsecured network. Both protocols are deigned to facilitate secure communication between two parties across an insecure medium and both parties use cryptography as a means to do so. The differ in that TLS is a lightweight implemented where only a single method of authentication is agreed upon by the client for the server. IPSec is a suite of protocols including IKE, AH, ESP, ISAKMP, KINK, IPSECKEY or other protocols are utilized for mutual party authentication; in fact both ends of the VPN must agree upon the type and method of authentication to be used to create the PIPE, once created the pipe behaves just like any other TCP/IP version 4 link in that any and all encapsulated traffic may enter the pipe on one segment destined for the other segment. IPSec does have a tax since it encapsulates the entire IP packet thus by duplicating layers 3 to 1 within TCP/IP; these are the Frame, IP SRC and DST headers and other network related information such as routing; the encrypted packets are about 20% larger than their unencrypted counters parts. TLS only suffers a moderate bloat during encryption as it's integrated into the sockets layer.

TLS is easier to implement than IPSec, both provide full security but IPSec is the more secure of the two protocols; TLS will support all kinds of web applications; where as IPSec will support any protocol that works on TCP/IP which is practically everything on the Internet. Tailored services may be provided by establishing a VPN with clients or over SSL examples include on line banking; IPSec is more transparent to applications than TLS however since most applications are now programmed as websites or web-based applications TLS is relatively transparent provided it's configured to support port redirection on the server. Of the two protocols deployment of TLS only requires the installation of a certificate on a web server in either IIS or Apache; IPSec requires two gateway devices or client software that creates a virtual network interface on the host in question.

Generally speaking the choice of technology is Dependant upon the business requirement; if you are connecting to clients over the Internet and you have a website in which you wish your clients to feel secure in it's use and operation than TLS is the ideal choice as it's easier and less costly to implement. If you have a large multinational company with offices all around the planet in various countries engaging in business in all these countries than having a VPN gateway at every offices point of presences is a cost effective way to tie all of the networks in each of these offices together.

i[IETF] Dierks T.; Rescorla E; (IETF, 2008) The transport layer security (TLS) protocol version 1.2 [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc5246 (Accessed on June 7^th 2011)

ii[IETF] Kent, S; Atkinson, R; (IETF, 1998) IP Encapsulating Security Payload [Online] World Wide Web, Avaialble from; http://tools.ietf.org/html/rfc2406 (Accessed on June 7^th 2011)

iii[IETF] Harkins, D; Carrel D; (IETF, 1998) Internet Key Exchange [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc2409 (Accessed on June 7^th 2011)

Severed Limbs and Poked out Eyes

Utilizing Biometrics is not a new idea; nor is using the data captured by a biometric device as a unique cryptographic key. The real issue with biometrics as keys is that they may be faked just as easily as a password. Cappelli et al demonstrate that the effectiveness of both capacitive and optical scanning devices at differentiating an imposer versus the actual finger print are marginal at best.[CR]ⁱ Futher to their analysis Sten et al. State that various standard methods utilizing house hold items may be conducted to fool the fingerprint scanner, these include creating a gelatin mold of the available fingerprint left on the laptop case itself or simply breathing on the scanner to reveal the oil of the previous scan then utilizing common forensic methods to lift the print and reproduce it in a usable medium, silicon sealant works well with tape and graphite from pencils for such work.[SA]ⁱⁱ

Poorly written spy thrillers and action films would have us believe that a severed finger or poked out eye may fool even the worlds best biometric systems, the truth is that a severed finger would fool most biometric scanners; we may assume the deformation of a eye given the severe trauma involved in removing it from the socket would modify both the iris and retina characteristics used by said scanning systems beyond acceptable reading norms. However with medical images available on health networks, should an advanced persistent threat so choose to they may recreate the eye including the iris utilizing modern 3D printing techniques and available data from the person in question and ensure it meets the optical characteristics required to maintain authentication. However since we are considering only a general log-on and authentication to a workstation we may limit the scope of discussion to fingerprint scanners as they are the most popular and least expensive option.

Authentication can be augmented by the use of biometrics but these only serve to increase the level of effort and skill a persistent threat requires to circumvent the system's logon process. Identity based crypto-systems simply incorporate the use of biometrics with tokens and passwords. Strong Authentication as defined by RSA [RSA]ⁱⁱⁱ, Tipton [TH]^iv and others involved the use of any two following three characteristics:

• something known (ie; a password)
• something possessed (a token, smart card or standard IDE card)
• something unique (fingerprint, iris, face, retina, hand geometry, vascular structure of the hand or arm, typing gate and pattern, voice )

Considering the recent breaches at both RSA and Lockheed Martin we should reconsider any and all authentication systems to use one of all three of the above and define that as “Very Strong” authentication.

So we can use biometrics as a login to a device of relatively low sensitivity but as the saying goes, security measures should always be commensurate with asset value so if an identity based crypto system is implemented to secure assets of a sensitive nature we should use three factor authentication on said system after passing through a man-trap with three factor authentication and ensure that said system has no connection what so ever to the Internet.

As new methods to identify people evolve they will reduce the cost of implementation said methods which benefits the industry as now most if not all new laptops ship with a fingerprint reader as a standard option. Many software applications may tie into this reader as it does use a standardized interface just as a mouse or keyboard does; however due to the inherent weaknesses in this technology we should only rely upon the fingerprint as a single of three factors to consider when granting access to sensitive information or a sensitive system. Hybrid systems like those from Autenticka and other providers will considerably increase the difficulty required to circumvent a given systems authentication mechanisms.

Even with three factor authentication we are not considering authentication under duress; ie; someone holds a gun to your back and forces you to logon to a system; which in reality may happen in cases of industrial espionage more than any company would like to admit. Or the potential for fraud, as when the system itself becomes more difficult to exploit the people behind it often become the target.

In summary; we will always require a password, we may use biometrics to augment the authentication to a given crypto-system or console but to rely solely upon them is to invite moral hazard.

i[CP] Capelli Raffaele, Dario Mario, Maltoni Davide, Wayman James L, Jain Anik (IEEE, Transacations on Pattern analisys and Machine Intellegence, Vol 28. No. 1, January 2006) Preformance evaluation of fingerprint verfication systems [Online] PDF Document, Available from: http://www.computer.org/portal/web/csdl/doi/10.1109/TPAMI.2006.20 (Accessed on June 1^st 2011)

ii[SA] Sten Antti, Kaseva Antti, Virtanen Teemupekka (Helsinki Unviersity of Technology, 2003) Folling Fingerprint scanners – Biometric vulnerabilities of the Precise Biometrics 100 SC Scanner

iii[RSA] n.d. (RSA, 2011) Strong Authentication [Online] World Wide Web, Available from: http://www.rsa.com/glossary/default.asp?id=1080 (Accessed on June 1^st 2011)

iv[THF] Tipton, Harold F (CRC, Taylor and Francis, 2010) Offical guide to the CISSP CBK 2^nd ED. ISBN: 978-1-4398-0959-4