第五章 PGP 电子商务信息安全与管理教学课件.pptVIP

* * * 戎 玫 2008－3 Overview Need for E-Mail security Threats to E-Mail Pretty good privacy Recommended web sites Need for E-Mail Security E-mail is necessary for E-Commerce Daily communication E-Mail is also very public, allowing for access at each point form the sender’s computer to the recipient’s screen. Pretty Good Privacy 1991 – Creation of a single person, Phil Zimmermann Provides confidentiality and authentication services for electronic mail and file storage applications Pretty Good Privacy Selected best available cryptographic algorithms Integrated these algorithms into a general purpose application Source code and doc freely available on the net Agreement with company (Viacrypt) for low cost commercial version Phil Zimmermann “PGP has spread like a prairie fire, fanned by countless people who fervently want their privacy restored in the information age” - Phil Zimmermann, 1996 Why Is PGP Popular? It is availiable free on a variety of platforms. Based on well known algorithms. Wide range of applicability Not developed or controlled by governmental or standards organizations Operational Description PGP Consists of five services: Authentication Confidentiality Compression E-mail compatibility Segmentation and Reassembly The last three are transparent to the user PGP: Authentication steps Sender: Creates a message Hashes it to 160-bits using SHA1 Encrypts the hash code using her private key, forming a signature PGP prompts the user for the passphrase to recover the private key Attaches the signature to message PGP: Authentication steps Receiver: Decrypts attached signature using sender’s public key and recovers hash code Recomputes hash code using message and compares with the received hash code’ If they match, accepts the message M = original message H = hash function | | = concatenation (join) Z = compression Z-1= decompression EP = public key encryption DP = public key decryption KRa = A’s private key KUa = A’