Instructor: In this lesson,
we will learn about Asymmetric Cryptography Use Cases.
Asymmetric Cryptography Use Cases involve scenarios
where public and private key pairs
are utilized to secure communications
and authenticate users.
Asymmetric cryptography use cases include
certificate-based authentication,
passwordless authentication, and secure email.
Certificate-based Authentication
uses digital certificates to validate identities.
Next, Passwordless Authentication uses cryptographic keys
to eliminate the need for passwords.
Finally, Secure Email employs asymmetric encryption
to ensure that email communications are confidential
from end-to-end,
and can only be read by the intended recipient.
Let's learn more about Certificate-based Authentication,
Passwordless Authentication, and Secure Email.
First, we have Certificate-based Authentication.
Certificate-based Authentication is a secure method
of verifying identities using digital certificates,
which are issued by a trusted certificate authority
within a public key infrastructure.
Certificate-based authentication
ensures that only authorized users and systems
can access protected resources
by proving their identity with a digital certificate.
In client authentication,
a server verifies whether a connection request
is coming from a preauthorized client, such as a device,
or user based on the client-presented certificate.
This is commonly managed through Network Access Control
or NAC systems.
NAC systems authenticate devices
and ensure that only trusted clients
can connect to the network.
Alternatively, server authentication is used by a client
to validate that the server, such as a web server,
is genuine and not an imposter.
For example, every time a web browser
connects to a website over https,
which is hypertext transfer protocol over SSL,
it uses a digital certificate issued to the server
to confirm the server's identity.
This ensures the user is connecting to the real website
and not a fraudulent one.
In modern enterprise environments,
certificate-based authentication is often integrated
within Single Sign-On or SSO systems,
which streamline access management.
SSO allows users to access multiple resources and services
using a single set of credentials
or a digital certificate.
For example, a user might log into their computer
with a smart card that a digital certificate.
Once authenticated, the SSO system
uses the certificate to grant access
to various applications, websites,
and network resources without requiring the user
to repeatedly enter their credentials.
This approach simplifies user authentication,
reduces the risk of password-related security issues,
and enhances overall security by leveraging strong
certificate-based identity verification.
So, by relying on certificates
instead of traditional passwords,
certificate-based authentication
significantly enhances security,
reduces the burden of managing multiple credentials,
and provides a seamless user experience
in accessing trusted resources.
Second, we have Passwordless Authentication.
Passwordless Authentication is an authentication method
that allows users to access systems
without entering passwords
or other knowledge-based secrets.
This approach enhances security and user experience
by using password alternatives,
such as public-key cryptography,
where a private key is stored on the user's device
and used for authentication.
Passwordless authentication generally relies
on two main types of factors.
Ownership factors are something the user has,
like a smartphone, a smart card, or a hardware token,
while biometric factors are something the user is,
such as fingerprints or facial recognition.
These factors eliminate the need
for traditional passwords,
which are often vulnerable to being stolen or guessed.
Passwordless systems offer several benefits,
including improved security, a better user experience,
and reduced IT cost.
By removing passwords,
systems are protected against common attacks
like brute force and password theft.
Users also enjoy a smoother experience,
as they no longer need to remember
or frequently update complex passwords.
IT departments benefit as well,
since the need for password storage,
management and security auditing is significantly reduced.
Additionally, passwordless authentication
provides better tracking of credential use,
as it is closely tied to specific devices
or unique user attributes like biometrics.
But passwordless authentication also has some challenges,
including higher implementation costs,
the need for additional training
and potential single points of failure
if relying on only one factor,
such as a hardware token or a biometric scan.
For example, if biometric factors like fingerprints
or facial recognition are used,
there is a risk of biometric impersonation.
Biometric impersonation involves
bypassing biometric security
by mimicking a user's physical traits.
This can be seen in movies,
where a spy recreates someone's fingerprint
from a drinking glass to bypass security.
To mitigate such risks,
systems must ensure low false-positive rates
in biometric scanners,
and use secure, well-tested technology.
While biometric authentication is considered secure,
using multifactor authentication or MFA
greatly enhances security.
For example, if you can consider the iPhone's Touch ID
and Face ID systems,
you will find that a standard four-digit PIN
has a one in 10,000 chance
of being guessed by an attacker.
But if you're using Touch ID with your fingerprint
to unlock the device,
the chance that somebody else's fingerprint
will unlock your device goes up to one in 50,000,
making it five times more secure.
If you're using Face ID with its facial recognition scanning
to secure your device,
the chances of somebody else's face unlocking your device
goes up to one in 1 million.
But for the most secure implementation
of passwordless authentication,
you should use multifactor authentication.
For example, if you combine facial recognition
with a one-time PIN from an RSA key fob,
your overall system security
is going to increase tremendously,
because multi-factor authentication is much more secure
than any single factor on its own.
Third and last, we have Secure Email.
Secure Email creates confidentiality, integrity,
authentication, and non-repudiation in email communication.
To achieve confidentiality, the email message is encrypted
with the receiver's public key,
ensuring that only the intended recipient
can decrypt and read the message.
For integrity, the sender hashes the email message,
creating a unique hash digest
that ensures the content
has not been altered during transmission.
To provide non-repudiation,
the sender encrypts this hash digest with their private key,
allowing the receiver to confirm the sender's identity
and that the message has not been tampered with.
One of the most widely used standards
for secure email is
the Secure Multipurpose Internet Mail Extension or S/MIME.
S/MIME uses public key cryptography standards
or PKCS to provide encryption, digital signatures,
and other cryptographic security
for electronic messaging like email.
Unlike connection security protocols
like Secure Sockets Layer and Transport Layer Security,
which protect data in transit,
S/MIME focuses on securing individual messages.
It applies encryption
and digital signatures directly to each email,
ensuring both sender and receiver
can trust the message's integrity
and guarantee confidentiality.
Today, S/MIME is integrated into most email clients,
such as Microsoft Outlook, Apple Mail, and Gmail.
It uses separate session keys for each email message
and applies digital signatures to emails
to ensure authentication, integrity and non-repudiation.
For S/MIME to work,
each user is issued a digital certificate
containing their public key
signed by a trusted certificate authority or CA,
and a private key that remains a secret.
This public and private key combination
allows users to securely exchange public keys
and validate each other's identities
through their respective certificate authorities.
For instance, if you and I want to exchange secure emails,
we first exchange our public keys through email,
signing these initial messages
with our private keys for validation.
My email client will verify your public key
using your certificate authority
to ensure its authenticity,
and you will do the same with my public key.
Once we have each other's validated public keys,
we can start sending encrypted emails to each other
using each other's public keys
to ensure confidentiality.
Each of us will also sign our messages
by encrypting a message hash with our own private key.
This adds authentication, integrity,
and non-repudiation to our communication.
This layered approach makes S/MIME
a critical component of email security,
but S/MIME does have some challenges,
such as potentially being exploited
in social engineering attacks.
For example, an attacker could send malware
hidden inside of an encrypted email,
bypassing traditional security filters.
Since the contents are encrypted,
boundary protection devices like email filters
cannot inspect the message for threats
without access to the private key.
This creates a trade-off when implementing S/MIME.
because while it provides robust security
for legitimate communications,
it can be used to bypass security measures too,
requiring careful consideration
and additional controls when used in corporate environments.
So, remember, Asymmetric Cryptography uses public
and private key pairs to secure communications
and authenticate users.
This approach is seen in various use cases,
including Certificate-based authentication,
Passwordless authentication, and Secure email.
First, Certificate-based Authentication
uses digital certificates to verify identities,
enhancing security by proving
that users and devices are who they claim to be.
Second, Passwordless Authentication eliminates the need
for passwords, relying instead on cryptographic keys
and biometrics to provide secure access.
And third, Secure Email employs asymmetric encryption
to ensure that messages are confidential,
authentic, and protected from tampering.