IIR-tutorial-4

“application” layer securityTim WrightCommunications Security and AdvancedDevelopment GroupVodafone LimitedSecurity and Fraud, 2000 the word is09.03.00ContentsIntroduction to public key cryptographyWAP securityMExE and MExE securityIntroduction to Java / J2MEIssues and challenges for application layer securitySecurity and Fraud, 2000 the word is09.03.00Digital signatures and PKSecret key cryptography - good where you trust whoyou’re talking toPublic key crypto where you don’t or have problemstransmitting keysA private key for every public keyEncrypt with public key and decrypt with privateOr the reverse - sign with private key, verify withpublicSecurity and Fraud, 2000 the word is09.03.00CertificatesPublic keys can be public but could be changedPossibility of spoofingCertificate is a public key signed with a “higher”private keyNeed a public key to verify that private keyEnd up with a root at the topPublic Key Infrastructure, PKI, is:Certification Authorities (CA), from which certificates areobtainedRegistration Authorities (RA), that check identity of clientbefore certificate is issuedinterfaces between these and other nodesSecurity and Fraud, 2000 the word is09.03.00WAP - servicesInitially just browsingFuture:mobile e-commercedownloaded scripts and applicationstelephony control (WTA)links to external devicesSecurity and Fraud, 2000 the word is09.03.00WAP - ...