GowsiTamil CSE Notes

  Public Key Infrastructure(PKI) Public Key Infrastructure (PKI) is a framework used to create, manage, distribute, verify, and revoke digital certificates and public keys . PKI enables secure communication by providing: Authentication Data Integrity Trust It is commonly used over open networks such as the Internet . Need for PKI Public-key cryptography allows public keys to be shared openly. However, it does not by itself guarantee that a public key actually belongs to the claimed user. PKI solves this problem by: Verifying user identities. Binding public keys with identities using digital certificates. Establishing trust through trusted authorities. Without PKI, systems may be vulnerable to Man-in-the-Middle (MITM) attacks . Components of PKI 1. Certificate Authority (CA) The Certificate Authority (CA) is a trusted entity in PKI that: Issues digital certificates. Digitally signs certificates. Revokes certifi...

  Kerberos Authentication Kerberos is a network authentication protocol used to verify the identity of users and systems before access to network resources is provided. It uses secret-key cryptography and a trusted third party , called the Key Distribution Center (KDC) , to perform authentication. The important feature is that the user's password is not sent directly across the network . Kerberos was developed at MIT (Massachusetts Institute of Technology) and provides secure login along with Single Sign-On (SSO) . (Kerberos in Greek mythology: Kerberos is a multi-headed dog that guards the gates of the underworld. The name is used for the authentication system because it acts as a guard for network resources.) Why Kerberos is Needed? Normal Client–Server Login Before Kerberos In a traditional client-server login:         Username + Password Client ------------------------> Server         <------...

  EAP(Extensible Authentication Protocol) EAP (Extensible Authentication Protocol) is an authentication framework used to verify the identity of a user or device before allowing secure network access.  It is not a single fixed authentication method ; instead, it supports multiple authentication techniques. Features of EAP EAP can support different authentication methods, such as: Password-based authentication Digital certificates Smart cards One-Time Passwords (OTP) Biometrics These methods are used to verify identity before providing secure access. The main advantage of EAP is its extensible nature . New authentication technologies can be supported by using suitable EAP methods without replacing the underlying network infrastructure. EAP is commonly used in: Wireless networks VPNs Enterprise networks Mobile networks 1. EAP-TLS (Transport Layer Security) EAP-TLS is a certificate-based authenticati...

  x.509 Certificate  An X.509 certificate is a standard digital certificate format used in network security to associate a public key with the identity of an entity   such as user, server, or organization. X.509 is defined by the ITU-T X.509 standard . It is commonly used in secure communication protocols such as: SSL/TLS HTTPS Secure Email VPN Purpose of X.509 Certificate To authenticate users and servers. To prevent the use of fake or malicious public keys. To establish trust between communicating parties. To support secure key exchange in public-key cryptography. Without certificates, an attacker could provide a false public key and perform a Man-in-the-Middle (MITM) attack. Issuing Process of X.509 Certificate The user or server generates a public key and private key pair . The user sends the public key and identity information to the Registration Authority...

  Digital Signature Algorithm  A digital signature is a cryptographic technique used to verify the authenticity and integrity of a digital message, file, or document. It confirms that: The message was created by the claimed sender. The message has not been modified after signing. The sender cannot easily deny having signed the message. Three Main Purposes Authentication Proves that the message came from the claimed sender. Message Integrity Confirms that the original data has not been changed. Non-repudiation Provides evidence that the sender signed and sent the message.   How DSA Works? DSA follows three main phases : Key Generation Signature Generation Signature Verification   1. Key Generation DSA uses two keys: Private Key The private key is used to create the digital signature. The sender signs the message using the private key.       ...

  IEEE 8 02.1x Port based Network Access Control  IEEE 802.1X is a port-based network access control mechanism used to prevent unauthorized devices from accessing a network. It  restricts unauthorized devices from connecting to a LAN or WLAN (Wi-Fi) . The authentication process commonly uses EAP (Extensible Authentication Protocol) and EAPOL (EAP over LAN) . Main Components of IEEE 802.1X: 1. Supplicant  The Supplicant is the client device that needs to be authenticated before accessing the network.    Examples: Laptop, Mobile phone, PC  2. Authenticator  It acts as an intermediate device between the client and the authentication server. It blocks normal network access until the user or device is successfully verified. It forwards authentication-related messages between the supplicant and authentication server.  Examples: Wi-Fi Router ,Network Switch  3. Authentication Server   The Authentication Server...