|By James H. Wong||
|December 9, 2012 04:00 PM EST||
Designing and implementing a hybrid encryption application is a big challenge but without a supporting infrastructure it's almost impossible. There are open source libraries that allow you to encrypt a file but only provide the translation technique. After the information has been encrypted, how do you know what algorithm was used, who you encrypted it, what version did you used, etc. In order to decrypt the protected message or file, a well-defined cryptographic header provides all the information required. This also applies if the encrypted data is digitally signed and the recipient wants to validate the signature.
This article will address one of the critical components of a support infrastructure by providing a design of a cryptographic header used to precede encrypted and/or digitally signed messages and files. The header is used within an application known as DocuArmor that was written using Java and the Cryptography library from the BouncyCastle organization and designed by Logical Answers Inc. The header will store information used when encrypting and/or digitally signing a message or file and allow the recipient to decrypt the information and/or verify the digital signature. With a properly designed header, a person can encrypt their personal files as well as exchange confidential messages and authenticate the sender.
In order to encrypt personal files and exchange protected data, we use a hybrid technique with two types of encryption, symmetric and asymmetric.
Symmetric encryption uses a single key to hide the message and reveal the message. There are several symmetric algorithms available such as AES (the Advanced Encryption Standard) but the important thing to remember is that the file can be encrypted and decrypted using the same key. An example is the Caesar cipher that shifts the letters of the alphabet by a specific number. If the shift is 2 (single key) then we get the following translation; a=c, b=d, c=e, ..., z=b.
Asymmetric encryption uses a pair of keys (public, private) to hide and reveal the message and the RSA algorithm is most commonly used. The RSA algorithm was credited in 1977 to Ronald Rivest, Adi Shamir, and Leonard Adleman. Sometimes referred to as Public Key Infrastructure (PKI), the pubic key is used to encrypt data and the private key is used to decrypt data.
Figure 1: Public and Private Key Functions
The hybrid technique uses the symmetric key to encrypt a file. The asymmetric public key is used to encrypt the symmetric key and is placed in the header. When the recipient receives an encrypted file, the encrypted symmetric key is extracted from the header. The encrypted symmetric key is decrypted using the private key. The file is decrypted using the symmetric key.
The same pair of keys can be used with digital signatures. The private key is used to generate a digital signature from a file and inserted into the header. The public key is used to verify the authenticity of the signature.
When two people want to exchange encrypted files, they each generate a pair of asymmetric keys and exchange a copy of their public keys. By using the other person's public key, they can encrypt a file, storing the cryptographic information in the header and then e-mail it to the recipient. The recipient will use the header to extract a symmetric key with their private key and decrypt the accompanying file. If a digital signature is included, the recipient can authenticate the sender.
Figure 2: Exchange of Encrypted Files
When a file is encrypted, digitally signed or both, a Cryptographic header is placed in front of the resulting file and has the following structure. The structure consists of two sections, the header and the encrypted/plain file contents.
Figure 3: Encrypted File Structure
The header structure contains information required to reverse the encryption process and decrypt the contents of the file or verify the digital signature. The header contains the total length, an ID, version, and two sections containing encryption and digital signature information. Using Java, you can write out the contents of header within a byte stream as well as read it back in.
Figure 4: Cryptographic Header Structure
- Total Len: Contains the total length of the header (stored as a 4 byte integer)
- Header ID: Contains the string "LAHEADER" to identify the file (16 bytes)
- Header Version: Structural version of the header (stored as a 4 byte integer)
- Encryption Information: Holds the algorithm, mode, encrypted symmetric key, etc.
- Digital Signature Information: Holds digital signature
The Encryption Information structure contains information that was used to encrypt the contents of the file and later decrypt the file. The symmetric key and initialization vector is encrypted with the recipient's asymmetric public key. The recipient could be the owner if you are encrypting a file for yourself or another user you want to send confidential information to.
An additional field has been allocated to allow the encryption of the symmetric key with another set of asymmetric keys. For example, if owner A is sending an encrypted file to another person B, the symmetric key can be encrypted with B's public key as well as A's public key so that either person can decrypt the file.
Alternatively, an employee can encrypt a file with their public key and a corporation could insert an encrypted symmetric key into the header using their asymmetric keys. The corporation's asymmetric keys can be a Certifying Authority (CA), which can be used to issue employee keys.
Figure 5: Encryption Information Structure
- Encrypt Flag: (Y/N - 2 bytes) specifies whether the file is encrypted.
- Decrypt ID Length: (integer - 4 bytes) length in chars(bytes) of the Key ID.
- Decrypt ID: (size varies) an identifier of the RSA keys used in the encryption/decryption process. It is the alias associated to the asymmetric encryption keys (e.g., JaneDoe_12ff).
- Other Decrypt ID Length: (integer - 4 bytes) length in chars(bytes) of the Key ID.
- Other Decrypt ID: (size varies) an identifier of the RSA keys used in the encryption/decryption process. It can be the alias or the common name (e.g., JaneDoe_12ff or Logical Answers CA).
- Symmetric Key Algorithm: (integer - 4 bytes) specifies the symmetric key algorithm used to encrypt the file. The default value is 1=AES.
- Symmetric Key Mode: (integer - 4 bytes) specifies the symmetric key block cipher mode used to enhance confidentiality. The default value is 5=Segmented Integer Counter mode (CTR).
- Symmetric Key Padding: (integer - 4 bytes) specifies the type of padding for block cipher. The default value is 1=No Padding
- Wrapped Symmetric Key Length: (integer - 4 bytes)
- Wrapped Symmetric Key: (size varies) symmetric key used to encrypt/decrypt the file and encrypted with the asymmetric key.
- Initialization Vector Length: (integer - 4 bytes)
- Initialization Vector: (byte - size varies) vector used with the symmetric encryption process.
- Other Wrapped Symmetric Key Length: (integer - 4 bytes)
- Other Wrapped Symmetric Key: (size varies) symmetric key used to encrypt/decrypt the file and encrypted with another person's asymmetric key.
- Other Initialization Vector Length: (integer - 4 bytes)
- Other Initialization Vector: (byte - size varies) vector used with the symmetric encryption process.
Digital Signature Information
The Digital Signature Information structure contains information used to add or verify a digital signature generated from the contents of the file. The digital signature is generated with the owner's private key using a specific algorithm and then inserted into the header. When the recipient receives the signed file, they can use the signer's public key to validate its authenticity. If the signature is authenticated, it implies the file has not been altered and the holder of the private key generated the signature.
Figure 6: Digital Signature Information Structure
- Signed Flag: (Y/N - 2 bytes) specifies whether the file contains a digital signature
- Signature Algorithm: (integer - 4 bytes) specifies the algorithm used to generate the digital signature. The default value is 12= SHA512WithRSAEncryption
- Verify Signature Cert Name Length: (integer - 4 bytes) length in chars(bytes) of the filename of the certificate used to verify a digital signature
- Verify Signature Cert Name: (size varies) filename of the certificate holding the RSA public key used to verify the digital signature of a file (e.g., JaneDoe_fa39.cer).
- Signature Date/Time: (long - 8 bytes) date the digital signature was generated.
- Signature Length: (integer - 4 bytes)
- Signature: (size varies) holds digital signature generated with RSA private key and signature engine
File Naming Conventions
The Cryptographic header holds information that designates which keys were used to encrypt a file but it's not physically accessible without reading it in first. With proper naming conventions, you can determine who the intended recipient is for encrypted files - whether it is for yourself or a colleague. When you generate your pair of asymmetric encryption keys using Java, store them in a file called a key store. The key store holds a pair of asymmetric keys as an entry with a unique alias. The alias typically consists of the initial of your first name and your last name. To make it more unique, you can extract 4 hex digits from your public key and append an underline and the hex digits to the alias. For example, if the person's name was Jane Smith, then the resulting unique alias would be jsmith_ad5e. A certificate holds a person's public key and the alias would be used in the filename, as jsmith_ad5e.cer. Similarly, the key store holding the pair of asymmetric keys would be saved as, jsmith_ad5e.jks.
Following the unique alias analogy, Jane Smith could encrypt files for herself and the file name would be appended with her alias and an appropriate file extension. For example, if Jane encrypted a personal file, myTaxes.txt, then the result would be myTaxes.txt.jsmith_ad5e.aes. If Jane wanted to send her colleague Dick an encrypted document, she would use Dick's certificate to encrypt it. If Dick's certificate is djones_9fa2, Jane could encrypt the file, comments.doc, for Dick and the resulting file would be comments.doc.djones_9fa2.aes. When Dick receives the file, he knows it is for him by recognizing his alias on the file name.
The unique alias is stored within the header. This reinforces the importance of having a well-defined Cryptographic header for implementing encryption within your applications.
A well-defined cryptographic header stores the information required to encrypt, decrypt and digitally sign a file. Along with facilitating the implementation of standard cryptographic functions, the header also provides the following benefits:
- The header allows for the protection of personal files as well as the exchange of confidential data.
- Using the stored digital signature, the recipient can determine if the sender is valid and whether file has been altered.
- The header allows either the sender or recipient to decrypt the encrypted file since both would encrypt the symmetric key with their public key.
- Using the concept of a Certifying Authority pair of asymmetric keys, a corporation, group, or family could issue pairs of asymmetric keys to their employees or members and decipher files encrypted by them in case of emergencies.
- The header allows for using different combinations of symmetric algorithms, modes, padding and key sizes to be used to encrypt information.
- The header version allows for enhancements to be added to the structure for implementing new functions and still support older versions.
References and Other Technical Notes
- Computer running Windows XP or higher...
- Java Runtime (JRE V1.6 or higher)
- The Legion of the Bouncy Castle Encryption Modules (no runtime fee)
- DocuArmor software modules by Logical Answers Inc.
- "Beginning Cryptography with Java" by David Hook.
- "The Code Book" by Simon Singh
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
Sep. 26, 2016 07:15 AM EDT Reads: 1,596
An IoT product’s log files speak volumes about what’s happening with your products in the field, pinpointing current and potential issues, and enabling you to predict failures and save millions of dollars in inventory. But until recently, no one knew how to listen. In his session at @ThingsExpo, Dan Gettens, Chief Research Officer at OnProcess, will discuss recent research by Massachusetts Institute of Technology and OnProcess Technology, where MIT created a new, breakthrough analytics model f...
Sep. 26, 2016 07:15 AM EDT Reads: 1,875
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
Sep. 26, 2016 07:00 AM EDT Reads: 2,644
Technology vendors and analysts are eager to paint a rosy picture of how wonderful IoT is and why your deployment will be great with the use of their products and services. While it is easy to showcase successful IoT solutions, identifying IoT systems that missed the mark or failed can often provide more in the way of key lessons learned. In his session at @ThingsExpo, Peter Vanderminden, Principal Industry Analyst for IoT & Digital Supply Chain to Flatiron Strategies, will focus on how IoT de...
Sep. 26, 2016 06:45 AM EDT Reads: 1,073
Fact is, enterprises have significant legacy voice infrastructure that’s costly to replace with pure IP solutions. How can we bring this analog infrastructure into our shiny new cloud applications? There are proven methods to bind both legacy voice applications and traditional PSTN audio into cloud-based applications and services at a carrier scale. Some of the most successful implementations leverage WebRTC, WebSockets, SIP and other open source technologies. In his session at @ThingsExpo, Da...
Sep. 26, 2016 06:30 AM EDT Reads: 1,568
SYS-CON Events announced today that Roundee / LinearHub will exhibit at the WebRTC Summit at @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. LinearHub provides Roundee Service, a smart platform for enterprise video conferencing with enhanced features such as automatic recording and transcription service. Slack users can integrate Roundee to their team via Slack’s App Directory, and '/roundee' command lets your video conference ...
Sep. 26, 2016 04:30 AM EDT Reads: 1,417
Digital transformation is too big and important for our future success to not understand the rules that apply to it. The first three rules for winning in this age of hyper-digital transformation are: Advantages in speed, analytics and operational tempos must be captured by implementing an optimized information logistics system (OILS) Real-time operational tempos (IT, people and business processes) must be achieved Businesses that can "analyze data and act and with speed" will dominate those t...
Sep. 26, 2016 04:30 AM EDT Reads: 1,058
Information technology is an industry that has always experienced change, and the dramatic change sweeping across the industry today could not be truthfully described as the first time we've seen such widespread change impacting customer investments. However, the rate of the change, and the potential outcomes from today's digital transformation has the distinct potential to separate the industry into two camps: Organizations that see the change coming, embrace it, and successful leverage it; and...
Sep. 26, 2016 03:15 AM EDT Reads: 1,091
There is growing need for data-driven applications and the need for digital platforms to build these apps. In his session at 19th Cloud Expo, Muddu Sudhakar, VP and GM of Security & IoT at Splunk, will cover different PaaS solutions and Big Data platforms that are available to build applications. In addition, AI and machine learning are creating new requirements that developers need in the building of next-gen apps. The next-generation digital platforms have some of the past platform needs a...
Sep. 26, 2016 03:00 AM EDT Reads: 1,770
Almost two-thirds of companies either have or soon will have IoT as the backbone of their business in 2016. However, IoT is far more complex than most firms expected. How can you not get trapped in the pitfalls? In his session at @ThingsExpo, Tony Shan, a renowned visionary and thought leader, will introduce a holistic method of IoTification, which is the process of IoTifying the existing technology and business models to adopt and leverage IoT. He will drill down to the components in this fra...
Sep. 26, 2016 01:00 AM EDT Reads: 1,644
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
Sep. 26, 2016 01:00 AM EDT Reads: 1,962
IoT is fundamentally transforming the auto industry, turning the vehicle into a hub for connected services, including safety, infotainment and usage-based insurance. Auto manufacturers – and businesses across all verticals – have built an entire ecosystem around the Connected Car, creating new customer touch points and revenue streams. In his session at @ThingsExpo, Macario Namie, Head of IoT Strategy at Cisco Jasper, will share real-world examples of how IoT transforms the car from a static p...
Sep. 26, 2016 12:30 AM EDT Reads: 1,547
I'm a lonely sensor. I spend all day telling the world how I'm feeling, but none of the other sensors seem to care. I want to be connected. I want to build relationships with other sensors to be more useful for my human. I want my human to understand that when my friends next door are too hot for a while, I'll soon be flaming. And when all my friends go outside without me, I may be left behind. Don't just log my data; use the relationship graph. In his session at @ThingsExpo, Ryan Boyd, Engi...
Sep. 26, 2016 12:30 AM EDT Reads: 1,255
SYS-CON Events announced today that Pulzze Systems will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Pulzze Systems, Inc. provides infrastructure products for the Internet of Things to enable any connected device and system to carry out matched operations without programming. For more information, visit http://www.pulzzesystems.com.
Sep. 26, 2016 12:15 AM EDT Reads: 1,824
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, will discuss the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports. The session will include a working demo and a technical d...
Sep. 25, 2016 10:00 PM EDT Reads: 1,709
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
Sep. 25, 2016 09:30 PM EDT Reads: 2,531
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace.
Sep. 25, 2016 09:00 PM EDT Reads: 969
The vision of a connected smart home is becoming reality with the application of integrated wireless technologies in devices and appliances. The use of standardized and TCP/IP networked wireless technologies in line-powered and battery operated sensors and controls has led to the adoption of radios in the 2.4GHz band, including Wi-Fi, BT/BLE and 802.15.4 applied ZigBee and Thread. This is driving the need for robust wireless coexistence for multiple radios to ensure throughput performance and th...
Sep. 25, 2016 02:30 PM EDT Reads: 1,541
Enterprise IT has been in the era of Hybrid Cloud for some time now. But it seems most conversations about Hybrid are focused on integrating AWS, Microsoft Azure, or Google ECM into existing on-premises systems. Where is all the Private Cloud? What do technology providers need to do to make their offerings more compelling? How should enterprise IT executives and buyers define their focus, needs, and roadmap, and communicate that clearly to the providers?
Sep. 25, 2016 02:00 PM EDT Reads: 1,534
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
Sep. 25, 2016 01:00 PM EDT Reads: 870