Applied Cryptography in E-mail Services and Web Services

2011 ◽  
pp. 130-145
Author(s):  
Lei Chen ◽  
Wen-Chen Hu ◽  
Ming Yang ◽  
Lei Zhang
Keyword(s):  
Web Services ◽  
Communication Networks ◽  
Secure Communication ◽  
Transport Layer ◽  
Public Key ◽  
Applied Cryptography ◽  
Public Networks ◽  
Trust System ◽  
Security Standards ◽  
E Mail

E-mail services are the method of sending and receiving electronic messages over communication networks. Web services on the other hand provide a channel of accessing interlinked hypermeida via the World Wide Web. As these two methods of network communications turn into the most popular services over the Internet, applied cryptography and secure authentication protocols become indispensable in securing confidential data over public networks. In this chapter, we first review a number of cryptographic ciphers widely used in secure communication protocols. We then discuss and compare the popular trust system Web of Trust, the certificate standard X.509, and the standard for public key systems Public Key Infrastructure (PKI). Two secure e-mail standards, OpenPGP and S/MIME, are examined and compared. The de facto standard cryptographic protocol for e-commerce, Secure Socket Layer (SSL) / Transport Layer Security (TLS), and XML Security Standards for secure web services are also discussed.

A large-scale analysis of HTTPS deployments: Challenges, solutions, and recommendations

2020 ◽  
pp. 1-26
Author(s):  
Qinwen Hu ◽  
Muhammad Rizwan Asghar ◽  
Nevil Brownlee
Keyword(s):  
Secure Communication ◽  
Large Scale ◽  
Transport Layer ◽  
Security Level ◽  
Secure Socket Layer ◽  
Security Issues ◽  
Large Scale Analysis ◽  
Government Websites ◽  
Encrypted Communication ◽  
Specific Implementation

HTTPS refers to an application-specific implementation that runs HyperText Transfer Protocol (HTTP) on top of Secure Socket Layer (SSL) or Transport Layer Security (TLS). HTTPS is used to provide encrypted communication and secure identification of web servers and clients, for different purposes such as online banking and e-commerce. However, many HTTPS vulnerabilities have been disclosed in recent years. Although many studies have pointed out that these vulnerabilities can lead to serious consequences, domain administrators seem to ignore them. In this study, we evaluate the HTTPS security level of Alexa’s top 1 million domains from two perspectives. First, we explore which popular sites are still affected by those well-known security issues. Our results show that less than 0.1% of HTTPS-enabled servers in the measured domains are still vulnerable to known attacks including Rivest Cipher 4 (RC4), Compression Ratio Info-Leak Mass Exploitation (CRIME), Padding Oracle On Downgraded Legacy Encryption (POODLE), Factoring RSA Export Keys (FREAK), Logjam, and Decrypting Rivest–Shamir–Adleman (RSA) using Obsolete and Weakened eNcryption (DROWN). Second, we assess the security level of the digital certificates used by each measured HTTPS domain. Our results highlight that less than 0.52% domains use the expired certificate, 0.42% HTTPS certificates contain different hostnames, and 2.59% HTTPS domains use a self-signed certificate. The domains we investigate in our study cover 5 regions (including ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC) and 61 different categories such as online shopping websites, banking websites, educational websites, and government websites. Although our results show that the problem still exists, we find that changes have been taking place when HTTPS vulnerabilities were discovered. Through this three-year study, we found that more attention has been paid to the use and configuration of HTTPS. For example, more and more domains begin to enable the HTTPS protocol to ensure a secure communication channel between users and websites. From the first measurement, we observed that many domains are still using TLS 1.0 and 1.1, SSL 2.0, and SSL 3.0 protocols to support user clients that use outdated systems. As the previous studies revealed security risks of using these protocols, in the subsequent studies, we found that the majority of domains updated their TLS protocol on time. Our 2020 results suggest that most HTTPS domains use the TLS 1.2 protocol and show that some HTTPS domains are still vulnerable to the existing known attacks. As academics and industry professionals continue to disclose attacks against HTTPS and recommend the secure configuration of HTTPS, we found that the number of vulnerable domain is gradually decreasing every year.

Sustainability of Public Key Cryptosystem in Quantum Computing Paradigm

2018 ◽  
pp. 563-588
Author(s):  
Krishna Asawa ◽  
Akanksha Bhardwaj
Keyword(s):  
Quantum Computing ◽  
Secure Communication ◽  
Prime Numbers ◽  
Cryptographic Protocols ◽  
Public Key ◽  
Quantum Computers ◽  
New Paradigm ◽  
Public Key Cryptosystems ◽  
Computing Paradigm ◽  
Diffie Hellman

With the emergence of technological revolution to host services over Internet, secure communication over World Wide Web becomes critical. Cryptographic protocols are being in practice to secure the data transmission over network. Researchers use complex mathematical problem, number theory, prime numbers etc. to develop such cryptographic protocols. RSA and Diffie Hellman public key crypto systems have proven to be secure due to the difficulty of factoring the product of two large primes or computing discrete logarithms respectively. With the advent of quantum computers a new paradigm shift on public key cryptography may be on horizon. Since superposition of the qubits and entanglement behavior exhibited by quantum computers could hold the potential to render most modern encryption useless. The aim of this chapter is to analyze the implications of quantum computing power on current public key cryptosystems and to show how these cryptosystems can be restructured to sustain in the new computing paradigm.

Cryptography in E-Mail and Web Services

2011 ◽  
pp. 79-129
Author(s):  
Wasim A Al-Hamdani
Keyword(s):  
Web Services ◽  
Web Service ◽  
Web Based ◽  
Web Service Security ◽  
Xml Signature ◽  
Personal Use ◽  
Remote System ◽  
A Site ◽  
Mail Service ◽  
E Mail

Cryptography has been used since ancient times in many different shapes and forms to protect messages from being intercepted. However, since 1976, cryptography started to be part of protected public communication when e-mail became commonly used by the public. Webmail (or Web-based e-mail) is an e-mail service intended to be primarily accessed via a web browser, as opposed to through an e-mail client, such as Microsoft Outlook, Mozilla‘s Thunderbird Mail. Very popular webmail providers include Gmail, Yahoo! Mail, Hotmail and AOL. Web based email has its advantages, especially for people who travel. Email can be collected by simply visiting a website, negating the need for an email client, or to logon from home. Wherever a public terminal with Internet access exists one can check, sends and receive email quickly and easily. Another advantage of web based email is that it provides an alternate address allowing user to reserve his/her ISP address for personal use. If someone would like to subscribe to a newsletter, enter a drawing, register at a website, participate in chats, or send feedback to a site, a web based email address is the perfect answer. It will keep non-personal mail on a server for you to check when you wish, rather than filling up your private email box. Web service is defined as “a software system designed to support interoperable machine-to-machine interaction over a network”. Web services are frequently just Internet application programming interfaces (API) that can be accessed over a network, such as the Internet, and executed on a remote system hosting the requested services. Other approaches with nearly the same functionality as web services are Object Management Group‘s (OMG) Common Object Request Broker Architecture (CORBA), Microsoft‘s Distributed Component Object Model (DCOM) or SUN‘s Java/Remote Method Invocation (RMI). Integrating Encryption with web service could be performing in many ways such as: XML Encryption and XML Signature. In this article we present client and Web-based E-mail, next generation E-mail and secure E-mail, followed by cryptography in web service and the last part is the future of web service security. The article start with the integration of cryptography with E-mail client and web base then the integration of cryptography and web service is presented. At the end of the major two sections: e-mail service and web service there is a general prospect vision of encryption future for e-mail service and web service. This section presents our view for the cryptography integration with the second generation of e-mail and web service.

Sustainability of Public Key Cryptosystem in Quantum Computing Paradigm

2016 ◽  
pp. 664-688
Author(s):  
Krishna Asawa ◽  
Akanksha Bhardwaj
Keyword(s):  
Quantum Computing ◽  
Secure Communication ◽  
Prime Numbers ◽  
Cryptographic Protocols ◽  
Public Key ◽  
Quantum Computers ◽  
New Paradigm ◽  
Public Key Cryptosystems ◽  
Computing Paradigm ◽  
Diffie Hellman

With the emergence of technological revolution to host services over Internet, secure communication over World Wide Web becomes critical. Cryptographic protocols are being in practice to secure the data transmission over network. Researchers use complex mathematical problem, number theory, prime numbers etc. to develop such cryptographic protocols. RSA and Diffie Hellman public key crypto systems have proven to be secure due to the difficulty of factoring the product of two large primes or computing discrete logarithms respectively. With the advent of quantum computers a new paradigm shift on public key cryptography may be on horizon. Since superposition of the qubits and entanglement behavior exhibited by quantum computers could hold the potential to render most modern encryption useless. The aim of this chapter is to analyze the implications of quantum computing power on current public key cryptosystems and to show how these cryptosystems can be restructured to sustain in the new computing paradigm.

Access Control and Information Flow Control for Web Services Security

2016 ◽  
Vol 11 (1) ◽  
pp. 44-76 ◽  
Author(s):  
Saadia Kedjar ◽  
Abdelkamel Tari ◽  
Peter Bertok
Keyword(s):  
Web Services ◽  
Access Control ◽  
Flow Control ◽  
Information Flow ◽  
Information Flow Control ◽  
User Access ◽  
Web Services Security ◽  
Information Confidentiality ◽  
Security Standards

With the advancement of web services technology, security has become an increasingly important issue. Various security standards have been developed to secure web services at the transport and message level, but application level has received less attention. The security solutions at the application level focus on access control which cannot alone ensure the confidentiality and integrity of information. The solution proposed in this paper consists on a hybrid model that combines access control (AC) and information flow control (IFC). The AC mechanism uses the concept of roles and attributes to control user access to web services' methods. The IFC mechanism uses labels to control how the roles access to the system's objects and verify the information flows between them to ensure the information confidentiality and integrity. This manuscript describes the model, gives the demonstration of the IFC model safety, presents the modeling and implementation of the model and a case study.

Building Innovative Secure and Interoperable e-government Services

2008 ◽  
pp. 228-256
Author(s):  
A. Kaliontzoglou ◽  
T. Karantjias ◽  
D. Polemi
Keyword(s):  
Web Services ◽  
Systematic Approach ◽  
New Technologies ◽  
Use Cases ◽  
Public Key ◽  
Government Services

Research into initiatives worldwide shows that although some of the legal and or-ganizational barriers for the adoption of new technologies in e-government have been lifted, there are still not many implementations of actual e-government ser-vices that have been designed based on a common and systematic approach. The prevailing requirements for e-government services, interoperability and security, pose major challenges to e-government architects and it is now being slowly un-derstood that Web services in combination with public key infrastructures may provide the necessary solutions. In this context, this chapter presents three innova-tive e-government services based on these technologies, focusing on their security and interoperability aspects. The goal of the chapter is to demonstrate the ser-vices’ specifications and use cases so that they may act as examples for further re-search and development.

The Repercussions of the Adoption of Information Technology in Co-Operative Innovation

2006 ◽  
pp. 122-152 ◽  
Author(s):  
Cristina Bayona-Saez ◽  
Teresa Garcia-Marco
Keyword(s):  
Information Technology ◽  
Empirical Analysis ◽  
Communication Networks ◽  
Internet Access ◽  
Collaborative Innovation ◽  
Cooperative Agreements ◽  
Information And Communication ◽  
Types Of Information ◽  
The Empirical Analysis ◽  
E Mail

The aim of this chapter is to analyse what repercussion the adoption of certain types of information and communication technology (ICT), by firms, may have on collaborative innovation. It is our belief that tools such as Internet access, e-mail, and the presence of internal and inter-organisational communication networks, will promote and facilitate the signing of cooperative agreements. The empirical analysis performed on a sample of 1,649 firms partially confirms this intuition, since the existence of a network, bringing the firm into contact with its subcontractors, customers, and/or suppliers, increases the propensity of firms to cooperate in innovation.

Sign in / Sign up

Export Citation Format

Share Document