|
 HP Open Source Security for OpenVMS Volume 1:... |
|
| |
AAL Application Adaptation Layer (AAL).
AC Authorization Computation service provider module.Synonymous with Authorization Computation Module (ACM).
Accountability A mechanism whereby the action of a user or a machinecan be traced to that user or machine. A user's action may be auditedand stored in a data bank called an audit trail. Subsequent searchingof the audit trail can match events to the event instigator. Inthe commercial world, accountability is important to establish accurate billingprocedures.
Application Adaptation Layer (AAL) An interface between CDSA and applications designed touse CDSA services.
Asymmetric Algorithms Cryptographic algorithms using one key to encryptand a second key to decrypt. They are often called public-key algorithms.One key is called the public key, and the other is called the privatekey or secret key.
Attach A process whereby an application obtains a serviceprovider module handle, via an ATTACH call to CSSM. A service providermodule can be a dynamic load module added at runtime on demand ora statically resident module.
Authentication A user or machine's identity must be establishedbefore establishing a connection to a computer. Authentication isthe process of proving identity to the satisfaction of the permission-grantingauthority.
Authorization Permission for an entity to perform an action uponan object. Authorization is evaluated by a set of access controlrules. Evaluation typically includes authentication of the requestingentity. The result of the evaluation should be conveyed to an agentthat can enable the requested action upon the target object.
Biometric input The gathering of data from a personal, unique source,such as fingerprints, retina patterns, or human voice, for the purposesof verification or authorization.
BSAFE A cryptographic toolkit from RSA Data Security Incorporated.
CDSA Common Data Security Architecture (CDSA).
Certificate A combination of an asymmetric public key and otheridentifying private information, which is digitally signed by aprivate key so it can be verified. Digital certificate
Certificate chain The hierarchical chain of all other certificatesused to sign the current certificate. This includes the CertificateAuthority (CA) who signs the certificate, the CA who signed thatCA's certificate, and so on. There is no limit to the depth of thecertificate chain.
Certificate signing The Certificate Authority (CA) can sign certificatesit issues or cosign certificates issued by another CA. In a generalsigning model, an object signs an arbitrary set of one or more objects. Hence,any number of signers can attest to an arbitrary set of objects.The arbitrary objects could be, for example, pieces of a documentfor libraries of executable code.
Certificate validity date A start date and a stop date for the validity ofa certificate. If a certificate expires, the Certificate Authority(CA) may issue a new certificate.
Certification Authority An entity that guarantees or sponsors a certificate.For example, a credit card company signs a cardholder's certificateto ensure that the cardholder is who he or she claims to be. Thecredit card company is a certificate authority. Certificate authoritiesissue, verify, and revoke certificates.
CL Certificate Library service provider module. Synonymouswith Certificate Library Module (CLM).
Common Data Security Architecture (CDSA) A set of layered security services that address communicationsand data security problems in the emerging Internet and Intranetapplication space. CDSA consists of three basic layers:
Common Security Services Manager (CSSM) The central layer of the Common Data Security Architecture(CDSA) that defines the following service components:
Confidentiality Information is revealed only to those who are authorizedto see it. Confidentiality can be provided through an authorizationand access control mechanism. It can also be provided through encryptionand decryption operations, which limit data access to those whopossess the cryptographic keys required to decrypt the information.
Cryptographic algorithm A method or defined mathematical process for implementinga cryptography operation. A Cryptographic algorithm may specifythe procedure for encrypting and decrypting a byte stream, digitallysigning an object, computing the hash of an object, or generatinga random number.
Cryptographic Service Providers (CSPs) Modules that provide secure key storage and cryptographicfunctions. The modules may be software only or hardware with softwaredrivers. The cryptographic functions provided may include:
Cryptography The art and science of using mathematics to secureinformation and create a high degree of trust in the electronicmedia.
Cryptoki The name of the PKCS#11 Version 1.0 standard publishedby RSA Laboratories. The standard specifies the interface for accessing cryptographicservices performed by a removable device. For additional information,refer to http://www.rsasecurity.com.
CSP Cryptographic Service Providers (CSPs).
CSSM Common Security Services Manager (CSSM).
Digital certificate The binding of some identification to a public keyin a particular domain, as attested to directly or indirectly bythe digital signature of the owner of that domain. A digital certificateis an unforgeable credential in cyberspace. The certificate is issuedby a trusted authority and covered by that party's digital signature.The certificate may attest to the certificate holder's identityor may authorize certain actions by the certificate holder. A certificatemay include multiple signatures and may attest to multiple objectsor multiple actions.
Digital signature A data block that was created by applying a cryptographicsigning algorithm to some other data using a secret key. Digitalsignatures may be used to:
DL Database Library service provider module.
EISL Embedded Integrity Services Library.
EMM Elective module manager.
ESW Electronic shrink-wrap. A term used to refer to anaggregate collection of data files identified by a manifest or billof materials.
Generic Cryptographic Services (GCS) A set of services and associated APIs designed toprovide key-based cryptographic operations to applications. GCSpredates CDSA. GCS requirements were based on early hardware-basedcryptographic devices where cryptographic keys were retained withinthe device. Some Internet applications require the secured transmissionof cryptographic keys. The CDSA Cryptographic Service APIs accommodate bothtypes of requirements.
Generic Security Services (GSS) A set of services and associated APIs defined bythe International Engineering Task Force (IETF). The defined APIs supportconcurrent applications in authenticating each other, delegatingrights and privileges to each other, and using confidentiality andintegrity verification services to secure communications betweenthe applications.
GUID Globally unique identifier.
Hash algorithm A cryptographic algorithm used to compress a variable-sizeinput stream into a unique, fixed-size output value. The functionis one-way, meaning the input value cannot be derived from the outputvalue. A cryptographically strong hash algorithm is collision-free,meaning unique input values produce unique output values. Hashingis typically used in digital signing algorithms. Example hash algorithmsinclude MD and MD2 from RSA Data Security. MD5, also from RSA DataSecurity, hashes a variable-size input stream into a 128-bit outputvalue. SHA, a Secure Hash Algorithm published by the U.S. Government,produces a 160-bit hash value from a variable-size input stream.
HRS Human Recognition Services. HRS is a CSSM ElectiveModule Manager intended to provide a high-level generic authenticationmodel suited for any form of human authentication. Particular emphasishas been made in the design on its suitability for authenticationusing biometric technology.
Integrity Information is said to have integrity if that datahas not been modified or altered since the point in time when anauthorized agent intended the data to be static. Information integrityis important for all data types including authorization data and authenticationcredentials.
Key Management Public-private key pairs are items that need tobe securely managed. A key may be lost, stolen, or compromised.If this happens, the key (and in fact, the key pair) must be nulled. Whatevertask the key was used for, a new key must be issued and used. Inthe case of the lost key, a duplicate should be available. If not,the data protected by the lost key may itself be lost. The null publickey must be advertised as invalid. It will be listed in a data bankcalled a revocation list. The new public key must be distributedto those entitled to have it.
Leaf certificate The certificate in a certificate chain that hasnot been used to sign another certificate in that chain. The leafcertificate is signed directly or transitively by all other certificatesin the chain.
Manifest A digital signature of a file, created using certificates. The digital signature takes the form of a separate file calleda manifest. The manifest contains the encrypted digest of the targetfile and the X509 certificates of the signers. This data is sufficientto guarantee the identity of the signer of a file and the authenticityof the file's contents.
MDS Module Directory Services (MDS).
Message Digest The digital fingerprint of an input stream. A cryptographichash function is applied to an input message of arbitrary lengthand returns a fixed-size output, which is called the digest value.
Meta-information Descriptive information specified by a service providermodule and stored in MDS. This information advertises the module's services.CSSM supports application queries for this information. The informationmay change at runtime.
Module Directory Services (MDS) A platform-independent registration service for managingexecutable code modules and their associated signed integrity credentials.
Nonce A nonrepeating value, usually but not necessarilyrandom.
OID Object identifier.
Owned certificate A certificate whose associated private key residesin a local CSP. Digital signature algorithms require the privatekey when signing data. A system may supply certificates it ownsalong with signed data to allow others to verify the signature.A system uses certificates that it does not own to verify signaturescreated by others.
PKI Public Key Infrastructure (PKI).
Private key The cryptographic key used to decipher or sign messagesin public-key cryptography. This key is kept secret by its owner.
Public key The cryptographic key used to encrypt messages inpublic-key cryptography. The public key is available to multipleusers (for example, the public).
Public Key Infrastructure (PKI) The agreed infrastructure, ultimately to be appliedworldwide, in which secure electronic business (eCommerce, banking,legal transactions) and secure electronic welfare (medical welfare,state and government provision for pensions, social security, andso forth) can function securely using the private-public key methodof cryptography.
PVC Pointer validation checking.
Random number generator A function that generates cryptographically strongrandom numbers that cannot be easily guessed by an attacker. Randomnumbers are often used to generate session keys.
Root certificate The prime certificate, such as the official certificateof a corporation or government entity. The root certificate is positionedat the top of the certificate hierarchy in its domain, and it guaranteesthe other certificates in its certificate chain. The root certificate'spublic key is the foundation of signature verification in its domain.
RSA RSA Data Security, Incorporated, Bedford, MA. Producersof the BSAFE toolkit.
Secret key A cryptographic key used with symmetric algorithms,usually to provide confidentiality.
Secure Electronic Transaction (SET) A specification designed to utilize technology for authenticatingthe parties involved in payment card purchases on any type of onlinenetwork, including the Internet. SET focuses on maintaining confidentialityof information, ensuring message integrity, and authenticating theparties involved in a transaction. More information about SET is availableat: http://www.setco.org/.Secure Sockets Layer (SSL)
Secure Sockets Layer (SSL) Also known as Above Transport Layer Security (TLS).A security protocol that prevents eavesdropping, tampering, or message forgeryover the Internet. An SSL service negotiates a secure session betweentwo communicating endpoints. Basic facilities include certificate-based authentication,end-to-end data integrity, and optional data privacy. SSL has beensubmitted to the IETF as an Internet Draft for Transport Layer Security(TLS).
Security context A control structure that retains state informationshared between a cryptographic service provider and the applicationagent requesting service from the CSP. A security context specifiesCSP and application-specific values, such as required key lengthand desired hash functions.
Security infrastructure An agreed infrastructure for the security of allelectronic data transfer. Such an infrastructure would, in theory,lessen the need for organizations to construct trust domains. An internationalsecurity infrastructure would facilitate the creation of a secureInternet. Presently, global efforts are more focussed on an architecturefor Public Key Infrastructure, seen by many as the blueprint forthe infrastructure that will facilitate eCommerce.
Security perimeter A conceptual perimeter or boundary of a computersystem or local area network inside which the security is at a known levelof competence. If data is required to cross this perimeter, it isprudent to pass all such data through a firewall.
Security-relevant event An event where a CSP-provided function is performed,a security service provider module is loaded, or a breach of systemsecurity is detected.
Security risk assessment An exercise performed by specialists to assess howvulnerable an enterprise is to various forms of security attack.The ideal outcome from this exercise is a recommended range of securitymeasures, hardware, software, and procedural, which give a levelof protection commensurate with the value of the assets that need tobe protected.
Session key A cryptographic key used to encrypt and decryptdata. The key is shared by two or more communicating parties, whouse the key to ensure privacy of the exchanged data.
SET Secure Electronic Transaction (SET).
Signature Digital Signature.
Signature chain The hierarchical chain of signers, from the rootcertificate to the leaf certificate, in a certificate chain.
Signing and sealing The electronic equivalent to the handwritten signatureand the secure strong room. Precise ways of performing these actionsmay vary, but signing by digital signature and sealing (for transportor storage) by encryption is evolving towards internationally agreedprotocols which will be acceptable to the commercial world, thelegal profession, and governments.
Single sign-on A mechanism whereby a single action of user authenticationand authorization can permit a user to access all computers andsystems where he has access permission, without the need to entermultiple passwords. Single sign-on reduces human error, a majorcomponent of systems failure.
SmartCard A card of the same dimensions as the magnetic-stripecredit card, but containing processing ability and memory storagespace. Because the card can contain storage credentials and cryptographickeys and perform encryption/decryption operations, its power asa tamper-proof personal token for authentication makes it very attractiveto a whole range of computer applications.
SPI Service provider interface.
SPKI Simple public key infrastructure. Information aboutSPKI can be found at http://www.ietf.org/html.charters/spki-charter.html.
SSL Secure Sockets Layer (SSL).
SSLeay A free implementation of the Secure Sockets Layer. Secure Sockets Layer (SSL)
Symmetric algorithms Cryptographic algorithms that use a single secretkey for encryption and decryption. Both the sender and receivermust know the secret key. Well known symmetric functions includeDES (Data Encryption Standard) and IDEA. DES was endorsed by theU.S. Government as a standard in 1977. It's an encryption blockcipher that operates on 64-bit blocks with a 56-bit key. It is designedto be implemented in hardware, and works well for bulk encryption.IDEA (International Data Encryption Algorithm) uses a 128-bit key.
Token The logical view of a cryptographic device, as definedby a CSP's interface. A token can be hardware, a physical object,or software. A token contains information about its owner in digitalform and about the services it provides for electronic-commerceand other communication applications. A token is a secure device.It may provide a limited or a broad range of cryptographic functions.Examples of hardware tokens are SmartCards and PMCIA cards.
TP Trust Policy service provider module. Synonymouswith Trust Policy Module (TPM).
Trust domains A designated virtual area that has a known and acceptedlevel of security, and thus a known and accepted level of trust.A local area network is an example of a domain that is likely to betrusted. Domains may be geographically wide ranging, and may bemade up of subdomains. A domain is only as trustworthy as its weakest component.
Verification A process performed to check the integrity of amessage, to determine the sender of a message, or both. Differentalgorithms are used to support different modes of verification.
A typical procedure supporting integrity verification is thecombination of a one-way hash function and a reversible digitalsignaturing algorithm. A one-way hash of the message is computed.The hash value is signed by encrypting it with a private key. The messageand the encrypted hash value are sent to a receiver. The recipientrecomputes the one-way hash, decrypts the signed hash value, andcompares it with the computed hash. If the values match, then themessage has not been tampered since it was signed.
The identity of a sender can be verified by a challenge-responseprotocol. The recipient sends the message sender a random challengevalue. The original sender uses its private key to sign the challengevalue and returns the result to the receiver. The receiver usesthe corresponding public key to verify the signature over the challengevalue. If the signature is valid, the sender is the holder of theprivate key. If the receiver can reliably associate the correspondingpublic key with the named/known entity, then the identity of thesender is said to have been verified.
Web of trust A trust network among people who know and communicatewith each other. Digital certificates are used to represent entitiesin the web of trust. Any pair of entities can determine the extentof trust between the two, based on their relationship in the web.
X509v3 X.509 Version 3. This standard defines the contentsand structure of a digital certificate. The specification is ITU-TRecommendation X.509, Data Networks and Open System Communications Directory:Authentication Framework, 06/97. This certificate format constitutesa widely accepted basis for a public key infrastructure. To supportthe PKI, certificates of this form are digitally signed and issuedby certification authorities (CAs).
|
