Symmetric Key Cryptography provides confidentiality, authentication,
and integrity. You can think of authentication in this case as
a "weak" form of authentication for the following reasons:
Basis: only the Alice AND Bob know the key to encrypt or decrypt the
message.
1) So if Bob is able to decrypt the message then the Bob knows it
came from Alice since he knows he did not send it.
2) Bob cannot prove to anyone else (say Clyde) that the message came
from Alice since any such message could have been produced by either
Alice or Bob. This later case is referred to as non-repudiation.
Asymmetric cryptography CAN provide encryption (confidentiality and
integrity), authentication, key exchange, and non-repudiation.
Basis: A message encrypted by Alice (in Alice's private key) can be
decrypted by anybody (from Alice's public) key, but only could have
been encrypted by Alice (since Alice's public key decrypts the
message).
a) The receiver of Alice's message (Bob) can show the still
encrypted message to anybody, who can then independently verify the
message came from Alice (by decrypting the message using Alice's
public key).
The Shon Harris book glosses over the difference
between "authentication" (in the symmetric crypto sense) and non-
repudiation. Also be careful about the information in a lot of these
books regarding the capabilities of the various assymetric
algorithms. A couple of key points are as follows:
D-H: key exchange only
El Gamal: Key Exchange, Encryption (C and I), and Non-repudiation
RSA: Key Exchange, Encryption (C and I), and Non-repudiation
Regards,
Doug Landoll, CISSP, CISA
President, Veridyn Inc
(512) 310-2228
--- In CISSP-Discuss@yahoogroups.com, Vijay Kumar <vijaychhipa@y...>
wrote:
Manish
Your comments are in-line with what is logical. However the Shon
Harris
book mentioned that authentication can not be had with Symmetric
only encryption.
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/CISSP-Discuss/
<*> To unsubscribe from this group, send an email to:
CISSP-Discuss-unsubscribe@yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
