Digital certificates and PKI provide authentication, digital signing of documents, and encryption. Digital certificates can authenticate individuals and machines, digitally sign emails and documents to verify authenticity and integrity, and encrypt information for privacy and security both in transit and at rest. At UW-Madison, many departments and offices use digital certificates including DoIT, UW Police, the Registrar's Office, and the Medical School. Other organizations that use them include the US Department of Defense, Western European countries, and large companies like Johnson & Johnson. Digital certificates need to reach critical mass to provide security benefits, but provide assurances and keep private information private.

1. PKI & Personal Digital Certificates,
The Key to Securing Sensitive
Electronic Communications
MATC
April 22, 2010
Nicholas Davis

2. Overview
Why is electronic privacy such a hot
topic these days?
Watch video
What is a digital certificate?
What is PKI?
Why are these technologies important?
Trusted Root Authorities
Using digital certificates for email encryption
Key Escrow, the double edged sword
Integrating digital certificates into email for
security
New uses for digital certificates
How is PKI related to SSL?
Using certificates for code signing of
software
NSA conspiracy theories
Real world issues with PKI
Discussion

3. Why is Electronic Privacy
Such a Hot Topic Today?
• Evolution of the Internet,
commerce, banking, healthcare
• Dependence on Email
• Government regulations, SOX,
HIPAA, GLB, PCI, FERPA
• Public Image
• Business warehousing
• Industrial Espionage
• The United States government!

4. The Topic is More Interesting
When It Affects You!

5. Intercepting Your Electronic
Communications

6. Digital certificates can
protect your
sensitive electronic
information in multiple
Ways
Encryption, Digital Signing and
Authentication

7. Discussion Topic One
• Do you think the threat of Email
eavesdropping is real?
• What about the government’s argument
about Email being like a “postcard?”
• Should DOA be allowed to look at
DWD emails on a public network?
• Are you angry now, or just afraid?
• Who has the responsibility in this
situation?

8. What is a Digital Certificate?

9. Digital Certificate Terminology
Defined
Digital Certificate
Electronic Passport
Good for authentication
Good non-repudiation
Proof of authorship
Proof of non-altered content
Encryption!
Better than username - password

10. What is in a Certificate?

11. Public and Private Keys
The digital certificate has two parts, a
PUBLIC key and a PRIVATE key
The Public Key is distributed to
everyone
The Private Key is held very closely
And NEVER shared
Public Key is used for encryption and
verification of a digital signature
Private Key is used for Digital signing and
decryption

12. Public Key Cryptography

13. Getting Someone’s Public Key
The Public Key must be shared to be
Useful
It can be included as part of your
Email signature
It can be looked up in an LDAP
Directory
Can you think of the advantages and
disadvantages of each method?

14. Who Could This Public Key
Possibly Belong To?

15. What is PKI?
• PKI is an acronym for Public Key
Infrastructure
• It is the system which manages and
controls the lifecycle of digital
certificates
• The PKI has many features

16. What Is In a PKI?
• Credentialing of individuals
• Generating certificates
• Distributing certificates
• Keeping copies of certificates
• Reissuing certificates
• Revoking Certificates

17. Credentialing
• Non technical, but the most
important part of a PKI!
• A certificate is only as trustworthy as
the underlying credentialing and
management system
• Certificate Policies and Certificate
Practices Statement

18. Certificate Generation and Storage
• How do you know who you are
dealing with in the generation
process?
• Where you keep the certificate is
important

19. Distributing Certificates
• Can be done
remotely – benefits
and drawbacks
• Can be done face
to face – benefits
and drawbacks

20. Keeping Copies – Key Escrow
• Benefit –
Available in case
of emergency
• Drawback – Can
be stolen
• Compromise is
the best!
• Use Audit Trails,
separation of
duties and good
accounting
controls for key
escrow

21. Certificate Renewal
• Just like your passport, digital certificates
expire
• This is for the safety of the organization
and those who do business with it
• Short lifetime – more assurance of
validity but a pain to renew
• Long lifetime – less assurance of validity,
but easier to manage
• Use a Certificate Revocation List if you
are unsure of certificate validity

22. Trusted Root Authorities
• A certificate issuer
recognized by all
computers around
the globe
• Root certificates
are stored in the
computer’s central
certificate store
• Requires a
stringent audit and
a lot of money!

23. It Is All About Trust

24. Using Certificates to Secure Email
• Best use for certificates, in my
opinion
• Digital certificate provides proof that
the email did indeed come from the
purported sender
• Public key enables encryption and
ensures that the message can only
be read by the intended recipient

25. Secure Email is Called
S/MIME
• S/MIME = Secure
Multipurpose Mail
Extensions
• S/MIME is the
industry standard,
not a point
solution, unique to
a specific vendor

26. Using Certificates For
Authentication

27. Digital Certificates
• A digital passport,
either contained on a
secure device, or on
a hard disk
• Secured with a
password, making
them truly a dual
factor solution
• Can be used to
authenticate
machines as well as
humans

28. Digital Certificate Benefits
• True Dual Factor Authentication
• Low variable cost to produce
• Can contain authorization data as
well as authentication data

29. Digital Certificate Drawbacks
• High fixed cost to build initial
infrastructure
• Can be copied and shared if not
properly stored
• Expiration
• Often require access to an interface
such as a card reader of USB port,
not always available at kiosks

30. Digital Signing of Email
• Proves that the email came from
you
• Invalidates plausible denial
• Proves through a checksum that the
contents of the email were not
altered while in transit
• Provides a mechanism to distribute
your public key
• Does NOT prove when you sent the
email

31. Using Digital Certificates for Digital
Signing

32. Digital Signatures Do Not Prove When
a Message or Document Was Signed
You need a
neutral third party
time stamping
service, similar to
how hostages
often have their
pictures taken in
front of a
newspaper to
prove they are still
alive!

33. Send Me a Signed Email, Please,
I Need Your Public Key

34. What Does a Digital Signature Prove?
Provides proof that the
email came from the
purported sender…Is
this email really from
Britney Spears?
Provides proof that the
contents of the email
have not been altered
from the original form

35. A Digital Signature Can Be Invalid For
Many Reasons

36. Why Is The Digital Signature of the
Sender So Important?

37. What if This Happens at MATC?
Could cause harm in
a critical situation
Case Scenario
Multiple hoax emails
sent with Chancellor’s
name and email.
When real crisis
arrives, people might
not believe the
warning.
It is all about trust!

38. Digital Signing Summary
• Provides proof of the
author
• Testifies to message
integrity
• Valuable for both
individual or mass
email
• Supported by
Wiscmail Web client
(used by 80% of
students)

39. Using Digital Certificates for
Encryption

40. What Encryption Does
Encrypting data with a
digital certificate
Secures it end to end.
• While in transit
• Across the network
• While sitting on email
servers
• While in storage
• On your desktop
computer
• On your laptop
computer
• On a server

41. Encryption Protects the Data At Rest
and In Transit
Physical theft from office
Physical theft from airport
Virtual theft over the network

42. Why Encryption is Important
• Keeps private information private
• HIPAA, FERPA, SOX, GLB compliance
• Proprietary research
• Human Resource issues
• Legal Issues
• PR Issues
• Industrial Espionage
• Over-intrusive Government
• You never know who is
listening and watching!

43. What does it actually look like in practice?
-Sending-

44. What does it actually look like in
practice (unlocking my private key)
-receiving-

45. What does it actually look like in practice?
-receiving- (decrypted)

46. Digitally signed and verified;
Encrypted

47. What does it look like in practice?
-receiving- (intercepted)

48. Intercepting the Data in Transit

49. Digital Certificates For Machines Too
• SSL – Secure
Socket Layer
• Protection of data
in transit
• Protection of data
at rest
• Where is the
greater threat?
• Our certs protect
both!

50. Case Study - Why the Registrar’s
Office Chose Digital Certificates
• Cost
• Easy Integration
• Security
• No individual
process
evaluation
• Leverages a
central, generic
resource
• Ability to inter-
communicate

51. Is the NSA Watching?
• Discussion of NSA_key in Microsoft
Operating System
• What about UW-Madison?

52. SUMMARY
• Authentication
• Digital Signing of Documents
• Encryption
• Digital certificates can do all of this!

53. Benefits of Using Digital
Certificates
Provide global assurance of your identity,
both internally and externally to the
UW-Madison
Provide assurance of message authenticity
and data integrity
Keeps private information private, end to
end, while in transit and storage
You don’t need to have a digital certificate
To verify someone else’s digital signature
Can be used for individual or generic mail
accounts.

54. Who Uses Digital Certificates
at UW-Madison?
DoIT
UW Police and Security
Office of the Registrar
Office of Financial Aid
Office of Admissions
Primate Research Lab
Medical School
Bucky Badger, because he’s a team
player and slightly paranoid about his
basketball plays being stolen

55. Who Uses Digital Certificates
Besides UW-Madison?
US Department of Defense
US Department of Homeland
Security
All Western European countries
New US Passport
Dartmouth College
University of Texas at Austin
Johnson & Johnson
Raytheon
Others

56. The Telephone Analogy
When the
telephone was
invented, it was
hard to sell.
It needed to
reach critical
mass and then
everyone wanted
one.

57. That All Sounds Great in Theory,
But Do I Really Need It?
• The world seems
to get along just
fine without digital
certificates…
• Oh, really?
• Let’s talk about
some recent
stories

58. We Have Internal Threats Too
@ UW-Madison!

59. How Do Users Feel About the
Technology?
• Ease of use
• Challenges
• Changes in how they do their daily
work
• Benefits
• Drawbacks

60. It Really Is Up To You!
• Digital certificates / PKI is not hard to
implement
• It provides end to end security of
sensitive communications
• It is comprehensive, not a mix of point
solutions
• You are the leaders of tomorrow, make
your choices count by pushing for
secure electronic communications!

61. How Can I Help You?
ndavis1@wisc.edu
http://www.cio.wisc.edu/security/digitalCert/