Management of Symmetric Keys for Electronic Commerce and EDI over the Internet
Symmetric Encryption of Bulk Messages and Transactions
symmetric key encryption algorithms are recommended
Basis of Symmetric Encryption
shared secret key between trading partners
a random symmetric key must be generated and agreed upon
the key must be securely exchanged between trading partners
both trading partners encrypt and decrypt using the same key
Basis of Symmetric Encryption (cont)
a process is necessary to invalidate symmetric keys that have been compromised or need changing
arrangements must be similarly made with every trading partner
Problems with Traditional Symmetric Key Management Schemes
management and distribution of symmetric keys can be cumbersome and insecure
origin authenticity cannot be proved
two parties share the secret encryption key
any transaction could have been sent by either party
Needs Regarding Key Management of Symmetric Keys for Use in Electronic Commerce
a method to manage the symmetric encryption keys used for encrypting messages and EDI interchanges on a message/transaction basis
simplification of the methodology used to generate, maintain, and distribute symmetric encryption keys
security in the method of distribution of symmetric keys between trading partners
Steps for Using Public Key Cryptography for Symmetric Key Management - Sender
1) EDI Translator outputs EDI Interchange
2) Random symmetric key of specified length is generated
3) EDI Interchange is encrypted using the randomly generated symmetric key with the chosen symmetric encryption algorithm
Sender Steps (cont)
4) Random symmetric key is encrypted using the receiving trading partner’s public asymmetric key
5) Encrypted symmetric key and encrypted EDI Interchange are enveloped and sent to receiving trading partner
Steps for Using Public Key Cryptography for Symmetric Key Management - Receiver
1) Symmetric key is decrypted using receiving trading partner’s private key
2) Decrypted symmetric key is used to decrypt the EDI Interchange
3) Decrypted EDI Interchange is routed to the EDI translator
Benefits of Using Public Key Cryptography to Manage Symmetric Keys
simplifies the management of symmetric keys
makes the exchange of symmetric keys more secure
trading partners do not need to agree on secret symmetric keys as part of the trading partner agreement
origin authenticity problem inherent in pure symmetric key management schemes is solved
Benefits of Using Public Key Cryptography to Manage Symmetric Keys (cont)
a different symmetric key can be used for each exchange between trading partners
symmetric keys generated for each transaction (session keys) remove the requirement for maintenance of symmetric keys
invalidation of compromised or expired symmetric keys is no longer a problem
each symmetric key is only used one time with one message
Additional Security Benefits of Using Public Key Cryptography for Management of Symmetric Keys
if a symmetric key is compromised, only one message is affected
public key encryption provides a secure way to distribute symmetric keys
Additional Security Benefits of Using Public Key Cryptography for Management of Symmetric Keys (cont)
since only the receiving trading partner has knowledge of the private asymmetric key, only that trading partner can decrypt the symmetric key that was encrypted with the public asymmetric key -- and thus is the only one who can use the symmetric key to decrypt the message.
Issues to Implementing Public Key Cryptography for Management of Symmetric Keys
agreements between trading partners
use public key cryptography to manage symmetric keys
generate a symmetric key for each transaction or message
Issues to Implementing Public Key Cryptography for Management of Symmetric Keys (cont)
sufficient key lengths must be chosen with regard to the value of the interchanges so that brute force attacks are not worth the time or effort compared to the value of the interchange
Criteria for Choosing Public Key Algorithms
how secure is the algorithm?
how fast are current implementations of the algorithm?
if needed internationally is it available for international use or is it domestic only?
are APIs and tool kits available to implement the algorithms?
are the algorithms in frequent use?
Recommendations
RSA is recommended for managing and distributing symmetric encryption keys when doing Electronic Commerce over the Internet
it is a public-key encryption algorithm
it has become the defacto standard in its use for symmetric key management
S/MIME and PGP/MIME make use of the RSA encryption algorithm to encrypt/decrypt "session keys"
Recommendations for Key Lengths For Public Keys
in general asymmetric algorithms require longer keys to provide the same level of security as symmetric keys
if using RSA encryption to encrypt session keys, it is recommended that at least a 768 bit key used
for high dollar transactions it is recommended that at least a 1024 bit key be used.
Conclusions
symmetric keys should be used to encrypt transactions and messages
public key cryptography should be used to manage the symmetric keys