Running head: PUBLIC-KEY CRYPTOGRAPHY

!1

Public-Key Cryptography: An Annotated Bibliography Morgan Walker Chapin High School

PUBLIC KEY CRYPTOGRAPHY Public-Key Cryptography: An Annotated Bibliography There are many applications for public-key cryptography, ranging all the way from nuclear treaty verification to email security, but most systems of encryption and sender verification are used very similarly, no matter their purpose. Another aspect of public-key cryptology is the large amount of trust models in use. These are necessary for key distribution and verification, and some examples include direct trust, web of trust, and hierarchical model. Many of these models assume that trust is transitive, which can be a disastrous assumption. These documents all relate to public-key encryption and verification in some way. Most deal with the basic mechanics of public-key cryptography, although the articles by Herald et al. and Herzeberg et al. are about extensions of conventional trust models rather than basics of public-key cryptography systems. Most of the texts greatly increased my understanding of public-key encryption and verification, although the texts that contained extensions of conventional trust models were (for the most part) too complex for me to understand completely without a higher level education in mathematics.

!2

Abdul-Rahman, A. (1997, April). The pgp trust model. In EDI-Forum: the Journal of Electronic Commerce (Vol. 10, No. 3, pp. 27-31). This is an explanation of the basic structure of the PGP, or "Pretty Good Privacy," trust model. The article shows how PGP's trust model contrasts drastically with the conventional hierarchical trust architecture in most other encryption and authentication systems. Abdul-Rahman also explains how, while PGP was a large improvement in public acquisition of privacy mechanisms, it was only meant as an email encryption

PUBLIC KEY CRYPTOGRAPHY service and is too simple for anything more complex than that. This article was very helpful to me because it contained a concise description of PGP's function, something

!3

that had been extremely difficult to obtain. It also helped me understand the advantages as well as the vulnerabilities and complications of this type of trust model. Diffie, W. (1988). The first ten years of public-key cryptography. Proceedings of the IEEE, 76(5), 560-577. This article summarizes the history of public-key cryptography, which originated in 1975 because of problems with key distribution and signatures. It has since become the main method of encryption and verification in electronic communications, and it has generally replaced symmetric cryptography in the cyber-security field. Public-key cryptography is based on a set of two inverse keys (one public and one private) with the following properties: anything encrypted by one can be decrypted by the other, and given the public key, it is impossible to determine the private key. This article chronicles some of the major failures of public-key cryptography, the most important being the breaking of the knapsack function. While this is a valuable resource that explains the basis of public-key cryptography relatively simply, it was written in 1988, which means it does not contain information about the most recent developments in this field. Herald, S., Clarke, S., & Christianson, B. (2010). A non-transitive trust model for key distribution. Journal of Information Assurance and Security. In this article, Herald et al. describe a key distribution model that does not rely on transitive trust, instead using a new idea known as trust*. (In the model, trust is classified into three trust models: Direct Trust, Hierarchical Trust, and Web of Trust.)

PUBLIC KEY CRYPTOGRAPHY While the trust model used in common key distribution systems such as PGP (a web of

!4

trust-based system) and PKI (hierarchical trust system) assume trust to be transitive, this can be a problematic assumption. This model eliminates the need for reliance on third parties and instead uses guarantees for the validity of a public key, obtained from those the trust*er trusts directly.. This article offered an interesting viewpoint on the modification of conventional trust mechanisms, and expanded on basic concepts of public-key cryptography and the web of trust to introduce a more secure model. However, it did not help me to understand the basic concepts of trust models themselves. Herzberg, A., Mass, Y., Mihaeli, J., Naor, D., & Ravid, Y. (2000). Access control meets public key infrastructure, or: Assigning roles to strangers. In Security and Privacy, 2000. S&P 2000. Proceedings. 2000 IEEE Symposium on (pp. 2-14). IEEE. In this article, Herzeberg et al. describe the uses of a dual key system in access control. Users will use their public and private keys to log in to the system, and unverified certificates will be placed in a Trust Establishment system, which will determine the role of each new user. Applications of this include eBusiness and the use of anonymous medical data for research. This article is extremely informative and strongly assisted in my understanding of the applications of public-key cryptography. Menezes, A. J., Van Oorschot, P. C., & Vanstone, S. A. (1997). Overview of cryptography. In Handbook of applied cryptography (pp. 25-33). Boca Raton, FL: CRC Press. This chapter from the Handbook of Applied Cryptology provides an overview of the methods and functions of public-key cryptography, including digital signatures and

PUBLIC KEY CRYPTOGRAPHY encryption. Plaintext is encrypted using one-way trapdoor functions and the public key that can only be undone with the inverse (private) key. It also compares symmetric-key cryptography to public-key cryptography. Authentication is also an essential part of public-key cryptography, because anyone can encrypt a message with your public key that only you can read. Therefore, plaintext is encrypted twice: once with your public key, and once with the senders private key (the outer lock comes off with the senders public key, and the inner lock comes off with your private key). This is, by

!5

far, the most comprehensive guide to public key cryptography out of these five sources, and it is indispensable when it comes to basic aspects of public-key cryptography.