p. 361

1 - 2 Information Security Technology

Information security technology is computer technology used within the technological measures that are implemented as information security measures.

1-2-1 Cryptography

Cryptography is encryption technology implemented as measures against information leakage or measures against tapping of communications. Terminology that pertains to cryptography is defined as follows: · 2 questions

p. 362

(1) Common key cryptography

Common key cryptography (also known as symmetric key cryptography or secret key cryptography) is a method for performing encryption/decryption between parties that exchange data, using a common key. This encryption method performs both encryption and decryption using the same key, and therefore, the parties must in advance have a common key that is kept secret from third parties.

Typical methods of common key cryptography include AES (Advanced Encryption Standard) from the NIST (National Institute of Standards and Technology) which adopted the Rijndael method, TripleDES which repeats DES three times, and IDEA (International Data Encryption Algorithm) which repeats several rounds of the XOR (exclusive OR), addition, and multiplication operations. · 1 question

(2) Public key cryptography

Public key cryptography is a method that uses a pair of private key and public key. The private key is concealed by its owner, while the public key is disclosed or distributed, and is made usable by anyone. This cryptography can encrypt plain text by using one key, and can decrypt the cipher text with the other key. However, this does not mean that the public key is always used for encryption and the private key for decryption; rather, they are used according to purpose (see details later). In order to prevent decryption of encrypted text by third parties when measures against information leakage or measures against tapping of communications are taken, encryption is performed with the recipient’s public key, and decryption with the recipient’s private key. · 4 questions

p. 363

Typical methods of public key cryptography include RSA (from the initials of the three developers, Rivest, Shamir, and Adleman), ElGamal encryption which applies the discrete logarithm problem, and Elliptic Curve Cryptography which uses elliptic curve equations.

The strengths and weaknesses of common key cryptography and public key cryptography can be summarized as follows:

p. 364

(3) Session key cryptography (hybrid cryptography)

Session key cryptography (hybrid cryptography) uses public key cryptography for the transfer of keys, which has a weakness of common key cryptography, and performs encrypted communication using common key cryptography. · 1 question

In session key cryptography, common keys are generated using means such as a hash function (i.e., a function that obtains a unique, fixed-length output value from an input value) which is based on the communication session number or a random number. The generation of a common key is performed for each encrypted communication session, and the key is transferred using public key cryptography. For that reason, damage is limited even if the common key is leaked. In addition, since only one pair of public key and private key usually needs to be managed, management of keys is simple, and encrypted communication can be carried out at high speed by using common key cryptography. In other words, this approach can be said to combine the strengths of common key cryptography and public key cryptography. However, even session key cryptography is not able to eliminate the possibility of spoofing.

p. 365