iTP Secure WebServer System Administrator's Guide (iTPWebSvr 6.0+)

Security Concepts

iTP Secure WebServer System Administrator’s Guide—523346-002

D-2

Authentication

If Capulet, Juliet’s father, were to intercept Romeo’s ciphertext during transmission, he

could not read Romeo’s message unless he could access Juliet’s decryption key or

broke the code by some other means.

Juliet’s decryption key might be the same secret key Romeo uses to encrypt his

messages to Juliet, or it might be the private component of a public/private key pair:

Romeo uses Juliet’s public key to encrypt his message, then Juliet uses the associated

private key to decrypt it.

For a discussion about public keys, see Public Key Systems on page D-3.

Authentication

Authentication is encryption’s complement. While encryption ensures against

eavesdroppers, authentication ensures against imposters. Often, it is not enough to

ensure that only its intended receiver can read a message; there must also be a way to

verify that the sender of a message is in fact who he or she says they are. In fact, used

alone, encryption can make a message appear to be what it is not: an authentic

message from a authentic sender.

Authentication often employs digital signatures, which are pieces of data that function

for digital documents much as handwritten signatures function for printed documents.

Digital signatures are both unique and unforgeable. Many authentication systems,

therefore, consist of two parts: (1) a method of applying a unique, unforgeable digital

signature to a message and (2) a method of verifying the authenticity of a digital

signature that has been applied to a message.

Capulet, posing as Romeo, might send a message to Juliet. Capulet’s message might

even be encrypted, using Juliet’s public encryption key. However, when Juliet tests the

digital signature on the message, she discovers that it does not match Romeo’s. She

knows, therefore, she has received a bogus message.

Figure D-1. Basic Encryption

Romeo

Encryption

Key

Juliet

Decryption

Key

CDT008.CDD