(I) A methodology used to provide fail-safe or fail-soft
termination and recovery of functions and processes when failures
are detected or occur in a system. [FP039]
$ Federal Information Processing Standards (FIPS)
(N) The Federal Information Processing Standards Publication (FIPS
PUB) series issued by the U.S. National Institute of Standards and
Technology as technical guidelines for U.S. Government
procurements of information processing system equipment and
services. [FP031, FP039, FP046, FP081, FP102, FP113, FP140, FP151,
FP180, FP185, FP186, FP188]
(C) Issued under the provisions of section 111(d) of the Federal
Property and Administrative Services Act of 1949 as amended by the
Computer Security Act of 1987, Public Law 100-235.
$ Federal Public-key Infrastructure (FPKI)
(N) A PKI being planned to establish facilities, specifications,
and policies needed by the U.S. Federal Government to use public-
key certificates for INFOSEC, COMSEC, and electronic commerce
involving unclassified but sensitive applications and interactions
between Federal agencies as well as with entities of other
branches of the Federal Government, state, and local governments,
business, and the public. [FPKI]
$ Federal Standard 1027
(N) An U.S. Government document defining emanation, anti-tamper,
security fault analysis, and manual key management criteria for
DES encryption devices, primary for OSI layer 2. Was renamed "FIPS
PUB 140" when responsibility for protecting unclassified,
sensitive information was transferred from NSA to NIST, and then
was superseded by FIPS PUB 140-1.
$ File Transfer Protocol (FTP)
(I) A TCP-based, application-layer, Internet Standard protocol
[R0959] for moving data files from one computer to another.
$ filtering router
(I) An internetwork router that selectively prevents the passage
of data packets according to a security policy.
(C) A filtering router may be used as a firewall or part of a
firewall. A router usually receives a packet from a network and
decides where to forward it on a second network. A filtering
router does the same, but first decides whether the packet should
be forwarded at all, according to some security policy. The policy
is implemented by rules (packet filters) loaded into the router.
The rules mostly involve values of data packet control fields
(especially IP source and destination addresses and TCP port
numbers). [R2179]
$ financial institution
(N) "An establishment responsible for facilitating customer-
initiated transactions or transmission of funds for the extension
of credit or the custody, loan, exchange, or issuance of money."
[SET2]
$ fingerprint
(I) A pattern of curves formed by the ridges on a fingertip. (See:
biometric authentication, thumbprint.)
(D) ISDs SHOULD NOT use this term as a synonym for "hash result"
because it mixes concepts in a potentially misleading way.
(D) ISDs SHOULD NOT use this term with the following PGP
definition, because the term and definition mix concepts in a
potentially misleading way and duplicate the meaning of "hash
result":
(O) PGP usage: A hash result used to authenticate a public key
(key fingerprint) or other data. [PGP]
$ FIPS
See: Federal Information Processing Standards.
$ FIPS PUB 140-1
(N) The U.S. Government standard [FP140] for security requirements
to be met by a cryptographic module used to protect unclassified
information in computer and communication systems. (See: Common
Criteria, FIPS, Federal Standard 1027.)
(C) The standard specifies four increasing levels (from "Level 1"
to "Level 4") of requirements to cover a wide range of potential
applications and environments. The requirements address basic
design and documentation, module interfaces, authorized roles and
services, physical security, software security, operating system
security, key management, cryptographic algorithms,
electromagnetic interference and electromagnetic compatibility
(EMI/EMC), and self-testing. NIST and the Canadian Communication
Security Establishment jointly certify modules.
$ firewall
(I) An internetwork gateway that restricts data communication
traffic to and from one of the connected networks (the one said to
be "inside" the firewall) and thus protects that network's system
resources against threats from the other network (the one that is
said to be "outside" the firewall). (See: guard, security
gateway.)
(C) A firewall typically protects a smaller, secure network (such
as a corporate LAN, or even just one host) from a larger network
(such as the Internet). The firewall is installed at the point
where the networks connect, and the firewall applies security
policy rules to control traffic that flows in and out of the
protected network.
(C) A firewall is not always a single computer. For example, a
firewall may consist of a pair of filtering routers and one or
more proxy servers running on one or more bastion hosts, all
connected to a small, dedicated LAN between the two routers. The
external router blocks attacks that use IP to break security (IP
address spoofing, source routing, packet fragments), while proxy
servers block attacks that would exploit a vulnerability in a
higher layer protocol or service. The internal router blocks
traffic from leaving the protected network except through the
proxy servers. The difficult part is defining criteria by which
packets are denied passage through the firewall, because a
firewall not only needs to keep intruders out, but usually also
needs to let authorized users in and out.
$ firmware
(I) Computer programs and data stored in hardware--typically in
read-only memory (ROM) or programmable read-only memory (PROM)--
such that the programs and data cannot be dynamically written or
modified during execution of the programs. (See: hardware,
software.)
$ FIRST
See: Forum of Incident Response and Security Teams.
$ flaw hypothesis methodology
(I) An evaluation or attack technique in which specifications and
documentation for a system are analyzed to hypothesize flaws in
the system. The list of hypothetical flaws is prioritized on the
basis of the estimated probability that a flaw exists and,
assuming it does, on the ease of exploiting it and the extent of
control or compromise it would provide. The prioritized list is
used to direct a penetration test or attack against the system.
[NCS04]
$ flooding
(I) An attack that attempts to cause a failure in (especially, in
the security of) a computer system or other data processing entity
by providing more input than the entity can process properly.
(See: denial of service.)
$ flow analysis
(I) An analysis performed on a nonprocedural formal system
specification that locates potential flows of information between
system variables. By assigning security levels to the variables,
the analysis can find some types of covert channels.
$ flow control
(I) A procedure or technique to ensure that information transfers
within a system are not made from one security level to another
security level, and especially not from a higher level to a lower
level. (See: covert channel, simple security property, confinement
property.)
$ formal specification
(I) A specification of hardware or software functionality in a
computer-readable language; usually a precise mathematical
description of the behavior of the system with the aim of
providing a correctness proof.
$ formulary
(I) A technique for enabling a decision to grant or deny access to
be made dynamically at the time the access is attempted, rather
than earlier when an access control list or ticket is created.
$ FORTEZZA(trademark)
(N) A registered trademark of NSA, used for a family of
interoperable security products that implement a NIST/NSA-approved
suite of cryptographic algorithms for digital signature, hash,
encryption, and key exchange. The products include a PC card that
contains a CAPSTONE chip, serial port modems, server boards, smart
cards, and software implementations.
$ Forum of Incident Response and Security Teams (FIRST)
(N) An international consortium of CSIRTs that work together to
handle computer security incidents and promote preventive
activities. (See: CSIRT, security incident.)
(C) FIRST was founded in 1990 and, as of September 1999, had
nearly 70 members spanning the globe. Its mission includes:
- Provide members with technical information, tools, methods,
assistance, and guidance.
- Coordinate proactive liaison activities and analytical support.
- Encourage development of quality products and services.
- Improve national and international information security for
government, private industry, academia, and the individual.
- Enhance the image and status of the CSIRT community.
$ forward secrecy
See: public-key forward secrecy.
$ FPKI
See: Federal Public-Key Infrastructure.
$ FTP
See: File Transfer Protocol.
$ gateway
(I) A relay mechanism that attaches to two (or more) computer
networks that have similar functions but dissimilar
implementations and that enables host computers on one network to
communicate with hosts on the other; an intermediate system that
is the interface between two computer networks. (See: bridge,
firewall, guard, internetwork, proxy server, router, and
subnetwork.)
(C) In theory, gateways are conceivable at any OSI layer. In
practice, they operate at OSI layer 3 (see: bridge, router) or
layer 7 (see: proxy server). When the two networks differ in the
protocol by which they offer service to hosts, the gateway may
translate one protocol into another or otherwise facilitate
interoperation of hosts (see: Internet Protocol).
$ GCA
See: geopolitical certificate authority.
$ GeneralizedTime
(N) The ASN.1 data type "GeneralizedTime" (specified in ISO 8601)
contains a calendar date (YYYYMMDD) and a time of day, which is
either (a) the local time, (b) the Coordinated Universal Time, or
(c) both the local time and an offset allowing Coordinated
Universal Time to be calculated. (See: Coordinated Universal Time,
UTCTime.)
$ Generic Security Service Application Program Interface (GSS-API)
(I) An Internet Standard protocol [R2078] that specifies calling
conventions by which an application (typically another
communication protocol) can obtain authentication, integrity, and
confidentiality security services independently of the underlying
security mechanisms and technologies, thus allowing the
application source code to be ported to different environments.
(C) "A GSS-API caller accepts tokens provided to it by its local
GSS-API implementation and transfers the tokens to a peer on a
remote system; that peer passes the received tokens to its local
GSS-API implementation for processing. The security services
available through GSS-API in this fashion are implementable (and
have been implemented) over a range of underlying mechanisms based
on [symmetric] and [asymmetric cryptography]." [R2078]
$ geopolitical certificate authority (GCA)
(O) SET usage: In a SET certification hierarchy, an optional level
that is certified by a BCA and that may certify cardholder CAs,
merchant CAs, and payment gateway CAs. Using GCAs enables a brand
to distribute responsibility for managing certificates to
geographic or political regions, so that brand policies can vary
between regions as needed.
$ Green Book
(D) Except as an explanatory appositive, ISDs SHOULD NOT use this
term as a synonym for "Defense Password Management Guideline"
[CSC2]. Instead, use the full proper name of the document or, in
subsequent references, a conventional abbreviation. (See: Rainbow
Series.)
(D) Usage note: To improve international comprehensibility of
Internet Standards and the Internet Standards Process, ISDs SHOULD
NOT use "cute" synonyms for document titles. No matter how popular
and clearly understood a nickname may be in one community, it is
likely to cause confusion in others. For example, several other
information system standards also are called "the Green Book". The
following are some examples:
- Each volume of 1992 ITU-T (at that time, CCITT) standards.
- "PostScript Language Program Design", Adobe Systems, Addison-
Wesley, 1988.
- IEEE 1003.1 POSIX Operating Systems Interface.
- "Smalltalk-80: Bits of History, Words of Advice", Glenn
Krasner, Addison-Wesley, 1983.
- "X/Open Compatibility Guide".
- A particular CD-ROM format developed by Phillips.
$ GRIP
(I) A contraction of "Guidelines and Recommendations for Security
Incident Processing", the name of the IETF working group that
seeks to facilitate consistent handling of security incidents in
the Internet community. (See: security incident.)
(C) Guidelines to be produced by the WG will address technology
vendors, network service providers, and response teams in their
roles assisting organizations in resolving security incidents.
These relationships are functional and can exist within and across
organizational boundaries.
$ GSS-API
See: Generic Security Service Application Program Interface.
$ guard
(I) A gateway that is interposed between two networks (or
computers, or other information systems) operating at different
security levels (one level is usually higher than the other) and
is trusted to mediate all information transfers between the two
levels, either to ensure that no sensitive information from the
first (higher) level is disclosed to the second (lower) level, or
to protect the integrity of data on the first (higher) level.
(See: firewall.)
$ guest login
See: anonymous login.
$ GULS
(I) Generic Upper Layer Security service element (ISO 11586), a
five-part standard for the exchange of security information and
security-transformation functions that protect confidentiality and
integrity of application data.
$ hacker
(I) Someone with a strong interest in computers, who enjoys
learning about them and experimenting with them. (See: cracker.)
(C) The recommended definition is the original meaning of the term
(circa 1960), which then had a neutral or positive connotation of
"someone who figures things out and makes something cool
happen". Today, the term is frequently misused, especially by
journalists, to have the pejorative meaning of cracker.
$ handle
(I) (1.) Verb: Perform processing operations on data, such as
receive and transmit, collect and disseminate, create and delete,
store and retrieve, read and write, and compare. (2.) Noun: An on-
line pseudonym, particularly one used by a cracker; derived from
citizens band radio culture.
$ hardware
(I) The material physical components of a computer system. (See:
firmware, software.)
$ hardware token
See: token.
$ hash code
(D) ISDs SHOULD NOT use this term (especially not as a synonym for
"hash result") because it mixes concepts in a potentially
misleading way. A hash result is not a "code" in any sense defined
by this glossary. (See: code, hash result, hash value, message
digest.)
$ hash function
(I) An algorithm that computes a value based on a data object
(such as a message or file; usually variable-length; possibly very
large), thereby mapping the data object to a smaller data object
(the "hash result") which is usually a fixed-size value. (See:
checksum, keyed hash.)
(O) "A (mathematical) function which maps values from a large
(possibly very large) domain into a smaller range. A 'good' hash
function is such that the results of applying the function to a
(large) set of values in the domain will be evenly distributed
(and apparently at random) over the range." [X509]
(C) The kind of hash function needed for security applications is
called a "cryptographic hash function", an algorithm for which it
is computationally infeasible (because no attack is significantly
more efficient than brute force) to find either (a) a data object
that maps to a pre-specified hash result (the "one-way" property)
or (b) two data objects that map to the same hash result (the
"collision-free" property). (See: MD2, MD4, MD5, SHA-1.)
(C) A cryptographic hash is "good" in the sense stated in the "O"
definition for hash function. Any change to an input data object
will, with high probability, result in a different hash result, so
that the result of a cryptographic hash makes a good checksum for
a data object.
$ hash result
(I) The output of a hash function. (See: hash code, hash value.)
(O) "The output produced by a hash function upon processing a
message" (where "message" is broadly defined as "a digital
representation of data"). [ABA] (The recommended definition is
compatible with this ABA definition, but we avoid the unusual
definition of "message".)
$ hash value
(D) ISDs SHOULD NOT use this term (especially not as a synonym for
"hash result", the output of a hash function) because it might be
confused with "hashed value" (the input to a hash function). (See:
hash code, hash result, message digest.)
$ hierarchical PKI
(I) A PKI architecture based on a certification hierarchy. (See:
mesh PKI, trust-file PKI.)
$ hierarchy management
(I) The process of generating configuration data and issuing
public-key certificates to build and operate a certification
hierarchy.
$ hierarchy of trust
(D) ISDs SHOULD NOT use this term with regard to PKI, especially
not as a synonym for "certification hierarchy", because this term
mixes concepts in a potentially misleading way. (See:
certification hierarchy, trust, web of trust.)
$ hijack attack
(I) A form of active wiretapping in which the attacker seizes
control of a previously established communication association.
(See: man-in-the-middle attack, pagejacking, piggyback attack.)
$ HMAC
(I) A keyed hash [R2104] that can be based on any iterated
cryptographic hash (e.g., MD5 or SHA-1), so that the cryptographic
strength of HMAC depends on the properties of the selected
cryptographic hash. (See: [R2202, R2403, R2404].)
(C) Assume that H is a generic cryptographic hash in which a
function is iterated on data blocks of length B bytes. L is the
length of the of hash result of H. K is a secret key of length L
<= K <= B. The values IPAD and OPAD are fixed strings used as
inner and outer padding and defined as follows: IPAD = the byte
0x36 repeated B times, OPAD = the byte 0x5C repeated B times. HMAC
is computed by H(K XOR OPAD, H(K XOR IPAD, inputdata)).
(C) The goals of HMAC are as follows:
- To use available cryptographic hash functions without
modification, particularly functions that perform well in
software and for which software is freely and widely available.
- To preserve the original performance of the selected hash
without significant degradation.
- To use and handle keys in a simple way.
- To have a well-understood cryptographic analysis of the
strength of the mechanism based on reasonable assumptions about
the underlying hash function.
- To enable easy replacement of the hash function in case a
faster or stronger hash is found or required.
$ honey pot
(I) A system (e.g., a web server) or a system resource (e.g., a
file on a server), that is designed to be attractive to potential
crackers and intruders, like honey is attractive to bears. (See:
entrapment.)
(D) It is likely that other cultures have different metaphors for
this concept. To ensure international understanding, ISDs should
not use this term unless they also provide an explanation like
this one. (See: (usage note under) Green Book.)
$ host
(I) General computer network usage: A computer that is attached to
a communication subnetwork or internetwork and can use services
provided by the network to exchange data with other attached
systems. (See: end system.)
(I) Specific Internet Protocol Suite usage: A networked computer
that does not forward Internet Protocol packets that are not
addressed to the computer itself. (See: router.)
(C) Derivation: As viewed by its users, a host "entertains"
guests, providing application layer services or access to other
computers attached to the network. However, even though some
traditional peripheral service devices, such as printers, can now
be independently connected to networks, they are not usually
called hosts.
$ HTML
See: Hypertext Markup Language.
$ HTTP
See: Hypertext Transfer Protocol.
$ https
(I) When used in the first part of a URL (the part that precedes
the colon and specifies an access scheme or protocol), this term
specifies the use of HTTP enhanced by a security mechanism, which
is usually SSL. (See: S-HTTP.)
$ hybrid encryption
(I) An application of cryptography that combines two or more
encryption algorithms, particularly a combination of symmetric and
asymmetric encryption. (E.g., see: digital envelope.)
(C) Asymmetric algorithms require more computation than
equivalently strong symmetric ones. Thus, asymmetric encryption is
not normally used for data confidentiality except in distributing
symmetric keys in applications where the key data is usually short
(in terms of bits) compared to the data it protects. (E.g., see:
MSP, PEM, PGP.)
$ hyperlink
(I) In hypertext or hypermedia, an information object (such as a
word, a phrase, or an image; usually highlighted by color or
underscoring) that points (indicates how to connect) to related
information that is located elsewhere and can be retrieved by
activating the link (e.g., by selecting the object with a mouse
pointer and then clicking).
$ hypermedia
(I) A generalization of hypertext; any media that contain
hyperlinks that point to material in the same or another data
object.
$ hypertext
(I) A computer document, or part of a document, that contains
hyperlinks to other documents; i.e., text that contains active
pointers to other text. Usually written in Hypertext Markup
Language and accessed using a web browser. (See: hypermedia.)
$ Hypertext Markup Language (HTML)
(I) A platform-independent system of syntax and semantics for
adding characters to data files (particularly text files) to
represent the data's structure and to point to related data, thus
creating hypertext for use in the World Wide Web and other
applications. [R1866]
$ Hypertext Transfer Protocol (HTTP)
(I) A TCP-based, application-layer, client-server, Internet
protocol [R2616] used to carry data requests and responses in the
World Wide Web. (See: hypertext.)
$ IAB
See: Internet Architecture Board.
$ IANA
See: Internet Assigned Numbers Authority.
$ ICANN
See: Internet Corporation for Assigned Names and Numbers.
$ ICMP
See: Internet Control Message Protocol.
$ ICMP flood
(I) A denial of service attack that sends a host more ICMP echo
request ("ping") packets than the protocol implementation can
handle. (See: flooding, smurf.)
$ ICRL
See: indirect certificate revocation list.
$ IDEA
See: International Data Encryption Algorithm.
$ identification
(I) An act or process that presents an identifier to a system so
that the system can recognize a system entity and distinguish it
from other entities. (See: authentication.)
$ Identification Protocol
(I) An client-server Internet protocol [R1413] for learning the
identity of a user of a particular TCP connection.
(C) Given a TCP port number pair, the server returns a character
string that identifies the owner of that connection on the
server's system. The protocol is not intended for authorization or
access control. At best, it provides additional auditing
information with respect to TCP.
$ identity-based security policy
(I) "A security policy based on the identities and/or attributes
of users, a group of users, or entities acting on behalf of the
users and the resources/objects being accessed." [I7498 Part 2]
(See: rule-based security policy.)
$ IEEE
See: Institute of Electrical and Electronics Engineers, Inc.
$ IEEE 802.10
(N) An IEEE committee developing security standards for local area
networks. (See: SILS.)
$ IEEE P1363
(N) An IEEE working group, Standard for Public-Key Cryptography,
developing a comprehensive reference standard for asymmetric
cryptography. Covers discrete logarithm (e.g., DSA), elliptic
curve, and integer factorization (e.g., RSA); and covers key
agreement, digital signature, and encryption.
$ IESG
See: Internet Engineering Steering Group.
$ IETF
See: Internet Engineering Task Force.
$ IKE
See: IPsec Key Exchange.
$ IMAP4
See: Internet Message Access Protocol, version 4.
$ IMAP4 AUTHENTICATE
(I) A IMAP4 "command" (better described as a transaction type, or
a protocol-within-a-protocol) by which an IMAP4 client optionally
proposes a mechanism to an IMAP4 server to authenticate the client
to the server and provide other security services. (See: POP3.)
(C) If the server accepts the proposal, the command is followed by
performing a challenge-response authentication protocol and,
optionally, negotiating a protection mechanism for subsequent POP3
interactions. The security mechanisms that are used by IMAP4
AUTHENTICATE--including Kerberos, GSSAPI, and S/Key--are described
in [R1731].
$ in the clear
(I) Not encrypted. (See: cleartext.)
$ indirect certificate revocation list (ICRL)
(I) In X.509, a CRL that may contain certificate revocation
notifications for certificates issued by CAs other than the issuer
of the ICRL.
$ indistinguishability
(I) An attribute of an encryption algorithm that is a
formalization of the notion that the encryption of some string is
indistinguishable from the encryption of an equal-length string of
nonsense.
(C) Under certain conditions, this notion is equivalent to
"semantic security".
$ information
(I) Facts and ideas, which can be represented (encoded) as various
forms of data.
$ Information Technology Security Evaluation Criteria (ITSEC)
(N) Standard developed for use in the European Union; accommodates
a wider range of security assurance and functionality combinations
than the TCSEC. Superseded by the Common Criteria. [ITSEC]
$ INFOSEC
(I) Abbreviation for "information security", referring to security
measures that implement and assure security services in computer
systems (i.e., COMPUSEC) and communication systems (i.e., COMSEC).
$ initialization value (IV)
(I) An input parameter that sets the starting state of a
cryptographic algorithm or mode. (Sometimes called "initialization
vector" or "message indicator".)
(C) An IV can be used to introduce cryptographic variance in
addition to that provided by a key (see: salt), and to synchronize
one cryptographic process with another. For an example of the
latter, cipher block chaining mode requires an IV. [R2405]
$ initialization vector
(D) For consistency, ISDs SHOULD NOT use this term as a synonym
for "initialization value".
$ insider attack
See: (secondary definition under) attack.
$ Institute of Electrical and Electronics Engineers, Inc. (IEEE)
(N) The IEEE is a not-for-profit association of more than 330,000
individual members in 150 countries. The IEEE produces 30 percent
of the world's published literature in electrical engineering,
computers, and control technology; holds annually more than 300
major conferences; and has more than 800 active standards with 700
under development. (See: Standards for Interoperable LAN/MAN
Security.)
$ integrity
See: data integrity, correctness integrity, source integrity,
system integrity.
$ integrity check
(D) ISDs SHOULD NOT use this term as a synonym for "cryptographic
hash" or "protected checksum", because this term unnecessarily
duplicates the meaning of other, well-established terms.
$ intelligent threat
(I) A circumstance in which an adversary has the technical and
operational capability to detect and exploit a vulnerability and
also has the demonstrated, presumed, or inferred intent to do so.
(See: threat.)
$ International Data Encryption Algorithm (IDEA)
(N) A patented, symmetric block cipher that uses a 128-bit key and
operates on 64-bit blocks. [Schn] (See: symmetric cryptography.)
$ International Standard
See: (secondary definition under) ISO.
$ International Traffic in Arms Regulations (ITAR)
(N) Rules issued by the U.S. State Department, by authority of the
Arms Export Control Act (22 U.S.C. 2778), to control export and
import of defense articles and defense services, including
information security systems, such as cryptographic systems, and
TEMPEST suppression technology. (See: Wassenaar Arrangement.)
$ internet
$ Internet
See: internet vs. Internet.
$ Internet Architecture Board (IAB)
(I) A technical advisory group of the ISOC, chartered by the ISOC
Trustees to provide oversight of Internet architecture and
protocols and, in the context of Internet Standards, a body to
which decisions of the IESG may be appealed. Responsible for
approving appointments to the IESG from among nominees submitted
by the IETF nominating committee. [R2026]
$ Internet Assigned Numbers Authority (IANA)
(I) From the early days of the Internet, the IANA was chartered by
the ISOC and the U.S. Government's Federal Network Council to be
the central coordination, allocation, and registration body for
parameters for Internet protocols. Superseded by ICANN.
$ Internet Control Message Protocol (ICMP)
(I) An Internet Standard protocol [R0792] that is used to report
error conditions during IP datagram processing and to exchange
other information concerning the state of the IP network.
$ Internet Corporation for Assigned Names and Numbers (ICANN)
(I) The non-profit, private corporation that has assumed
responsibility for the IP address space allocation, protocol
parameter assignment, domain name system management, and root
server system management functions formerly performed under U.S.
Government contract by IANA and other entities.
(C) The Internet Protocol Suite, as defined by the IETF and the
IESG, contains numerous parameters, such as internet addresses,
domain names, autonomous system numbers, protocol numbers, port
numbers, management information base object identifiers, including
private enterprise numbers, and many others. The Internet
community requires that the values used in these parameter fields
be assigned uniquely. ICANN makes those assignments as requested
and maintains a registry of the current values.
(C) ICANN was formed in October 1998, by a coalition of the
Internet's business, technical, and academic communities. The U.S.
Government designated ICANN to serve as the global consensus
entity with responsibility for coordinating four key functions for
the Internet: the allocation of IP address space, the assignment
of protocol parameters, the management of the DNS, and the
management of the DNS root server system.
$ Internet Draft
(I) A working document of the IETF, its areas, and its working
groups. (Other groups may also distribute working documents as
Internet Drafts.) An Internet Draft is not an archival document
like an RFCis. Instead, an Internet Draft is a preliminary or
working document that is valid for a maximum of six months and may
be updated, replaced, or made obsolete by other documents at any
time. It is inappropriate to use an Internet Draft as reference
material or to cite it other than as "work in progress."
$ Internet Engineering Steering Group (IESG)
(I) The part of the ISOC responsible for technical management of
IETF activities and administration of the Internet Standards
Process according to procedures approved by the ISOC Trustees.
Directly responsible for actions along the "standards track",
including final approval of specifications as Internet Standards.
Composed of IETF Area Directors and the IETF chairperson, who also
chairs the IESG. [R2026]
$ Internet Engineering Task Force (IETF)
(I) A self-organized group of people who make contributions to the
development of Internet technology. The principal body engaged in
developing Internet Standards, although not itself a part of the
ISOC. Composed of Working Groups, which are arranged into Areas
(such as the Security Area), each coordinated by one or more Area
Directors. Nominations to the IAB and the IESG are made by a
committee selected at random from regular IETF meeting attendees
who have volunteered. [R2026, R2323]
$ Internet Message Access Protocol, version 4 (IMAP4)
(I) An Internet protocol [R2060] by which a client workstation can
dynamically access a mailbox on a server host to manipulate and
retrieve mail messages that the server has received and is holding
for the client. (See: POP3.)
(C) IMAP4 has mechanisms for optionally authenticating a client to
a server and providing other security services. (See: IMAP4
AUTHENTICATE.)
$ Internet Policy Registration Authority (IPRA)
(I) An X.509-compliant CA that is the top CA of the Internet
certification hierarchy operated under the auspices of the ISOC
[R1422]. (See: (PEM usage under) certification hierarchy.)
$ Internet Protocol (IP)
(I) A Internet Standard protocol (version 4 [R0791] and version 6
[R2460]) that moves datagrams (discrete sets of bits) from one
computer to another across an internetwork but does not provide
reliable delivery, flow control, sequencing, or other end-to-end
services that TCP provides. (See: IP address, TCP/IP.)
(C) In the OSIRM, IP would be located at the top of layer 3.
$ Internet Protocol security (IPsec)
(I) (1.) The name of the IETF working group that is specifying a
security architecture [R2401] and protocols to provide security
services for Internet Protocol traffic. (2.) A collective name for
that architecture and set of protocols. (Implementation of IPsec
protocols is optional for IP version 4, but mandatory for IP
version 6.) (See: Internet Protocol Security Option.)
(C) Note that the letters "sec" are lower-case.
(C) The IPsec architecture specifies (a) security protocols (AH
and ESP), (b) security associations (what they are, how they work,
how they are managed, and associated processing), (c) key
management (IKE), and (d) algorithms for authentication and
encryption. The set of security services include access control
service, connectionless data integrity service, data origin
authentication service, protection against replays (detection of
the arrival of duplicate datagrams, within a constrained window),
data confidentiality service, and limited traffic flow
confidentiality.
$ Internet Protocol Security Option (IPSO)
(I) Refers to one of three types of IP security options, which are
fields that may be added to an IP datagram for the purpose of
carrying security information about the datagram. (See: IPsec.)
(D) ISDs SHOULD NOT use this term without a modifier to indicate
which of the three types is meant.
1. "DoD Basic Security Option" (IP option type 130): Defined for
use on U.S. Department of Defense common user data networks.
Identifies the Defense classification level at which the
datagram is to be protected and the protection authorities
whose rules apply to the datagram. [R1108]
A "protection authority" is a National Access Program (e.g.,
GENSER, SIOP-ESI, SCI, NSA, Department of Energy) or Special
Access Program that specifies protection rules for transmission
and processing of the information contained in the datagram.
[R1108]
2. "DoD Extended Security Option" (IP option type 133): Permits
additional security labeling information, beyond that present
in the Basic Security Option, to be supplied in the datagram to
meet the needs of registered authorities. [R1108]
3. "Common IP Security Option" (CIPSO) (IP option type 134):
Designed by TSIG to carry hierarchic and non-hierarchic
security labels. (Formerly called "Commercial IP Security
Option".) Was published as Internet-Draft [CIPSO]; not advanced
to RFC.
$ Internet Protocol Suite
See: (secondary definition under) Internet.
$ Internet Security Association and Key Management Protocol (ISAKMP)
(I) An Internet IPsec protocol [R2408] to negotiate, establish,
modify, and delete security associations, and to exchange key
generation and authentication data, independent of the details of
any specific key generation technique, key establishment protocol,
encryption algorithm, or authentication mechanism.
(C) ISAKMP supports negotiation of security associations for
protocols at all TCP/IP layers. By centralizing management of
security associations, ISAKMP reduces duplicated functionality
within each protocol. ISAKMP can also reduce connection setup
time, by negotiating a whole stack of services at once. Strong
authentication is required on ISAKMP exchanges, and a digital
signature algorithm based on asymmetric cryptography is used
within ISAKMP's authentication component.
$ Internet Society (ISOC)
(I) A professional society concerned with Internet development
(including technical Internet Standards); with how the Internet is
and can be used; and with social, political, and technical issues
that result. The ISOC Board of Trustees approves appointments to
the IAB from among nominees submitted by the IETF nominating
committee. [R2026]
$ Internet Standard
(I) A specification, approved by the IESG and published as an RFC,
that is stable and well-understood, is technically competent, has
multiple, independent, and interoperable implementations with
substantial operational experience, enjoys significant public
support, and is recognizably useful in some or all parts of the
Internet. [R2026] (See: RFC.)
(C) The Internet Standards Process is an activity of the ISOC and
is organized and managed by the IAB and the IESG. The process is
concerned with all protocols, procedures, and conventions used in
or by the Internet, whether or not they are part of the Internet
Protocol Suite. The "Internet Standards Track" has three levels of
increasing maturity: Proposed Standard, Draft Standard, and
Standard. (See: (standards levels under) ISO.)
$ Internet Standards document (ISD)
(C) In this Glossary, this term refers to an RFC, Internet-Draft,
or other item that is produced as part of the Internet Standards
Process [R2026]. However, neither the term nor the abbreviation is
widely accepted and, therefore, SHOULD NOT be used in an ISD
unless it is accompanied by an explanation like this. (See:
Internet Standard.)
$ internet vs. Internet
1. (I) Not capitalized: A popular abbreviation for "internetwork".
2. (I) Capitalized: "The Internet" is the single, interconnected,
worldwide system of commercial, government, educational, and other
computer networks that share the set of protocols specified by the
IAB [R2026] and the name and address spaces managed by the ICANN.
(C) The protocol set is named the "Internet Protocol Suite". It
also is popularly known as "TCP/IP", because TCP and IP are two of
its fundamental components. These protocols enable a user of any
one of the networks in the Internet to communicate with, or use
services located on, any of the other networks.
(C) Although the Internet does have architectural principles
[R1958], no Internet Standard formally defines a layered reference
model for the IPS that is similar to the OSIRM. However, Internet
community documents do refer (inconsistently) to layers:
application, socket, transport, internetwork, network, data link,
and physical. In this Glossary, Internet layers are referred to by
name to avoid confusing them with OSIRM layers, which are referred
to by number.
$ internetwork
(I) A system of interconnected networks; a network of networks.
Usually shortened to "internet". (See: internet vs. Internet.)
(C) An internet is usually built using OSI layer 3 gateways to
connect a set of subnetworks. When the subnetworks differ in the
OSI layer 3 protocol service they provide, the gateways sometimes
implement a uniform internetwork protocol (e.g., IP) that operates
at the top of layer 3 and hides the underlying heterogeneity from
hosts that use communication services provided by the internet.
(See: router.)
$ intranet
(I) A computer network, especially one based on Internet
technology, that an organization uses for its own internal, and
usually private, purposes and that is closed to outsiders. (See:
extranet, virtual private network.)
$ intruder
(I) An entity that gains or attempts to gain access to a system or
system resource without having authorization to do so. (See:
cracker.)
$ intrusion
See: security intrusion.
$ intrusion detection
(I) A security service that monitors and analyzes system events
for the purpose of finding, and providing real-time or near real-
time warning of, attempts to access system resources in an
unauthorized manner.
$ invalidity date
(N) An X.509 CRL entry extension that "indicates the date at which
it is known or suspected that the [revoked certificate's private
key] was compromised or that the certificate should otherwise be
considered invalid" [X509].
(C) This date may be earlier than the revocation date in the CRL
entry, and may even be earlier than the date of issue of earlier
CRLs. However, the invalidity date is not, by itself, sufficient
for purposes of non-repudiation service. For example, to
fraudulently repudiate a validly-generated signature, a private
key holder may falsely claim that the key was compromised at some
time in the past.
$ IP
See: Internet Protocol.
$ IP address
(I) A computer's internetwork address that is assigned for use by
the Internet Protocol and other protocols.
(C) An IP version 4 [R0791] address is written as a series of four
8-bit numbers separated by periods. For example, the address of
the host named "rosslyn.bbn.com" is 192.1.7.10.
(C) An IP version 6 [R2373] address is written as x:x:x:x:x:x:x:x,
where each "x" is the hexadecimal value of one of the eight 16-bit
parts of the address. For example, 1080:0:0:0:8:800:200C:417A and
FEDC:BA98:7654:3210:FEDC:BA98:7654:3210.
$ IP Security Option
See: Internet Protocol Security Option.
$ IPRA
See: Internet Policy Registration Authority.
$ IPsec
See: Internet Protocol security.
$ IPsec Key Exchange (IKE)
(I) An Internet, IPsec, key-establishment protocol [R2409] (partly
based on OAKLEY) that is intended for putting in place
authenticated keying material for use with ISAKMP and for other
security associations, such as in AH and ESP.
$ IPSO
See: Internet Protocol Security Option.
$ ISAKMP
See: Internet Security Association and Key Management Protocol.
$ ISD
See: Internet Standards document.
$ ISO
(I) International Organization for Standardization, a voluntary,
non-treaty, non-government organization, established in 1947, with
voting members that are designated standards bodies of
participating nations and non-voting observer organizations. (See:
ANSI, ITU-T.)
(C) Legally, ISO is a Swiss, non-profit, private organization. ISO
and the IEC (the International Electrotechnical Commission) form
the specialized system for worldwide standardization. National
bodies that are members of ISO or IEC participate in developing
international standards through ISO and IEC technical committees
that deal with particular fields of activity. Other international
governmental and non-governmental organizations, in liaison with
ISO and IEC, also take part. (ANSI is the U.S. voting member of
ISO. ISO is a class D member of ITU-T.)
(C) The ISO standards development process has four levels of
increasing maturity: Working Draft (WD), Committee Draft (CD),
Draft International Standard (DIS), and International Standard
(IS). (See: (standards track levels under) Internet Standard.) In
information technology, ISO and IEC have a joint technical
committee, ISO/IEC JTC 1. DISs adopted by JTC 1 are circulated to
national bodies for voting, and publication as an IS requires
approval by at least 75% of the national bodies casting a vote.
$ ISOC
See: Internet Society.
$ issue (a digital certificate or CRL)
(I) Generate and sign a digital certificate (or CRL) and, usually,
distribute it and make it available to potential certificate users
(or CRL users). (See: certificate creation.)
(C) The ABA Guidelines [ABA] explicitly limit this term to
certificate creation, and exclude the act of publishing. In
general usage, however, "issuing" a digital certificate (or CRL)
includes not only certificate creation but also making it
available to potential users, such as by storing it in a
repository or other directory or otherwise publishing it.
$ issuer
1. (I) "Issuer" of a certificate or CRL: The CA that signs the
digital certificate or CRL.
(C) An X.509 certificate always includes the issuer's name. The
name may include a common name value.
2. (N) "Issuer" of a payment card: SET usage: "The financial
institution or its agent that issues the unique primary account
number to the cardholder for the payment card brand." [SET2]
(C) The institution that establishes the account for a cardholder
and issues the payment card also guarantees payment for authorized
transactions that use the card in accordance with card brand
regulations and local legislation. [SET1]
$ ITAR
See: International Traffic in Arms Regulations.
$ ITSEC
See: Information Technology System Evaluation Criteria.
$ ITU-T
(N) International Telecommunications Union, Telecommunication
Standardization Sector (formerly "CCITT"), a United Nations treaty
organization that is composed mainly of postal, telephone, and
telegraph authorities of the member countries and that publishes
standards called "Recommendations". (See: X.400, X.500.)
(C) The Department of State represents the United States. ITU-T
works on many kinds of communication systems. ITU-T cooperates
with ISO on communication protocol standards, and many
Recommendations in that area are also published as an ISO standard
with an ISO name and number.
$ IV
See: initialization value.
$ KDC
See: Key Distribution Center.
$ KEA
See: Key Exchange Algorithm.
$ KEK
See: key-encrypting key.
$ Kerberos
(N) A system developed at the Massachusetts Institute of
Technology that depends on passwords and symmetric cryptography
(DES) to implement ticket-based, peer entity authentication
service and access control service distributed in a client-server
network environment. [R1510, Stei]
(C) Kerberos was developed by Project Athena and is named for the
three-headed dog guarding Hades.
$ key
See: cryptographic key.
$ key agreement (algorithm or protocol)
(I) A key establishment method (especially one involving
asymmetric cryptography) by which two or more entities, without
prior arrangement except a public exchange of data (such as public
keys), each computes the same key value. I.e., each can
independently generate the same key value, but that key cannot be
computed by other entities. (See: Diffie-Hellman, key
establishment, Key Exchange Algorithm, key transport.)
(O) "A method for negotiating a key value on line without
transferring the key, even in an encrypted form, e.g., the Diffie-
Hellman technique." [X509]
(O) "The procedure whereby two different parties generate shared
symmetric keys such that any of the shared symmetric keys is a
function of the information contributed by all legitimate
participants, so that no party [alone] can predetermine the value
of the key." [A9042]
(C) For example, a message originator and the intended recipient
can each use their own private key and the other's public key with
the Diffie-Hellman algorithm to first compute a shared secret
value and, from that value, derive a session key to encrypt the