Web search services, thereby diverting browsers from the target
server to the attacker's server.
(D) ISDs SHOULD NOT use this term without including a definition,
because the term is not listed in most dictionaries and could
confuse international readers. (See: (usage note under) Green
Book.)
$ PAN
See: primary account number.
$ PAP
See: Password Authentication Protocol.
$ partitioned security mode
(N) A mode of operation of an information system, wherein all
users have the clearance, but not necessarily formal access
authorization and need-to-know, for all information handled by the
system. This mode is defined in U.S. Department of Defense policy
regarding system accreditation. [DoD2]
$ passive attack
See: (secondary definition under) attack.
$ passive wiretapping
See: (secondary definition under) wiretapping.
$ password
(I) A secret data value, usually a character string, that is used
as authentication information. (See: challenge-response.)
(C) A password is usually matched with a user identifier that is
explicitly presented in the authentication process, but in some
cases the identity may be implicit.
(C) Using a password as authentication information assumes that
the password is known only by the system entity whose identity is
being authenticated. Therefore, in a network environment where
wiretapping is possible, simple authentication that relies on
transmission of static (i.e., repetitively used) passwords as
cleartext is inadequate. (See: one-time password, strong
authentication.)
$ Password Authentication Protocol (PAP)
(I) A simple authentication mechanism in PPP. In PAP, a user
identifier and password are transmitted in cleartext. [R1334]
(See: CHAP.)
$ password sniffing
(I) Passive wiretapping, usually on a local area network, to gain
knowledge of passwords. (See: (usage note under) sniffing.)
$ path discovery
(I) For a digital certificate, the process of finding a set of
public-key certificates that comprise a certification path from a
trusted key to that specific certificate.
$ path validation
(I) The process of validating (a) all of the digital certificates
in a certification path and (b) the required relationships between
those certificates, thus validating the contents of the last
certificate on the path. (See: certificate validation.)
$ payment card
(N) SET usage: Collectively refers "to credit cards, debit cards,
charge cards, and bank cards issued by a financial institution and
which reflects a relationship between the cardholder and the
financial institution." [SET2]
$ payment gateway
(O) SET usage: A system operated by an acquirer, or a third party
designated by an acquirer, for the purpose of providing electronic
commerce services to the merchants in support of the acquirer, and
which interfaces to the acquirer to support the authorization,
capture, and processing of merchant payment messages, including
payment instructions from cardholders. [SET1, SET2]
$ payment gateway certification authority (SET PCA)
(O) SET usage: A CA that issues digital certificates to payment
gateways and is operated on behalf of a payment card brand, an
acquirer, or another party according to brand rules. A SET PCA
issues a CRL for compromised payment gateway certificates. [SET2]
(See: PCA.)
$ PC card
(N) A type of credit card-sized, plug-in peripheral device that
was originally developed to provide memory expansion for portable
computers, but is also used for other kinds of functional
expansion. (See: FORTEZZA, PCMCIA.)
(C) The international PC Card Standard defines a non-proprietary
form factor in three standard sizes--Types I, II and III--each of
which have a 68-pin interface between the card and the socket into
which it plugs. All three types have the same length and width,
roughly the size of a credit card, but differ in their thickness
from 3.3 to 10.5 mm. Examples include storage modules, modems,
device interface adapters, and cryptographic modules.
$ PCA
(D) ISDs SHOULD NOT use this acronym without a qualifying
adjective because that would be ambiguous. (See: Internet policy
certification authority, (MISSI) policy creation authority, (SET)
payment gateway certification authority.)
$ PCMCIA
(N) Personal Computer Memory Card International Association, a
group of manufacturers, developers, and vendors, founded in 1989
to standardize plug-in peripheral memory cards for personal
computers and now extended to deal with any technology that works
in the PC card form factor. (See: PC card.)
$ peer entity authentication
(I) "The corroboration that a peer entity in an association is the
one claimed." [I7498 Part 2] (See: authentication.)
$ peer entity authentication service
(I) A security service that verifies an identity claimed by or for
a system entity in an association. (See: authentication,
authentication service.)
(C) This service is used at the establishment of, or at times
during, an association to confirm the identity of one entity to
another, thus protecting against a masquerade by the first entity.
However, unlike data origin authentication service, this service
requires an association to exist between the two entities, and the
corroboration provided by the service is valid only at the current
time that the service is provided.
(C) See: "relationship between data integrity service and
authentication services" under data integrity service.
$ PEM
See: Privacy Enhanced Mail.
$ penetration
(I) Successful, repeatable, unauthorized access to a protected
system resource. (See: attack, violation.)
$ penetration test
(I) A system test, often part of system certification, in which
evaluators attempt to circumvent the security features of the
system. [NCS04]
(C) Penetration testing may be performed under various constraints
and conditions. However, for a TCSEC evaluation, testers are
assumed to have all system design and implementation
documentation, including source code, manuals, and circuit
diagrams, and to work under no greater constraints than those
applied to ordinary users.
$ perfect forward secrecy
See: (discussion under) public-key forward secrecy.
$ perimeter
See: security perimeter.
$ periods processing
(I) A mode of system operation in which information of different
sensitivities is processed at distinctly different times by the
same system, with the system being properly purged or sanitized
between periods. (See: color change.)
$ permission
(I) A synonym for "authorization", but "authorization" is
preferred in the PKI context. (See: privilege.)
$ personal identification number (PIN)
(I) A character string used as a password to gain access to a
system resource. (See: authentication information.)
(C) Despite the words "identification" and "number", a PIN seldom
serves as a user identifier, and a PIN's characters are not
necessarily all numeric. A better name for this concept would have
been "personal authentication system string (PASS)".
(C) Retail banking applications commonly use 4-digit PINs.
FORTEZZA PC card's use up to 12 characters for user or SSO PINs.
$ personality
$ personality label
(O) MISSI usage: A set of MISSI X.509 public-key certificates that
have the same subject DN, together with their associated private
keys and usage specifications, that is stored on a FORTEZZA PC
card to support a role played by the card's user.
(C) When a card's user selects a personality to use in a FORTEZZA-
aware application, the data determines behavior traits (the
personality) of the application. A card's user may have multiple
personalities on the card. Each has a "personality label", a user-
friendly character string that applications can display to the
user for selecting or changing the personality to be used. For
example, a military user's card might contain three personalities:
GENERAL HALFTRACK, COMMANDER FORT SWAMPY, and NEW YEAR'S EVE PARTY
CHAIRMAN. Each personality includes one or more certificates of
different types (such as DSA versus RSA), for different purposes
(such as digital signature versus encryption), or with different
authorizations.
$ personnel security
(I) Procedures to ensure that persons who access a system have
proper clearance, authorization, and need-to-know as required by
the system's security policy.
$ PGP(trademark)
See: Pretty Good Privacy.
$ Photuris
(I) A UDP-based, key establishment protocol for session keys,
designed for use with the IPsec protocols AH and ESP. Superseded
by IKE.
$ phreaking
(I) A contraction of "telephone breaking". An attack on or
penetration of a telephone system or, by extension, any other
communication or information system. [Raym]
(D) ISDs SHOULD NOT use this term because it is not listed in most
dictionaries and could confuse international readers.
$ physical security
(I) Tangible means of preventing unauthorized physical access to a
system. E.g., fences, walls, and other barriers; locks, safes, and
vaults; dogs and armed guards; sensors and alarm bells. [FP031,
R1455]
$ piggyback attack
(I) A form of active wiretapping in which the attacker gains
access to a system via intervals of inactivity in another user's
legitimate communication connection. Sometimes called a "between-
the-lines" attack. (See: hijack attack, man-in-the-middle attack.)
$ PIN
See: personal identification number.
$ ping of death
(I) An attack that sends an improperly large ICMP [R0792] echo
request packet (a "ping") with the intent of overflowing the input
buffers of the destination machine and causing it to crash.
$ ping sweep
(I) An attack that sends ICMP [R0792] echo requests ("pings") to a
range of IP addresses, with the goal of finding hosts that can be
probed for vulnerabilities.
$ PKCS
See: Public-Key Cryptography Standards.
$ PKCS #7
(N) A standard [PKC07, R2315] from the PKCS series; defines a
syntax for data that may have cryptography applied to it, such as
for digital signatures and digital envelopes.
$ PKCS #10
(N) A standard [PKC10] from the PKCS series; defines a syntax for
requests for public-key certificates. (See: certification
request.)
(C) A PKCS #10 request contains a DN and a public key, and may
contain other attributes, and is signed by the entity making the
request. The request is sent to a CA, who converts it to an X.509
public-key certificate (or some other form) and returns it,
possibly in PKCS #7 format.
$ PKCS #11
(N) A standard [PKC11] from the PKCS series; defines a software
CAPI called Cryptoki (pronounced "crypto-key"; short for
"cryptographic token interface") for devices that hold
cryptographic information and perform cryptographic functions.
$ PKI
See: public-key infrastructure.
$ PKIX
(I) (1.) A contraction of "Public-Key Infrastructure (X.509)", the
name of the IETF working group that is specifying an architecture
and set of protocols needed to support an X.509-based PKI for the
Internet. (2.) A collective name for that architecture and set of
protocols.
(C) The goal of PKIX is to facilitate the use of X.509 public-key
certificates in multiple Internet applications and to promote
interoperability between different implementations that use those
certificates. The resulting PKI is intended to provide a framework
that supports a range of trust and hierarchy environments and a
range of usage environments. PKIX specifies (a) profiles of the v3
X.509 public-key certificate standards and the v2 X.509 CRL
standards for the Internet; (b) operational protocols used by
relying parties to obtain information such as certificates or
certificate status; (c) management protocols used by system
entities to exchange information needed for proper management of
the PKI; and (d) information about certificate policies and CPSs,
covering the areas of PKI security not directly addressed in the
rest of PKIX.
$ PKIX private extension
(I) PKIX defines a private extension to identify an on-line
verification service supporting the issuing CA.
$ plaintext
(I) Data that is input to and transformed by an encryption
process, or that is output by a decryption process.
(C) Usually, the plaintext input to an encryption operation is
cleartext. But in some cases, the input is ciphertext that was
output from another encryption operation. (See: superencryption.)
$ Point-to-Point Protocol (PPP)
(I) An Internet Standard protocol [R1661] for encapsulation and
full-duplex transportation of network layer (mainly OSI layer 3)
protocol data packets over a link between two peers, and for
multiplexing different network layer protocols over the same link.
Includes optional negotiation to select and use a peer entity
authentication protocol to authenticate the peers to each other
before they exchange network layer data. (See: CHAP, EAP, PAP.)
$ Point-to-Point Tunneling Protocol (PPTP)
(I) An Internet client-server protocol (originally developed by
Ascend and Microsoft) that enables a dial-up user to create a
virtual extension of the dial-up link across a network by
tunneling PPP over IP. (See: L2TP.)
(C) PPP can encapsulate any Internet Protocol Suite network layer
protocol (or OSI layer 3 protocol). Therefore, PPTP does not
specify security services; it depends on protocols above and below
it to provide any needed security. PPTP makes it possible to
divorce the location of the initial dial-up server (i.e., the PPTP
Access Concentrator, the client, which runs on a special-purpose
host) from the location at which the dial-up protocol (PPP)
connection is terminated and access to the network is provided
(i.e., the PPTP Network Server, which runs on a general-purpose
host).
$ policy
(D) ISDs SHOULD NOT use this word as an abbreviation for either
"security policy" or "certificate policy". Instead, to avoid
misunderstanding, use the fully qualified term, at least at the
point of first usage.
$ policy approving authority (PAA)
(O) MISSI usage: The top-level signing authority of a MISSI
certification hierarchy. The term refers both to that
authoritative office or role and to the person who plays that
role. (See: root registry.)
(C) A PAA registers MISSI PCAs and signs their X.509 public-key
certificates. A PAA issues CRLs but does not issue a CKL. A PAA
may issue cross-certificates to other PAAs.
$ policy certification authority (Internet PCA)
(I) An X.509-compliant CA at the second level of the Internet
certification hierarchy, under the Internet Policy Registration
Authority (IPRA). Each PCA operates in accordance with its
published security policy (see: certification practice statement)
and within constraints established by the IPRA for all PCAs.
[R1422]. (See: policy creation authority.)
$ policy creation authority (MISSI PCA)
(O) MISSI usage: The second level of a MISSI certification
hierarchy; the administrative root of a security policy domain of
MISSI users and other, subsidiary authorities. The term refers
both to that authoritative office or role and to the person who
fills that office. (See: policy certification authority.)
(C) A MISSI PCA's certificate is issued by a policy approving
authority. The PCA registers the CAs in its domain, defines their
configurations, and issues their X.509 public-key certificates.
(The PCA may also issue certificates for SCAs, ORAs, and other end
entities, but a PCA does not usually do this.) The PCA
periodically issues CRLs and CKLs for its domain.
$ Policy Management Authority
(N) Canadian usage: An organization responsible for PKI oversight
and policy management in the Government of Canada.
$ policy mapping
(I) "Recognizing that, when a CA in one domain certifies a CA in
another domain, a particular certificate policy in the second
domain may be considered by the authority of the first domain to
be equivalent (but not necessarily identical in all respects) to a
particular certificate policy in the first domain." [X509]
$ POP3
See: Post Office Protocol, version 3.
$ POP3 APOP
(I) A POP3 "command" (better described as a transaction type, or a
protocol-within-a-protocol) by which a POP3 client optionally uses
a keyed hash (based on MD5) to authenticate itself to a POP3
server and, depending on the server implementation, to protect
against replay attacks. (See: CRAM, POP3 AUTH, IMAP4
AUTHENTICATE.)
(C) The server includes a unique timestamp in its greeting to the
client. The subsequent APOP command sent by the client to the
server contains the client's name and the hash result of applying
MD5 to a string formed from both the timestamp and a shared secret
that is known only to the client and the server. APOP was designed
to provide as an alternative to using POP3's USER and PASS (i.e.,
password) command pair, in which the client sends a cleartext
password to the server.
$ POP3 AUTH
(I) A "command" [R1734] (better described as a transaction type,
or a protocol-within-a-protocol) in POP3, by which a POP3 client
optionally proposes a mechanism to a POP3 server to authenticate
the client to the server and provide other security services.
(See: POP3 APOP, IMAP4 AUTHENTICATE.)
(C) If the server accepts the proposal, the command is followed by
performing a challenge-response authentication protocol and,
optionally, negotiating a protection mechanism for subsequent POP3
interactions. The security mechanisms used by POP3 AUTH are those
used by IMAP4.
$ port scan
(I) An attack that sends client requests to a range of server port
addresses on a host, with the goal of finding an active port and
exploiting a known vulnerability of that service.
$ POSIX
(N) Portable Operating System Interface for Computer Environments,
a standard [FP151, IS9945-1] (originally IEEE Standard P1003.1)
that defines an operating system interface and environment to
support application portability at the source code level. It is
intended to be used by both application developers and system
implementers.
(C) P1003.1 supports security functionality like those on most
UNIX systems, including discretionary access control and
privilege. IEEE Draft Standard P1003.6.1 specifies additional
functionality not provided in the base standard, including (a)
discretionary access control, (b) audit trail mechanisms, (c)
privilege mechanisms, (d) mandatory access control, and (e)
information label mechanisms.
$ Post Office Protocol, version 3 (POP3)
(I) An Internet Standard protocol [R1939] by which a client
workstation can dynamically access a mailbox on a server host to
retrieve mail messages that the server has received and is holding
for the client. (See: IMAP4.)
(C) POP3 has mechanisms for optionally authenticating a client to
a server and providing other security services. (See: POP3 APOP,
POP3 AUTH.)
$ PPP
See: Point-to-Point Protocol.
$ PPTP
See: Point-to-Point Tunneling Protocol.
$ pre-authorization
(I) A capability of a CAW that enables certification requests to
be automatically validated against data provided in advance to the
CA by an authorizing entity.
$ Pretty Good Privacy(trademark) (PGP(trademark))
(O) Trademarks of Network Associates, Inc., referring to a
computer program (and related protocols) that uses cryptography to
provide data security for electronic mail and other applications
on the Internet. (See: MOSS, PEM, S/MIME.)
(C) PGP encrypts messages with IDEA in CFB mode, distributes the
IDEA keys by encrypting them with RSA, and creates digital
signatures on messages with MD5 and RSA. To establish ownership of
public keys, PGP depends on the web of trust. (See: Privacy
Enhanced Mail.)
$ primary account number (PAN)
(O) SET usage: "The assigned number that identifies the card
issuer and cardholder. This account number is composed of an
issuer identification number, an individual account number
identification, and an accompanying check digit as defined by ISO
7812-1985." [SET2, IS7812] (See: bank identification number.)
(C) The PAN is embossed, encoded, or both on a magnetic-strip-
based credit card. The PAN identifies the issuer to which a
transaction is to be routed and the account to which it is to be
applied unless specific instructions indicate otherwise. The
authority that assigns the bank identification number part of the
PAN is the American Bankers Association.
$ privacy
(I) The right of an entity (normally a person), acting in its own
behalf, to determine the degree to which it will interact with its
environment, including the degree to which the entity is willing
to share information about itself with others. (See: anonymity.)
(O) "The right of individuals to control or influence what
information related to them may be collected and stored and by
whom and to whom that information may be disclosed." [I7498 Part
2]
(D) ISDs SHOULD NOT use this term as a synonym for "data
confidentiality" or "data confidentiality service", which are
different concepts. Privacy is a reason for security rather than a
kind of security. For example, a system that stores personal data
needs to protect the data to prevent harm, embarrassment,
inconvenience, or unfairness to any person about whom data is
maintained, and to protect the person's privacy. For that reason,
the system may need to provide data confidentiality service.
$ Privacy Enhanced Mail (PEM)
(I) An Internet protocol to provide data confidentiality, data
integrity, and data origin authentication for electronic mail.
[R1421, R1422]. (See: MOSS, MSP, PGP, S/MIME.)
(C) PEM encrypts messages with DES in CBC mode, provides key
distribution of DES keys by encrypting them with RSA, and signs
messages with RSA over either MD2 or MD5. To establish ownership
of public keys, PEM uses a certification hierarchy, with X.509
public-key certificates and X.509 CRLs that are signed with RSA
and MD2. (See: Pretty Good Privacy.)
(C) PEM is designed to be compatible with a wide range of key
management methods, but is limited to specifying security services
only for text messages and, like MOSS, has not been widely
implemented in the Internet.
$ private component
(I) A synonym for "private key".
(D) In most cases, ISDs SHOULD NOT use this term; to avoid
confusing readers, use "private key" instead. However, the term
MAY be used when specifically discussing a key pair; e.g., "A key
pair has a public component and a private component."
$ private extension
See: (secondary definition under) extension.
$ private key
(I) The secret component of a pair of cryptographic keys used for
asymmetric cryptography. (See: key pair, public key.)
(O) "(In a public key cryptosystem) that key of a user's key pair
which is known only by that user." [X509]
$ privilege
(I) An authorization or set of authorizations to perform security-
relevant functions, especially in the context of a computer
operating system.
$ privilege management infrastructure
(N) "The complete set of processes required to provide an
authorization service", i.e., processes concerned with attribute
certificates. [FPDAM] (See: PKI.)
(D) ISDs SHOULD NOT use this term and its definition because the
definition is vague, and there is no consensus on an alternate
definition.
$ privileged process
(I) An computer process that is authorized (and, therefore,
trusted) to perform some security-relevant functions that ordinary
processes are not. (See: privilege, trusted process.)
$ procedural security
(D) ISDs SHOULD NOT use this term as a synonym for "administrative
security". Any type of security may involve procedures; therefore,
the term may be misleading. Instead, use "administrative
security", "communication security", "computer security",
"emanations security", "personnel security", "physical security",
or whatever specific type is meant. (See: security architecture.)
$ proprietary
(I) Refers to information (or other property) that is owned by an
individual or organization and for which the use is restricted by
that entity.
$ protected checksum
(I) A checksum that is computed for a data object by means that
protect against active attacks that would attempt to change the
checksum to make it match changes made to the data object. (See:
digital signature, keyed hash, (discussion under) checksum.
$ protected distribution system
(I) A wireline or fiber-optic system that includes sufficient
safeguards (acoustic, electric, electromagnetic, and physical) to
permit its use for unencrypted transmission of (cleartext) data.
$ protection authority
See: (secondary definition under) Internet Protocol Security
Option.
$ protection ring
(I) One of a hierarchy of privileged operation modes of a system
that gives certain access rights to processes authorized to
operate in that mode.
$ protocol
(I) A set of rules (i.e., formats and procedures) to implement and
control some type of association (e.g., communication) between
systems. (E.g., see: Internet Protocol.)
(C) In particular, a series of ordered steps involving computing
and communication that are performed by two or more system
entities to achieve a joint objective. [A9042]
$ protocol suite
(I) A complementary collection of communication protocols used in
a computer network. (See: Internet, OSI.)
$ proxy server
(I) A computer process--often used as, or as part of, a firewall--
that relays a protocol between client and server computer systems,
by appearing to the client to be the server and appearing to the
server to be the client. (See: SOCKS.)
(C) In a firewall, a proxy server usually runs on a bastion host,
which may support proxies for several protocols (e.g., FTP, HTTP,
and TELNET). Instead of a client in the protected enclave
connecting directly to an external server, the internal client
connects to the proxy server which in turn connects to the
external server. The proxy server waits for a request from inside
the firewall, forwards the request to the remote server outside
the firewall, gets the response, then sends the response back to
the client. The proxy may be transparent to the clients, or they
may need to connect first to the proxy server, and then use that
association to also initiate a connection to the real server.
(C) Proxies are generally preferred over SOCKS for their ability
to perform caching, high-level logging, and access control. A
proxy can provide security service beyond that which is normally
part of the relayed protocol, such as access control based on peer
entity authentication of clients, or peer entity authentication of
servers when clients do not have that capability. A proxy at OSI
layer 7 can also provide finer-grained security service than can a
filtering router at OSI layer 3. For example, an FTP proxy could
permit transfers out of, but not into, a protected network.
$ pseudo-random
(I) A sequence of values that appears to be random (i.e.,
unpredictable) but is actually generated by a deterministic
algorithm. (See: random.)
$ pseudo-random number generator
(I) A process used to deterministically generate a series of
numbers (usually integers) that appear to be random according to
certain statistical tests, but actually are pseudo-random.
(C) Pseudo-random number generators are usually implemented in
software.
$ public component
(I) A synonym for "public key".
(D) In most cases, ISDs SHOULD NOT use this term; to avoid
confusing readers, use "private key" instead. However, the term
MAY be used when specifically discussing a key pair; e.g., "A key
pair has a public component and a private component."
$ public key
(I) The publicly-disclosable component of a pair of cryptographic
keys used for asymmetric cryptography. (See: key pair, private
key.)
(O) "(In a public key cryptosystem) that key of a user's key pair
which is publicly known." [X509]
$ public-key certificate
(I) A digital certificate that binds a system entity's identity to
a public key value, and possibly to additional data items; a
digitally-signed data structure that attests to the ownership of a
public key. (See: X.509 public-key certificate.)
(C) The digital signature on a public-key certificate is
unforgeable. Thus, the certificate can be published, such as by
posting it in a directory, without the directory having to protect
the certificate's data integrity.
(O) "The public key of a user, together with some other
information, rendered unforgeable by encipherment with the private
key of the certification authority which issued it." [X509]
$ public-key cryptography
(I) The popular synonym for "asymmetric cryptography".
$ Public-Key Cryptography Standards (PKCS)
(I) A series of specifications published by RSA Laboratories for
data structures and algorithm usage for basic applications of
asymmetric cryptography. (See: PKCS #7, PKCS #10, PKCS #11.)
(C) The PKCS were begun in 1991 in cooperation with industry and
academia, originally including Apple, Digital, Lotus, Microsoft,
Northern Telecom, Sun, and MIT. Today, the specifications are
widely used, but they are not sanctioned by an official standards
organization, such as ANSI, ITU-T, or IETF. RSA Laboratories
retains sole decision-making authority over the PKCS.
$ public-key forward secrecy (PFS)
(I) For a key agreement protocol based on asymmetric cryptography,
the property that ensures that a session key derived from a set of
long-term public and private keys will not be compromised if one
of the private keys is compromised in the future.
(C) Some existing RFCs use the term "perfect forward secrecy" but
either do not define it or do not define it precisely. While
preparing this Glossary, we tried to find a good definition for
that term, but found this to be a muddled area. Experts did not
agree. For all practical purposes, the literature defines "perfect
forward secrecy" by stating the Diffie-Hellman algorithm. The term
"public-key forward secrecy" (suggested by Hilarie Orman) and the
"I" definition stated for it here were crafted to be compatible
with current Internet documents, yet be narrow and leave room for
improved terminology.
(C) Challenge to the Internet security community: We need a
taxonomy--a family of mutually exclusive and collectively
exhaustive terms and definitions to cover the basic properties
discussed here--for the full range of cryptographic algorithms and
protocols used in Internet Standards:
(C) Involvement of session keys vs. long-term keys: Experts
disagree about the basic ideas involved.
- One concept of "forward secrecy" is that, given observations of
the operation of a key establishment protocol up to time t, and
given some of the session keys derived from those protocol runs,
you cannot derive unknown past session keys or future session
keys.
- A related property is that, given observations of the protocol
and knowledge of the derived session keys, you cannot derive one
or more of the long-term private keys.
- The "I" definition presented above involves a third concept of
"forward secrecy" that refers to the effect of the compromise of
long-term keys.
- All three concepts involve the idea that a compromise of "this"
encryption key is not supposed to compromise the "next" one. There
also is the idea that compromise of a single key will compromise
only the data protected by the single key. In Internet literature,
the focus has been on protection against decryption of back
traffic in the event of a compromise of secret key material held
by one or both parties to a communication.
(C) Forward vs. backward: Experts are unhappy with the word
"forward", because compromise of "this" encryption key also is not
supposed to compromise the "previous" one, which is "backward"
rather than forward. In S/KEY, if the key used at time t is
compromised, then all keys used prior to that are compromised. If
the "long-term" key (i.e., the base of the hashing scheme) is
compromised, then all keys past and future are compromised; thus,
you could say that S/KEY has neither forward nor backward secrecy.
(C) Asymmetric cryptography vs. symmetric: Experts disagree about
forward secrecy in the context of symmetric cryptographic systems.
In the absence of asymmetric cryptography, compromise of any long-
term key seems to compromise any session key derived from the
long-term key. For example, Kerberos isn't forward secret, because
compromising a client's password (thus compromising the key shared
by the client and the authentication server) compromises future
session keys shared by the client and the ticket-granting server.
(C) Ordinary forward secrecy vs. "perfect" forward secret: Experts
disagree about the difference between these two. Some say there is
no difference, and some say that the initial naming was
unfortunate and suggest dropping the word "perfect". Some suggest
using "forward secrecy" for the case where one long-term private
key is compromised, and adding "perfect" for when both private
keys (or, when the protocol is multi-party, all private keys) are
compromised.
(C) Acknowledgements: Bill Burr, Burt Kaliski, Steve Kent, Paul
Van Oorschot, Michael Wiener, and, especially, Hilarie Orman
contributed ideas to this discussion.
$ public-key infrastructure (PKI)
(I) A system of CAs (and, optionally, RAs and other supporting
servers and agents) that perform some set of certificate
management, archive management, key management, and token
management functions for a community of users in an application of
asymmetric cryptography. (See: hierarchical PKI, mesh PKI,
security management infrastructure, trust-file PKI.)
(O) PKIX usage: The set of hardware, software, people, policies,
and procedures needed to create, manage, store, distribute, and
revoke digital certificates based on asymmetric cryptography.
(C) The core PKI functions are (a) to register users and issue
their public-key certificates, (b) to revoke certificates when
required, and (c) to archive data needed to validate certificates
at a much later time. Key pairs for data confidentiality may be
generated (and perhaps escrowed) by CAs or RAs, but requiring a
PKI client to generate its own digital signature key pair helps
maintain system integrity of the cryptographic system, because
then only the client ever possesses the private key it uses. Also,
an authority may be established to approve or coordinate CPSs,
which are security policies under which components of a PKI
operate.
(C) A number of other servers and agents may support the core PKI,
and PKI clients may obtain services from them. The full range of
such services is not yet fully understood and is evolving, but
supporting roles may include archive agent, certified delivery
agent, confirmation agent, digital notary, directory, key escrow
agent, key generation agent, naming agent who ensures that issuers
and subjects have unique identifiers within the PKI, repository,
ticket-granting agent, and time stamp agent.
$ RA
See: registration authority.
$ RA domains
(I) A capability of a CAW that allows a CA to divide the
responsibility for certification requests among multiple RAs.
(C) This capability might be used to restrict access to private
authorization data that is provided with a certification request,
and to distribute the responsibility to review and approve
certification requests in high volume environments. RA domains
might segregate certification requests according to an attribute
of the certificate subject, such as an organizational unit.
$ RADIUS
See: Remote Authentication Dial-In User Service.
$ Rainbow Series
(O) A set of more than 30 technical and policy documents with
colored covers, issued by the NCSC, that discuss in detail the
TCSEC and provide guidance for meeting and applying the criteria.
(See: Green Book, Orange Book, Red Book, Yellow Book.)
$ random
(I) General usage: In mathematics, random means "unpredictable". A
sequence of values is called random if each successive value is
obtained merely by chance and does not depend on the preceding
values of the sequence, and a selected individual value is called
random if each of the values in the total population of
possibilities has equal probability of being selected. [Knuth]
(See: cryptographic key, pseudo-random, random number generator.)
(I) Security usage: In cryptography and other security
applications, random means not only unpredictable, but also
"unguessable". When selecting data values to use for cryptographic
keys, "the requirement is for data that an adversary has a very
low probability of guessing or determining." It is not sufficient
to use data that "only meets traditional statistical tests for
randomness or which is based on limited range sources, such as
clocks. Frequently such random quantities are determinable [i.e.,
guessable] by an adversary searching through an embarrassingly
small space of possibilities." [R1750]
$ random number generator
(I) A process used to generate an unpredictable, uniformly
distributed series of numbers (usually integers). (See: pseudo-
random, random.)
(C) True random number generators are hardware-based devices that
depend on the output of a "noisy diode" or other physical
phenomena. [R1750]
$ RBAC
See: Role-Based Access Control.
$ RC2
$ RC4
See: Rivest Cipher #2, Rivest Cipher #4.
$ realm
(O) Kerberos usage: The domain of authority of a Kerberos server
(consisting of an authentication server and a ticket-granting
server), including the Kerberized clients and the Kerberized
application servers
$ RED
(I) Designation for information system equipment or facilities
that handle (and for data that contains) only plaintext (or,
depending on the context, classified information), and for such
data itself. This term derives from U.S. Government COMSEC
terminology. (See: BLACK, RED/BLACK separation.)
$ Red Book
(D) ISDs SHOULD NOT use this term as a synonym for "Trusted
Network Interpretation of the Trusted Computer System Evaluation
Criteria" [NCS05]. Instead, use the full proper name of the
document or, in subsequent references, a more conventional
abbreviation. (See: TCSEC, Rainbow Series, (usage note under)
Green Book.)
$ RED/BLACK separation
(I) An architectural concept for cryptographic systems that
strictly separates the parts of a system that handle plaintext
(i.e., RED information) from the parts that handle ciphertext
(i.e., BLACK information). This term derives from U.S. Government
COMSEC terminology. (See: BLACK, RED.)
$ reference monitor
(I) "An access control concept that refers to an abstract machine
that mediates all accesses to objects by subjects." [NCS04] (See:
security kernel.)
(C) A reference monitor should be (a) complete (i.e., it mediates
every access), (b) isolated (i.e., it cannot be modified by other
system entities), and (c) verifiable (i.e., small enough to be
subjected to analysis and tests to ensure that it is correct).
$ reflection attack
(I) A type of replay attack in which transmitted data is sent back
to its originator.
$ register
$ registration
(I) An administrative act or process whereby an entity's name and
other attributes are established for the first time at a CA, prior
to the CA issuing a digital certificate that has the entity's name
as the subject. (See: registration authority.)
(C) Registration may be accomplished either directly, by the CA,
or indirectly, by a separate RA. An entity is presented to the CA
or RA, and the authority either records the name(s) claimed for
the entity or assigns the entity's name(s). The authority also
determines and records other attributes of the entity that are to
be bound in a certificate (such as a public key or authorizations)
or maintained in the authority's database (such as street address
and telephone number). The authority is responsible, possibly
assisted by an RA, for authenticating the entity's identity and
verifying the correctness of the other attributes, in accordance
with the CA's CPS.
(C) Among the registration issues that a CPS may address are the
following [R2527]:
- How a claimed identity and other attributes are verified.
- How organization affiliation or representation is verified.
- What forms of names are permitted, such as X.500 DN, domain
name, or IP address.
- Whether names are required to be meaningful or unique, and
within what domain.
- How naming disputes are resolved, including the role of
trademarks.
- Whether certificates are issued to entities that are not
persons.
- Whether a person is required to appear before the CA or RA, or
can instead be represented by an agent.
- Whether and how an entity proves possession of the private key
matching a public key.
$ registration authority (RA)
(I) An optional PKI entity (separate from the CAs) that does not
sign either digital certificates or CRLs but has responsibility
for recording or verifying some or all of the information
(particularly the identities of subjects) needed by a CA to issue
certificates and CRLs and to perform other certificate management
functions. (See: organizational registration authority,
registration.)
(C) Sometimes, a CA may perform all certificate management
functions for all end users for which the CA signs certificates.
Other times, such as in a large or geographically dispersed
community, it may be necessary or desirable to offload secondary
CA functions and delegate them to an assistant, while the CA
retains the primary functions (signing certificates and CRLs). The
tasks that are delegated to an RA by a CA may include personal
authentication, name assignment, token distribution, revocation
reporting, key generation, and archiving. An RA is an optional PKI
component, separate from the CA, that is assigned secondary
functions. The duties assigned to RAs vary from case to case but
may include the following:
- Verifying a subject's identity, i.e., performing personal
authentication functions.
- Assigning a name to a subject. (See: distinguished name.)
- Verifying that a subject is entitled to have the attributes
requested for a certificate.
- Verifying that a subject possesses the private key that matches
the public key requested for a certificate.
- Performing functions beyond mere registration, such as
generating key pairs, distributing tokens, and handling
revocation reports. (Such functions may be assigned to a PKI
element that is separate from both the CA and the RA.)
(I) PKIX usage: An optional PKI component, separate from the
CA(s). The functions that the RA performs will vary from case to
case but may include identity authentication and name assignment,
key generation and archiving of key pairs, token distribution, and
revocation reporting. [R2510]
(O) SET usage: "An independent third-party organization that
processes payment card applications for multiple payment card
brands and forwards applications to the appropriate financial
institutions." [SET2]
$ regrade
(I) Deliberately change the classification level of information in
an authorized manner.
$ rekey
(I) Change the value of a cryptographic key that is being used in
an application of a cryptographic system. (See: certificate
rekey.)
(C) For example, rekey is required at the end of a cryptoperiod or
key lifetime.
$ reliability
(I) The ability of a system to perform a required function under
stated conditions for a specified period of time. (See:
availability, survivability.)
$ relying party
(N) A synonym for "certificate user". Used in a legal context to
mean a recipient of a certificate who acts in reliance on that
certificate. (See: ABA Guidelines.)
$ Remote Authentication Dial-In User Service (RADIUS)
(I) An Internet protocol [R2138] for carrying dial-in users'
authentication information and configuration information between a
shared, centralized authentication server (the RADIUS server) and
a network access server (the RADIUS client) that needs to
authenticate the users of its network access ports. (See: TACACS.)
(C) A user of the RADIUS client presents authentication
information to the client, and the client passes that information
to the RADIUS server. The server authenticates the client using a
shared secret value, then checks the user's authentication
information, and finally returns to the client all authorization
and configuration information needed by the client to deliver
service to the user.
$ renew
See: certificate renewal.
$ replay attack
(I) An attack in which a valid data transmission is maliciously or
fraudulently repeated, either by the originator or by an adversary
who intercepts the data and retransmits it, possibly as part of a
masquerade attack. (See: active wiretapping.)
$ repository
(I) A system for storing and distributing digital certificates and
related information (including CRLs, CPSs, and certificate
policies) to certificate users. (See: directory.)
(O) "A trustworthy system for storing and retrieving certificates
or other information relevant to certificates." [ABA]
(C) A certificate is published to those who might need it by
putting it in a repository. The repository usually is a publicly
accessible, on-line server. In the Federal Public-key
Infrastructure, for example, the expected repository is a
directory that uses LDAP, but also may be the X.500 Directory that
uses DAP, or an HTTP server, or an FTP server that permits
anonymous login.
$ repudiation
(I) Denial by a system entity that was involved in an association
(especially an association that transfers information) of having
participated in the relationship. (See: accountability, non-
repudiation service.)
(O) "Denial by one of the entities involved in a communication of
having participated in all or part of the communication." [I7498
Part 2]
$ Request for Comment (RFC)
(I) One of the documents in the archival series that is the
official channel for ISDs and other publications of the Internet
Engineering Steering Group, the Internet Architecture Board, and
the Internet community in general. [R2026, R2223] (See: Internet
Standard.)
(C) This term is *not* a synonym for "Internet Standard".
$ residual risk
(I) The risk that remains after countermeasures have been applied.
$ restore
See: card restore.
$ revocation
See: certificate revocation.
$ revocation date
(N) In an X.509 CRL entry, a date-time field that states when the
certificate revocation occurred, i.e., when the CA declared the
digital certificate to be invalid. (See: invalidity date.)
(C) The revocation date may not resolve some disputes because, in
the worst case, all signatures made during the validity period of
the certificate may have to be considered invalid. However, it may
be desirable to treat a digital signature as valid even though the
private key used to sign was compromised after the signing. If
more is known about when the compromise actually occurred, a
second date-time, an "invalidity date", can be included in an
extension of the CRL entry.
$ revocation list
See: certificate revocation list.
$ revoke
See: certificate revocation.
$ RFC
See: Request for Comment.
$ risk
(I) An expectation of loss expressed as the probability that a
particular threat will exploit a particular vulnerability with a
particular harmful result.
(O) SET usage: "The possibility of loss because of one or more
threats to information (not to be confused with financial or
business risk)." [SET2]
$ risk analysis
$ risk assessment
(I) A process that systematically identifies valuable system
resources and threats to those resources, quantifies loss