Contents Overview 1 Lesson: Introduction to Cryptography 3 Lesson: Working with Digital Certificates 15 Lab 8.1: Obtaining a Server Certificate 35 Lesson: Using the Secure Sockets Layer/Transport Layer Security Protocols 39 Lesson: Using Internet Protocol Security 58 Review 63 Lab 8.2: Protecting Communication Privacy and Data Integrity 65 Course Evaluation 76 Module 8: Protecting Communication Privacy and Data Integrity Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.  2002 Microsoft Corporation. All rights reserved. Microsoft, MS-DOS, Windows, Windows NT, ActiveX, Active Directory, Authenticode, Hotmail, JScript, Microsoft Press, MSDN, PowerPoint, Visual Basic, Visual C++, Visual Studio, and Windows Media are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. Module 8: Protecting Communication Privacy and Data Integrity iii Instructor Notes This module provides students with an overview of cryptography and digital certificates. The module then explains how students can protect data and communications between the Web browser and the Web server. After completing this module, students will be able to protect the portions of a Web application that require private communications through Secure Sockets Layer (SSL) security. After completing this module, students will be able to: ! Define the basic elements of cryptography. ! Describe the purpose of digital certificates and obtain one through a Certificate Authority (CA). ! Validate user and Web server identity through the use of SSL/Transport Layer Security (TLS). ! Protect communications between Web application resources through the use of Internet Protocol security (IPSec). To teach this module, you need the following materials: ! Microsoft ® PowerPoint ® file 2300A_08.ppt ! Hypertext Markup Language (HTML) and Flash animation files 2300A_08_A05_1619.htm and 2300A_08_A05_1619.swf To prepare for this module: ! Read all of the materials for this module. ! Complete the demonstrations and labs. ! Read Module 5, “Configuring Network Security by Using Public Key Infrastructure,” in Course 2153, Implementing a Microsoft Windows 2000 Network Infrastructure. ! Read Module 6, “Configuring Network Security by Using IPSec,” in Course 2153, Implementing a Microsoft Windows 2000 Network Infrastructure. ! Read Module 5, “Implementing Security on a Web Server,” in Course 2295, Implementing and Supporting Microsoft Internet Information Services 5.0. ! Read the article “Step-by-Step Guide to Internet Protocol Security (IPSec),” which is available at http://www.microsoft.com/windows2000/techinfo/ planning/security/ipsecsteps.asp. ! Read the TechNet article, “Authentication and Encryption,” which is available at http://www.microsoft.com/technet/security/network/authen.asp. ! Read the Microsoft MSDN ® Magazine article, “Web Security: Putting a Secure Front End on Your COM+ Distributed Applications,” which is available at http://msdn.microsoft.com/msdnmag/issues/0600/ websecure/websecure.asp. Presentation: 120 minutes Lab: 30 minutes Required materials Preparation tasks iv Module 8: Protecting Communication Privacy and Data Integrity ! Read the MSDN article, “The Evolution of Security on the Web: An Introduction to Cryptosystems on the Internet,” which is available at http://msdn.microsoft.com/library/en-us/dnsecure/html/msdn_websec.asp. ! Read the VeriSign article, “Implementing Web Site Client Authentication Using Digital IDs,” which is available at http://www.verisign.com/ clientauth/kit/details.html. ! Read the VeriSign article, “Guide to Securing Your Web Site For Business,” which is available at http://www.verisign.com/resources/ gd/secureBusiness/secureBusiness.html. Module 8: Protecting Communication Privacy and Data Integrity v How to Teach This Module Begin this module with a discussion of the types of attacks that are possible on the communication link between the browser and the Web server. Lesson: Introduction to Cryptography It is an interesting sidebar to mention the role that cryptographic code breaking played in World War II. “Enigma,” “Purple,” and “Magic” are the code names of some of the more well-known cryptographic systems. You can find more information about cryptography during wartime by searching for “cryptography World War II” on the Internet. Mention that symmetric encryption is very fast and that it is the most efficient way to transfer larger quantities of data securely. By using asymmetric encryption, the recipient of the encrypted data can be assured that the data came from the owner of the public key. Therefore, not only can asymmetric encryption be used to encrypt the data, it also provides a guarantee of the data’s origin. Note that the key length plays an important role in the strength of the encryption. If the key length is long enough, it is virtually impossible to guess. Storing private keys is the most challenging aspect of encryption. For more information about this topic, direct students to the book, Writing Secure Code, by Michael Howard and David LaBlanc (Redmond: Microsoft Press ® ), 2002. An important distinction between encryption and hashing is that encryption scrambles the data such that it can be unscrambled, whereas hashing cannot be reversed. You can sign data without hashing it to guarantee that the data came from you; however, this would not guarantee that the data was not changed en route to the recipient. After reviewing the answers to the practice, brainstorm with the students for more scenarios of when cryptography could be used in Web applications. Lesson: Working with Digital Certificates Mention briefly that one of the reasons for obtaining a certificate (personal or server) is to use SSL to communicate with a Web server. Students will learn more about the SSL/TLS and IPSec protocols later in this module. You can do the steps of this practice with the students and show the nwtraders.msft certificate, which is the certificate from the London CA. Students may ask about the process that is required to become a CA, such as VeriSign. Although anyone who uses Certificate Services can generate certificates, not everyone who generates certificates is a trusted CA. Trust is based on many factors, including the length of time that the CA is in business, the CA’s reputation, and the process that the CA uses to verify those who request certificates. What Is Cryptography? How Does Symmetric Encr y ption Work? How Does Asymmetric Encryption Work? Exchanging and Storing Ke y s Verifying Data Integrity with Hashes Using Digital Signatures Practice: Using Cr y pto g raph y What Are Digital Certificates? Practice: Viewing Digital Certificates What Is a Certificate Authorit y ? vi Module 8: Protecting Communication Privacy and Data Integrity This animation provides an overview of the process of how certificates are requested and granted from a CA, and then how those certificates are used to communicate securely over SSL. You might consider postponing this animation until the next lesson, which discusses SSL. Note that the “random bits” referred to in the multimedia are the session key. For certificates to be effective, they must be trusted. Certificate chains enable users to trace a certificate back to the original CA. If time permits, demonstrate the use of the Certificate Manager tool. Discuss some of the reasons why a user would want to obtain a personal certificate. Note The options for certificate templates offered by the Certificate Request Wizard depend on how you installed the Microsoft Management Console (MMC) Certificates snap-in: ! If you installed the MMC Certificates snap-in to manage certificates for My user account, as directed in the “Practice: Viewing Digital Certificates” topic, you get Authenticated Session, Basic EFS, and User Signature Only templates. ! If you installed the MMC Certificates snap-in to manage certificates for Computer account, you get Computer and IPSEC templates. You will need to lead this practice and also get a personal certificate; make sure to enter Research for your department, because this field will be used in the client certificate mapping demonstration. As the students submit their requests for personal certificates, you need to issue the certificates. The issuing of certificates should be done with little explanation and with the screen blanked so that the students do not get confused between the request and issue processes. ! To process the certificate requests with Microsoft Certificate Services for Microsoft Windows ® 2000 1. On the Start menu, click Programs, click Administrative Tools, and then click Certification Authority. During setup, the instructor computer was set up with Certificate Services and was created as a stand-alone root CA. 2. Expand the nwtraders.msft CA, and then click Pending Requests. There will be one certificate request from each student. 3. To accept the request and issue a certificate, right-click the request, click All Tasks, and then click Issue. The request is moved from the Pending Requests node to the Issued Certificates node. Multimedia: Using Digital Certificates Certificate Chains and Hierarchies Certificate Stores Obtaining a Personal Certificate Note Instructor-Led Practice: Obtaining a Personal Certificate Module 8: Protecting Communication Privacy and Data Integrity vii Show how the SSL port, 443, is disabled by opening Internet Information Services (IIS) and viewing the Web Site tab for the Mod08 folder of the 2300Demos Web application. Explain to students that they will obtain a server certificate in the lab; therefore, they can just watch the demonstration now, rather than performing the steps. When processing the certificate request with Certification Services, do not explain what is being done. This step occurs only because you are using Certificate Services in the classroom. Lab 8.1: Obtaining a Server Certificate Both the TailspinToys and TailspinToysAdmin Web applications contain Web pages that either request private information from users or deliver private information to users. Before students can turn on SSL for these Web pages, they need to obtain a server certificate for their Web servers. Students will request the server certificates from the London CA. You will need to approve the requests as they are made by the students. ! To issue certificates by using Certificate Services After students have submitted their requests for server certificates, you must issue the certificates: 1. On the Start menu, click Programs, click Administrative Tools, and then click Certification Authority. 2. Expand the nwtraders.msft CA, and then click Pending Requests. There will be a certificate request from each student. 3. To accept a request and issue a certificate, right-click the request, click All Tasks, and then click Issue. The request is moved from the Pending Requests folder to the Issued Certificates folder. Lesson: Using the Secure Sockets Layer/Transport Layer Security Protocols Students may have heard of both SSL and TLS. It is important to note that TLS is the most recent version of the protocol and that although SSL is the more commonly referred-to protocol, it is most likely TLS that is being used. Mention that SSL/TLS are the protocols that enable the secure communications that are described in the animation “Using Digital Certificates.” You might consider showing this animation here instead of in the previous lesson. Mention the steps that are required before SSL can be enabled in IIS. You will demonstrate the process of enabling SSL in the demonstration that follows this topic. Show how SSL is enabled in IIS. Discuss the various options that are available for client certificates. Obtaining a Server Certificate Demonstration: Obtaining a Server Certificate Overview of Security Protocols How Does SSL/TLS Work? Enabling SSL for an IIS Web Application Demonstration: Enabling SSL viii Module 8: Protecting Communication Privacy and Data Integrity Discuss both the Active Server Pages (ASP) method and the Microsoft ASP.NET method of verifying the authenticity of client certificates. Before students can view the pages in the practice, you must configure the Mod08 folder of the 2300Demos Web application to require client certificates. After students have accessed the WhoAmI.asp and ReadCertInfo.aspx pages in the Mod08 folder of the 2300Demos Web application on the London computer, examine the source code for the pages in Microsoft Visual Studio ® .NET: 1. In Visual Studio .NET, open the WhoAmI.asp page in the Mod08 folder of the 2300Demos project. 2. In Visual Studio .NET, open the ReadCertInfo.aspx page in the Mod08 folder of the 2300Demos project. The page displays information from a client certificate by using the HttpClientCertificate object. Client certificate mapping is a powerful authentication method that allows IIS to perform work on behalf of the client, based on the contents of a client certificate. Emphasize IIS client certificate mapping. Information on Active Directory ® directory service mapping is provided for those students that have previous experience with Active Directory. Demonstrate how to enable many-to-one client certificate mapping in the 2300Demos Web application. Note that client certificate mapping is not used in the labs. SSL should be used only for those portions of the Web application that require secure communications. There is a performance cost that is associated with using SSL, and care should be taken to ensure that SSL is used only when necessary. Discuss the guidelines for using SSL. Run this practice as a group brainstorming session where students determine which pages in the TailspinToys and TailspinToysAdmin Web applications should be protected with SSL. Lesson: Using Internet Protocol Security Note that although IPSec is not commonly used for securing communications between client computers and Web applications on the IIS Web server, IPSec does have a role in protecting communications between the IIS Web server and the other computers and resources that are on the organization’s network. Briefly discuss the process of implementing IPSec. Understanding how IPSec and SSL/TLS differ is important when deciding where to apply each protocol. Discuss each difference between IPSec and SSL/TLS. Lab 8.2: Protecting Communication Privacy and Data Integrity In Lab 8.2, students will turn on SSL for portions of the TailspinToys and TailspinToysAdmin Web applications. Verifying the Authenticity of Client Certificates Instructor-Led Practice: Verifying the Authenticity of Client Certificates Using Client Certificate Mappin g Demonstration: Client Certificate Mapping Guidelines for Using SSL/TLS Practice: Requiring SSL for Web Application Pages Overview of IPSec Implementing IPSec Comparing IPSec and SSL/TLS Module 8: Protecting Communication Privacy and Data Integrity ix Customization Information This section identifies the lab setup requirements for a module and the configuration changes that occur on student computers during the labs. This information is provided to assist you in replicating or customizing Microsoft Official Curriculum (MOC) courseware. Lab Setup To complete this lab, the WebUser login and the InternetStoredProcs and IntranetStoredProcs roles must be added to Microsoft SQL Server ™ on the Glasgow computer. ! Configure SQL Server on the Glasgow computer • If you did not perform the “Adding Roles and Logins to SQL Server” demonstration in Module 7, “Securing Microsoft SQL Server,” in Course 2300, Developing Secure Web Applications, you must do it now. To complete this lab, students can continue working in the Tailspin Toys Visual Studio .NET projects that they used in previous labs, or they can start with new files. To start with new files, students must complete the following steps. ! Create the Web applications for the ASP exercises 1. Copy all of the contents of the ASP starter folder install_folder\Labfiles\ Lab08_2\ASP\Starter\TailspinToys to the TailspinToys IIS virtual directory at C:\Inetpub\wwwroot\TailspinToys. 2. Copy all of the contents of the ASP starter folder install_folder\Labfiles\ Lab08_2\ASP\Starter\TailspinToysAdmin to the TailspinToys IIS virtual directory at C:\Inetpub\wwwroot\TailspinToysAdmin. ! Create the Web applications for the ASP.NET exercises 1. Copy all of the contents of the ASP.NET folder install_folder\Labfiles\ Lab08_2\ASPXVB\Starter\TailspinToys.NET to the TailspinToys.NET IIS virtual directory at C:\Inetpub\wwwroot\TailspinToys.NET. 2. Copy all of the contents of the ASP.NET folder install_folder\Labfiles\ Lab08_2\ASPXVB\Starter\TailspinToysAdmin.NET to the TailspinToysAdmin.NET IIS virtual directory at C:\Inetpub\wwwroot\ TailspinToysAdmin.NET. 3. Edit the file c:\Inetpub\wwwroot\TailspinToysAdmin.NET\Web.config and change the <allow roles="London\TailspinAdmins"/> tag to be <allow roles="machineName\TailspinAdmins"/>, where machineName is the name of your computer. x Module 8: Protecting Communication Privacy and Data Integrity ! Configure IIS authentication 1. Run the IIS administrative tool. 2. Expand the computer node and the Default Web Site node in the tree. 3. Right-click the TailspinToysAdmin virtual directory, and then click Properties. 4. Click Directory Security. 5. In the Anonymous access and authentication control group, click Edit. 6. Clear the Anonymous access check box. 7. Click OK twice to save your changes. 8. Right-click the TailspinToysAdmin.NET virtual directory, and then click Properties. 9. Click Directory Security. 10. In the Anonymous access and authentication control group, click Edit. 11. Clear the Anonymous access check box. 12. Click OK twice to save your changes. Lab Results Performing the labs in this module introduces the following configuration changes: ! The Login.asp and ChangePassword.asp pages are moved into a private folder in the TailspinToys Web application. ! The Login.aspx and ChangePassword.aspx pages are moved into a private folder in the TailspinToys.NET Web application. ! The private folder in each of the following Web applications is configured in IIS to require SSL: • TailspinToys • TailspinToys.NET • TailspinToysAdmin • TailspinToysAdmin.NET [...]... Howard and David LaBlanc (Redmond: Microsoft Press), 2001 Module 8: Protecting Communication Privacy and Data Integrity 11 Verifying Data Integrity with Hashes User B User A Data Data Hash value Hash value Hash algorithm Hash algorithm Data Data Hash algorithm Hash algorithm Data Data Hash value Hash value If hash If hash values values match, match, data is valid data is valid Hash value Hash value Data. .. hashing and digital signing 4 Module 8: Protecting Communication Privacy and Data Integrity What Is Cryptography? ! Cryptography is the science of protecting data " Protects a user's identity or data from being read " Protects data from being altered " Verifies that data originates from a particular user ! Encryption is the process of scrambling data ! Encryption is only as strong as the key Data Data... actively monitor, capture, and control the data that passes between two communicating computers without the knowledge of the affected parties (for example, the attacker can reroute a data exchange) Note The code samples in this module are provided in both Microsoft® Visual Basic® NET and C# 2 Module 8: Protecting Communication Privacy and Data Integrity Objectives After completing this module, you will be... the password 12 Module 8: Protecting Communication Privacy and Data Integrity Using Digital Signatures User A User B Data Data Data Data Hash algorithm Hash algorithm Hash algorithm Hash algorithm User B User B User B User B Hash value Hash value Hash value Hash value Private key 1 2 2 3 Private Public key Hash value Hash value If hash values If hash values match, data came match, data came from the... connection between a client application and a server application (such as a Web browser and Web server) ! Secure Multipurpose Internet Mail Extensions (S/MIME) A protocol that is used for sending secure e-mail ! IPSec A computer-to-computer protocol that supports privacy, authentication, and data integrity 18 Module 8: Protecting Communication Privacy and Data Integrity Practice: Viewing Digital Certificates... message or other forms of communication to obtain the keys Note For more information about encryption algorithms, see the topic “Supported Algorithms” in the Microsoft MSDN® online documentation 5 6 Module 8: Protecting Communication Privacy and Data Integrity How Does Symmetric Encryption Work? ! Same encryption algorithm and key are used to both encrypt and decrypt the data ! Fast and efficient ! Difficult... 14 Module 8: Protecting Communication Privacy and Data Integrity 4 You want to send data to a user and have the user be sure that the file is from you and has not been changed en route Create a hash of the file and sign the hash to send along with the file 5 You want to send a broadcast message with important data You do not... difficult and time consuming, if not impossible, for an attacker to decipher the data Encryption is often used in the following types of transactions: ! E-mail ! E-commerce ! File storage ! Database connections ! Web client authentication Module 8: Protecting Communication Privacy and Data Integrity How is data encrypted? An encryption algorithm, also called a cipher, is used with secret data, which... Add Standalone Snap-in dialog box, and then in the Add/Remove Snap-in dialog box, click OK ! View certificates on your computer 1 In Microsoft Management Console (MMC), expand the Certificates node, which is under the Console Root node 2 Expand the Personal node Do you have any personal certificates installed? No Module 8: Protecting Communication Privacy and Data Integrity. .. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnmag01/ html/com0105.asp 10 Module 8: Protecting Communication Privacy and Data Integrity If your process runs as SYSTEM (such as an Active Server Pages (ASP) page), you can store keys in the Local Security Authority (LSA) by using LsaStorePrivateData and LsaRetrievePrivateData LSA can store only a fixed (small) number of keys, however, so this option . Lab 8.2: Protecting Communication Privacy and Data Integrity 65 Course Evaluation 76 Module 8: Protecting Communication Privacy and Data Integrity. gd/secureBusiness/secureBusiness.html. Module 8: Protecting Communication Privacy and Data Integrity v How to Teach This Module Begin this module with a discussion