SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 5: Elementary CryptographyPLAINTEXT MESSAGEHashalgorithmOne-way functionHash value/Message digestEncrypt usingsender’s private keyDigital SignatureSenderPLAINTEXT MESSAGESend signed messageto receiverReceiverIf the two MDs match, thenmessage is authenticHash value/Message digestHash value/Message digestPLAINTEXT MESSAGEDecrypt usingsender’s public keyDigital signatureFigure 5. Digital signatureDigital signatures provide non-repudiation and integrity to preventsomeone from claiming that they did not perform an action or approvea transaction, and to confirm that the message has not been modified.Modes of OperationA cryptographic algorithm can be applied in different ways dependingon the type of data and specific requirements of its application. Forexample, some data is fixed length and must remain exactly the samesize after it has been encrypted, as is the case with block data writtento disks. In other contexts, such as tape backup applications, the datais streaming to the device very rapidly on a flexible media. Encryptingdata bit by bit as it is transported serially through a wire requires yetanother method of encryption. Instead of creating a different cryptographicalgorithm for each application and type of data, the samealgorithm is used in different ways to accommodate each specificrequirement. These methods are called modes of operation.The following describes common modes of operation in use today:• Electronic Codebook (ECB). Divides the message into equal-sizeblocks that are encrypted separately. ECB is not very good for hidingpatterns, since identical plaintext blocks encrypt to identicalciphertext blocks.• Cipher-Block Chaining (CBC). A message is divided into equal-sizeblocks and the entire block is encrypted. The first block is alsoencrypted using an initialization vector (IV) to randomize the82 Securing Fibre Channel Fabrics