What security operations provide confidentiality, integrity and authentication?

Question

I'm a newbie in security. I read a lot (recently read this book), and now asking question just to be sure if I understood everything.

Here are my questions (or assumptions), which of them are correct?

• Confidentiality: to ensure confidentiality, we can use encryption
• Integrity: to ensure integrity, we can use encryption, or data signing
• Authentication: to ensure authentication, we can use data signing
• Availibility: is ensured no matter what we use - we can use encryption, data signing, or we can not use them - we always have the Availibility

Answer 1

Your question is difficult to answer because security is a property of a system, not a property of a single technology or algorithm.

Confidentiality

It can be assured using encryption, but that's not enough. You need to look at the whole system to give a meaningful answer.

Here's a system that uses encryption and doesn't guarantee confidentiality: The WEP wireless encryption system. It is flawed because is reuses IVs too fast (I think), meaning that you can decrypt WEP communications after listening to the encrypted traffic for a while.

Also, sometimes the content of a message isn't as important as the fact that there was a message at all. So just knowing that A sent a message to B might already be enough to destroy confidentiality. If you call a suicide prevention hotline and I learn of this conversation, I can be fairly sure what you were talking about without knowing the exact content of the conversation.

Integrity and Authentication

You have a related problem when using encryption for integrity. Assume you're using a block cipher which encrypts data in 8 byte blocks. Assume you're trying to protect the integrity of the string "I give Reinards $1000000". You encrypt that, yielding "a7nBg2iUlRaM1iiRT64O21pm". What's to stop me from taking the last 8 bytes of the ciphertext and replacing them with something else? As long as it decrypts correctly, how are you going to know it's not the original? And what if I manage to replace the last 8 bytes with something that decrypts to "$9999999", or "my child"? Okay, maybe the times where we sold children into slavery are over, but you've just given me much more than you bargained for. So you don't need encryption for message integrity, you need message authentication, which is commonly done using message authentication codes.

Availability

Availability means the data is there when you need it. You don't just "have" availability in contexts where data sits in a datacenter at the other end of the planet. A large number of systems must interoperate perfectly to allow you to look at that data when you want it. One of these systems may be Nagios, which alerts people to service disruptions. Another might be a set of high-availability solutions which switch over to another datacenter when the first one currently suffers from a power outage or hurricane damage. This has nothing at all to do with encryption or digital signing.

The currently gravest threat to service availabilty is probably distributed denial of service attacks, which are very difficult to counter. No amount of encryption or digital signing can help here.

Answer 2

No. Confidentiality, Availability and Integrity are the pillars of the security of an information system. You can use data signing and/or encryption to reach your goals, but security cannot be reduced to that.

Confidentiality: only allowed people should be able to read the information. Sending encrypted data can be one way, but using a physical safe for printed document in also important. In the context in IT, it involves authenticating users and only delivering the granted information.

Integrity: only allowed people should be able to change information, and only in a definite way. Here again authentication is involved, but also archives can be a way to recover from incidents that could have altered os destroyed information.

Availabity: In the context of IT, it involves redundant power supplies, RAID disks and redundant network links. For major platforms, data can be duplicated on different data centers to make sure that even if one is not reachable, you can access data from an online backup center.

TL/DR: data signing and encryption in only a small part of the great security pillars Availability, Integrity and Confidentiality.