Why Local-First JSON Processing Matters for Security

(e.g., smart card or PCMCIA card) used to store cryptographic information and possibly also perform cryptographic functions. (See: cryptographic card, token.) Tutorial: A smart token might implement some set of cryptographic algorithms and might incorporate related key management functions, such as a random number generator. A smart cryptographic token may contain a cryptographic module or may not be explicitly designed that way. $ cryptography 1. (I) The mathematical science that deals with transforming data to render its meaning unintelligible (i.e., to hide its semantic content), prevent its undetected alteration, or prevent its unauthorized use.

If the transformation is reversible, cryptography also deals with restoring encrypted data to intelligible form. (See: cryptology, steganography.) 2. (O) "The discipline which embodies principles, means, and methods for the transformation of data in order to hide its information content, prevent its undetected modification and/or prevent its unauthorized use.... Cryptography determines the methods used in encipherment and decipherment." [I7498-2] Shirey Informational [Page 90] RFC 4949 Internet Security Glossary, Version 2 August 2007 Tutorial: Comprehensive coverage of applied cryptographic protocols and algorithms is provided by Schneier [Schn]. Businesses and governments use cryptography to make data incomprehensible to outsiders; to make data incomprehensible to both outsiders and insiders, the data is sent to lawyers for a rewrite.

$ Cryptoki (N) A CAPI defined in PKCS #11. Pronunciation: "CRYPTO-key". Derivation: Abbreviation of "cryptographic token interface". $ cryptology (I) The science of secret communication, which includes both cryptography and cryptanalysis. Tutorial: Sometimes the term is used more broadly to denote activity that includes both rendering signals secure (see: signal security) and extracting information from signals (see: signal intelligence) [Kahn].

$ cryptonet (I) A network (i.e., a communicating set) of system entities that share a secret cryptographic key for a symmetric algorithm. (See: controlling authority.) (O) "Stations holding a common key." [C4009] $ cryptoperiod (I) The time span during which a particular key value is authorized to be used in a cryptographic system. (See: key management.) Usage: This term is long-established in COMPUSEC usage. In the context of certificates and public keys, "key lifetime" and "validity period" are often used instead. Tutorial: A cryptoperiod is usually stated in terms of calendar or clock time, but sometimes is stated in terms of the maximum amount of data permitted to be processed by a cryptographic algorithm using the key.

Specifying a cryptoperiod involves a tradeoff between the cost of rekeying and the risk of successful cryptoanalysis. $ cryptosystem (I) Contraction of "cryptographic system". $ cryptovariable (D) Synonym for "key". Shirey Informational [Page 91] RFC 4949 Internet Security Glossary, Version 2 August 2007 Deprecated Usage: In contemporary COMSEC usage, the term "key" has replaced the term "cryptovariable". $ CSIRT (I) See: computer security incident response team.

$ CSOR (N) See: Computer Security Objects Register. $ CTAK (D) See: ciphertext auto-key. $ CTR (N) See: counter mode. $ cut-and-paste attack (I) An active attack on the data integrity of cipher text, effected by replacing sections of cipher text with other cipher text, such that the result appears to decrypt correctly but actually decrypts to plain text that is forged to the satisfaction of the attacker. $ cyclic redundancy check (CRC) (I) A type of checksum algorithm that is not a cryptographic hash but is used to implement data integrity service where accidental changes to data are expected.

Sometimes called "cyclic redundancy code". $ DAC (N) See: Data Authentication Code, discretionary access control. Deprecated Usage: IDOCs that use this term SHOULD state a definition for it because this abbreviation is ambiguous. $ daemon (I) A computer program that is not invoked explicitly but waits until a specified condition occurs, and then runs with no associated user (principal), usually for an administrative purpose. (See: zombie.) $ dangling threat (O) A threat to a system for which there is no corresponding vulnerability and, therefore, no implied risk.

$ dangling vulnerability (O) A vulnerability of a system for which there is no corresponding threat and, therefore, no implied risk. Shirey Informational [Page 92] RFC 4949 Internet Security Glossary, Version 2 August 2007 $ DASS (I) See: Distributed Authentication Security Service. $ data (I) Information in a specific representation, usually as a sequence of symbols that have meaning. Usage: Refers to both (a) representations that can be recognized, processed, or produced by a computer or other type of machine, and (b) representations that can be handled by a human. $ Data Authentication Algorithm, data authentication algorithm 1.

(N) /capitalized/ The ANSI standard for a keyed hash function that is equivalent to DES cipher block chaining with IV = 0. [A9009] 2. (D) /not capitalized/ Synonym for some kind of "checksum". Deprecated Term: IDOCs SHOULD NOT use the uncapitalized form "data authentication algorithm" as a synonym for any kind of checksum, regardless of whether or not the checksum is based on a hash. Instead, use "checksum", "Data Authentication Code", "error detection code", "hash", "keyed hash", "Message Authentication Code", "protected checksum", or some other specific term, depending on what is meant.

The uncapitalized term can be confused with the Data Authentication Code and also mixes concepts in a potentially misleading way. The word "authentication" is misleading because the checksum may be used to perform a data integrity function rather than a data origin authentication function. $ Data Authentication Code, data authentication code 1. (N) /capitalized/ A specific U.S. Government standard [FP113] for a checksum that is computed by the Data Authentication Algorithm.

Usage: a.k.a. Message Authentication Code [A9009].) (See: DAC.) 2. (D) /not capitalized/ Synonym for some kind of "checksum". Deprecated Term: IDOCs SHOULD NOT use the uncapitalized form "data authentication code" as a synonym for any kind of checksum, regardless of whether or not the checksum is based on the Data Authentication Algorithm. The uncapitalized term can be confused with the Data Authentication Code and also mixes concepts in a potentially misleading way (see: authentication code).

Shirey Informational [Page 93] RFC 4949 Internet Security Glossary, Version 2 August 2007 $ data compromise 1. (I) A security incident in which information is exposed to potential unauthorized access, such that unauthorized disclosure, alteration, or use of the information might have occurred. (Compare: security compromise, security incident.) 2. (O) /U.S. DoD/ A "compromise" is a "communication or physical transfer of information to an unauthorized recipient." [DoD5] 3.

(O) /U.S. Government/ "Type of [security] incident where information is disclosed to unauthorized individuals or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred." [C4009] $ data confidentiality 1. (I) The property that data is not disclosed to system entities unless they have been authorized to know the data. (See: Bell- LaPadula model, classification, data confidentiality service, secret. Compare: privacy.) 2.

(D) "The property that information is not made available or disclosed to unauthorized individuals, entities, or processes [i.e., to any unauthorized system entity]." [I7498-2]. Deprecated Definition: The phrase "made available" might be interpreted to mean that the data could be altered, and that would confuse this term with the concept of "data integrity". $ data confidentiality service (I) A security service that protects data against unauthorized disclosure. (See: access control, data confidentiality, datagram confidentiality service, flow control, inference control.) Deprecated Usage: IDOCs SHOULD NOT use this term as a synonym for "privacy", which is a different concept. $ Data Encryption Algorithm (DEA) (N) A symmetric block cipher, defined in the U.S.

Government's DES. DEA uses a 64-bit key, of which 56 bits are independently chosen and 8 are parity bits, and maps a 64-bit block into another 64-bit block. [FP046] (See: AES, symmetric cryptography.) Usage: This algorithm is usually referred to as "DES". The algorithm has also been adopted in standards outside the Government (e.g., [A3092]). Shirey Informational [Page 94] RFC 4949 Internet Security Glossary, Version 2 August 2007 $ data encryption key (DEK) (I) A cryptographic key that is used to encipher application data.

(Compare: key-encrypting key.) $ Data Encryption Standard (DES) (N) A U.S. Government standard [FP046] that specifies the DEA and states policy for using the algorithm to protect unclassified, sensitive data. (See: AES.) $ data integrity 1. (I) The property that data has not been changed, destroyed, or lost in an unauthorized or accidental manner. (See: data integrity service.

Compare: correctness integrity, source integrity.) 2. (O) "The property that information has not been modified or destroyed in an unauthorized manner." [I7498-2] Usage: Deals with (a) constancy of and confidence in data values, and not with either (b) information that the values represent (see: correctness integrity) or (c) the trustworthiness of the source of the values (see: source integrity). $ data integrity service (I) A security service that protects against unauthorized changes to data, including both intentional change or destruction and accidental change or loss, by ensuring that changes to data are detectable. (See: data integrity, checksum, datagram integrity service.) Tutorial: A data integrity service can only detect a change and report it to an appropriate system entity; changes cannot be prevented unless the system is perfect (error-free) and no malicious user has access. However, a system that offers data integrity service might also attempt to correct and recover from changes.

The ability of this service to detect changes is limited by the technology of the mechanisms used to implement the service. For example, if the mechanism were a one-bit parity check across each entire SDU, then changes to an odd number of bits in an SDU would be detected, but changes to an even number of bits would not. Relationship between data integrity service and authentication services: Although data integrity service is defined separately from data origin authentication service and peer entity authentication service, it is closely related to them. Authentication services depend, by definition, on companion data integrity services. Data origin authentication service provides Shirey Informational [Page 95] RFC 4949 Internet Security Glossary, Version 2 August 2007 verification that the identity of the original source of a received data unit is as claimed; there can be no such verification if the data unit has been altered.

Peer entity authentication service provides verification that the identity of a peer entity in a current association is as claimed; there can be no such verification if the claimed identity has been altered. $ data origin authentication (I) "The corroboration that the source of data received is as claimed." [I7498-2] (See: authentication.) $ data origin authentication service (I) A security service that verifies the identity of a system entity that is claimed to be the original source of received data. (See: authentication, authentication service.) Tutorial: This service is provided to any system entity that receives or holds the data. Unlike peer entity authentication service, this service is independent of any association between the originator and the recipient, and the data in question may have originated at any time in the past. A digital signature mechanism can be used to provide this service, because someone who does not know the private key cannot forge the correct signature.

However, by using the signer's public key, anyone can verify the origin of correctly signed data. This service is usually bundled with connectionless data integrity service. (See: "relationship between data integrity service and authentication services" under "data integrity service". $ data owner (N) The organization that has the final statutory and operational authority for specified information. $ data privacy (D) Synonym for "data confidentiality".

Deprecated Term: IDOCs SHOULD NOT use this term; it mixes concepts in a potentially misleading way. Instead, use either "data confidentiality" or "privacy" or both, depending on what is meant. $ data recovery 1. (I) /cryptanalysis/ A process for learning, from some cipher text, the plain text that was previously encrypted to produce the cipher text. (See: recovery.) Shirey Informational [Page 96] RFC 4949 Internet Security Glossary, Version 2 August 2007 2.

(I) /system integrity/ The process of restoring information following damage or destruction. $ data security (I) The protection of data from disclosure, alteration, destruction, or loss that either is accidental or is intentional but unauthorized. Tutorial:.