Skip to content

Glossary of Terms

An administrative installation

Copies an image of Reflection to a destination folder to create an administrative installation point. This folder can be used by deployment tools to access and create packages that are deployed to workstations. An end user who has access to the folder can then use it to install the product on his or her workstation. You can also run the Installation Customization Tool from the administrative installation point.

authentication

The process of reliably determining the identity of a communicating party. Identity can be proven by something you know (such as a password), something you have (such as a private key or token), or something intrinsic about you (such as a fingerprint).

CA (Certificate Authority)

A server, in a trusted organization, which issues digital certificates. The CA manages the issuance of new certificates and revokes certificates that are no longer valid for authentication. A CA may also delegate certificate issuance authority to one or more intermediate CAs creating a chain of trust. The highest level CA certificate is referred to as the trusted root.

cipher

A cipher is an encryption algorithm. The cipher you select determines which mathematical algorithm is used to obscure the data being sent after a successful Secure Shell connection has been established.

CRL (Certificate Revocation List)

A digitally signed list of certificates that have been revoked by the Certification Authority. Certificates identified in a CRL are no longer valid.

data integrity

The assurance that data has not been changed from its original source. Methods to preserve data integrity are designed to ensure that data has not been accidentally or maliciously modified, altered or destroyed.

digital certificate

An integral part of a PKI (Public Key Infrastructure). Digital certificates (also called X.509 certificates) are issued by a certificate authority (CA), which ensures the validity of the information in the certificate. Each certificate contains identifying information about the certificate owner, a copy of the certificate owner's public key (used for encrypting and decrypting messages and digital signatures), and a digital signature (generated by the CA based on the certificate contents). The digital signature is used by a recipient to verify that the certificate has not been tampered with and can be trusted.

digital signature

Used to confirm the authenticity and integrity of a transmitted message. Typically, the sender holds the private key of a public/private key pair and the recipient holds the public key. To create the signature, the sender computes a hash from the message, and then encrypts this value with its private key. The recipient decrypts the signature using the sender's public key, and independently computes the hash of the received message. If the decrypted and calculated values match, the recipient trusts that the sender holds the private key, and that the message has not been altered in transit.

encryption

Encryption is the process of scrambling data by use of a secret code or cipher so that it is unreadable except by authorized users. Encrypted data is far more secure than unencrypted data.

GSSAPI (Generic Security Services Application Program Interface)

An application programming interface that provides programs with access to security services.

hash

Also called a message digest, a hash or hash value is a fixed-length number generated from variable-length digital data. The hash is substantially smaller than the original data, and is generated by a formula in such a way that it is statistically unlikely that some other data will produce the same hash value.

LDAP (Lightweight Directory Access Protocol)

A standard protocol that can be used to store information in a central location and distribute that information to users.

MAC (Message Authentication Code)

Used to verify that data is not changed in transit, a MAC is a hash created using an arbitrary-length packet of data and a shared secret key. The sending and receiving party compute the MAC independently for each packet of transferred data using the shared key and an agreed-upon algorithm. If the message has changed in transit, the hash values are different and the packet is rejected.

OCSP (Online Certificate Status Protocol)

A protocol (using the HTTP transport) that can be used as an alternative to CRL checking to confirm whether a certificate is valid. An OCSP responder responds to certificate status requests with one of three digitally signed responses: "good", "revoked", and "unknown". Using OCSP removes the need for servers and/or clients to retrieve and sort through large CRLs.

passphrase

A passphrase is similar to a password, except it can be a phrase with a series of words, punctuation, numbers, white space, or any string of characters. Passphrases improve security by limiting access to secure objects, such as private keys and/or a key agent.

PKCS

PKCS (Public Key Cryptography Standards) is a set of standards devised and published by RSA laboratories that enable compatibility among public key cryptography implementations. Different PKCS standards identify specifications for particular cryptographic uses. Reflection for Secure IT Client for Windows uses the following PKCS standards:

  • PKCS#11 provides support for authentication using hardware devices, such as smart cards or USB tokens.

  • PKCS#12 is used for storage and transportation of certificates and associated private keys. Files in this format typically use a .pfx or .p12 extension. Reflection for Secure IT supports authentication using certificates and keys stored in this format.

Different PKCS standards identify specifications for particular cryptographic uses, for example:

  • PKCS#7 can be used to sign and/or encrypt messages. It can also be used to store certificates and to disseminate certificates (for instance as a response to a PKCS#10 message).

  • PKCS#10 is a certification request syntax.

  • PKCS#11 is a programming interface used for cryptographic hardware tokens.

  • PKCS#12 defines the personal information exchange syntax used for storage and transportation of certificates and associated private keys. Files in this format typically use a .pfx or .p12 extension.

port forwarding

A way to redirect unsecured traffic through a secure SSH tunnel. Two types of port forwarding are available: local and remote. Local (also called outgoing) port forwarding sends outgoing data sent from a specified local port through the secure channel to a specified remote port. You can configure a client application to exchange data securely with a server by configuring the client to connect to the redirected port instead of directly to the computer running the associated server. Remote (also called incoming) port forwarding sends incoming data from a specified remote port through the secure channel to a specified local port.

public key/private key

Public keys and private keys are pairs of cryptographic keys that are used to encrypt or decrypt data. Data encrypted with the public key can only be decrypted with the private key; and data encrypted with the private key can only be decrypted with the public key.

Reflection application data folder

Reflection stores Secure Shell information that is available to all users in the following location:

Windows 7, Windows Vista, Windows Server 2008:

\ProgramData\Attachmate\Reflection

Reflection ssh folder

Reflection stores Secure Shell information for individual users in the following location in the Windows personal documents folder:

Windows 7, Windows Vista, Windows Server 2008:

\Users\username\Documents\Attachmate\Reflection\.ssh

Comparable files are placed in the $HOME directory on UNIX systems.

regular expression

Often abbreviated as regex, a regular expression is a string of characters that describes one or more matching strings. Within a regular expression, some characters have a predefined meaning that determines what qualifies as a match. For example, the regular expression "t.*t" matches any word that starts and ends in the letter t, while the regular expression "text" matches only itself.

Secure Shell

A protocol for securely logging onto a remote computer and executing commands. It provides a secure alternative to Telnet, FTP, rlogin, or rsh. Secure Shell connections require both server and user authentication, and all communications pass between hosts over an encrypted communication channel. You can also use Secure Shell connections to forward X11 sessions or specified TCP/IP ports through the secure tunnel.

socket

The combination of a host name (IP address or DNS name) and a port number. This creates a unique identifier that a client application uses as an end point of communications.

trusted host

A trusted host is one for which you hold the public key.

URI (Uniform Resource Identifier)

A string of characters that represents the location or address of a resource. URIs can be used to locate resources on the Internet or on an LDAP server.

UTC (Universal Time, Coordinated)

A high-precision time standard. When describing time zones, UTC refers to the time kept on the Greenwich meridian (longitude zero), also known as Greenwich Mean Time. UTC times are generally given in terms of a 24-hour clock.

Windows common application data folder

The application data folder is hidden by default.

The default is:

  • Windows 8, Windows 7, Windows Vista, Windows Server 2008:

    \ProgramData\

Windows personal documents folder

The default is:

  • Windows 8, Windows 7, Windows Vista, Windows Server 2008:

    \Users\username\Documents\

Windows user profile folder

The user profile folder is configurable by the Windows system administrator. The default is:

  • Windows 7, Windows Server 2008:

    \Users\username\

Workstation Installation

Installs Reflection on a workstation hard disk. You can accept the default settings or customize the install by changing the default location, specifying an organization name, and selecting feature installation states.