>> Hello. Now we're going to
talk about some of the terms
>> we use within cryptography.
>> We'll start out by looking at
encryption for the purpose of privacy.
We start out with plain texts
and that's the data we want to protect.
Ultimately, what we want to do
is confine that to the ciphertext.
If anyone is able to access it,
they won't be able to read it or find meaning.
If we start with plain text,
use an initialization vector,
an algorithm and a key,
that's what takes us from plain to ciphertext.
We want to talk about what an initialization vector,
an algorithm, and a key.
Let's talk about an initialization vector.
The job in the initialization vector
is to add randomness to
the encryption process. Randomness is good.
We want our ciphertext as far
removed from the plain texts as possible.
Even though the encryption process is going to
change our data from plain text to cipher,
by adding additional randomness,
we'll make the process more complex
and that makes it more difficult to reverse.
For instance, think about
your digital music collection and digital music player.
Onetime l lend a friend of mine my iPod and she
downloaded the sound tracks to the [inaudible].
Now, I know I can erase that,
but I never think about it until it's too late.
I pull up to stop play and I'm feeling cool and
playing the music that was popular
when I was in high school.
Then next thing you know,
the song, The Sun Will Come Out Tomorrow,
starts playing on my stereo and I'm thinking,
got to be kidding me.
My question is this,
I've got over a thousand songs on my iPod,
why does the same song keep coming up
time and time again when I'm playing it in random mode?
I do find that there are a handful songs that you can't
count on hearing when I put my music player on random.
Well, if you look at what I have on
the screen, in the second bullet,
I just came up with some random numbers
and I came up with some random math.
But even though I've got
>> random numbers and random math,
>> the question becomes, do I have to randomness?
Well, if I always start at the track zero and I
jump to the fifth track
and jump three tracks and so forth,
I really don't get randomness because it
keeps starting at the beginning of the zero track,
but if I can randomize the beginning point,
then I add more randomness to the process.
Now the thing about the initialization vector
is that it needs to be long enough,
just like everything else.
But you can't have an initialization vector that is
too long because when you use security,
you often trade performance.
You want an initialization vector that is
just long enough, but not too long.
Let's go back to what we talked about with WEP.
Remember, WEP stands for wired equivalent privacy
and it was one of the first means of
encrypting Mi-Fi communication for our local networks.
With WEP, one of the starting problems was that WEP had
a very short initialization vector
and that IV was 24 bits.
When WPA came along to replace WEP,
WPA increased the initialization vector substantially.
It went from a 24-bit IV to
a 48-bit IV, significantly better.
WPA settled on the 48-bit initialization vector
and that gave us more security than we had with WEP,
but still performing it enough to be acceptable.
That 48-bit Initialization vector continues
today with WPA2 even WPA3.
Now, a couple more things to consider with IVs.
First of all, have you heard of the term seat insole?
It's very comparable to a initialization vector.
We talk about initialization vectors
when we're encrypting data.
But when we're hashing passwords,
it's a one-way mechanism to protect our passwords.
When we're hashing our passwords, we add seeds.
This adds randomness is beginning.
This makes passwords more random,
it makes them harder to compromise.
You could also hear the term soul.
A seed at the beginning of
>> the process. A soul is leader.
>> All these things, seed, salt,
and IV's have the same purpose, to add randomness.
Now, the second thing to think about is how
computers really aren't good at true randomization.
You and I can think of a random number like 1,043,007,
pretty easily on top of our head,
but computerized systems are logic-based.
There aren't very predictable.
The challenge becomes that we need
randomness and allotting incursion functions
that we perform on a day-to-day basis
are dependent on randomness.
Computers need something to base
the randomness on in order to come up with it.
It could be based on internal CPU cycles,
temperature, date, and time variables.
There could be a million different variables to
come up with an initialization vector.
We just have to remember that it's not truly
random, it's pseudo-random.
Something cool here.
Have you heard of a company called CloudFlare?
They're an Internet web organization.
They provide infrastructure support
and security for massive amounts of
data and information and
services at organizations across the Internet.
They use lava lamps as a basis for the random numbers.
They have a wall of 100 lava lamps
and they have a camera that takes
pictures of the lava lamps
periodically and sends those images
to the servers that analyze
the configuration at any given time
and it's always going to be
>> different and unpredictable.
>> They create a value for the initialization vector
based on the lava lamps.
It's pretty fascinating.
You can look it up and read about how it works.
It solves a problem.
Real-life is more random than computers,
so we look to real lives for solutions.