>> Cryptography. The learning objectives for
this lesson are to define
hashing and its role in security,
to explore message authentication codes,
and to differentiate the types of symmetric algorithms.
Let's get started. Well,
before we really get started,
one thing I'd like you to understand is we're not
going to be doing any math on this lesson.
The exam doesn't expect you to understand
the mathematics that are behind these complex algorithms.
What they really want to make sure
is that you know the difference
between symmetric and asymmetric algorithms,
hashing and what are used
cases for these types of technologies.
Think about a professional race car driver.
They are expected to get the
most out of their car on the track.
But they're not the ones that are tuning
the engines or making any repairs to the car.
Also, cryptography is
a very complex subject and there's a lot of areas
on the tests that are
covered by the cryptography subjects.
I've broken it into three lessons and each of
these lessons will cover
different aspects of the cryptography.
What are some common uses of cryptography?
The first is encrypting data at rest.
This is data that is stored on
computers or in databases or other areas.
The key point is that the data isn't moving.
Usually this data will be encrypted with
a symmetrical algorithm like AES.
Full drive encryption or file level encryption
would be examples of this.
Data in transit is sometimes called data in motion.
This is when data is moving from one place to another.
Think of it when you're accessing an HTTPS web site,
the data is moving from the web server to
you across that encrypted channel.
Also TLS and IPsec are methods
that we can use to secure data while it's in motion.
Finally, we have data in use.
This is the data that is in
volatile memory such as the system RAM,
CPU registers, and cache.
An example would be fields in a database that are being
modified or event logs
that are being created while the system is running.
When he data goes from rest to in use,
it will be decrypted and then read or modified.
Hashing. Hashing is a mathematical function
that will take input
from data and then transform that into
a fixed-length hexadecimal output.
The keys to remember about hashing are
that the output is always of a fixed length.
The same input will always produce the same output.
If I were to hash a file,
it will give me an output.
If I hash it 10 minutes later or a week later,
if it's the same file,
I will get the same output.
The reason we do this is that this allows
us to ensure that no changes have been made to that file.
Also, there is no way for us to take that hash and
reverse it to find
the input or find out the contents of the file.
For example, hashing is irreversible.
It's considered one-way encryption.
Finally, the output of a hash is known as a digest.
Let's talk about a practical example.
Many of you have probably
downloaded ISO files from the Internet.
Most of these ISOs will also have
a sum provided where you download on the site.
You'll see the long string of numbers,
and that is the hash of this file.
After you've downloaded the file,
you can make a hash of it on your own system and then
compare it to the one that's provided by the site.
If they match, you know that you've got an exact copy.
If they don't, then something happened along the way,
maybe the file is incomplete or
it got corrupted and you'll have to download it again.
But this is a way for you to verify that yours is
an exact duplicate of
what they are supplying from the website.
Now there are some potential problems with hashing.
If we're using this to monitor file changes,
like I mentioned earlier,
we have to make sure that we are certain and
have no doubts about the original hash that we took.
If for some reason we are
doubtful about it then any hashes we make of
it after that are pretty much useless because
our baseline that we are using to compare
everything to is no longer solid.
In addition, older hashing algorithms
can allow for collisions.
A collision is when we can take
two completely different inputs but they will
both produce the same output hash.
This happens more often in our older algorithms,
and we're going to cover some of those on the next slide.
Here are some hashing algorithms.
The most famous and most widely used
is the Message-Digest Algorithm or MD5.
It creates a 128-bit output,
but it's easily brute-forced
and it has a high chance of collisions.
I say it's the most widely used because it's
still in use for things where no security is concerned.
For example, for downloading ISO files, MD5 is fine.
But it's long since been considered
insecure and has been replaced by
other far stronger algorithms.
Next, we have the Secure Hash Algorithm or SHA.
We have several variants for this one.
The first is SHA-1 and it produces a 160-bit output,
but it has also successfully
been cracked and it should not
be used for anything that needs to be considered secure.
SHA-3 is a replacement and it has fundamentally
changed the way the algorithm
works compared to the previous SHA-1 or even MD5.
We also have the Race Integrity Primitives
Evaluation Message Digest or RIPEMD.
This was developed completely independently from
the US government and it has
versions that allow for 128,
160, 256 and 320 bit outputs.
This is used for bitcoin addresses.
Message authentication codes.
Remember when I said in previous lessons that
you would see MAC several times throughout
the course and they would almost always
be different meanings,
this is another example of that.
Message authentication codes allows
us to validate messages.
These are hash-based message authentication codes,
HMAC, and this is a specific usage
of MAC, message authentication codes.
With HMAC, both the source and the message
content can be verified without needing anything else.
MAC is created through hashing
and then it becomes an HMAC.
HMACs have two parameters,
the message and a secret key that is
known by the sender and the receiver.
Here's a flow of how HMAC works.
The sender creates a message which is then concatenated
with a symmetric key that the receiver also has.
The message and the key are hashed using a MAC algorithm.
This could be SHA-2,
SHA-3 or SHA-256,
and that is sent to the receiver.
The receiver can use the MAC algorithm to check
the hash and then confirm the integrity of the message,
and then decrypt it using the key with
a reasonable certainty that it came from the sender.
Poly1305 is a MAC that is
focused on speed and efficiency.
If functions were on devices that do not have
hardware acceleration for crypto like AES,
and when used with algorithms like ChaCha20 or Salsa20,
it is much faster and has
better performance than traditional algorithms.
Symmetric algorithms.
These are used to encrypt data or messages.
They can only be unlocked with a single key.
Encryption isn't like hashing as you
can view the data once it's been decrypted.
That's a key thing to keep in mind
between hashing and encryption.
The weakness for symmetric algorithms is the
creating and distributing the keys in a secure way.
This is similar to,
imagine you have a file and you
right-click on it and select
encrypt and it asks you for a password.
You type the password. Now the file is encrypted.
You want to send that to someone across the Internet,
but you also have to send the key with them too.
For one-to-one, this is not such a big deal.
You can call someone up,
you can find another way to get the key to
them or maybe it's just something
you agree to ahead of time.
But imagine having to do this with millions of people.
It becomes very cumbersome to use symmetric algorithms in
this way. Stream cipher.
This is where every digit of plaintext data
is encrypted one at a time using a keystream.
This is a stream of pseudorandom values.
It's useful for encrypting data when the amount
or the length of the data isn't known like video.
Key streams are generated by an initialization vector
IV that is combined with a static key.
This creates a unique key stream.
The IV is always changing to ensure that
the unique ciphertext is
created from the same plain text.
Block ciphers. This is where plain texts to separate it
into equal size blocks
and they're usually 128 bits in length.
If there isn't enough data to fill a block, it is padded.
This is where we add additional data to
the end to bring it up to 128 bits.
Each block is then encrypted based on
the mode of operation being used.
We'll go over those modes of operation in
the next slide. Let's do an example.
We have 950 bits of data that we need to encrypt.
The data will be broken into seven blocks that are
128 bits long but we have a leftover,
the block will be 54 bits.
We will add 74 bits to
that to bring that last block up to 128 bits.
This is the cipher modes of operation.
There are quite a lot here.
But the key to remember is
that we're only going to be using
the last three or four because this has
been the evolution of
the different modes of ciphers over time.
The first one we'll go over is
the cipher block chaining or CBC.
This is a very simple mode and it should not be used.
The same is true of the Electronic Code Book or ECB.
Another one that's very simple
mode and shouldn't be used.
Next we have the Galois Counter Mode or GCM.
This is a high performance mode
of operation and it provides
authenticated encryption and it's been widely adopted.
We also have counter or CTR.
This applies an IV and
an incrementing counter value
to the key to create a keystream.
You do not need padding with
the leftover space because it's removed.
Then finally we have the Output Feedback or OFB.
This uses initial chaining vector, ICV,
for the first round and then combines the output of
all previous rounds as input to the next round.
Stream ciphers and block cipher examples.
For stream ciphers, we have RC4.
This was developed in 1984
and it has numerous vulnerabilities.
It really shouldn't be used anymore.
We also have Salsa20.
It was developed in 2005 and it's
well regarded and it's also a fast algorithm.
We also have ChaCha,
which is a variant of Salsa developed in 2008.
It's used in Chrome on Android devices.
It's good for devices that lack
the hardware support that couldn't
use algorithms such as AES.
For block ciphers, we have
the Data Encryption Standard or DES, or triple DES.
This was originally developed in 1977.
This states DES should be replaced with AES.
Being an old cipher,
DES has already been broken
and that was the purpose for AES
being created was to shift everything from DES to AES.
Finally we have AES,
which is the Advanced Encryption Standard.
This is the US Federal Government encryption standard
for symmetric algorithms.
It's very efficient and secure and
it's available in 128 bit,
192 and 256 bit versions.
It's based on the Rijndael algorithm.
Two other examples because you've probably seen them
in your own research online are Twofish and Blowfish.
These are both block ciphers.
Here's some crypto humor.
Like I said, this cartoon always has good stuff.
I really got a kick out of this one
when I was building this lesson.
Hopefully you'd like it as well.
Let's summarize. We went
over hashing and hashing algorithms.
We also discuss symmetric algorithms
and streaming and block ciphers.
We went over the different encryption modes of operation.
Let's do some example questions.
Question 1, true or false.
Symmetric encryption keys can be sent through email so
that the recipient can decrypt any encrypted attachments.
False. Symmetric keys must be shared in a secure manner.
Question 2, blank transforms
data inputs into fixed length output called a digest.
Hashing. Question 3,
this type of symmetric algorithm encrypts
each bit of data
and is ideal for situations
where the amount of data is unknown.
Stream cipher. Remember this is often used for video.
If you keep that in mind
that you don't know how long that video file
is going to be and because it's unknown,
it's being streamed across the Internet,
think stream cipher,
unknown length video that
will maybe help you remember for the test.
Question 4, this is
the current US government encryption standard
and is widely used.
Advanced Encryption Standard or AES.
Hope this lesson was helpful
for you and I'll see you the next one.