So once again, what is a symmetric algorithm in a symmetrical algorithm?
The same key is used to encrypt and decrypt the message.
An example of a symmetric key algorithm would be a ease.
Notice.
Both the sender and the receiver using the same algorithm as well as the same key.
This can cause a major problem because both the sender and the receiver must know what the key is.
And they need a method to communicate this.
The problem is, how do I tell you securely what the key is?
If I don't have a secure tunnel established as yet, I need the key to establish the secure tunnel.
But I cannot establish the secure tunnel until we both know what the key is.
So this means that we need to communicate the key out of band.
I need to phone you or I need to SMS you or I need to use some out-of-band method to tell you what key
to use.
So as an example, if I'm in the UK and you're in the US and we want to set up a private VPN between
a router in the UK and a router in the US, I would have to phone you and let you know what key to use.
That's fine when we have a simple VPN, but it doesn't scale well when we have thousands of routers.
There is an advantage of a symmetrical QI algorithm though.
Good symmetric ciphers are first secure and easy to implement using modern microprocessors and therefore
tend to be used for bulk encryption.
Here are some examples of symmetric key algorithms.
Days, triple days.
Ace and Blowfish.
I'm going to explain data encryption standard or days, triple days, an advanced encryption standard
or as in more detail in the upcoming slides.
But for now, please realize that we still use symmetric key algorithms in VPNs today because of the
advantage that they can encrypt both data quickly in modern microprocessors.
So data encryption standard or DES is a symmetric encryption algorithm where the same key is used by
the sender and receiver.
So notice the sender uses Des with a key of 1 to 3 and the receiver uses Des with a key of 1 to 3.
It was developed by IBM and the US National Security Agency in 1975.
It has a fixed key length of 56 bits.
Remember once again that a class A IP address gives you two to the power of 24 combinations?
Daisy gives you two to the power of 56 combinations.
So the algorithm was good, but the key length doesn't meet today's security requirements and it's recommended
that you do not use DES in today's corporate environments.
The problem is, is that it's susceptible to brute force attacks.
By 1998, a days encrypted message was decrypted within 56 hours.
And by 1999, it took just over 22 hours to crack.
Once again, data is not recommended in today's environments.
Around the same time, triple days was developed.
Triple DS is also asymmetric key algorithm with the sender uses triple DS and the receiver uses triple
bass and they have the same set of keys.
In this case, there are three keys.
The way triple dez works is that clear text data is encrypted with key one.
That encrypted text is then decrypted with a different key key to and then it's encrypted with a third
key in this case, key three.
So the data is encrypted, then decrypted and then encrypted, but with different keys.
Now, if key one and key three are the same, this would result in 112 bit key length.
If key one and key three are not the same, it would result in 168 bit key length.
As you can see, the key length is greater than DES, which was 56 bits in length.
Please note at CNA level, it's not expected that you understand the details of all these algorithms.
But I mention them here because I find it's easier to understand how VPNs work if you have a bit of
knowledge of how the algorithms function.
A Yes or advanced encryption standard is the recommended symmetric key algorithm to use today in corporate
environments.
Once again, the sender and the receiver use the same algorithm as well as the same key as this is a
symmetric key algorithm.
This comes in different variants.
You've got a 128 bit, a 192, but an A is 256.
But as was announced in 2001 and became a federal government standard in May of 2002, it was approved
by the NSA for top secret information.
It once again is a recommended algorithm for VPNs in today's corporate environment.
The details of these three algorithms are available on the Internet.
Have a look at Wikipedia and other sources for more detailed information of how the algorithms work.
But for now, just have an appreciation that days, triple days and these are symmetric key algorithms
that can be used for bulk encryption and decryption of data.
Now an asymmetric key algorithm uses a different key to encrypt and decrypt.
So, for instance, the sender would be using a asymmetric algorithm like RSA.
The receiver would be using an algorithm like RSA.
But please notice different keys are used to encrypt and decrypt the data.
Asymmetric key algorithms solve many of the longstanding problems with symmetric key algorithms.
Like how do you exchange the secret keys in the first place with a symmetric key algorithm, for instance?
How do we send the decided private key to each other without it being intercepted?
When using a symmetric key algorithm once again without a secure channel, there is no way to establish
a secure channel.
I need to securely tell you, for instance, what the shared key is in a symmetric key algorithm.
But we both need to know what the shared secret key is to establish a secure channel, to be able to
securely send the key to one another.
But we can't set up the channel because we don't have a key yet.
That means we have to tell each other what the key is out of band like by phoning one another.
Asymmetric key algorithms allow us to solve this problem because different keys are used for encryption
versus decryption.
Also note asymmetric key algorithms have key lengths far greater than symmetric key algorithms.
The key lengths vary from 512 bits to 2048 bits.
A lot of this information is out of the scope of the course, but it's worth knowing so that you can
understand how VPNs work with an asymmetric key algorithm.
You firstly generate what's called a private key.
Now the word private means that you don't tell anyone else what your key is.
In other words, a private key is kept to oneself.
No one else gets told what your private key is.
A public key is derived from a private key.
So firstly, a device like a router will generate a private key.
It will then generate a public key from its private key.
Please note a private key cannot be generated from a public key.
A public key can only be generated from a private key.
Now, this is not a math course, so we're not going to get into the mathematics of how public and private
keys are derived.
We as network engineers just need to have an appreciation of how they work and then how to configure
them in networking environments.
So to sum up, you create a private key which you keep to yourself.
You then generate a public key from your private key.
Your public key is then shared with the world.
Now something encrypted with your private key can only be decrypted by your public key, and something
encrypted with your public key can only be decrypted with your private key.
So for instance, if a on the left wants to send something to be on the right.
The way it works is as follows b generates a private key.
A public key is then generated from B's private key.
B then shares is public key with a.
When a wants to send something to be a encrypts the data with B's public key, which a now knows the
only key that can decrypt something encrypted with B's public key is B's private key, and B is the
only person that has B's private key.
So A encrypts the data with B's public key and sends it to B.
B is the only device or person with B's private key, so only B can decrypt the information.
Can get really confusing.
So let me say it again.
If I want to send something to you that only you can decrypt, I would encrypt the data with your public
key.
If you want to send something to me that only I can decrypt, you would encrypt that data with my public
key because only my private key would be able to decrypt something encrypted with my public key.
Now.
How does this apply to VPNs?
Well, in 1976, two gentlemen, Duffy and Hellman, discovered a way out of the secure channel dilemma.
In other words, the issue we had with the transmission of a shared secret across an insecure medium
can be solved by using Duffy Hellman.
They found out that by using a different key, certain one way functions could be undone.
The solution, called public key cryptography takes advantage of a characteristic of prime and almost
prime numbers, specifically how hard it is to find the two factors of a large number that has only
two factors, both of which are prime.
This uses things like quadratic residues.
Now, unless you're a mathematician, that'll have no meaning, I'm sure.
I once again, we as network engineers do not need to understand the math behind all of these algorithms.
We just have to know when to apply the algorithms in production environments.
So just understand that Duffy Hellman discovered a way to securely create a secure channel to exchange
a shared secret key which is required by algorithms like AI's triple days and days across an insecure
medium like the internet securely so that no hacker can find out what the shared secret is.
In brief.
The way Duffy Hillman works is as follows The peers.
In other words, the two devices involved in a VPN can yield or create a shared secret key based on
the other peers, public value and their own secret.
In other words, if you and I are going to set up a VPN and we need to create a shared secret key between
us by using complicated mathematics, we can create a shared secret securely without other people being
able to work out what that key is.
You need at least one secret value to perform this function or calculation.
Remember, secret or private keys are not exchanged with other people, so the attacker has no secret
values and needs to perform a discrete logarithm of a public value which is computationally infeasible.
In other words, in theory, impossible.
So for example, yes, I'm clear text data that we want to send securely using an algorithm like ease
as being a symmetric key algorithm requires that the same key be used for encryption and decryption.
We want to be able to work out a shared secret key between the sender and receiver securely across an
insecure medium with all kinds of undesirables, trying to sniff the network and work out what the password
is.
So both peers need to establish a shared key securely, and Duffie Hellman gives us the ability to do
this.
So by using public key cryptography, in other words, private and public keys, we can work out a shared
secret securely without others being able to see that.
So when two piers want to set up a VPN, they use Duffy Holman to work out a shared key.
The reason why we need that shared key is symmetric.
Key algorithms like these require that the same key be used on both sides.
And the reason why we use these is because it's good for bulk encryption.
Once the Diffie Hellman Key Exchange has taken place.
We can create a shade secret for a is and therefore A is, and the shade key can be used for bulk encryption
of our data, which can be sent across the insecure internet securely and only decrypted by the receiving
party.