If you've been following along on my videos you should be pretty comfortable with a lot of different
encryption algorithms that we use in today's I.T. world.
What I want to do now is take these algorithms and actually plug them into the real world to see real
protocols and real applications that use a yes or RSA or whatever it might be.
Now before we do that I want to make sure you're comfortable with something when we talk about networking
and technology today.
We're pretty much talking about the world of TZP IP and the Internet as a whole so when we're doing
encryption we're usually talking about the Internet and everything on the Internet runs on top of TCAP
IP.
Now that's important because TCAP IP and the Internet really kind of predate encryption the whole world
of TZP IP and what eventually became the Internet was invented by a bunch of arguably hippies.
I'd like you guys are nice hippies but they never really thought about encryption or security or anything
like that it was open and free.
Man it was all cool.
Well the first time somebody logged in to eBay to buy a pair of sneakers suddenly motivated us to get
into the world of a cripple.
Now encryption predates the World Wide Web.
But the important thing I need you to get in your head right now is that we had all kinds of applications
out there.
Email the web.
Telenet all kinds of stuff out there that really didn't have encryption.
So we spent a lot of the 80s and 90s and we still do it today taking unencrypted applications and either
completely rewriting them so that they are encryption capable or inventing protocols that we slid under
unencrypted applications to make them secure.
So the best place to start is to understand a very very famous encrypted protocol called S-sh.
Now to give you an idea what's happening here.
I've got my little laptop here is running an S-sh server called free as SAHD wonderful free S-sh server.
And over here on my main machine I'm running the very popular puttee program puttee is a client for
all kinds of stuff.
But in this case we're going to be running puttee as an S-sh client and connecting to this guy.
So let's watch all this in action.
So to connect to my S-sh I'm going to go ahead use good old putty here.
Everybody knows about puttee if you don't know about it you should.
So what I need do is just type in the IP address of the machine I want to connect to.
Now I want you to look very carefully here you see I typed in an IP address.
It uses port 22 that's at S-sh port.
And you'll notice that puttee can do all kinds of other connections.
But in this case I want to do S-sh so I have s s h.
Clicked on radio button.
So I hit open.
Now the first thing I want you to notice is right here.
This is a standard function of S S H S S H.
Always has the server first pass you his it's really they call it a certificate but it's really just
a key.
And this particular key is going to be used to make the initial key exchange so that we can go ahead
and start sending each other encrypted data.
So if we take a look at this I'm going to go ahead and say yes and if I want to I can go ahead and log
in.
Now I'm going to get the log in for right now not because I don't want to log in but because I want
to show you how we set all this up within an encrypted application like S-sh.
So let me bring the backup now.
I'm going to bother connecting right now.
What I want you to do is look down here you see it says S-sh.
These are the settings for S-sh.
Now first of all we're going to have a key exchange.
Remember the bottom line here is that on almost any encrypted application or protocol number one you
do some kind of key exchange.
So everybody gets a symmetric key and then you use a symmetric key to send all your encoded data and
S-sh certainly works just like that now if you'll take a look there are three different kinds of Diffie
Hellman here don't worry about the different kinds just know that it's got three different ways to do
Diffie Helman and then it has RSA.
So what you're looking at here is the order by which this particular client wants to do the key exchange.
And that order is important because that is a order of preference.
So this is how the client will talk to the server to actually decide how they're going to do the key
exchange.
Next down here is the cipher.
So once the key exchange is done what kind of encryption do you want to use.
Now you'll notice appeared at the top and says Yes yes is the big standard that someone we would expect
to see at the top.
But then it goes down it could use Blowfish or it could use triple Des's or it could use arc for which
I've never even heard of before.
And then Des's.
So this is how s s h negotiates all of the things we need to do in order to go ahead and make a connection.
Now to watch this in action what we really need to do is head over to my laptop because we're going
to do is light up the S-sh server and let me show you the S-sh server has basically the same type of
functions.
So this is what free S-sh looks like when it's running.
So right now I'm running an S-sh server.
It does other stuff but I'm not interested in talking about it right now what I am interested in is
a few of the things in here for example now on authentication I could just use a password if I wanted
to but I also have this key authentication.
And right now it says that that's allowed because that's the main way I like to use this.
Now once that takes place though I need to set an encryption.
So on the server side you'll see he has a list of encryptions that he likes to connect to.
So SS H is a secure application.
The actual algorithms are built into SS h.
So what will take place is when these guys connect to each other the client's going to say oh here are
the ways I like to connect and the server is going to go well here's the ways I like to connect.
And then the client will make a decision based on its pecking order how the actual connection takes
place.
And from there everything else is completely transparent.
So the key exchange is transparent.
The actual symmetric key which is then established and all the data is encrypted via symmetric and it
works beautifully.
So S-sh is kind of unique though because it is an application that has built encryption into it.
Now a lot of other things we do on the internet don't work quite the same way and probably one of the
best examples of that would be good old HTP.
Now when you connect to a web page the web page itself by default is not encrypted.
So what we do is we use a protocol called transport layer security or LS which actually acts as an intermediary
between the web page and our individual web browser and acts as an intermediary that does all the encryption.
So what will happen is we build these protocols into our web servers and to our web clients to make
that work.
Now what's actually cool about T.L. less is that T.L. S was invented for Web sites.
However TLM less because of the way it works can work with a lot of other applications so T.L. s by
itself is not an application it's just a protocol and we plug it into our different types of applications
to make it all work.
In fact DNS is so pretty that I can't repeat what I just did with S-sh for you.
Within T.L. s because it's designed to be very very robust.
What I'm going to do instead.
In fact I've already set up a capture is I opened up a web page to my total some dotcom but to a secure
I did HTP S and I use Gudel Wireshark to make a capture.
So what I'm going to do now is just open up the wireshark capture.
So you can see the results.
OK.
So what I've done here is these are the result of me going to HTP P.S. Colin whack whack BWR total CENTCOM.
And this is the entire initial HTP connection that took place.
Now if you don't know how to use wireshark to do stuff like this well you need to learn how to use wireshark
But what's actually kind of cool here is you take a quick look now the you 164 that 21 is my computer
over here and 75 5.1 got 29 out 1 0 6 is the secure total some dot com website.
So you'll see here's my computer saying hello hello hello.
So we get the initial connection going.
Now that's all done under TZP.
But now I want to look right here and see where it says T.L. s when we say T.L. s like you see right
there.
What we're doing is in essence making another connection.
But this time we're saying Hey man I want to do TLM.
So let's start talking.
So if you look really really carefully in here you can see exactly what types of connections that this
client wants to use.
So here's a elliptic curve.
There's some different types of hashes that wants to use.
There's all kinds of information in here that the client uses to establish that secure connection.
So in this particular case he's going to be using RSA because I know how my web server set up.
And then once that set up it will be using.
Yes as the actual symmetric encryption.
So you can even see on the other side
here's where the server talks back and you can see that he's already setting up an encryption to begin
the conversation to allow these two different devices to talk.
Now the cool part to all this is that every secure connection that happens on the Internet is either
going to be an encrypted application like S-sh or it's kind of built into the application itself or
it's going to be using a protocol right now.
LS is the stuff Teall s and we have a whole other episodes that are going to go to tell us in more detail
but for right now understand that if you want to be encrypted on the Internet you're not going to be
writing your own algorithms what you're going to be doing is you're going to be using applications that
have their own built in security ready to go or you're going to be taking advantage of powerful protocols
that pretty much make the entire encryption process completely invisible to you and me.