Cryptographic Solutions

Cryptography

Practice and study of writing and solving codes, Encryption to hide information's true meaning

ROT13

Rotate 13 spots, a cryptographic code

Cipher

Algorithm that performs the encryption or decryption function

Key

Essential piece of information that determines output of the cipher

How to keep keys secure

Longer key and rotate keys often. Length of key is proportional to amount of security it provides

Algorithm

Performs encryption or decryption

Symmetric Encryption

Use Single Key to encrypt and decrypt that data. Private Key Algorithm since both sender and receiver use the same key

Asymmetric Encryption

Encryption algorithms where different keys are used to encrypt and decrypt the data. Public Key Cryptography.

Issue with Symmetric Encryption

Everyone uses the same key, so it’s harder to see who used it for one particular action. Distribution of the shared secret key can be an issue is that each person needs a set of individual keys, more and more people mean more and more keys. How to protect this secret and how to distribute it?

Popular Asymmetric Encryption methods

Diffie-Hellman, RSA, Elliptic Curve Cryptography (ECC)

In what way is symmetric encryption better than asymmetric?

It’s 100-1000 times faster

In what was is asymmetric encryption better than symmetric?

The key distribution problem is solved

Hybrid Implementation

Uses asymmetric encryption to securely transfer a private key that can be used with symmetric encryption

Stream Cipher

Uses a key stream generator to encrypt data but by bit by using a mathematical XOR function to create ciphertext

Block Cipher

Breaks input into fixed-length blocks of data and encrypts each block

Block ciphers are better than stream ciphers because …

Easy to set up and implement, less susceptible to security issues, Implemented in software solutions over hardware solutions

DES (Data Encryption Standard)

Encryption algorithm which breaks the input into 64-bit blocks and uses 16 rounds of transposition and substitution to make ciphertext using an effective key length of only 56-bits

Triple DES (3DES)

Uses 3 different 56-bit keys. Uses the 3 symmetric keys to encrypt, decrypt, and then encrypt the plaintext into ciphertext to order to increase strength of DES, results in 112-bit key

International Data Encryption Algorithm (IDEA)

Symmetric block cipher, which uses 64-bit blocks to encrypt plaintext into ciphertext

Advanced Encryption Standard (AES)

Replacement for DES and 3DES. Symmetric block cipher that uses 128-bit, 192-bit, or 256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext. Industry standard and used by federal government. Strongest cipher

Blowfish

Symmetric Block cipher that uses 64-bit blocks and a variable length encryption key to encrypt plaintext into ciphertext

Blowfish

Symmetric Block cipher that uses 64-bit blocks and a variable length encryption key to encrypt plaintext into ciphertext

RC Cipher Suite

Created by Ron Rivest, 6 algorithms under the name RC which stands for the Rivest Cipher. We use RC4, 5, and 6

Rivest Cipher (RC4)

Symmetric stream cipher using a variable key size from 40 bits to 2048 bits and is used in SSL and WEP

Rivest Cipher (RC5)

Symmetric Block cipher that uses key sizes up to 2048-bits

Rivest Cipher (RC6)

Symmetric block cipher that is based on RC5

How Public Key Cryptography ensures non-repudiation

I encrypt the data with the receiver’s public key so only they can decrypt it with the receivers private key

Digital Signature

A Hash digest of a message encrypted with the sender’s private key to let the recipient know the document was made and sent by the person claiming to have sent it

Diffie-Hellman (DH)

Used to conduct key exchanges and secure key distribution over an unsecured network. Susceptible to on path and person in the middle attacks.

This is an asymmetric algorithm and it’s used for key exchange inside of creating a VPN tunnel establishment as part of IPSec

RSA

Asymmetric algorithm that relies on the mathematical difficulties of factoring large prime numbers

How is RSA used co commonly?

RSA is used commonly for 6 digit MFA

Elliptic Curve Cryptography (ECC)

Used a lot in mobile devices cause it uses less processing power and it’s based on the algebraic structure of elliptical curves over finite fields to define its keys. More efficient than RSA with less bits

Elliptic Curve Diffie-Hellman (ECDH)

ECC version of the popular Diffie-Hellman key exchange protocol

Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)

Uses a different key for each portion of the key establishment process inside the Diffie-Hellman key exchange

Elliptic Curve Digital Signature Algorithm (ECDSA)

Used as a public key encryption algorithm by the US government in their digital signatures

ECC common use

for mobile devices and low-power computing devices because they give you an equivalent level of protection to other asymmetric algorithms with a lower key size, using less processing power

Hashing

One way cryptographic function that takes an input and produces a unique message digest as its output, always the same length no matter what the input is

MD5

Most popular hashing algorithm. Makes a 128-hash value that is unique to input files.

Collision

2 files have same hash value. Common issue with MD5 since it’s only 128 bits

Secure Hash Algorithm (SHA)

SHA1-3

SHA-1

Makes a 160 bit hash digest the greatly reduces collisions

SHA-2

Family of hash functions with longer hash digests, like 224, 256, etc

SHA-3

Hash digest is between 224 bites and 512 bits, a newer family of hash functions. More security since it uses 120 rounds of computation inseam of 62

RIPEMD (RACE integrity primitive evaluation message digest)

A competitor to SHA that comes in 160 bit, 256 bit, and 320 bit versions

HMAC

Hash based Authentication code. Used to check integrity of message and adds assurance of authenticity. Used with other hashes

Common uses of hashes

Making a digital signature to prove integrity of message and shows non-repudiation

Digital Security Algorithm (DSA)

Uses 160 bit message digest by the US government created by the Digital Security Standard

Pass the Hash Attack

Allows the attacker to authenticate to a remote service or server by using the underlying hash of a user’s password instead of needing the regular plaintext password. Hard to defend against and can hash harvesting can be automated by penetration tools like Mimikatz

How to prevent the Pass the Hash Attack?

Use only trusted OS, All workstations are updates, All Accounts use least privilege, MFA, Patching

Birthday Attack

When 2 different messages result in the same hash digest (collision). The collisions can be exploited by attackers to bypass authentication system, like using the wrong password with the same hash

How to prevent Birthday Attacks

Use a stronger hash output like SHA-256 to reduce collisions

Key Stretching

Used to mitigate a weaker key by creating longer, more secure keys to increase time to crack the key

Salting

Adds random data to passwords before hashing and ensures distinct password hashs for the same password due to different salts. Stops Dictionary Attacks, Brute-Force, and Rainbow attacks

Dictionary Attack

Attacker tries every word from predefined list

Rainbow Tables

Precomputed tables for reversing cryptographic hash functions. Salt forces attackers to have to reconfigure it

Nonce (Numbers Used Once)

A unique, often random number that is added to password-based authentication process. Makes it hard for attakers to re-use stolen authentication data

How does limiting failed login attempts

Prevents brute-force attacks and locks the account after small number incorrect login attempts

Public Key Infrastructure (PKI)

A system of hardware software, policies, procedures, and people that’s based on asymmetric encryption. Used in HTTPS connections on websites

Establishing a Secure Connection

Connect to website with HTTPS, web browser contacts a trusted certificate authority for the web server’s public key, a random shared secret key is generated with symmetric encryption, shared secret is securely transmitted using public key encryption, web server decrypts the shared secret with private key, both parties used the shared secret key for symmetric encryption (like AES) to make a secure tunnel

Difference between PKI and Public Key Cryptography

PKI makes asymmetrical key pair of the public and private keys used in encryption and decryption , the other is just the encryption and decryption process

Certificate Authority

Issues digital certificates and keeps the level of trust between all of the certificate authorities around the world

Key Escrow

Process where the cryptographic keys are stored in a secure, 3rd party location, which is effectively an escrow

Why does PKI need key escrow

Organization can retrieve keys and use them if they loose access to encryption keys. However malicious access will obviously lead to data decryption, so it must be heavily guarded

Digital Signatures

Digitally signed electronic document that binds a public key to a user’s identity. Uses the X.509 standard for PKI

Wildcard Certificate

Allows all subdomains to use the same public key certificate and have it displayed as valid. Easy to manage and cost effective, but if one gets compromised, they all do

SAN (Subject Alternate Name)

Certificated that specifies what additional domains and IP addresses are going to be supported

Single-Sided Certificate

Only requires the server to be validated

Dual-Sided Certifcate

Requires the server and the user to be validated.

Self-Signed Certificate

Signed by the same entity whose identity it certified. Gives encryption but lacks 3rd party trust

Third Party Certificate

Issued and signed by a trusted certificate authority (CA)

Root of Trust

Each certificate is validated using the root of trust or a train of trust. This is the highest level of trust in certificate authority. Usually a trusted 3rd party

Certificate Authority

Trusted 3rd party who is going to issue these digital certificate

Registration Authority

Requests identifying information from the user and forwards certificate requests up to the CA to make a digital certificate. Gets user information for certificates and helps with certificate insurance processes

Certificate Signing Request (CSR)

Block of encoded text that contains info about the entity requests the certificate. Private key stays secure with the requester

Certificate Revocation List

Online list of digital certificates that the certificate authority has ever revoked, checked before validating a certificate

OCSP (Online Certificate Status Protocol)

Allows to determine the revocation status of any digital certificate using its serial number. Faster but less secure than CRL

OCSP Stapling

lets certificate holder to get the OCSP record from the server at regular intervals

Public Key Pinning

Allows an HTTPS website to resist impersonation attacks from users with present fraudulent certificates by presenting a set of correct public keys to browsers, alerting the user if the fake site uses a fraudulent certificate

Key Escrow Agents

securely sore copies of private keys and ensures key recovery in case of loss

Key Recovery Agents

Specialized type of software that allows the restoration of a lost or corrupted key to be performed, allows backup of certificate authority keys

Blockchain

Shared immutable ledger for recording transactions and asset tracking. A long series of information with each block holding information.

What is in a block for the block chain?

Previous hash, timestamp so they link chronologically, root transactions that are hashes of individual transactions

Public Ledger

A record-keeping system that maintains participants’ identities in a secure and anonymous format. Blockchain use

Smart Contracts

Self-executing contracts where the terms of agreement or conditions are written directly into lines of code on the blockchain. Makes the agreement trustworthy, unalterable, and tamper-proof

Permissioned Blockchain

Used for business transactions and adds new levels of trust and transparency with the immutability of public ledgers

TPM (Trusted Platform Module)

Dedicated microcontroller designed to secure hardware with integrated cryptographic keys. Vault that keeps information encryped

HSM (Hardware Security Module)

Physical device that safeguards and manages digital keys, primarily for highly critical situations. Very strong vault and tamperproof. It can provide accelerated cryptographic operations and securely generate cryptographic keys

Key Management System

Integrated approach for generating, distributing, and managing cryptographic keys for devices and applications. Controls whole lifecycle of cryptographic keys

Secure Enclaves

Co-processor integrated into main processor of some devices designed with the sole purpose of ensuring data protection. It is kept separate from main processor, so even if compromised, this data remains untouched

Obfuscation

Obscuring information

Steganography

Concealing a message within another so that the very existence of hidden message is hidden. Hide secret data in unsecret data so people think its not important. Embedding data and used alongside encryption for extra layer of security

Data Masking (Data Obfuscation)

Protects data by making sure it remains recognizable but does not actually include sensitive information. Used a lot in industries that needs to use personal data, like masking most of your credit card number

Cryptographic Attacks

Ways enemies try to exploit vulnerabilities in cryptographic systems to compromise the CIA of the data

Downgrade Attack

Forces a system to use a weaker or older cryptographic standards or protocols to exploit known weaknesses and vulnerabilities in the old version

How to fight downgrade attack

Phase out support for insecure protocols and version-intolerant checks. Reduces some backwards some backwards compatibility

Collision Attack

Aims to find 2 different inputs that make the same hash output. Attack on hashing solutions like MD5

Quantum Computing

Computer that uses quantum mechanics to generate and manipulate quantum bits to access enormous processing power. Uses Qubits instead of 1s and 0s. Used for very specific used cases like complex math

Quantum Communication

Communications network that relies on qubits made of photons to send multiple combinations of 1s and 0s simultaneously to make communications tamper resistant and very fast

Qubit

Quantum bit composed of electrons or photons that can represent numerous combos of 1s and 0s at the same time with superposition

Why does quantum computing matter?

It is a threat to traditional encryption algorithms (RSA, ECC) by rapid factorization of large prime numbers