Chapter 3

Encryption keys

Encryption keys are used to encrypt and decrypt data. The key is a string of bits randomly generated using a specific cipher, such as Advanced Encryption Standard (AES). There are two types of encryption methods used with keys: symmetric and asymmetric. Symmetric encryption uses the same key to encrypt and decrypt data. Asymmetric encryption uses one key to encrypt the data and a different key to decrypt the data. These keys are known as a public key and private key.

Hashing

Hashing is the process of converting one value into another using a mathematical algorithm like MD5 or SHA. This fixed length of data is called the hash. Hashing is used on data that does not need to be decrypted, such as passwords. When a piece of data is run through a hashing algorithm, it always generates the same hash; if even one letter is altered, the resulting hash is different, which is why hashing can verify data hasn't been altered during transmission. A hash cannot be decrypted, though attackers can compare a captured hash against massive precomputed password-hash databases to quickly recover the original password.

Salt

Salt, or salting the hash, means that a random number of characters are added to the password before the hash is created. For example, if the password to be hashed was p@ssw0rd, a salt such as E1343135E119C253 may be added, so the string actually hashed would be p@ssw0rdE1343135E119C253. Since the salt is randomly generated each time, it's virtually impossible to build a database containing all possible salted passwords, even for the same password.

Digital signatures

By combining a user's private encryption key and a hash of the data, a user can create a digital signature. A digital signature verifies that the data is legitimate and provides non-repudiation, meaning the sender cannot deny having sent the file.

Elliptic Curve Cryptography (ECC)

One of the newer cryptography methods being implemented. ECC can generate smaller keys that are more secure than most other methods. Many websites today use ECC to secure connections and data transmissions.

Perfect Forward Secrecy

A cryptography method used often in messaging apps. Instead of the same key being used for an entire conversation or session on a website, each transmission is encrypted with a different unique key.

Steganography

The technique of hiding or concealing a file, message, image, or video within another file, message, image, or video. Special programs are often used to hide messages in media files — if a hacker intercepts the message, all they see is the media, with no indication a hidden message exists.

Dictionary

A dictionary attack is a type of brute-force attack. The hacker uses a list of words and phrases to try to guess the decryption key.

• Dictionary attacks work well if weak passwords are used.

• Using longer and uncommon passphrases is the best way to secure data against these attacks.

Collision attack

A collision attack tries to find two inputs that produce the same hash value. This type of attack is often used on digital signatures.

• If a hacker wanted to get User2 to sign a document by making it seem like it came from User1, they would generate two documents that generate the same hash.

• The hacker would send one document to User1 and get that signature.

• The signature would be attached to the second document and sent to User2. Because the hashes are identical, User2 thinks the document is legitimate and has been signed by User1.

Generating longer hash outputs is the key to stopping these types of attacks.

Birthday attack

This attack combines a collision attack and a brute-force attack. The name is taken from the birthday probability math problem.

The birthday probability math problem states that if you have 30 people in a room, the probability that someone has the same birthday as you is approximately 8%. However, the probability that any two people in the room have the same birthday is 70%. This is because we are not looking for an exact match (just any match), so the probability is higher. Digital signatures can be susceptible to birthday attacks.

Generating longer hash outputs is the key to stopping these attacks.

Downgrade attack

A downgrade attack forces the system to use an older, less secure communication protocol.

• SSL exploitation is a common implementation of this attack. A hacker can set up their computer to only use SSL so that when the request is sent to the server, the server downgrades from TLS to SSL to communicate. This then allows the hacker to launch SSL-based attacks on the server.

• Downgrade attacks are often used as part of a man-in-the-middle (MITM) attack. The hacker can intercept an HTTPS packet and downgrade it to an HTTP packet. If the server is not configured properly, the server responds using HTTP. This allows the hacker to now see all communications.

To prevent downgrade attacks, servers must be set up not to support these older and less secure protocols. Proper server configuration is the key to stopping these types of attacks.

Obfuscation

A technique that essentially hides or camouflages code or other information so that it is harder to read by unauthorized users.

Steganography

A technique for obscuring the presence of a message, often by embedding information within a file or other entity.

Data masking

A de-identification method where generic or placeholder labels are substituted for real data while preserving the structure or format of the original data.

Tokenization

A de-identification method where a unique token is substituted for real data.

Key management system

In public key infrastructure (PKI), procedures and tools that centralize generation and storage of cryptographic keys.

Trusted Platform Module (TPM)

Specification for secure hardware-based storage of encryption keys, hashed passwords, and other user- and platform-identification information.

Application programming interface (API)

Methods exposed by a script or program that allow other scripts or programs to use it. For example, an API enables software developers to access functions of the TCP/IP network stack under a particular operating system.

Secure enclave

CPU extensions that protect data stored in system memory so that an untrusted process cannot read it.

Trusted Platform Module (TPM)

A TPM is a cryptoprocessor implemented as a module within the CPU on a computer or mobile device. TPMs are produced to different version specifications, with versions 1.2 and 2.0 in current use. Version 2.0 is not backward compatible with version 1.2. Beginning with Windows 10 version 1607, Microsoft required that TPM 2.0 be enabled by default on all new computers. A TPM is required to check the integrity of startup files and components in BitLocker implementations. The TPM generates a hash of the startup files to verify the integrity of those files. Additionally, the TPM creates a hash of system components. This hash acts as a validation check of the system to ensure that system components have not changed. The hash can also be used to uniquely identify the system. Windows Credential Guard requires the computer to have a TPM chip installed. A TPM provides protection for virtual-based security encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. A TPM can generate truly random numbers, thus preventing entropy. TPM provides full support for asymmetric encryption; therefore, it can generate public and private keys. A TPM also provides encrypted storage for user passwords, encryption keys, and digital certificates. Windows 10 can pull stored keys directly from the TPM without loading them into the RAM, where they would be more vulnerable to an attack.

Hardware security module (HSM)

An HSM is cryptoprocessor hardware implemented in a removable or dedicated form factor, including rack-mounted appliances, plug-in PCIe adapter cards, and USB-connected security keys. It is also possible to provision an HSM as a virtual appliance. HSMs provide cryptographic functions such as: generating and storing encryption keys, generating and validating digital signatures, and generating keys used in smart cards. HSMs traditionally come in the form of a plug-in card or an external security device that can be attached directly to the computer system. These devices offer some benefits over TPM chips: HSMs are more powerful and can perform more powerful cryptographic functions quicker; HSMs can perform multiple cryptographic functions simultaneously; and HSMs can be attached to a network and handle cryptographic functions for multiple users across the network. Hardware Security Modules are also known as: Personal Computer Security Module (PCSM), Secure Application Module (SAM), hardware cryptographic devices, and cryptographic modules.

Hashing algorithm

A function that converts an arbitrary-length string input to a fixed-length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output.

Cryptographic primitive

A single hash function, symmetric cipher, or asymmetric cipher.

Digital signature

A message digest encrypted using the sender's private key that is appended to a message to authenticate the sender and prove message integrity.

Salt

A security countermeasure that mitigates the impact of precomputed hash table attacks by adding a random value to ("salting") each plaintext input.

Key stretching

A technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks.

Secure Hash Algorithm (SHA)

A cryptographic hashing algorithm created to address possible weaknesses in multi-domain authentication (MDA). The current version is SHA-2.

Message-Digest Algorithm 5 (MD5)

A cryptographic hash function producing a 128-bit output.