- Welcome to lesson four,
Explain the Importance of Using
Appropriate Cryptographic Solutions.
Now, this is a first of many lessons about cryptography,
and, as I mentioned in the intro,
really one of my favorite topics.
You may find this topic to be challenging,
so just kinda stick with it.
And if it doesn't resonate the first time,
don't hesitate to go through the lessons
one more time, two more times, three more times,
until, all of a sudden, you have that aha moment
and you're like, "Oh yeah, I get it now."
So we're gonna start off in 4.1 with a cryptography primer.
Now, traditional cryptography,
and traditional cryptography goes
way back into ancient times,
is a conversion of communication
into a form that can only be read by the intended recipient.
I want you to imagine, in ancient times,
a massive battle going on
and we've got generals on both sides.
And one general wants to get a message
to his frontline troops,
but really worried that what if the messenger
got captured and got sent to the other general,
would they be able to read the message?
And so they wanted to have some way
to make that message unreadable,
and that was a traditional application of cryptography.
Now, modern cryptography
has really widened that historical definition
to also include the assurance of integrity,
that the message is trustworthy,
that it hasn't been changed in transmission,
and sender identity.
We know exactly who that message came from.
When we talk about cryptography from a high level,
we'll use the term PKI.
It stands for public key Infrastructure.
And public key infrastructure really encompasses
all of the programs, the data formats, the procedures
the communication protocols, the security policies,
and the public key cryptographic mechanisms
that work together in a comprehensive manner
to enable secure communication.
So I wanna introduce you to four cryptographic solutions
and, most importantly, their use case,
encryption, hashing, digital signatures,
and digital certificates.
Now, in this lesson,
I'm just gonna introduce you to each of them,
and then we will do lessons specifically on that.
We have a lesson on encryption, a lesson on hashing,
a lesson on digital signatures,
and a lesson on digital certificates.
Encryption is a process of encoding information.
It's really making information unreadable.
When you open up and you look at the message,
you're like, "That's gibberish.
What does it mean?"
So the use case of encryption is confidentiality.
Hashing is a one-way function
that turns a file or a string of text into a unique digest,
sometimes called a fingerprint,
which is just a number a bunch of values of the message.
Now, the use case for hashing is going to be integrity.
Then we have digital signatures.
Digital signature's actually a hash value
that's been encrypted with the sender's private key.
That sounds a little confusing right now.
Don't worry about it.
What you need to know right now
is the use case is sender authenticity
that we know who the sender was,
and non-repudiation,
that the sender cannot deny that they sent the message.
And then we have digital certificates.
And digital certificates is a digital object
that is tied to a cryptographic key pair.
We haven't talked about this yet, so don't worry.
But the use case for a digital certificate
is authentication.
It's how we can authenticate someone.
When a server says, "I am this server,"
when the code says, "I am this code,"
when the patch says, "I am this code,"
it will be from their digital certificate that we can say,
"Okay, you are who you say you are."
So encryption for confidentiality, hashing for integrity,
digital signatures for sender
authentication and non-repudiation,
and digital certificates for authentication.
We've got lots of terms to go through in this lesson.
We're gonna start with talking about what a cipher is.
A cipher is just a technique that transforms plain text
into cipher text and back to plain text.
We have had cipher since ancient times.
The Caesar cipher was just
move every character three places over.
So we would substitute a D for an A, and an E for a B.
So it's just the technique that allows us
to transform our plain text into cipher text
and back to plain text.
Plain text is just human readable text.
It's what you see on your screen right now.
Cipher text is either text that's been encrypted
or in some form is human unreadable.
It's it's letters, but it doesn't mean anything to you.
An algorithm is nothing more than a mathematically
complex modern cipher.
I'll say that again,
an algorithm is a mathematically complex modern cipher
that we need to have a computer to solve.
Now, algorithms are generally well known.
They're published.
They're really public information.
A key, also called a crypto variable,
is going to be a secret value that we use with an algorithm.
Because if everybody knows what the algorithm is,
then how do we use it for secrecy.
We have to have a secret component.
And the secret component that we use
in conjunction with the algorithm
is going to be known as a key.
Now, a stream cipher is going to be a cipher,
remember, that's just a technique
that transforms plain text into cipher text and back,
is an algorithm that works on one bit of data at a time,
using these XOR functions.
When I have to imagine a stream cipher,
I always think of a faucet that's dripping.
Drip, drip, drip.
And each of those drips in my mind is one bit at a time.
And so my algorithm would work on each one of those drip.
Drip, drip.
A block cipher is an algorithm
that works with a block of data.
Could be a 56k block, 64k block, 128k block,
could be a 256k block.
It's just a block of data.
Confusion is a process of changing values.
So complex substitution functions
are used to create confusion.
And lastly, diffusion is the process of changing the order.
So sending bits through multiple rounds of transposition
is used to create diffusion.
Okay, so I just introduced you to key.
Let's talk more about a key.
A key is a secret value used with an algorithm.
The key can dictate
what parts of the algorithm are gonna be used,
in what order, and with what values.
'Cause remember, the algorithms are published.
They're known.
So the key is what provides the secret part of it.
Now, when you hear the term key space,
it's really just the number of possible key combinations.
So a 256 bit key is two to the 256 bit power.
That's a lot of combinations.
Because a key is really just a value.
It's really just a set of numbers.
So two to the 256, lots of options there.
Key stretching is a technique that can be used
to strengthen a weak key.
So maybe we had a 56 bit key.
We can strengthen a weak key into a stronger key.
We often use that to protect against brute force attacks.
When you hear the term symmetric key,
we mean one key, a single key.
Sometimes it'll be referred to as symmetric key.
Sometimes it'll be referred to as a secret key.
Sometimes it'll be referred to as a shared key.
Sometimes it'll be refer to as a single key.
All of those mean the same thing.
And what it means is that we use the same key
to encrypt as we do to decrypt.
Think about the key that you use
to get into your house or your apartment.
You use the same key to unlock your door
as you do to lock your door.
Think about the key that you use to start your car.
Whether it's push button
or you actually still turn the key,
You use the same key to turn your car on
as you do to turn it off, that's symmetric.
Asymmetric says that we need to use two keys.
They're gonna be mathematically related.
We use one for encryption and one for decryption.
Now, both of them can do either function.
Both can encrypt or decrypt,
but you always have to use 'em in a pair configuration.
Now we wanna make sure that we secure our key.
If we have just one key,
so a symmetric key, a single key, a shared key,
even called a session key sometimes,
we always wanna make sure that
we're really keeping it secret.
In a key pair, we're going to have asymmetric.
We're going to have one key that is publicly distributed
and one that is private and must be kept secret.
So for our private key and for our symmetric key,
we need to look at ways to really ensure
the secrecy of that key.
And there are a couple of different options.
There's a TPM, a trusted platform module.
There's a secure enclave.
There's an HSM that stands for hardware security module,
and there's the option of key escrow.
A TPM is a hardware chip
used for storing cryptographic keys
and related information.
A secure enclave is a separate processor and microkernel
that's used specifically for storing and processing
cryptographic keys and related information
in mobile devices.
An HSM is a hardened tamper-resistant hardware device
that we can use to secure cryptographic keys
and, again, related information.
And key escrow is just a safe keeping mechanism
for storing and obtaining copies of keys
that are needed to decrypt encrypted data
under certain conditions or certain circumstances,
so you may give your attorney right a copy of the key,
and that key can only be used in certain circumstances.
Now, the strength of the crypto system
is gonna be a combination of a lot of factors.
The algorithm, we'll be talking about
lots of different algorithms shortly.
The algorithmic process,
the length of the key,
and the secrecy of the key.
And if any one element is weak,
well, the crypto system can potentially be compromised.
Now there are two terms you're going to hear
in relation to cryptographic strength.
One is deprecated and the other is broken.
Deprecated means that the use of the algorithm,
or the key length, or the process is allowed,
but the user must accept some risk
due to inherent weaknesses.
So you can use it, but you need to know it's weak,
and an example is the 3DES algorithm,
and we'll talk more about that shortly.
Broken means either the key and/or the key length
or the processes behind it is exploitable,
which means it's not gonna secure you anymore.
So deprecated is weak.
Broken is exploitable.
That's the end of our primer.
That's gonna bring us to a three-second challenge.
Then we'll go off into lessons about encryption,
and hashing, and digital signatures,
and digital certificates as well as emerging cryptography.
So three second challenge, are you ready?
Five challenge questions, three seconds each.
I know you can do these.
One, two, three. Let's start.
A mathematically complex modern cipher is a...
One, two, three.
That's an algorithm.
Secret value that's used with an algorithm.
One, two, three.
That's gonna be a key.
And if you said crypto variable, well, you're very cool
'cause it's also a crypto variable.
All right, number three.
The term used to describe a weak cryptographic element.
One, two, three.
That's gonna be deprecated number.
Remember deprecated if it's weak.
Broken if it's been exploited.
Number four, a separate processor and microkernel
used for storing and processing cryptographic keys
in mobile devices.
It's important in mobile devices.
One, two, three.
That's gonna be a secure enclave.
And lastly, number five.
The number of possible key combinations.
So I'm not asking you to give me a number.
I'm asking you to tell me what is that referred to,
the number of possible key combinations.
One, two, three.
And that's your key space.
All right, let's do our first
cryptographic security in action.
This is about key security.
Your municipal employer, Anytown Revenue Service,
wants to encrypt taxpayer data at rest.
Now, it's important that they adhere
to government standards,
so they're planning on using 3DES algorithm
for symmetric encryption.
Now, I get that we haven't talked about
symmetric encryption yet.
We haven't talked about 3DES,
but just kinda go with it.
Now, they wanna make sure that internal employees
have easy access to the data,
so they plan to publish the key
on their intranet.
Now, symmetric, what does that mean?
Symmetric means there's one key,
shared key, single key, secret key, session key,
one key to encrypt and decrypt.
So here's the important thing.
They wanna make sure the internal employees
have easy access to data,
so they plan to publish the key on their intranet.
So do you have any concerns about this approach?
Go ahead and put me on pause, jot down some notes.
Let me know if you have any concerns about their approach.
Well, I hope you do.
The strength of the crypto system
is a combination of the algorithm, the algorithmic process,
the length of the key, and the secrecy of the key.
Now, we weren't really asked to comment here about
whether they're using symmetric or asymmetric,
or the fact they're gonna use a 3DES algorithm.
What we really are commenting on is
publishing the key on their intranet.
But I will tell you that 3DES is deprecated
and shouldn't be used.
Again, you wouldn't have necessarily known that yet.
The AES has replaced 3DES as the US government standard.
Again, not something you necessarily would've known yet.
But here's what you should have known,
that the security of symmetric encryption
depends upon the secrecy
of the single shared crypto variable or key.
That key, 100%, definitely, definitely definitely
should not be published on their intranet.
And knowing that, my friends,
is absolutely security in action.
All right, there you go.
That's your word cloud. You know what to do.
I don't want you moving on to the next lesson
until you're comfortable with all these terms
and you're confident that you can explain them.
But when you're ready, head on over to the next lesson,
and we're gonna be talking about encryption.
See you there.