- In this lesson, lesson 4.2, we're gonna focus
in on encryption, both symmetric and asymmetric.
Encryption is commonly used to protect the confidentiality
of data that's in transit and data that's in rest.
And when we talk about emerging cryptography,
we'll talk about some ways that in the future
we'll be able to encrypt data that's actually in process
or being processed by our processor.
But let's take a big picture look
at how we actually do encryption
again, for data that's in transient and data that's at rest.
We're gonna start with our cleartext, right?
So text, just like what you see on the screen, right?
This readable text.
We're then going to take an algorithm and a key,
so, it doesn't matter right now for our purposes
whether it's a symmetric or asymmetric
but we're gonna take an algorithm and a key.
Our algorithm was just a mathematically complex cipher
that we need a computer to solve and a key which is a value
and our output is going to be our ciphertext.
What you can't read, it won't mean anything to you,
we'll often refer to it as encrypted text,
but just means that it's not human readable.
How are we gonna transform it back?
We're gonna use an algorithm and a key,
just reversing the process.
And that'll take us back to our cleartext.
So, that's a really big picture, simple view,
cleartext, algorithm and key,
ciphertext, algorithm and key, back to cleartext.
Now, we have two types of encryption
we're gonna be talking about,
symmetric encryption and asymmetric encryption.
Symmetric encryption uses the same key
to encrypt and decrypt.
And as I mentioned in the last lesson,
the key can be referred to as a single key,
a shared key, a secret key, a session key,
or a symmetric key, they all mean the same thing.
It means we're using the same key to encrypt
as we are to decrypt,
just like you use the same key to open your house door,
your apartment door as you do to lock it.
So, what are the components we have here?
Well, once again, we're gonna start with our cleartext.
Then we're going to use a symmetric algorithm,
because our algorithms are different
between symmetric and asymmetric.
So, there's a symmetric algorithm
and importantly a symmetric key, and you can see here,
our symmetric key, 1,2,3,4,5,6,7,8,9,
and then we will end up with our ciphertext.
When we wanna transform back to our cleartext,
we're going to use the same symmetric algorithm.
So, if I used 3DES to encrypt
I'll use 3DES to decrypt or AES to encrypt,
I'll use AES to decrypt and the same exact key.
So 1, 2, 3, 4, 5, 6, 7, 8, 9.
Same key to encrypt and decrypt
and that will get us back to our cleartext.
Pretty straightforward and simple.
There are four symmetric algorithms,
I wanna make sure that you know.
DES, 3DES, AES, also known as Rijndael and RC4.
The DES, 3DES and AES, are all block ciphers,
meaning that we're working with blocks of data at a time.
RC4 is a stream cipher.
Remember that faucet, drip, drip, drip.
We're working with one bit of a data at a time
using an XOR function.
So, DES in 1977, was established
as the US government standard for symmetric encryption.
It's a 64 bit key size
with 16 rounds of substitution and transposition.
But in 1998, it was demonstrated
that it could be broken in less than 56 hours.
Broken meaning exploitable,
meaning we're not gonna use DES anymore.
Now, that was quickly replaced by 3DES.
3DES in 1999, replaced DES
as the US government standard for symmetric encryption.
It's a 64 bit key, goes to 48 rounds of substitution
and transposition either using two or three keys,
but there's been a lot of weaknesses found in 3DES.
And what's the term we use for weakness now?
Deprecated, so it is considered to be deprecated,
means you could use it, but it's weak
and there's a lot of risk and you need to be aware of that.
In 2002, the US government replaced 3DES
with AES or Rijndael
as the US government standard for symmetric encryption.
Now, it's either 128 or 192 or a 256 bit key
with 10 or 12 or 14 rounds
of substitution and transposition,
just depending on the version you're using.
And then lastly, we have RC4, again, that's a Stream Cipher
with key sizes from 40 to 2,048 bits.
And there are multiple variants.
There's SPRITZ, there's RC4A, there's VMPC and RC4A+.
So, let's review symmetric characteristics.
Remember, symmetric encryption only uses one key,
same key to lock as unlock, encrypt and decrypt.
It is really, really, really computationally efficient.
Its key sizes are generally 128, 192, or 256 bit.
But here's the problem, it's not scalable.
If I wanted to send a symmetrically encrypted message
to everybody who's watching this video,
I would have to create a different symmetric key
for every single person.
So, it's really not scalable, right?
Doesn't make sense.
The other problem is key exchange is inherently insecure.
If I wanna get you the key,
I've gotta find a way to securely get you the key.
I can't just email it to you, right?
I have to find a secure way.
So, on the good side, it's computationally really efficient
and it means it also works great on large blocks of data,
but on the negative side, it's not scalable
and the key exchange is inherently insecure.
The asymmetric encryption uses two mathematically
related keys to encrypt and decrypt.
But bear in mind that either key could do either.
But when they're used in a pair, they only do one function.
Now the keys are often referred to
as a public key and a private key.
The public key is freely distributed.
So, if I have a public key and a private key,
which I'm gonna get from my digital certificates,
the public key, not a secret freely distributed
to everybody, but the private key must be secured.
It must be kept secret.
Just like we had to keep the symmetric key secret,
the private asymmetric key must be kept secret.
So, what does this look like from a 10,000 foot view?
So, I am gonna start with my cleartext.
Then I am going to use an asymmetric algorithm
and an asymmetric key.
In this case, I'm gonna use key M1,
because I have mathematically related pair.
I will then end up with my ciphertext or my encrypted text.
Now, to transform it back, what do I need to do?
Well, I'll use the same asymmetric algorithm.
So, if I used 3DES, I'll use 3DES.
If I used AES, I'll use AES.
And I am going to use the mathematically related key,
in this case, key M2.
And I will end up with my cleartext.
So, cleartext, asymmetric algorithm,
and one of the two keys,
ciphertext, asymmetric algorithm
and the other part of that key pair,
coming back to my cleartext.
So, there are four asymmetric algorithms
that I want you to know, starting with the very first one,
the most popular, which is RSA.
RSA is kind of the widely implemented
de facto commercial standard.
And it works with both encryption
and as we'll see next, with digital signatures.
The next one is Elliptic Curve Crypto System,
generally referred to as ECC.
It's a very similar function to RSA,
but with smaller key sizes,
so, it requires a little bit less computing power.
It is the current US government standard.
Diffie-Hellman is primarily used for key agreement
or key exchange and that allows two parties
in the same Diffie-Hellman group
that have no prior knowledge of each other
to jointly establish a shared secret key.
And lastly, we have El-Gamal.
Now, El-Gamal is primarily used for transmitting
digital signatures and key exchange.
So, in the commercial environment,
the one that you will probably work with most will be RSA.
If you're in government agencies or the military,
the chance you're working with ECC.
So, let's look at our asymmetric characteristics.
Remember, asymmetric encryption requires two keys.
Now, because it requires two keys,
it is really computationally intensive.
It doesn't work well on large blocks of data.
Matter of fact, it works much better
on very small blocks of data.
But key sizes are large,
generally could be greater than 2,048.
It is really scalable and I'm gonna demonstrate that to you.
And key exchange, well, it was designed for key exchange.
Inherent in the asymmetric environment is a key exchange.
And I'll be demonstrating that to you too.
So, let's look at an asymmetric message flow illustration.
I have Alice and I have Bob.
And Alice wants to send Bob
an asymmetrically encrypted message.
So, she's gonna take her plaintext message.
So, we've got a plaintext message
and she's going to use an asymmetric algorithm.
So, let's say she's going to use RSA for our purposes.
Now, she's using two keys and she needs to use a key
so that the corresponding key only belongs to Bob,
because she's sending a message to Bob
and she wants to make sure that only Bob,
only Bob can decrypt the message.
So, what is she gonna use?
She's gonna use a copy of Bob's public keys.
Remember, public keys are freely distributed.
Why Bob's public key?
Because what is the corresponding key to Bob's public key?
Well, hopefully you said, Bob's private key.
And who should have a copy of Bob's private key?
Hopefully you said, only Bob.
So, she'll use an asymmetric algorithm, let's say RSA,
and a copy of Bob's public key,
and we'll end up with an encrypted message.
Bob is gonna get that message.
He is gonna use the same asymmetric algorithm,
so let's say he uses RSA,
but he's gonna be using the corresponding key.
Remember we had two mathematically related keys, 1 and 2?
What is the mathematically related key to Bob's public key?
Bob's private key
and only Bob should ever have Bob's private key.
So, he'll be able to use that asymmetric algorithm
and a copy of his private key,
and voila, he's gonna have the plaintext message.
And if we do it this way,
only Bob would ever be able to decrypt the message.
All right, so why don't we just do everything this way
if it works?
Well, remember what I said,
the problems were with asymmetric, right?
Asymmetric is computationally intensive
and it doesn't work well on large blocks of data.
So, we need another solution.
Our solution is really a hybrid solution.
In our hybrid solution,
what we're gonna do is we're gonna use the best of symmetric
and the best of asymmetric to be able to deliver
an encrypted message, so, I've got Allison, Bob again,
we wanna send a message from Alice to Bob.
So, what she's gonna do is,
we're gonna start with the plaintext message,
down here on the bottom.
So, Alice is gonna take her plaintext message
and she's gonna use a symmetric algorithm.
Why?
Because symmetric is computationally efficient
on large blocks of data
and she's gonna use a key, a symmetric key,
but she's only ever gonna use it this one time.
And if you have a symmetric key that's only ever used
one time in a particular session,
it's referred to as a session key.
So, now she has encrypted the message.
So, she has sent that encrypted message to Bob.
Now what's Bob gonna need to decrypt the message?
Well, he's gonna need a copy of that session key.
So, now, I want you to come up to the top.
So, Alice is gonna take that session key.
Remember small little bits of data, it's just a key.
She's gonna use an asymmetric algorithm
and she's gonna use a copy of Bob's public key.
Why Bob's public key?
Well, we just talked about it.
What's the corresponding key to Bob's public key?
Bob's private key.
Who has a copy of Bob's private key?
Only Bob.
So, she's gonna take an asymmetric algorithm
and a copy of Bob's public key.
And now she's going to send him the encrypted session key.
So, what have we sent to Bob?
Encrypted session key and the encrypted message.
What's Bob gonna do?
Well, we're on the other side of the line.
That's where Bob is.
Bob is gonna take an asymmetric algorithm
and his corresponding key, his private key,
and what's he gonna end up with?
Cool, he's gonna end up with the session key.
And then he's gonna be able to take that session key
and use the symmetric algorithm, let's say AES,
with that session key and voila.
What is he gonna end up with?
He is gonna get the plaintext message.
So, in this example, we got to use the best of both worlds.
We use symmetric on the message itself.
Why?
Because it's large blocks of data
and symmetric is very computationally efficient
and we used asymmetric to get the key
from one place to another.
That session key, right?
Why did Alice used Bob's public key?
Because the corresponding key to Bob's public key
was Bob's private key, and only Bob, right,
should be able to have the corresponding key,
right, the private key.
So, we're ensuring the confidentiality of what's been sent
because nobody else would be able to decrypt it.
Clear as day or clear as mud?
All right, so let's compare symmetric and asymmetric, right?
Symmetric is a single shared key.
Asymmetric key pair, right?
We have M1 and M2.
We can refer to 'em as private and public.
Symmetric, works really well in large blocks of data.
Asymmetric, much more efficient on small blocks of data.
Why?
Because symmetric is computationally efficient.
Asymmetric is computationally intensive.
Symmetric, not the least bit scalable,
asymmetric, absolutely scalable.
Key exchange in symmetric, inherently insecure,
key distribution system is built
right into the asymmetric process.
So, while we could use just one or the other
when we combine, you know, parts of both,
we really get the best of all worlds.
And we need to make sure that we're always securing our key.
If it's symmetric, right?
It's that key that has to be secured.
If it's asymmetric, remember, we have public and private,
it's always the private key that has to be secured.
So, key management describes the activities involved
during the handling of cryptographic keys
during their entire lifecycle.
Usage, a key should only be used for one purpose, right?
We don't ever wanna use the same key
for different cryptographic purposes
because it might weaken the security provided
by one or both.
Our strength of our key should always be commensurate
with the data process protection requirements.
The storage of our key, remember symmetric and private keys,
must be securely stored and that the measures taken
to protect a private key must be at least equal
to the required security of the use of the key.
And lastly, a KMPS is a Key Management Practices Statement
and that's gonna be a document that an organization
is gonna create that describes in detail,
the organizational structure, the responsible roles,
and the rules for key management.
So, managing that key is extraordinarily important.
Whether you're doing symmetric or asymmetric encryption.
And that my friends, brings us to a three second challenge
on encryption.
You ready?
Five questions, three seconds each.
Let's do it.
Number of keys in symmetric encryption.
One, two, three.
It's gonna be one.
All right, the key mathematically related
to a public key is a?
One, two, three.
Oh, I hope you shouted out, private key.
Number three, the US government
symmetric algorithm standard.
So, it's a current standard for symmetric algorithm.
One, two, three.
It's gonna be AES, also known as Rijndael.
Number four, the key that Mary should use
to send an asymmetrically encrypted packet to Bob.
So, she's gonna asymmetrically encrypt a packet,
she needs to send that packet to Bob,
she wants to make sure only Bob can decrypt it.
So, think about what key Bob's gonna have
and then tell me what the corresponding key is
that Mary's gonna use to send an asymmetrically
encrypted packet to Bob.
I'm gonna give you six seconds on this one.
One, two, three, four, five, six.
What'd you come up with?
Should be Bob's public key.
She's gonna use Bob's public key,
because Bob has the corresponding key, Bob's private key.
So only Bob would be able to decrypt
the asymmetrically encrypted packet.
And lastly, number five,
the key that Mary should use to decrypt
an asymmetrically encrypted packet sent by Bob.
So, Bob sends Mary a packet this time.
What key is she gonna use
to decrypt the asymmetrically encrypted packet?
It's really the same question I asked you in reverse.
I'll give you six seconds again.
One, two, three, four, five, six.
Something came to her,
we wanna make sure that only Mary can decrypt that packet.
Only Mary, not Bob, not anybody else.
So, what key is she gonna use?
She'll use her private key.
Bob will have encrypted the packet using Mary's public key.
She'll decrypt it using her private key,
corresponding keys.
Best way to always think about this
is what are we trying to accomplish, right?
What's are the key?
And that'll help us understand what keys now we need to use.
Okay, here's a security in action about encrypting messages.
Jim, the procurement officer at your organization,
Anytown Medical Supply Company, plans to send messages
to his counterpart, Tom, at Anytown Hospital.
So, my question for you is,
should symmetric or asymmetric encryption
be used to encrypt the message?
And two, what keys should be used for this process?
So, is he gonna use symmetric or asymmetric encryption
to encrypt the message itself?
And then what keys should he be using for this process?
Great time to put me on pause and write down some notes.
All right, well, here might be your instructions.
Large blocks of data like messages,
should be symmetrically encrypted.
That's gonna mean using a single key,
symmetric is single key.
Often it's a single use key referred to as a session key.
But the challenge is gonna be,
how is Jim gonna get Tom that key, right?
The challenge is how to securely provide the symmetric key
to the recipient.
So, asymmetric encryption can be used to secure the key.
In this case, the session key will be encrypted
using Tom's public key and then transmitted to Tom.
And Tom will be able to decrypt the session key,
because he's gonna use the mathematically related key
which is his private key.
Now, once Tom has decrypted the session key,
he can then decrypt the original message.
I know this feels a little confusing at first,
but if you kind of draw it out, diagram it out,
what you're trying to accomplish
and what needs to be secret, you know, and what doesn't,
it'll really be helpful to understand what keys
you're going to be using, and doing that,
which is really really important to do,
is security in action.
There's your word cloud, you know what to do.
Don't move on until you really understand
all of these terms.
But when you're ready,
up next we're gonna talk about hashing.
See you there.