Section 2.10 Encryption Examples
Subsection 2.10.1 RSA
RSA is an asymmetric encryption standard developed in 1977 that is still very popular. Its trapdoor function is based on the difficulty of factoring large numbers. The name RSA comes from the names of the authors of the system: Ron Rivest, Adi Shamir, and Leonard Adleman.
Subsection 2.10.2 Advanced Encryption Standard (AES)
AES is a symmetric block cipher developed in 1998 to supersede the less secure Data Encryption Standard (DES). AES works on 128 bit blocks of data, performing multiple rounds of substitution-permutation to encrypt data. You will find AES used to encrypt network traffic (as is the case in a virtual private network), data stored to disk (disk encryption), or computer game data that is saved to storage. AES is a very common cipher.
Subsection 2.10.3 Elliptic-curve Cryptography (ECC)
ECC is an asymmetric encryption scheme that is quite fast and easy to computer. It is rapidly becoming the go to choice for digital signatures and key exchanges, gaining adopting starting in 2004. ECC is based on the geometry of a pre-determined set of curves (some examples can be found here), which can be used to create a trapdoor function.
1
www.secg.org/sec2-v2.pdfSubsection 2.10.4 Diffie-Hellman Key Exchange
The image, captioned ’dh’ and also titled ’Diffie-Hellman Key Exchange’ (or similar, based on context from image analysis), clearly illustrates the protocol using the well-known paint mixing analogy. It involves two parties, labeled Alice on the left and Bob on the right.
Both Alice and Bob begin with a canister of ’Common paint’ (depicted as yellow). Each then separately mixes this common paint with their own unique ’Secret colours’: Alice uses an orange paint, and Bob uses a blue-green paint. This step results in two distinct mixed paint colors, one for Alice (an orange-yellow mixture) and one for Bob (a blue-yellow mixture).
These new mixtures are then shown being exchanged via ’Public transport’, indicated by arrows crossing between Alice and Bob. After the exchange, Alice adds her original secret orange paint to the mixture received from Bob. Similarly, Bob adds his original secret blue-green paint to the mixture received from Alice. Both processes are depicted to culminate in the same final ’Common secret’ paint color (a brownish hue).
A note within the diagram, ’(assume that mixture separation is expensive)’, underscores the cryptographic principle that the combined values are difficult to reverse-engineer to find the original secret components.
Original schema: A.J. Han Vinck, University of Duisburg-EssenSVG version: Flugaal, Public domain, via Wikimedia Commons.
2
commons.wikimedia.org/wiki/File:Diffie-Hellman_Key_Exchange.svgGiven the slow nature of asymmetric algorithms, often an application such as a VPN will choose to use asymmetric cryptography to exchange a shared secret key and then use that secret key with a faster symmetric algorithm such as AES. Diffie-Hellman does exactly that and was first published in 1976. Diffie-Hellman key exchange uses the same mathematical concepts as RSA, exponentiation and modulus arithmetic, to great effect, but to visualize what is happening a metaphor of secret color mixing is used (see the included diagram). It is important to remember that because the medium of exchange may be slow a DH key exchange is designed to generate minimal traffic.
Subsection 2.10.5 Digital Certificates
A digital certificate is a set of credentials used to identify a company or an individual. Since asymmetric encryption requires know a party’s public key, a digital certificate includes that key as well as an ID of the owner. The question then becomes how do you trust that the public key is actually for the alleged owner? That’s where the issuing authority comes in. A certificate authority (CA) signs the certificate indicating that the ID and public_key are correct. Certificates can be self-signed, but this sidesteps the trust placed in the CA and is often only used in testing. Since most certificates are used for encrypting web traffic, Web browsers will typically warn you if a site is using a self-signed certificate.
Given how how many certificates need to be issued and the work that needs to be done to verify them, most certs are not issues by root CAs, but are actually issued by intermediate CAs. Root CAs delegate the work to Intermediate CAs and indicate their trust in them by signing the intermediate CAs keys. This creates a chain of trust from the issued certificate (signed by the Intermediate CA) to the Intermediate CA (signed by the root CA) to the root CA (trusted by the browser). Tools that use this chain of trust will keep the root CA certificates and update them from the companies that issue them as needed.
The certificate store is very important and while users rarely interact with it is often possible to install root CAs manually. This is can be used to create a proxy that can decrypt HTTPS traffic for debugging or for more nefarious purposes. For this reason some applications, Facebook mobiles apps for example, maintain their own certificate store and prevent users from adding root CAs to it.
3
docs.telerik.com/fiddler/configure-fiddler/tasks/trustfiddlerrootcert
So how do you get a certificate for your website? The customer will generate a Certificate Signing Request (CSR) that includes the public key and their ID. The CA will validate that the customer owns the website and build and sign the cert. This whole process can be automated and performed for free via a tool called Let’s Encrypt.
5
letsencrypt.org/Subsection 2.10.6 Blockchain
It is hard to talk about cryptography without addressing blockchains, one of the concepts behind cryptocurrencies. A blockchain is a shared ledger (of transactions in the case of BitCoin) where blocks are constantly being added to add to the information being stored. Periodically an new block is created, which includes a hash of the previous block and a hash of itself for the next block to reference. By examining these hashes, you can prove the integrity each block and its position, thus making a publicly-available, mutually agreed upon accounting of what has occurred on the network. Typically to prevent bad actors from adding block some sort of proof of work, a mathematically difficult operation, or proof of stake, an accounting of investment in the network, must be included when adding a block to the chain.
Subsection 2.10.7 Trusted Platform Module (TPM) / Hardware Security Module (HSM)
These modules provide hardware specifically for use with encryption. HSMs are removable modules while TPMs are motherboard chips. Many ciphers rely on a reliable source of entropy (randomness) which these modules provide. They can also significantly increase the speed at which cryptographic algorithms run by moving the operations to specialized hardware. Lastly, these modules can be used to store keys and make them only accessible via the module. This can add an extra layer of security to prevent the keys from being easily copied.
Subsection 2.10.8 Steganography
Steganography is the process of hiding data in something such that to a casual observer it cannot be detected. Data can be hidden in audio, images, or even plain text!. The hidden data can also be encrypted if an additional layer of security is required. In the field of security, malicious code may be hidden inside other files using steganographic techniques. This makes it more difficult for tools to find them when searching storage.
7
dl.packetstormsecurity.net/crypt/snow/description.htmlYou have attempted 1 of 1 activities on this page.
