All
right, let's take a look at Module 14,
which is going to deal specifically with cryptography.
First off, definition of cryptography.
The conversion of data into a scramble
code that is encrypted and sent across a public or private network.
It's not always sent across, though.
It is definitely encrypted and stored locally, but it puts data into an
unreadable format, except that of the intended recipient.
It's used to protect confidential data like email messages, chat sessions, web
transactions, personal data, corporate data, and e-commerce applications.
The goals or objectives of cryptography
are to provide confidentiality, integrity, authentication, and non repudiation.
Now, we've defined confidentiality,
integrity, authentication, and nonremediation before.
We're going to take a look at some
specifics on how we achieve that in this module.
First off, encryption.
Encryption is putting clear text or plain text, readable text into an encrypted
c ypher text format and then reversing that process is referred to as decryption.
So protecting information by transforming it in such a way that the resulting
transformed form is unreadable to an unauthorized third party.
Transformed form, I guess that works.
An encryption algorithm uses a key to perform the transformation on the data.
So you typically have an algorithm and then you have a key.
We'll call that a crypto variable.
There are two types of encryption.
We have symmetric and we have asymmetric.
In symmetric encryption, the same key is used to encrypt and decrypt.
In asymmetric, one key is used to encrypt, the other key is used to decrypt.
Now, we've talked about this a bit in earlier modules.
We're going to revisit the whole public private key phenomenon.
Semetric Encryption, also referred to as shared key or secret key encryption.
Semetric key, shared key, secret key.
Same key to encrypt and decrypt, best suited for bulk data.
But the problem with symmetric encryption is the key distribution.
You have to securely distribute it between the two participants in the communication.
Anyone that compromises that symmetric key
would be able to encrypt and decrypt data exchanged between two entities.
So it doesn't give us any nonremediation,
but it's fast and it's better suited for bulk encryption, large amounts of data.
Our Asometric Encryption.
Unlike Semetric, Asymetric uses two
separate keys to carry out encryption decryption.
One key is called the public key that is made public.
The other key is called the private key that is kept private.
I never, ever disclosed that private key to anybody but myself.
Some situations, private keys are generated.
They're used in enrollment stations for smart cards, things like that.
But your best case scenario is I generate the private key.
Now I am absolutely 100 % certain nobody else has a copy of it, and I distribute
that public key freely like business cards, don't care.
As long as I don't do anything sensitive with the private key, then we've got a
secure mechanism between public and private key.
Public key is used to encrypt, private key is to decrypt for confidentiality.
Private keys are used to sign or encrypt a hash for digital signatures for
authenticity, and the public key decrypts that hash.
But the difference is that that hash is not sensitive data.
We're not trying to achieve confidentiality.
Asymetric is also called public key encryption.
It's used to encrypt small amounts of data
and it's slow, up to 1,000 to 10 thousand times slower than bulk encryption.
So really not well suited for any volume whatsoever.
What we're going to typically do then is use Asymetric to encrypt Semetric and use
that to easily distribute the key to the recipient.
I've already talked about that a bit.
I showed you how an SSL TLS Handshake works.
We've talked a little bit about email security.
Again, the symmetric key is used to encrypt the bulk of the communication, and
asymmetric keys are used to encrypt the symmetric key.
We also have a key agreement mechanism
called Diffie Hellman or protocol called Diffie Hellman, which we'll touch on here
a little bit as well, that is an exchanging of public keys in a
Modulus value, and then mathematically deriving the same symmetric key.
It's amazing that it works, but it does.
So we don't really exchange, we agree on.
Government access to keys.
We always trust the government to safely
secure our data to not access anything they're not supposed to access.
Some may not share that sentiment.
Government access to keys means that
software companies will give copies of all keys or at least a sufficient proportion
of the key that the remainder could be cracked to the government.
The government promises they will hold on to the keys in a secure manner and will
only use them when a court issues a warrant to do so.
Okay, as long as we got their word. Yeah.
All right.
So to the government, this is similar to the ability to wiretap phones.
All right.
So the whole idea of key escrow is it's held by a trusted third party, and if a
court order dictates, it's then handed over.
All right.
So you may not share the same sentiment.
I always like to air on the side of caution.