And then authentication protocols.
Okay, so when you're logging into a remote
system and you're presenting credentials, you've got to protect the credentials.
Password authentication protocol doesn't do that, so we don't use PAP.
All right, PAP transmits passwords and usernames in clear text.
That's not good.
Passwords are in clear text and unencrypted.
This is the main weakness with PAP.
Basic authentication feature built into a HTTP uses PAP.
Clear text, bad idea.
But usually it's encrypted in an SSL or TLS session.
All right.
Shiba password authentication protocol.
The username and password are encrypted before being transmitted over the network.
In challenge handshake authentication, a unique challenge string is sent.
Here's the problem.
Let me give you my standard clear text password issues here.
A normal server.
Say I'm logging into it and I send my username and password.
That puts a smile on the attacker's face because it's in clear.
I could capture in the clear of the username and password.
I could use that to log in.
If they're encrypted
with Shiba, for example, I can still capture and repeat and replay.
I don't necessarily know that they're clear text.
I don't type them in, but a replay attack would work.
I'd capture the encrypted form and they're
in a hashed form or whatever, I just send the hashes.
In a challenge response, there's a
challenge string that's sent, and we talked about this in Kerberos, so this is
a bit of a review, but that challenge string is unique.
The challenge response is a product of the
challenge string of the variable and my password, hash, hash, and send.
That captured by an attacker
wouldn't be replayable since they would get a unique challenge when they logged in
and the challenge response would not be valid, so it wouldn't work.
The challenge handshake authentication gives a unique challenge for every
authentication attempt and that protects against replay attacks.
Blockchain.
Okay, blockchain is also referred to as a distributed ledger technology, restoring a
history of transactions in the form of blocks.
It's not unlike cifer block chaining using a symmetric block cifer.
For multiple transactions, multiple blocks
are created linked together to form a blockchain.
These days, blockchains are used and there's copies of ledgers, but they're
used for digital currency transactions and there's a lot of emphasis on blockchain.
The whole idea here is that you can't really alter one without altering the
entire chain and that gives you some reliability and integrity.
It gets deeper than that for sure, it depends on the application.
Steganography.
Steganography is the technique of hiding a secret message within an ordinary message
and extracting it at the destination to maintain the confidentiality of data.
Again, come back for CH for the full steg o discussion.
But utilizing a graphic image as a cover
is the most popular method to conceal the data and files.
If I want to send something secret or
sensitive, I could put it inside of a picture file and I could just send the
picture file as an email attachment, no big deal.
The Steganography tool embeds the object
and extracts the object and quite often the object is also encrypted.
Even if it's detected, you can't decrypt it.
You can encrypt or you can use a variety of mediums for Steganography.
The most common is a picture file.
A lso, again, there's audio, video, pictures, and so forth.
Now, one more difference.
They also will talk a lot of times about
watermarketing in conjunction with steganography.
Watermarketing is embedding a message or
an object that's used for ownership assertion or for verification.
It also gets used a lot in data loss
prevention to tag data as it's cruising through the network.
Then steganography sounds an awful lot
like Trojan encapsulation or binding, but it's not.
When I embed an execut in a picture file,
it doesn't run when the picture file gets opened.
When I embed an executable on another
executable, that's wrapping, and that's how Trojans work.
It's not the same concept, although it looks pretty similar.
Again, come back for CEH, and we'll do the
full steganography discussion and demonstrations and labs.
You do have a lab on steganography as well.
That's going to wrap up our cryptography module.
Lots and lots of detail in cryptography, potentially.
You get into key sizes and number of rounds and block sizes and so forth.
Everything at a high level is a good working knowledge.
If you want to get into advanced
cryptography, you can get into manipulation of digital signatures, key
rotation intervals, and all that good stuff.
That's a great broad overview of
cryptography, asymmetric, symmetric, hashing, digital
signature, PGI, steganography, so good stuff.
That wraps up Module 14, Cryptography.