Now in order to exchange or agree he's with Bob in a secure manner.
We need to authenticate Bob in order to securely exchange those keys.
If a man is sat in the middle he might be able to send as a public key pretending to be bald or pretending
to be Bob's public key.
When we request it from Bob or when we try to download it from a site so you can just take a public
key and assume that it is the real key.
We need to authenticate that it is the real key first.
And this brings us to all the cryptographic technologies and that is hash functions and digital signatures
which help provide authentication or legitimacy of the senders and the receivers.
So if you look here you can see input you can see the hash algorithm or function and you can see the
output.
A hash function takes as input data of any size so it can be an email file.
A word in this case we've got Falk's and it converts it via this hash function to here a fixed size
string of characters and these values returned by the hash function are referred to as simply hashes
or message digests or in this case digest.
Now a very important feature of the hash function is that you can never come back from this to the original
import.
This is a one way hash function and no keys are required for this.
You just require import the hash function and then you get the resulting output which is always of a
fixed length depending on the type of function that you're using.
So this provides integrity and it detects what intentional modifications.
It does not provide confidentiality authentication.
It can't detect if an intentional modification has been made.
There are many examples of hash functions you've got M.D to M.D for and the five have all.
Shaw.
Shaw warns Shaw 2 5 6 3 8 4 short 512 tiger etc..
Today if you're looking at a crypto system really should be using short to 5 6 or above which means
Schaaf 3 8 4 and Schaaf 512.
Let me show you some examples of this practically being used.
OK so here we have true correct which is a whole description technology if you are not familiar and
this is the file that you would download.
Now this here is the resulting hash of hashing this file against this algorithm.
Shaw to 5:6.
So when you download this file you can verify that the file has not been changed.
It has integrity using this.
Now there are tools that you can download to do this.
One search tool here is quick hash.
And all I can do is I can choose a file and
chrome drag it in.
And I can see that that is the hash for Chrome Forshaw warm to 5 6
512 and you'll notice that as we go up the numbers in the hash algorithm the hash lens gets bigger because
that is the bit length.
One small 2 4 6 5 12 and M.D 5 which is we can shouldn't be used.
So this is used as a way of verifying that what you have downloaded has maintained integrity.
Now the clever among you may be thinking well what if when I go to download something has been compromised
so here is the tale's Web site and we'll discuss tale's more.
But so I want to download tale's in here it is.
And I have the hash here of that.
But this Web site as being compromised.
It means that they could change this download and add something to it you know a trojan will some some
way of tracking me and it could also change this as well.
So that hash provides no value there.
It cannot detect intentional modification.
We need something else to verify that this site is in fact who it says it is.
And this is where we move into certificates digital signatures and other methods.
Another way you'll see is used with passwords.
Now when you enter a password into a web site or into your operating system it is very very very very
bad practice.
You just to store that password within a database because if that database is compromised then your
password is compromised.
What should happen is your password is converted by a password key to a creation function to a hash.
And you can see here examples of the Windows operating system converting the administrator password
to a hash and this is stored in something called the sound database within Windows.
And we'll discuss more on that later and how that can be compromised.
This is just to give you another example of how hashes are used.
And another use of hashes is to include a pre agreed shared secret into the message and then hash that
message which is known as a hate Mac or harsh message authentication code which provides authentication
integrity because we have the pre shared key and we have the hash used in combination together.
Don't worry too much about the detail.
It's just another technology used in crypto systems that you don't need to know the apps of the ins
and outs of.