The Fidelman comes in different forms.
Duffy Holman One is 768 bits in length.
Duffy Holman two is 1024 bits in length.
Duffy Holman five is 1536 bits in length.
Once again, the longer the key length, the more secure.
But the downside is more processing power would be required.
Now, just to reiterate, asymmetric key algorithms are used in VPNs today, not for bulk encryption
of data, but they help with the establishment of a shared secret.
Are also used for other things like authentication, which I'm going to talk about in a moment.
Symmetric key algorithms such as these are used for bulk encryption of data.
So we've covered confidentiality or encryption.
Let's look at the second goal, which is integrity.
We want to ensure that data has not been tampered with.
In other words, we want to know that the data has traversed the Internet or other network unchanged
between the two parties.
Data Integrity uses algorithms known as hashing algorithms, also known as trapdoor or message digests.
These are one way algorithms, unlike encryption algorithms, which can be reversed.
Hashing algorithms convert arbitrary data into a fixed length hash.
An example would be MD5 or Message Digest Algorithm five, which has a fixed length of 128 bits.
Now to demonstrate hedging.
Notice I can take a piece of arbitrary information.
Let's say my name.
And I can hash it.
In this case using Sha.
Shore or secure.
Hash algorithm is more secure than MD5.
This is the hexadecimal value or sha and the binary value for sha.
Notice if I change one value, for instance, making that David one and hash it again, notice the entire
hash changes.
But notice it's of a fixed length.
I could put a bunch of people's names in there.
And hash it again.
Notice the entire hash changes but is of a fixed length.
I could go and copy some text.
From, let's say, USA Today.
Arbitrary length.
Pasted it in.
Tree.
I could take the Encyclopedia Britannica.
Put it through an MD5 hash and come up with 128 bits.
So for example, I could take that us today article, put it into an MD5 hash generator and notice it
will come up with 128 bit hash value.
Or I could replace that with let's just say my name.
And will come up with 128 bit hash value.
Hashing is not reversible because data is lost.
You cannot take 128 bit MD5 hash, reverse it and come up with the Encyclopedia Britannica.
But you can take the Encyclopedia Britannica, hash it and come up with 128 bit value.
Please note that the hash will change, as I've demonstrated if any part of the input value changes.
So with hashing we can take data of arbitrary length.
Put it through an MD5 or sha hash.
In this case it's md5 and come up with a fixed 128 bit hash value.
You cannot take the 128 bit hash value and reverse the process and come up with the original data.
It is a one way function or trapdoor function.
There are various hashing algorithms that can be used.
MD5 once again is 128 bits.
MD5 is not recommended today in networking environments.
SHA one is 160 bits and length.
SHA two is 256 or 512 bits in length.
And SHA three is scheduled for release in 2012.
Just be aware that there are various hashing algorithms once again.
SHA two is what's recommended in today's networking environments.
So as an example, if Peter wanted to send data to Sarah ensuring confidentiality and integrity, the
following would happen.
Is private information that no one else except Sarah should read is encrypted, firstly, with an encryption
algorithm like these.
Now, in this case, we're assuming that a shared secret or shared key has been derived.
So assuming that that's happened, Peter can encrypt the data using a symmetric key algorithm like Amy's.
So the clear text information is encrypted into ciphertext.
This provides confidentiality.
Peter then takes the encrypted text or ciphertext and hashes it with a hashing algorithm like SHA or
MD5, which comes up with a fixed length hash.
This will ensure data integrity because if any part of the data is changed, remember the hash will
also change.
So Peter takes the clear text encrypted with an algorithm like ease to come up with ciphertext.
He hashes that encrypted text and comes up with a hash.
He then append the hash to the encrypted ciphertext and sends it to Sarah.
Sarah upon receipt of the data in this case, the encrypted ciphertext wants to make sure that the data
hasn't been tampered with before, going through all the effort of decrypting the text.
So Sarah will take the encrypted text and hash it herself to come up with a MD5 or sha hash.
She will then compare the hash that she derived with the hash appended to the encrypted data only if
the hashes are the same.
Does she bother decrypting the text now?
If the hashes are the same, it means that the data hasn't changed in transit.
If the hashes are the same, Sara can decrypt the data by reversing the A's encryption, knowing that
the data hasn't been tampered with.
However, that being said.
What stops Joe Hacker receiving the data?
Changing it.
So manipulating the data before it reaches error.
Encrypting it with ease.
Hashing that fake data with, let's say SHA and appending a new hash to the data and then transmitting
it to Sara.
Sarah has no way of knowing that the data has been manipulated because when she reverses the process
by hashing this new data, her hash will be the same as Joe Hacker's hash that he appended to the new
data.
So to combat that, what Peter needs to do is use something called hash message authentication code
or Mac.
And there are two variants of this.
You have Mac MD5 and Mac Sha.
And what Peter needs to do is take the data of arbitrary lengths.
So in other words, the data that he wants to send to Sarah.
Plus a secret key that only Sarah and he knows.
And now hash those two values with MD5 or SHA to get the hash.
That will combat Joe Hacker from manipulating the data because Joe Hacker won't know what the secret
key is that Peter and Sarah are using in combination with the hashing algorithm.
Joe Hacker will not know what the secret key is.
So when he hashes the data.
Sarah will know that the data has been manipulated because the hash that she derives will not be the
same hash.
Sarah will be taking the encrypted data.
In combination with the secret key and hashing those two together to come up with her hash.
Joe Hacker will not know what the secret key is.
So when Joe Hacker hashes the data, he's hash will not be the same as the new hash that Sarah derives.
And she will therefore know that the data has been tampered with.
Only Peter and Sarah know what that secret key is, not Joe Hacker, so he cannot successfully manipulate
the data and derive the same hash value.
Thus, data integrity is provided with HMC in combination with MD5 and SHA.
The third goal to accomplish is authentication.
Now authentication is knowing that data received is the same data that was sent and that the claim sender
is in fact the actual sender.
Now, we've already spoken about integrity.
Now we're looking at authenticating a peer to make sure that they are actually who they say they are.
This goes beyond validating the source attempting to access a service during initial login.
You should also validate that the source has not been replaced by an attacking host in the course of
the conversation, which is known as session hijacking.
You want to make sure that the person that you're talking to is the person that they say they are and
that they haven't been replaced by a hacker.
They are two types of authentication.
So we could authenticate rather one to write a two using either a preset key, which is a secret key
value entered into each pair manually and is used to authenticate the pair.
Or we could use RSA signatures which encrypt the hash with a private key.
So firstly, appreciate key.
In this example, Peter needs to be authenticated by Sarah.
In this case, PITA takes the Doofy helm and shade key that they derived.
The pre sched key that was agreed upon with Sarah, which should have been done out of band and other
information relating to IP sick.
And he hashes that with either MD5 or SHA and he attaches the hash to a packet with his ID information,
which may be the IP address or hostname that is used for the VPN.
Sarah can then hash her local copy of the information, which includes the agreed upon preset key and
derive an MD5 or SHA hash.
She can then compare her locally derived hash with the hash that she received from PETA.
If they the same.
She knows that Peter has the same pre shaved key as she does and she can thus authenticate Peter.
If the hashes are different, she knows Peter does not have the correct preset key and therefore the
VPN is not set up.
The second option is to use digital signatures.
Digital signatures have multiple advantages, including the automatic exchange of keys without the need
of programming static authentication keys on multiple devices.
This allows for scalability.
The key lengths are also a lot greater.
Pre shared keys should be changed on a regular basis, and in reality that often doesn't happen.
Another advantage of digital signatures is non repudiation, which means you cannot deny being involved
in a conversation because you're the only person that has your private key.
So the way it works is PETA in this example takes the diffi hellman shade key and other information
and hashes it in a very similar way to appreciate keys.
But notice the pre shade key is not in this list.
That hash is now signed with Peter's private key.
And remember that Peter is the only person that has that private key.
That creates what's called a digital signature.
So a digital signature is created when information is encrypted with a private key.
Please remember that if something is encrypted with someone's private key, only that person's public
key can decrypt it.
Peter now sends that information to Sarah.
Sarah takes the received signature from Peter and decrypts it with Peter's public key, which she had
previously received from Peter that will result in the original hash that Peter created.
Sarah now takes the same information that she has locally and hashes it herself to derive her own hash
of the various parameters.
She then compares the two hashes if they the same.
She knows firstly that Peter has all the correct information.
She also knows that this information could only have come from Peter because only Peter's public key
can decrypt something encrypted with Peter's private key.
So the digital signature proves that the information came from Peter and that all of this information
is correct.
She has thus been able to authenticate Peter.
Now the reverse will happen for both preset keys and digital signatures.
Peter will authenticate.
Sarah So there's mutual two way authentication either by using preset keys or by using digital signatures.