Comparing Cryptography Components¶
Cryptography, Encryption, and Hashing¶
Cryptography¶
- Confidentiality
- Integrity
- Non-repudiation
- Authentication
What is it?
- Plain text is encrypted using a key
- Data becomes cipher text, cipher text is decrypted with a key
- Data is plain text again
Encryption¶
Purpose of encryption
- Unauthorized parties don’t have access
- Provides confidentiality
- Encrypted cipher text has to be decrypted
- Various protocols can accomplish this
Types of Encryption
- Symmetric
- Same key used to encrypt is used to decrypt
- Asymmetric
- Two keys, one to encrypt, and a different one to decrypt
Types of Symmetric Ciphers
- Block Ciphers
- Encrypt a fix size of data, one block at a time
- Stream Cipher
- Encrypt one bit/byte at a time
Hashing¶
- Hash is secure when it cannot be converted back to original text
- String or number generated from text
- Fixed in length
- Very greatly with just a small change
Hash Use Case
- Store hashes of passwords
- Compare hash of entered password to a stored hash of the password
- Ensure file downloads have not been modified
- Compare hash on website to hash of the file that was downloaded
Symmetric Algorithms¶
- The algorithms in use today may not be secure tomorrow
- Next Generation Algorithms
- Secure enough for today’s computing power
- Estimated to be secure for 2 decades
- Commercial NSA Suite will need to be replaced
- Standards expected by 2024
- Algorithm is considered secure if the algorithm is known publicly, but the data is still confidential.
DES & 3DES¶
DES
- 64 bit block
- 56 bit key
3DES
- Data encrypted with key1
- Decrypted with key2
- Encrypted again with key3
AES¶
- Blocks are 128 bit
- Various key sizes
- 128 bit, 192 bit, 256 bit
- AES 256 required for Top Secret information
- GCM & CBC
- GCM is more secure, and provides hashing
Blowfish & Twofish¶
- Blowfish
- 64 bit block
- Various key sizes
- 32 bits to 448 bits
- Twofish
- 128 bit block
- Key sizes of 128, 192 and 256
RC4¶
- Stream cipher
- Key sizes from 40 bits to 2048 bits
- Insecure
Asymmetric Algorithms¶
Diffie Hellman¶
- Create a shared key over an insecure medium
- Mainly used as a key exchange
- Legacy
- Group 1: 768 modulus bits
- Group 2: 1024 modulus bits
- Group 5: 1536 modulus bits
- Current
- Group 14: 2048 modulus bits
- Group 15: 3072 modulus bits
- Group 16: 4096 Modulus bits
- Next Generation
- Based off of elliptic curve math
- Group 19: 256 bit elliptic curve
- Group 20: 384 bit elliptic curve
- Group 21: 521bit elliptic curve
RSA¶
- Traffic encrypted with KeyA and decrypted with KeyB
- Public key known by everyone
- Private key only known by system
- Allows for easier key management
RSA Key Size
- 768 & 1024
- 3072 - top secret information
- 2048 - Minimum
- 4096
DSA¶
- Asymmetric private and public key pair
- Traditional key values from 512 3072
- Elliptic Curve Keys
- ECDSA 256
- ECDSA 384 - top secret information
Hashing Algorithms¶
- MD5
- 128-bit hash
- 32 hex characters
- Multiple vulnerabilities - insecure
- SHA1
- 160-bit hash value
- 40 hexadecimal characters
- Also proven to not be secure
Key Sizes¶
- SHA-256
- SHA-384
- SHA-512
- All SHA versions have an HMAC (hash-based message authentication code
- md5, etc.) variant
VPN Types¶
Site-to-Site VPN¶
- Allow branches to connect with each other or HQ
- Allow different companies to connect to each other
Remote Access VPN¶
- VPNs are encrypted
- IPSEC
- TLS
Pre Shared Keys, Digital Certificates, and PKI¶
Pre-Shared Keys for Authentication¶
- Both sides of VPN need to authenticate each other
- If both sides are using the correct pre- shared key, they are who they say they are
- Can be difficult to share the pre-shared key
- Not scalable
Public Key Infrastructure¶
- Certificate Authority (CA)
- Device that issues and revokes certificates
- PKI Hierarchy
- Chain of CA’s that sign certificates
- Validation Authority (VA)
- Ensure that the certificates are still valid
- Digital Certificates
- Provides the identity & public key of the devices
IPsec Encryption¶
- Composed of multiple protocols
- IKEv1 or IKEv:
- ESP
- AH
IKE¶
- IKE version 1
- IKE version 2
- Phase 1 and Phase 2
IKE Phase 1 - ISAKMP
- Used to identify both sides of tunnel
- Authentication, Encryption, Integrity
- UDP 500
- Hash - SHA or MD5
- Authentication - Certs or PSK
- Group - Diffie Hellman
- Lifetime - Sec, Min, Hrs, Days
- Encryption - 3DES or AES
Phase 1 Main Mode Messages
- Client sends HAGLE config
- Server replies with choice
- Client sends DH secret key
- Server sends DH secret key
- PSK/cert sent by client
- PSK/cert sent by server
IKE Phase 2 - ESP or AH
- HAGLE gets matched again for phase 2 (IPSec)
- Known as quick mode (3 messages sent)
- ESP (IP 50) (italics are protected)
- Plain Text
- IP | TCP/UDP | PAYLOAD
- ESP Transport
- IP | ESP HDR | TCP/UDP | PAYLOAD | ESP TRAIL | ESP AUTH
- ESP Tunnel
- New IP | ESP HDR | IP | TCP/UDP | PAYLOAD | ESP TRAIL | ESP AUTH
- ESP Tunnel w/NAT-T
- New IP | UDP 4500 | ESP HDR | IP | TCP/UDP | PAYLOAD | ESP TRAIL | ESP AUTH
- Plain Text
- AH (IP 51) (not recommended)
- Plain Text
- IP | TCP/UDP | PAYLOAD
- AH Transport
- IP | AH HDR | TCP/UDP | PAYLOAD
- AH Tunnel
- NEW | IP | AH HDR | IP | TCP/UDP | PAYLOAD
- Plain Text
IKEv2¶
- Additional capabilities
- NAT
- Dead-peer detection
- Different authentication methods
- 4 messages to setup
- IKE_SA and Child_SA
SSL/TLS¶
- Secure Socket Layer
- Created by Netscape
- SSL 1.0, SSL 2.0, SSL 3.0
- Officially depreciated in 2015
- Transport Layer Security
- RFC Standard
- TLS 1.0 is the same as SSL 3.0
- TLS1.0, TLS1.1, TLS1.2
Tunnel Forming
- Client sends ciphers/hashing it supports & TLS version & session ID
- Server/FW sends choice of cipher, etc.
- Server sends digital cert
- Client uses digital cert to see that server is who they say they are
- Client uses server’s public key in digital cert to encrypt master key
- Master key is used to encrypt all traffic going forward
- Client sends message to server to say this
- Server decrypts using private key and uses master key
- Tunnel established