Security Razor @securityrazor-blog - Tumblr Blog

Hybrid Encryption and Digital Envelopes

Why do we care about Hybrid Encryption?

Hybrid encryption is the use of Symmetric and Asymmetric cryptography. It is more commonly referred to as Digital Envelope when used together. This is for the most part the method in which most encrypted communications takes place in today's modern world. Based on my understand, Symmetric cryptography is great at encrypted a large amount of data really fast. However, its an epic fail in key management and key distribution. Asymmetric cryptography is great at key mangement and distribution, but its a lot slower in encrypting date when compared to Symmetric Cryptography. Hybrid encryption uses the best of both worlds.

How does Hybrid Encryption work.

I think it's best that I just give an example. Lets say you want to write a letter to your girlfriend apologizing for your premature ejaculation last night. You really don't want anyone else to find out about it so you encrypt the message. The message is really, really, really long because you do a lot of crying so its best you use symmetric encryption. She doesn't have the key so you need to get it to her in a secure fashion. The best thing you can do is encrypt the symmetric key with your girlfriends public key (asymmetric).

Message Integrity + Digest + Message Authenication Code

One-Way Hash is... one way. "The hash function takes a variable length string and produces a fixed length value called a hash value."

This is a note for OSX users. There is already a toolkit in place to calculate message/file hashes. /usr/bin/openssl is a cryptography toolkit, command line tool for use in various cryptography functions. You can create keys, certs, calculate message digest, encrypt decrypt with various ciphers and more.

$echo -n "message string" | openssl sha1 <-- if you want to digest a string

Message digest are vulnerable to attacks like man-in-the-middle. If I send a message with a hash value, the message could be captured, altered, a new hash generated and forwarded to its original intended destination.

For more protection you need to use message authentication code (MAC).

HMAC is basically the same thing as generating a message digest, except you concatenate a symmetric key to your message before generating the digest. The resulting digest is then called message authentication code (MAC). You can then take the message+MAC and send it without the key. Once it is received, the receiving party takes the message + key and generates a MAC, and compares the two.

The CBC-MAC method used a symmetric block cipher in CBC mode to encrypt the message, and the final encrypted block is used as the MAC. The rest of the encrypted message is trashed. The sender sends the plain-text message and the MAC. The receiver also encrypts the plain-text message and compares the resulting MAC with the one that arrived with the message. The CBC-MAC not only provides data integrity, but also data origin authentication or system authentication. Remember a private key is bound to an individual, a symmetric key is not, so it can be used with systems.

There are security concerns with CBC-MAC, so the industry created CMAC or Cipher-Based Message Authentication Code. CMAC provides the same type of data origin authentication and integrity as CBC-MAC, but is more secure mathematically.

#Message Digest #MAC #HMAC

Block Cipher Modes: Output Feedback Mode

Output Feedback Mode is similar to Cipher Feedback Mode, but instead of using the previous blocks encrypted text to encrypt the next block, OFB uses a keystream. This reduces the chance that a corrupted block of encrypted text can ruin data. This mode is best used with applications that might be sensitive to errors such as digital video, or voice signals

#CISSP #Block Cipher #Output Feedback Mode #DES

Block Cipher Modes: Cipher Feedback Mode

This mode as I understand it.

For the first block of data you generate a keystream with the IV, Key, and whatever type of algorithm you are using, lets say AES.

The first part of the keystream is XOR'ed with your plain text message block to create your cipher text.

The resulting cipher text, combined with part of the IV is used with a key to generate the next "keystream", and so on...

I am certain this is an extremely simplified explanation, but there it is. I may amend this post later, but I just wanted to get it out here. I found a decent explanation here: http://www.youtube.com/watch?v=ASR8TDIf_6c

#CISSP #block cipher #CFB

Block Cipher Modes: Cipher Block Chaining

Wow! Long time between post!

The next mode we are going to learn about is called Cipher Block Chaining. Cipher Block Chaining mode introduces a lot of randomness into the process, which is always good for cryptography.

The process begins by XORing a 64-bit initialization vector to the plain text block. The result of XORing is passed through the encryption algorithm to product the desired cipher text. The cipher text from that process is XOR'ed with the next plain text block and the result of that is passed through the encryption algorithm to produce the designed cipher text, and so on. As long as the IV is different each time, the resulting cipher will be different.

#cryptography #Symmetric Crytography #block cipher

Block Cipher Modes: Electronic Code Book

After a week of RSA Conference and Security BSides San Francisco, I am finding it difficult to get back into the swing of things, but here we go. I must push on! Block ciphers can operate in several different modes. Each mode has its pros and cons and should be used for the appropriate application. The first mode we are going to learn about is the Electronic Code Book mode. Electronic Code Book mode operates like a single code book in that it uses the same process (depending on one key) to encrypt each separate data block. Any 64-bit plain text message using the same key will always produce the same encrypted cipher text. This doesn’t introduce much randomness into the process and thus introduces weakness. If the plain text message is not equal to 64-bits then ECB will pad the data to produce the 64-bits blocks required for encryption. Electronic Code Book is great when used for small amounts of data or in certain situations for database encryption because data can be encrypted and decrypted independently.

Important Characteristics: (This is straight from the book)

Operations can run in parallel, increases speed, decreases process time.

If an error takes place during the encryption process, it only affects one block of data, thus providing containment.

Again, best when used for encryption of short messages.

Cannot carry out preprocessing functions before receiving plain text.

#CISSP #Crytography Domain #ECB #Electronic Code Book

What is DES (Data Encryption Standard)

First, a little background about DES.

The National Institute of Standards and Technology wanted an encryption algorithm to be used as en encryption standard for sensitive but unclassified data. NIST invited the private sector/vendors to submit their data encryption algorithms for consideration. Lucifer was submitted by IBM in 1974 and after some neutering by the NSA (128-bit to 64-bit ) the Data Encryption Algorithm was born thus fulfilling the Data Encryption standard.

One of the most ironic parts of this story involves Horst Feistel the creator of the Lucifer algorithm. His cryptography research was shutdown twice by the NSA before he finally ended up at IBM and was allowed to complete his work. The result of such work would eventually become the NIST standard for encryption of sensitive data from 1974-1988.

Quick Facts

Symmetric Algorithm

Pre-government implementation was 128-bit algorithm named Lucifer

Post-governemt implementation was 64-bit algorithm named Data Encryption Algorithm (DEA)

8 bits of the 64 bits are used for parity - “true” 56 bit algorithm

American National Standards Institute (ANSI) in 1978

Replaced by the Rijndael Algorithm as the Advanced Encryption Standard (AES)

A 10,000 foot view of the Data Encryption Standard and how DEA works. Hopefully, my next post will be about the different modes that can be used in DEA.

#CISSP #DES #Cryptography #DEA

Crytographic Transformation Techniques

I wanted to mention some additional Cryptographic Transformation Techniques. The book I am studying list these techniques but doesn’t go into great detail about them. If you would like to discuss them further, please comment below. When I have time to do more research I will edit the post with greater detail about each one.

Diffusion - I posted earlier about Diffusion, but to recap diffusion is using transposition to scramble up the data bits.

Confusion- I also posted earlier about Confusion, but to recap confusion is using substitution to change out bits with different bits.

Key Mixing - Create sub-keys from the master key to limit the amount the full master key is exposed.

Expansion - Duplicating plain-text bits to expand the size of the plain-text to the key size.

Padding - Adding bits to the plain text bits before encryption. Just like expansion except we aren’t duplicating bits.

Compression - Compressing plain-text bits before encryption in attempt to reduce redundancy.

Avalanche - Changing one plain-text but alters many cipher text bits.

Initialization Vectors - Used with algorithms to ensure that randomness occurs and patterns are not created. IV’s are random values used with keys to make sure that when encrypting identical plain-text values the resulting cipher text will be different.

#CISSP #Crytography Domain #Diffusion #Confusion #Key Mixing #Expansion #Compression #Avalance #IV's #Initialization Vectors

Party it up with @RSA #RSAC calendar

@RSAparties tweeted a calendar today full of parties... I mean extra curricular activities during #RSAC. Be sure to check it out below. Currently, there are 54 parties sorted by date with details for each event.

RSA PARTY CALENDAR

#RSA #RSAC #Conference #Party #Beer

Stream Ciphers - Use Trout Bait!

I continue to move down the path of enlightenment. My path is still very dark, but I can vaguely make out a glimmer in the distance. Today my focus is on Stream Ciphers!

How does a stream cipher work?

A stream cipher works by performing mathematical functions on a “stream” of bits, one bit at a time. A keystream generator is used to generate bits that will be XOR’ed with the plain-text bits of the data. The resulting bits are encrypted.

How does a key come into play?

A key is used for the keystream generator to introduce randomness. The key makes the resulting bits that are generated more random. I don’t know in detail how a keystream generator for any given standard works but I am going to assume that if you didn’t have a key to introduce randomness the generate values would be easier to predict?

What makes a strong and effective stream cipher?

The values that are generated from the keystream must have long periods of no repeating patters - repeating patterns in cryptography is bad.

The keystream values must be statistically unbiased - The keystream must generate as many zeros as ones. I don’t know how this is effected by the key. If a key helps introduce randomness wouldn’t a key, a piece of the puzzle that directly influences the generated values have an affect on whether or not he values are statistically unbiased?

The keystream and the key are not linearly related - An attacker should not be able to determine the value of the key by the keystream values.

Unpredictable keystream - The generation of values by the keystream are statistically unpredictable.

#CISSP #Stream Cipher #Cipher

Block Ciphers - Confusion and Diffusion

Today my reading has brought me further into block ciphers, their function, and how the pieces within them function. I wanted to go over several concepts in order to try and retain the information. I would love to have discussions on the topic from anyone but especially if you are preparing to take the CISSP.

Block Ciphers as we know are blocks of data divided into blocks of bits for encryption/decryption, but what makes a strong cipher?

Confusion

Confusion is commonly carried out through substitution. Substitution is taking something out and replacing it with something different. When a plain text message is broken down into bits, substitution takes place by switching out some of those plain text bits with different plain text bits. This math is understandably quite complex if you think about what needs to take place in order to reverse the substitution process for decryption. Confusion through substitution makes the relationship between the key and the cipher text very complex in order to protect the key.

Diffusion

Diffusion is carried out through transposition. Transposition is basically scrambling up the bits of data that are already there. Suppose you have 26 blocks each with a letter of the alphabet and those blocks are lined up in the correct order. A midget ninja sneaks in during the night and kicks the blocks around; he then continues his path of destruction by kicking you in the nuts proceeded by a flip of the bird. That is transposition. You need at least a ninja, but the small person is optional. Diffusion offers protection by transposition because if a single plain text bit is changed, many cipher text bits are affected. This process is called an “avalanche effect”.

#CISSP #Block Cipher #Confusion #Diffusion

What is Symmetric Cryptography

Today we will be looking at some bullet points of Symmetric Cryptography. I have already surpassed this section in my reading material but wanted to include this information in a post. Don’t you feel special? As always, please feel free to comment. I would love to discuss and learn with others that are preparing for this exam.

Symmetric Cryptography

This type of cryptography uses algorithms that encrypt data with one key and decrypt data with the same key. The keys are the same.

Synonyms

Secret Keys

Shared Secret

Strengths

Much faster than Asymmetric Cryptography - The speed at which you can encrypt and decrypt data using a Symmetric algorithm is much faster than that of Asymmetric algorithms. The Symmetric mathematical functions are much less intense. However, that doesn’t mean they are less secure.

If a large key size is used then the cryptography is hard to break (impossible? nearly impossible?)

Weaknesses

Key delivery - The resulting cipher text that is encrypted using a symmetric algorithm key can be decrypted using the same symmetric key. You need a key for each individual you are communicating with. This makes key management and key delivery overwhelming. Here is a formula to calculate how many keys you will need N(N-1)/2 = Keys. So, if you have 5 people all communicating with each other then you will need 5(4)/2 = 10 keys.

Does not provide authenticity or non-repudiation because multiple people have the same key.

Examples of Symmetric Algorithms

Data Encryption Standard (DES) (Note: This “standard” uses the DEA - Data Encryption Algorithm)

Triple-DES (3DES)

Blowfish

International Data Encryption Algorithm (IDEA)

RC4, RC5, and RC6

Advanced Encryption Standard (AES)

#CISSP #Symmetric Crytography #Secret Key #Share Secret

What is Asymmetric Cryptography?

Today we will take a moment to look at some of the Asymmetric Cryptography bullet points. We will delve into this Asymmetric Cryptography in the future, but for now here are some bullet points. Currently, I am studying in preparation for the CISSP exam so much of what I post will be CISSP related. Please feel free to comment, and if you are also studying for this exam I would love to have conversations with you about each topic.

Asymmetric Cryptography

This type of cryptography uses algorithms that encrypt data with one key and decrypt data with a separate key. The keys are different.

Synonyms

Public Key Cryptography

Strengths

Key distribution - The use of public/private keys make key distribution much easier than Symmetric Cryptography.

Better Scalability - Again the use of public/private keys make exchanging keys with multiple users easier.

Authentication - If the sender encrypts data with their private key and the receiver decrypts with the senders public key, you have authenticity because the senders private key is…. private.

Non-repudiation - If the sender encrypts data with the senders private key then the sender cannot deny sending the data because the senders public key can decrypt it.

Weaknesses

Slooooow compared to Symmetric algorithms.

Mathematically Intense Task - I am assuming this is because the algorithm is using two different keys in conjunction. The math required to perform such a task is intense. Please correct me if I'm wrong.

Examples of Asymmetric Algorithms

Rivest-Shamir-Adleman (RSA)

Elliptic Curve Cryptosystem (ECC)

Diffie-Hellman

El Gamal

Digital Signature Algorithm (DSA)

Merkle-Hellman Knapscak

#CISSP #Asymmetric Cryptography #Public Key Cryptography #Security

Trending Blogs

Recently Viewed Blogs

Security Razor