022 Encryption - 022.1 Cryptography and Public Key Infrastructure (weight: 3)

Cryptography and Encryption

• Encryption methods, also known as cryptographic procedures or cryptology, are vital for achieving IT security objectives.
• Standardized procedures enable different manufacturers' products to communicate over the Internet.
• Cryptographic algorithms are mathematically complex; utilizing existing implementations is recommended over custom implementations.
• OpenSSL project offers various tools for using cryptographic functions as open-source software.

Types of Cryptographic Processes

• Cryptographic methods can be categorized into:
  • Encryption algorithms (Ciphers)
  • Key exchange algorithms
  • Hash functions

Encryption (Ciphers)

• Ciphers transform plaintext into unreadable text using a key, revertible only with the correct key.
• Two categories of encryption:
  • Symmetric encryption: Same key for both encryption and decryption, known to both sender and receiver (e.g., AES).
  • Asymmetric encryption: Uses two different keys; sender encrypts with the receiver's public key, which can only be decrypted using the receiver's private key (e.g., RSA).

Hybrid Encryption

• Combines symmetric and asymmetric algorithms.
• Asymmetric methods establish secure connections using public keys, thereafter agreeing on a shared key for symmetric encryption.

Security Considerations

• Encryption can differentiate outputs even with the same initial data if different keys are used.
• Exposure of a private asymmetric or shared symmetric key allows third parties to compromise encryption.
• Due to the Internet's vastness, pre-arranging a shared key is often impractical. Asymmetric encryption simplifies this, allowing public keys to be broadly available.

Perfect Forward Secrecy

• Measures aimed at preventing the retrospective decryption of past communications even if a key is compromised.
• Enables secure key agreement methods without key transmission over the network.

Key Exchange Algorithms

• Allow parties to establish a common key securely without transmitting it over the network.
• An example algorithm: Diffie-Hellman Key Exchange (DH).

Hash Functions

• Generate a checksum that changes with any data alteration, providing integrity verification but no reverse access to input data.
• Cryptographic hash attacks (collisions) occur when modifications create identical checksums.
• Notable hash algorithms: MD5 (seen as insecure) and SHA-256.

Signature Algorithms

• Used to verify data integrity and authenticity through digital signatures created by hashing and encrypting with a private key.
• Recipients can validate signatures using the sender's public key to ensure data hasn't been tampered with.

Elliptic Curve Cryptography (ECC)

• A form of asymmetric cryptography that uses elliptic curves to improve efficiency without compromising security.
• Frequently employed for Diffie-Hellman key exchange to ensure Perfect Forward Secrecy.

Encryption Levels

• Transport encryption: Encrypts data for segments of transmission, but not necessarily at rest on mail servers.
• End-to-end encryption: Ensures that data can only be decrypted by the intended recipient.

Certificates and Public Key Infrastructure (PKI)

• Asymmetric cryptography permits public key sharing for encrypted communication, necessitating identity verification of key holders.
• Certificates confirm the identity of key holders and include identity details, public keys, and signatures from trusted certification authorities (CAs).

X.509 Standard

• Internet standard for certificates, containing fields like issuer, subject, public key, and validity.

Certificate Lifecycle

• Certificates are created after generating a key pair and submitting a Certificate Signing Request (CSR) to a CA for validation.
• A successful submission results in the CA signing the certificate, binding the public key to the verified identity.

CA Structure

• PKI facilitates the organization and trustworthiness of CAs, including self-signed root CAs.
• Trust in a CA means trusting the certificates it issues, assuming identity claims are verified.

Certificate Revocation

• Certificates need revocation when trust is lost due to key exposure or ownership changes.
• Revocation lists are published by CAs, but checking these can be inadequate. Hence, certificates often have short lifespans.

Let's Encrypt

• A certification authority that issues free SSL certificates through automated processes using the ACME protocol.
• New certificates are obtained quickly, are valid for 90 days, and are widely trusted by mainstream browsers.

Explore the essential methods of cryptography and encryption that are crucial for IT security. This quiz covers encryption algorithms, key exchange processes, and the differences between symmetric and asymmetric encryption. Test your knowledge on the various cryptographic processes used in securing digital communications.