3. Security

Encryption Approaches

• There are two main approaches to encryption
• Encryption at rest protects against physical theft and tampering
• Encryption in transit protects data as it is transferred between two places
• Encryption at rest is used when only one party is involved
• Encryption in transit involves applying wrapping encryption, which looks like scrambled data to outside observers

Encryption Concepts

• Plaintext is unencrypted data, including text, images, and applications
• An algorithm is code that takes plaintext and an encryption key to generate encrypted data
• Key is a password that can be as simple as text, or more complex
• Ciphertext is encrypted data
• Encryption involves taking plaintext, an algorithm, and a key to create ciphertext
• Decryption is the reverse of encryption, it takes ciphertext and a key to generate plaintext

Symmetric Encryption

• Both parties involved agree on an algorithm, for example AES-256
• The sender generates a symmetric encryption key and keeps it safe
• The symmetric encryption algorithm accepts the key with plaintext, then outputs ciphertext
• Ciphertext is secure as it cannot be deciphered without the key
• Ciphertext can be sent over any transmission method, even in the open
• With symmetric encryption, the same key is needed to encrypt and decrypt
• A secure way of transmitting the key is needed, this is the most complex part of symmetric encryption
• After the key is transferred securely, the algorithm will decrypt ciphertext to return plaintext

Asymmetric Encryption

• Two parties agree on an asymmetric algorithm
• Keys used in asymmetric encryption are themselves asymmetric, making it easier to exchange them
• Asymmetric encryption keys are formed of public and private keys; both sides must make both keys
• A public key generates ciphertext that can only be decrypted with the corresponding private key; it cannot decrypt the data it was used to originally encrypt
• A method is required to safely guard the private key, because is what is used to decrypt data
• A public key is only used to encrypt and can be accessed by anyone
• The worst that can happen to someone with the public key is that they can use it to encrypt plaintext into ciphertext that only the robot general can decrypt
• There's no requirement to exchange keys in advance in asymmetric encryption
• Robot General gets his his private key and decrypts the cipherext back into plaintext, giving the Robot General the plaintext battle plans
• No key exchange is required with asymmetric encryption
• It is generally used where two or more parties are involved and never physically met before
• Examples are PGP, SSL/TLS, SSH, and key-based authentication
• Asymmetric encryption is computationally more difficult to perform than symmetric encryption
• Many processors use asymmetric encryption initially to communicate a symmetric key, which is then used for communication onward

Signing

• Used to verify identity, as confirmed plans require both sides to operate as one
• An “OK” message might be sent
• The Robot General can write an OK message and use the private key to sign the message
• When the Cat Ruler gets the message, the Robot General's public key can be used to prove the message was signed with the Robot General's private key
• Signing helps verify identity

Steganography

• Hides something within something else
• A ciphertext is hidden in a puppy image file
• The Robot General has the location to extract the ciphertext from that image
• This helps plausible deniability
• More security is added by encrypting the data with the Robot General's public key and taking that ciphertext
• Embedding this to the image, the image isn't tied to the Cat Ruler
• Only Robot General can extract data and decrypt it using his private key, then sign it

Envelope Encryption

• Process where you encrypt something with a key and then you encrypt that key again with another key
• Helps to follow best practices, and if one key is leaked, it only affects that one single image
• Key Encryption Keys (KEKs) are used to encrypt data less than four KB in size including other encryption keys
• Data Encryption Keys (DEKs) are created by KMS but not managed by KMS
• KMS is used to generate a DEK using a KMS key
• Two copies of the DEK are returned; plaintext and encrypted
• KMS key known as a KEK is used to encrypt this encrypted version
• The service, S3 for example, requests the data encryption key and use the plaintext version to encrypt data and then discards the plaintext DEK right after
• This wrapped, previously mentioned, DEK is also always with encrypted data
• There is always have a DEK available because it's stored with the object
• Data encryption keys are almost always symmetric keys as that is much faster
• Key encryption keys, in a generic sense, can be asymmetric or symmetric
• AWS use KMS and key encryption keys are, like KMS keys, symmetric

Considerations

• Asymmetric keys are flexible (public party is public), but they're slow
• Symmetric keys are fast, but difficult to securely move
• Envelope encryption is is the best of both (if you use asymmetric KEKs)
• Symmetric keys are used for encrypt/decrypt as they are fast
• All secured with Asymmetric keys ( normally) for flexibility
• In either case, less data to and from the key storage service (KMS)
• Unique DEKs are can be used per object

Hardware Security Modules (HSMs)

• Important type of device to understand to secure the general security space
• HSMs can be costly and so many don't opt for them
• Keys are stored in multiple places, making it easier for outside entities to find and exploit them if your premises and controls ever leave your space
• An HSM is a separate device or cluster of devices that’s isolated from your main infrastructure
• Inside the device where your keys are stored, never leave the device, and often created and deleted by the devices
• Cryptographic operations sent to the HSM together with data to perform operations, then result back
• This means you generate, manage, store, and secure keys without the risk of leaking any critical or sensitive information
• Authentication occurs inside the device meaning you have an isolated security radius
• Are tamper-proof by use of secure enclaves and is hardened against physical and logical attacks
• Access to cryptographic operations within the HSM is tightly controlled.
• Role separation. Admins can update and administer software and key generation
• Many HSMs are audited to stringent standards including those that are required for the U.S. government
• You can use them to offload SSL/TLS processing and is more efficient
• Key access is via industry standard API’s
• Use for signing certificates for a private PKI infrastructure

Hashing

• Algorithms used to turn a piece of data into a fixed length representation of that data
• For example, taking a picture and representing it as a string of data
• It is used at the core of critical services, including passwords, digital signatures, or SSL certificates
• Relied on to store definitions of malicious files by antivirus services without having to save an entire malicious file
• Think of a hashing function as a part of some code
• MD5 and SHA2-256 are common examples
• Can take large, variable-size data and output a fixed-size hash
• Data and put it through a hashing function will get a unique hash value
• Changing the data by any margin however small will result in a different hash value
• With the same data, you’ll always get the same hash value using the same hashing algorithm
• Once hashed, there's no way to derive the original image from the data back

Weakness - Collision

• Hash of dataA = has of dataB, which is bad
• One reason MD5 isn't as trusted, because it is possible for different data to generate the same hash value

Hashing passwords example

• Instead of sending a password, send a hash of the password when signing up or signing in
• It would store the hash, and the server would only have the hash of the password
• When logging in or creating an account, the client would check the value that gets delivered, which is i.e. the hash of the password
• It means it can check that it is the right password without ever storing a copy of the password
• MD5 hashing algorithm isn't super secure anymore (collisions, i.e.. more than one piece can generate same value), recommend to not use it and use something more secure
• Even better with multiple servers, only hashes are stored on the application server, and another server can check if those hashes are valid

Digital Signatures

• Key cryptography, signing, and hashing is the basis of many areas in the IT sector
• Needed to understand many areas of IT DNSSEC and SSL certificates
• Important to understand previous topics that involve hashes as well
• In public ley cryptography, you use secret and you public keys
• Secret/private key only every has to be known by the owner
• Public key is non secret and known by all
• You can take a public key, which as mentioned be possessed and accessed by all, and use it to encrypt data, that can only every be decrypted by the private key
• Allows you to securely send your data to a private key owner
• The architecture also allows to take something and sign it using the private key which enables those with the public key to verify and view the data
• Sign is a way to evidence you’re in control of the private key used to sign the data Verifies Integrity of what and Authenticity of who