Welcome back, my aspiring cyberwarriors!
As cyberwarriors, we are often faced with the hurdle or promise of cryptography and encryption. Every cyber security engineer worth their pocket protector understands that encryption make the hacker/attacker's task much more difficult. In addition, in some cases it may be useful to the attacker to hide their actions and messages through encryption.
Many applications and protocols use encryption to maintain confidentiality and integrity of data. To be able to crack passwords and encrypted protocols such as SSL and wireless, you need to have at least a basic familiarity with the concepts and terminology of cryptography and encryption.
What is Cryptography?
To many new hackers, all the concepts and terminology of cryptography can be a bit overwhelming and opaque. To begin, cryptography is the science and art of hiding messages so that they are confidential, then "unhiding" them so that only the intended recipient can read them. Basically, we can say that cryptography is the science of secret messaging.
With this brief overview for the newcomer, I hope to lift the fog that shrouds this subject and shed a tiny bit of light on cryptography. It is my intent here to create a quick and cursory overview of cryptography for the novice cyberwarrior, not a treatise on the algorithms and mathematics of encryption. I'll try to familiarize you with the basic terminology and concepts so that when you read about hashing, wireless cracking, or password cracking and the encryption technologies are mentioned, you have some grasp of what is being addressed.
Don't get me wrong, I don't intend to make you a cryptographer here (that would take years), but simply to help familiarize the beginner with the terms and concepts of cryptography so as to help you become a credible cyberwarrior, and maybe pass as few certification exams such as CWA, Security+ and CISSP (all require a basic knowledge of cryptography).
I will attempt to use as much plain English as possible to describe these technologies, but like everything in IT, there is a very specialized language for cryptography and encryption. Terms like cipher, plaintext, ciphertext, keyspace, block size, and collisions can make studying cryptography a bit confusing and overwhelming to the beginner. I will use the term "collision," as there really is no other word in plain English that can replace it.
Let's get started by breaking encryption into several categories.
Types of Cryptography
There are several ways to categorize encryption, but for our purposes here, I have broken them down into four main areas (I'm sure cryptographers will disagree with this classification system, but so be it).
Symmetric Encryption
Asymmetric Encryption
Hashes
Wireless
A Word About Key Size
In the world of cryptography, size does matter! In general, the larger the key, the more secure the encryption. This means that AES with a 256-bit key is stronger than AES with an 128-bit key and likely will be more difficult and time-consuming to crack. Within the same encryption algorithm, the larger the key, the stronger the encryption.
It does not necessarily mean that larger keys mean stronger encryption when making comparisons between encryption algorithms. When comparing algorithms (DES v. AES), the strength of the encryption is dependent on both the particulars of the algorithm AND the key size.
Symmetric Cryptography
Symmetric cryptography is the most common type of cryptography. Symmetric crytptography is where we have the same key at the sender and receiver. You have a password or "key" that encrypts a message and I have the same password to decrypt the message. Anyone else can't read our message or data without he key.
Symmetric cryptography is very fast, so it is well-suited for bulk storage or streaming applications. The drawback to symmetric cryptography is what is called the key exchange. If both ends need the same key, they need to use a third channel to exchange the key and therein lies the weakness. If there are two people who want to encrypt their communication and they are 12,000 miles apart, how do they exchange the key? This key exchange then is fraught with the all the problems of the confidentiality of the medium they choose, whether it be telephone, mail, email, face-to-face, etc. The key exchange can be intercepted and render the confidentiality of the encryption moot.
Some of the common symmetric algorithms that you should be familiar with are:
DES - This was one of the original and oldest encryption schemes developed by IBM. It was found to be flawed and breakable and was used in the original hashing system of LANMAN hashes in early (pre-2000) Windows systems.
3DES - This encryption algorithm was developed in response to the flaws in DES. 3DES applies the DES algorithm three times (hence the name "triple DES") making it slightly more secure than DES.
AES - Advanced Encryption Standard is not a encryption algorithm but rather a standard developed by National Institute for Standards and Technology (NIST). Presently, it is considered the strongest encryption, uses a 128-, 196-, or 256-bit key and is occupied by the Rijndael algorithm since 2001. It's used in WPA2, SSL/TLS, and many other protocols where confidentiality and speed is important.
RC4 - This is a streaming (it encrypts each bit or byte rather than a block of information) cipher and developed by Ronald Rivest of RSA fame. Used in VoIP and WEP.
Blowfish - The first of Bruce Schneier's encryption algorithms. It uses a variable key length and is very secure. It is not patented, so anyone can use it without license.
Twofish - A stronger version of Blowfish using a 128- or 256-bit key and was strong contender for AES. Used in Cryptcat and OpenPGP, among other places. It also is in the public domain without a patent.
Asymmetric Cryptography
Asymmetric cryptography uses different keys on both ends of the communication channel. Asymmetric cryptography is very slow, about 1,000 times slower than symmetric cryptography, so we don't want to use it for bulk encryption or streaming communication. It does, however, solve the key exchange problem. Since we don't need to have the same key on both ends of a communication, we don't have the issue of key exchange.
Asymmetric cryptography is used primarily when we have two entities unknown to each other that want to exchange a small bit of information, such as a key or other identifying information, such as a digital certificate. It is not used for bulk or streaming encryption due to its speed limitations.
Some of common asymmetric encryption schemes you should be familiar with are:
Diffie-Hellman - Many people in the field of cryptography regard the Diffie-Hellman key exchange to be the greatest development in cryptography (I would have to agree). Without going deep into the mathematics, Diffie and Hellman developed a way to generate keys without having to exchange the keys, thereby solving the key exchange problem that plagues symmetric key encryption.
RSA - Rivest, Shamir, and Adleman (RSA) is a scheme of asymmetric encryption that uses factorization of very large prime numbers as the relationship between the two keys.
PKI - Public key infrastructure is the widely used asymmetric system for exchanging confidential information using a private key and a public key.
ECC - Elliptical curve cryptography is becoming increasing popular in mobile computing as it efficient, requiring less computing power and energy consumption for the same level of security. ECC relies upon the shared relationship of two functions being on the same elliptical curve.
PGP - Pretty Good Privacy uses asymmetric encryption to assure the privacy and integrity of email messages.
Hashes
Hashes are one-way encryption. A message or password is encrypted in a way that it cannot be reversed or unencrypted. You might wonder, "What good would it do us to have a something encrypted and then not be able to decrypt it"? Good question!
When the message is encrypted it creates a "hash" that becomes a unique but indecipherable signature for the underlying message. Each and every message is encrypted in a way that it creates a unique hash. Usually, these hashes are a fixed length (an MD5 hash is always 32 characters). In that way, the attacker can not decipher any information about the underlying message from the length of the hash. Due to this, we don't need to know the original message, we simply need to see whether some text creates the same hash to check its integrity (unchanged).
This is why hashes can be used to store passwords. The passwords are stored as hashes and then when someone tries to log in, the system hashes the password and checks to see whether the hash generated matches the hash that has been stored. In addition, hashes are useful for integrity checking, for instance, with file downloads, system files and digital certificates.
In the world of encryption and hashing, a "collision" is where two different input texts produce the same hash. In other words, the hash is NOT unique. This can be an issue when we assume that all the hashes are unique such as in certificate exchanges in SSL. The US National Security Agency (NSA) used this property of collisions in the famous Stuxnet malware to provide it with what appeared to be a legitimate Microsoft digital certificate. Hash algorithms that produce collisions, as you might guess, are flawed and insecure.
These are the hashes you should be familiar with.
MD4 - This was an early hash developed by Ron Rivest and has largely been discontinued due to collisions.
MD5 - The most widely used hashing system. It's 128-bit and produces a 32-character message digest.
SHA1- Developed by the NSA, it is more secure than MD5, but not as widely used. It has 160-bit digest which is usually rendered in 40-character hexadecimal. Often used for certificate exchanges in SSL, but because of recently discovered flaws, is being deprecated for that purpose.
Wireless Cryptography
Wireless cryptography has been a favorite of my readers as so many here are trying to crack wireless access points. Wireless cryptography is symmetric (for speed) and-- as with all symmetric cryptography--key exchange is critical weakness.
WEP - This was the original encryption scheme for wireless and was quickly discovered to be flawed. It used RC4, but because of the small key size (24-bit), it repeated the IV about every 5,000 packets enabling easy cracking on a busy network using statistical attacks.
WPA - This was a quick fix for the flaws of WEP, adding a larger key and TKIP to make it slightly more difficult to crack.
WPA2-PSK - This was the first of the more secure wireless encryption schemes. It uses a pre-shared key (PSK) and AES. It then salts the hashes with the AP name or SSID. The hash is exchanged at authentication in a four-way handshake between the client and AP.
WPA2-Enterprise - This wireless encryption is the most secure. It uses a 128-bit key, AES, and a remote authentication server (RADIUS).
Summary
Cryptography is among the most important tools in the cyberwarrior's toolbox. For the defender, it helps to keep confidential information confidential and check the integrity of data (passwords, downloads, etc). For the attacker, encryption can be a key hurdle to overcome (cracking passwords). As a result, every cyberwarrior should be familiar with the basics of cryptography.