7. Cryptography - Encryption

Seventh section in Complete Beginner learning path.

Introduction

Some common terms to know before continuing are:

• Ciphertext : result of encrypting plaintext.

• Cipher : method of encrypting or decrypting data, modern ciphers are cryptographic but not all are.

• Plaintext : data before encryption, commonly text but can be a file or image.

• Encryption : transforming plaintext to ciphertext using a cipher.

• Encoding : not encryption but form of data representation like base64, immediately reversible.

• Key : info needed to correct decrypt ciphertext to plaintext.

• Passphrase : like a password, used to protect a key.

• Asymmetric encryption : different keys to encrypt and decrypt.

• Symmetric encryption : same key to encrypt an decrypt.

• Brute force : attacking cryptography by trying every password or key.

• Cryptanalysis : attacking cryptography by finding flaws in the maths.

• Alice and Bob : used to represent two people who want to communicate, used because it gives initials A and B.

Why is Encryption Important?

Cryptography is used to ensure integrity, authenticity and protect confidentiality. When you connect to SSH, your client and server establish an encrypted tunnel so no one can snoop on your session. When you connect to a bank, a certificate using cryptography proves it is actually your bank.

Whenever sensitive data needs to be stored, it should be encrypted. Passwords, however, should never be encrypted unless in some sort of password manager, these should always be stored in their hashed format.

Crucial Maths

The modulo operator is used in pretty much every programming language, or it at least has it available via a library. For example, 25 % 5 is 0, as there is no remainder when dividing 25 by 5. 23 % 6 is 5, because 23 does not divide evenly by 6, there would be a remainder of 5. Modulo is not reversible, if you are given the equation X % 5 = 4 then there are infinite possibilities for X that would be valid.

Types of Encryption

Two two main types of encryption are asymmetric and symmetric.

Symmetric encryption uses the same key to encrypt and decrypt. Examples of Symmetric encryption are DES (broken) and AES. These algorithms are faster than asymmetric encryption and use smaller keys.

Asymmetric encryption uses a pair of keys, one to encrypt and one to decrypt. Examples of this are RSA and Elliptic Curve Cryptography. These keys are typically referred to as public and private.

RSA (Rivest Shamir Adleman)

RSA Is based on the mathematically difficult problem of working out factors of a large number. It is quick to multiply two prime numbers like 17*23=391 but it is difficult to work out which two prime numbers multiply to make 14351.

Some tools exist for defeating RSA CTF challenges like RsaCtfTool and rsatool.

The key variables to know about in RSA (for CTFs) are p, q, m, n, e, d, and c.

"p" and "q" are large prime numbers and "n" is the product of them. The public key is "n" and "e" while "m" is used to represent the plaintext message and "c" represents the ciphertext.

Digital Signatures and Certificates

Digital signatures can prove who created or modified a file. Using asymmetric cryptography, a signature is produced with your private key and verified with your public key. Digital signatures and physical signatures have the same legal value in the UK.

Certificates are also used for public key cryptography, commonly they are used in HTTPS. Certificates prove a website is what it says it is. The chain of trust starts with a root CA (certificate authority). Root CAs are automatically trusted from install, certificates below that are trusted because the root CA says they are, certificates below that are trusted because the organisation is trusted by the root and so on.

SSH Authentication

SSH is authenticated with a username and password by default, however, it can be configured with key authentication instead, this will use public and private keys to prove the client is valid & authorised. If someone acquires your private key, they can use this to login to servers that accept it (unless its encrypted). The passphrase that decrypts the key must also never be something which can identify you to the server.

These keys are stored in the ~/.ssh directory by default, the authorized_keys file in here holds public keys which can access the server. To use a private SSH key the permissions must be set to 600 (only owner can read and write) or stricter, ssh -i key_name user@host is the default syntax for authenticating with an SSH key.

Diffie Hellman Key Exchange

Alice and Bob want to talk securely with a common key, they can use symmetric cryptography, but they don't want to key exchange with asymmetric cryptography, this is where Diffie Hellman (DH) comes in.

Alice and Bob (A and B) generate secrets, they also have common public material called C. Assuming that when we combine secrets and material it is impossible to separate, secondly we assume the order of combination does not matter. Alice and Bobs secrets are combined with the public material, creating AC and BC. These are then sent and combined to form two identical keys, ABC, which can now be used to communicate.

PGP, GPG and AES

PGP (Pretty Good Privacy) is software which implements encryption for files, digital signing and more.

GPG is an open source implementation of PGP which may need to be used in CTFs to decrypt files. PGP/GPG can be used to protect private keys with passphrases like SSH. If a password is protected it can be cracked with John the Ripper and gpg2john.

AES (Advanced Encryption Standard) is a replacement for DES which had short keys and cryptographic flaws.