Chapter 17 - Security

17.1 - Show understanding of how encryption works

Encryption

• Cryptography is the practice and study of techniques for communicating securely.
• Encryption - a technique used in Cryptography - is the process of scrambling data into an unreadable format for any individual for whom the data is not intended.
• A key is a piece of information (i.e. string, number, etc.) that is used by an encryption/decryption algorithm to encrypt/decrypt data in an algorithmic manner (aka. secret key)
• This way, only the intended recipient - who has the key - can understand (i.e. decrypt) the encrypted message.

Terminology

• Eavesdropper: A person who intercepts data being transmitted.
• Plain Text: The original text before being put through an encryption algorithm
• Cipher Text: The encrypted text that is formed by putting plaintext through an encryption algorithm.
• Cipher: The encryption/decryption algorithm.

Symmetric Key Cryptography

• Uses the same secret key for both encrypting and decrypting a message.
• To achieve this, the secret key must also be transmitted along with the message.
• Examples: AES (Advanced Encryption Standard), RC4/5/6 (Rivest Cipher 4/5/6), Blowfish, etc.

• Symmetric key encryption results in the key distribution problem: the security issue posed by the risk of the secret key being intercepted by an eavesdropper.
• This can be prevented using a key derivation function (KDF), which prevents the encryption keys from being directly transmitted, but be derived at the sender's or recipient's device:

1. The sender and receiver generate their secret key; independently of each other.
2. They use a modulo function F(X) to generate respective remainder values.
3. The sender and receiver exchange their remainder values RS and RR.
4. They use the same modulo function, but substitute the bases with the exchanged remainders (we will call this function G(X)) to generate a final secret key - which should be the same for both the receiver and sender.

• This final key serves as the symmetric encryption key.
• Notice how neither sender nor receiver transmitted this final key but derived it using remainder pairs - thus solving the key distribution problem.

Asymmetric Key Cryptography

• Uses a public key for encrypting and a private key for decrypting a message (i.e. different keys) - except when used in conjuction with sender verification (see below)
  • A public key is known to all users (often distributed across the internet).
  • A private key is known only by a single user (kept secret).
• The public key and private key are mathematically related, but cannot be derived from one another. Think of a remainder after division; with just the remainder, you can't figure out what numbers were divided to get this remainder. Therefore, modular arithmetic and prime numbers are used in most public-private key generator algorithms to generate virtually unbreakable key pairs.
• Another important thing to understand is that the encryption algorithms used under asymmetric key cryptography (denoted as E in the following diagrams) may use either a private or public key to encrypt. Correspondingly, the decryption function (denoted as D in the following diagrams) must use the counter key to decrypt the message; i.e. public if private, private if public.
• Examples: RSA (Rivest, Shamir and Adleman), D-H (Diffie-Hellman Key Exchange), ECC (Elliptic Curve Cryptography), etc.

1. The receiver (R) generates its own public and private key pair using a key generator algorithm. The receiver will transmit just its public key across the internet to the sender before the transmission begins.
2. When the sender wants to send a message to the receiver, it will use the receiver's public key (KRpublic) to encrypt the plaintext into ciphertext.
3. This ciphertext is then transmitted across the internet to the receiver.
4. The receiver will use its private key (KRprivate) to decrypt the message back into plaintext.

• If the receiver wants to send a message back to the sender, the same process will be repeated but with the sender's public and private key pairs. Hence, the key pair used depends on the recipient.
• However, this process doesn't guarantee the authenticity of the sender, as the receiver's public key could be with anyone. To solve this problem, we encrypt our data twice:

1. The receiver (R) and the sender (S) share their public keys with each other - across the internet - before transmission begins.
2. Unlike earlier, the sender will first encrypt the data using its private key (KSprivate) to produce an initial cipher text C1.
3. This is passed through another round of encryption but now using the receiver's public key (KRpublic) to produce the final cipher text C2.
4. This ciphertext C2 is transmitted across the internet to the receiver (R).
5. To decrypt the received ciphertext, the receiver will use its private key (KRprivate) to obtain the initial cipher text C1.
6. To obtain the original ciphertext, the receiver will use the sender's public key (KSpublic).

• In order for Step 6 to work, the plaintext should've been encrypted using the sender's private key first. This can only happen if the message was truly the sender's, thus helping verify its authenticity.
• However, this process doesn't guarantee the integrity (i.e. whether the data was tampered with / changed during transfer) of the data, which can be solved by using a digital signature (see below)

Quantum Cryptography

• Quantum Cryptography is a form of cryptography that utilizes quantum mechanics to produce a virtually unbreakable encryption system. This field of study involves several key concepts:
  • Qubits (i.e. Quantum Bits): A 2-state unit of information in quantum computing that can represent a 0 or 1 at the same time (i.e. superposition) but probabilistically collapses into one when measured. Qubits are usually electrons or photons.
  • Superposition: The ability of a quantum bit to be in multiple states simultaneously until it is measured - mathematically definded by the Schrödinger equation.
  • Entanglement: The ability for 2 quantum bits to be connected and affect each other even if those particles are light-years apart.
  • Polarizing Filter: A device (i.e. filter) that allows photons oscillating parallel to it to are observed through, while absorbing those photos oscillating perpendicular to it.
  • Beam Splitter: A device that causes incoming photons oscillating in a particular plane to probabilistically split into components of that plane.
• The primary purpose of quantum cryptography is to enable the secure distribution of cryptographic keys between 2 parties, ensuring that any attempt at eavesdropping or tampering with the key exchange process can be detected.
• Quantum Key Distribution (QKD) is a protocol which utilizes quantum mechanics to securely transfer encryption keys over fibre optic networks. As stated, this protocol only focuses on transferring cryptographic keys between a sender and a receiver, and not the encryption of the transferred data itself.
• Given below is Charles Bennett's and Gilles Brassard's implementation of QKD in 1984 - known as the BB84 scheme:

1. The sender generates unpolarized photons using a light source (L). Each photon represents a quantum bit of information.
2. The sender selects a random sequence of polarization filters.
3. Each unpolarized photon is passed through the respective random polarization filter. This causes the photons to be polarized perpendicular to the plane of the polarizing filter.
4. Using a photon-bit map, the polarized photons are encoded into binary 1s and 0s.
5. The encoded photons are transmitted across the internet via a fiber optic cable.
6. The receiver selects a random sequence of beam splitters. There are 2 kinds of beam splitters; rectilinear and diagonal.
7. The receiver passes the incoming polarized photons through the randomly selected sequence of beam splitters. This is referred to as observing the quantum bit:
   • When horizontally / vertically polarized photons are observed through a rectilinear splitter, the emerging photon is exactly that passed in.
   • When horizontally / vertically polarized photons are observed through a diagonal splitter, the emerging photon is maximally uncertain. This means that the emerging photon has a 50% chance of oscillating vertically, and a 50% chance of oscillating horizontally. Hence the emerging photon exists in a superposed state which collapses into 1 of the 2 oscillating planes probabilistically.
   • The same principles apply to diagonally polarized photons passing through a rectilinear / diagonal splitter.
8. As a result of observation, those superposed photons will probabilistically collapse into one plane or the other, while the photons that passed through beam splitters that had the same plane of polarization as that of their polarizing filter are observed through unaltered.
9. This results in a bit sequence - looked up from the same photon-bit map that may have some bits altered (i.e. see the blue color bit)
10. To ensure that the receiver's beam splitters are in line with the sender's polarizing filters, the receiver transmits its beam splitter sequence to the sender.
11. The sender replies with any corrections to the beam splitters by observing the bit sequence the receiver calculated with that of itself. This synchronizes the 2 parties for the duration of the communication.

• The most important feature of QKD is how it deals with eavesdroppers; if an eavesdropper used its own sequence of beam splitters to observe the photons under transmission, the emerging photons will be altered.
• Therefore, the receiver will realize that in places where the photon measurements must correlate, they will not correlate. Thus, the eavesdropper is detected and a new key is generated; this process is described by the no-cloning theorem.

Advantages of Quantum Cryptography

1. Unbreakable security due to quantum mechanics principles.
2. Future-proof against advances in computing power, including quantum computers.
3. Secure key distribution through eavesdropping detection.
4. Ability to detect any attempt at intercepting or measuring the quantum states.

Disadvantages of Quantum Cryptography

1. Limited range (~ 250 km) for transmitting quantum signals.
2. Complex + requires specialized and costly hardware/infrastructure (QKD filters, beam splitters, fiber optic networks).
3. Only secures key distribution, not key management or data transmission itself.
4. Polarization of light can change even without an eavesdropper, leading to false positives.
5. Criminals can hide their conduct better online when quantum computing goes mainstream.

17.2 - Show awareness of the Secure Socket Layer (SSL) / Transport Layer Security (TLS)

Security Protocols

• The security protocols SSL (Secure Sockets Layer) and Transport Layer Security (TLS) are primarily used to ensure secure and authenticated communication between a client and server.
• TLS is the more modern version of SSL and is primarily used with the https protocol when accessing websites. This means that data being transmitted across such connections are encrypted using asymmetric public key cryptography.
• In common use cases of TLS and SSL (such as web browsing, connecting to public servers, etc.) only the server is authenticated, while the client remains unauthenticated. This means that the protocol only authenticates the server's identity to the client, but not the client's identity to the server (i.e. legitimacy of server is the priority)

• SSL/TLS is widely used in various applications and protocols, including:
  • Web Browsing (HTTPS): SSL/TLS is commonly used to secure communication between web browsers and web servers, enabling secure online transactions, e-commerce, and browsing of sensitive information.
  • Email Communication (SMTP/POP3/IMAP): SSL/TLS can be used to secure email communications, protecting the contents of email messages and login credentials.
  • Virtual Private Networks (VPNs): SSL/TLS is often used as part of VPN protocols to create secure encrypted tunnels for remote access and secure communication over public networks.
  • Internet of Things (IoT) and Cloud: SSL/TLS is increasingly being used to secure communication in IoT devices and cloud resources, protecting data transmission and preventing unauthorized access to connected devices.
• SSL/TLS serves the following main objectives:
  • Encryption: Encrypts data transmitted using strong cryptographic algorithms, ensuring confidentiality by preventing unauthorized access to the communication content.
  • Authentication: Enables the client to verify the server's identity through digital certificates issued by trusted Certificate Authorities (CAs), preventing man-in-the-middle attacks and ensuring communication with the intended server.
  • Data Integrity: Guarantees that the transmitted data has not been tampered with or modified during transit by using message authentication codes (MACs) (aka. authentication tags) - a hash generated using the shared key to ensure that the data was not tampered with / altered during transmission and came from the stated sender.
  • Anti-Replay Protection: Includes mechanisms to prevent replay attacks, where an attacker attempts to gain unauthorized access or disrupt the connection by capturing and retransmitting previous communications.
• SSL/TLS uses public key infrastructure (PKI), which is a set of protocols, standards and services to allow clients and services to authenticate each other using digital certificates issued by a certificate authority (CA). The specifics of these protocols and more details about digital certificates are mentioned below.

Secure Sockets Layer (SSL)

• Secure Sockets Layer (SSL) is a stateful security protocol that:
  1. fragments data; into manageable size fragments of 2¹⁴ bytes or less.
  2. encrypts data; using both symmetric key encryption (during communication) and asymmetric key encryption (during the handshake process - see below).
  3. compresses data; using lossless compression - however, this may make the connection vulnerable to the CRIME SSL/TLS attack.
  4. authenticates server + verifies the integrity of data; using a digital signature contained within a digital certificate (see below) and message authentication codes (MACs).
• A client would initially establish connection with a server via SSL using the handshake protocol. The following diagram summarizes this handshake process, based on the TLS 1.2 version (i.e. both SSL and TLS use the same handshake process):

1. Client Hello: A message sent by the client to initiate the connection. Contains details such as the protocol version, session ID (a unique identifier to help resume a previous session without performing the full handshake process again, aiding efficency), cipher suite (the cryptography algorithms supported by the client), compression method and a random number (used to generate a session key)
2. Server Hello: A message similar to the "Client Hello" sent by the server back to the client upon receiving the "Client Hello" that confirms the final cipher suite (for example, RSA, Diffie-Hellman, etc.), compression method, etc. that will be used.
3. Server Certificate: A digital certificate / certificates sent by the server to the client to authenticate itself. This contain's the server's public key which will be used later (referred to as the subject public key in general)
4. Server Hello Done: A message signifying the end of the "Server Hello" and associated messages.
5. Client Key Exchange: The client generates a key known as the pre-master key that is encrypted using the server's public key (found in the server certificate). This key is sent to the server.
   • At around the same time, the client would use the server's random number (from Server Hello), its own random number (from "Client Hello") and the recently generated pre-master key to compute the session key (aka. master key). More information about the exact algorithms used here are described in RFC6101, the IETF's original documentation of SSL v3.0.
6. Change CipherSpec (from Client): Since the session key has now been generated, messages hereafter will be encrypted using this session key. The CipherSpec message informs the server of this change.
7. Client Finished: A message indicating the end of handshake process on the client side. This is the first piece of data to be protected using the shared key via symmetric key cryptography.
8. Change CipherSpec (from Server): The server first decrypts the pre-master key sent by the client in the "Client Key Exchange" stage and uses the same process to compute the session key (since the parameters used to compute this are the same, the secret key generated must be the same as that of the client). After this, a similar CipherSpec message is sent to the client to indicate that messages hereafter from the server will be encrypted with this session key.
9. Server Finished: A message similar to that of "Client Finished" protected using the shared key. A hash is also computed to ensure the integrity of the handshake.

• After this handshake process, the client and server can transmit application data, encrypted using the session key. Therefore, this process is used as means of initiating an encrypted communication between two devices; most commonly a client and a server.

Transport Layer Security (TLS)

• Transport Layer Security (TLS) is a layered security protocol that:
  1. fragments data; into manageable size fragments of 2¹⁴ bytes or less.
  2. encrypts data; using both symmetric key encryption (during communication) and asymmetric key encryption (during the handshake process - see below).
  3. authenticates server + verifies the integrity of data; using a digital signature contained within a digital certificate (see below) and message authentication codes (MACs).
• TLS involves the use of 2 protocols (i.e. layers) found in-between the application and transport layers of the TCP/IP protocol stack: handshake protocol and record protocol (top-to-bottom):

1. Handshake Protocol: Performs a process identical to that of SSL, with support for more secure and up-to-date cipher suites such as Advanced Encryption Standard (AES), and replaces the now outdated MD5 algorithm - for HMAC (Hash-based Message Authentication Code) - when generating message authentication codes (MACs). This provides more complex cryptography and security.
2. Record Protocol: Responsible for the actual transmission of data after the handshake process:
   • On transmission: fragments the data into manageable blocks, optionally compresses the data, applies a MAC (message authentication code) and encrypts the result.
   • On receipt: blocks are decrypted, verified, decompressed, reassembled, and then delivered to the application layer.

• TLS is able to perform session caching:
  1. The client sends a ClientHello using the Session ID of the session to be resumed.
  2. The server then checks its session cache for a match.
  3. If a match is found, the connection will be re-established.
  4. If a match is not found, the server generates a new session ID, and the client and server perform a full handshake.
• This process makes TLS highly efficient, as recomputing asymmetric key crytography algorithms and re-running the full handshake process is a computationally expensive process.

17.3 - Show understanding of digital certification

Digital Signatures

• Digital Signatures are electronic way of validating the authenticity of digital documents and also serves as proof that a document was sent by a known user.
• Digital Signatures help uphold the 4 core principles of security:
  1. Confidentiality: Only the intended recipient can read & decipher the data.
  2. Integrity: Data should reach the destination without alteration.
  3. Authentication: The sender should be confirmed as legitimate and who it claims to be.
  4. Non-Repudiation: Sender nor receiver can deny they were part of the data transmission.
• A digital signature is created through the following process:
  1. Hash Function
     1. The data to be signed (e.g., a document, email, or code) is passed through a cryptographic hash function, such as SHA-256 or SHA-3.
     2. The hash function produces a fixed-size digest or hash value, which is a unique representation of the data.
     3. Any change in the original data, even a single bit, will result in a completely different hash value.
  2. Private Key Encryption
     1. The hash value obtained from the previous step is encrypted using the signer's private key, which is part of an asymmetric key pair (public and private keys).
     2. The encryption process is typically performed using an algorithm like RSA or the Digital Signature Algorithm (DSA).
     3. The encrypted hash value becomes the digital signature.
  3. Signature Attachment
     1. The digital signature is then attached to the original data, either by appending it to the data or transmitting it separately but linked to the data.
• To verify the digital signature, the following steps are performed:
  1. Hash Function
     1. The recipient applies the same hash function to the received data to obtain a new hash value.
  2. Decryption
     1. The recipient uses the signer's public key (corresponding to the private key used for signing) to decrypt the digital signature, revealing the original hash value.
  3. Comparision
     1. The recipient compares the decrypted hash value from the digital signature with the newly calculated hash value from the received data.
     2. If the two hash values match, the digital signature is valid, and the data is considered authentic and unmodified.
     3. If the hash values do not match, the digital signature is invalid, indicating that the data has been tampered with or was not signed by the claimed signer.
• Digital signatures are widely used in various applications, such as software distribution, digital contracts, code signing, and secure communications

Digital Certificates

• A digital certificate is an electronic document that binds a public key to an entity's identity, such as a person, organization, or device.
• It is used in various security protocols, including SSL/TLS, to establish secure communication channels and authenticate parties involved in the communication.
• A digital certificate typically contains the following information:
  1. Subject: The entity (person, organization, or device) to which the certificate is issued.
  2. Subject's public key: The public key associated with the subject's identity.
  3. Issuer: The Certificate Authority (CA) that issued and digitally signed the certificate.
  4. Validity period: The time frame during which the certificate is considered valid.
  5. Signature: A digital signature from the issuing CA, which verifies the authenticity and integrity of the certificate.
• To obtain a digital certificate:
  1. Key Pair Generation: The entity generates a public-private key pair using a cryptographic algorithm like RSA or Elliptic Curve Cryptography (ECC).
  2. Certificate Signing Request (CSR): The entity creates a Certificate Signing Request (CSR), which includes the public key and additional information about the entity (such as name, organization, and location).
  3. Submission to a Certificate Authority (CA): The entity submits the CSR to a trusted Certificate Authority (CA), along with the required documentation and payment (if applicable).
  4. Verification: The CA verifies the entity's identity and the information provided in the CSR through various methods, such as document verification, domain validation, or extended validation processes.
  5. Certificate issuance: If the verification is successful, the CA creates a digital certificate by combining the entity's public key and identity information, along with other necessary metadata, and digitally signs it with the CA's private key.
  6. Certificate delivery: The CA delivers the issued digital certificate to the entity, which can then be installed on servers, devices, or applications that require secure communication or authentication.
• It's important to note that digital certificates have an expiration date, and they need to be renewed periodically by following a similar process with the issuing CA.
• In order to generate a digital signature using a digital certificate, the following process can be performed:
  1. Key Generation: The entity (person or organization) generates a pair of cryptographic keys: a public key and a private key.
  2. Certificate Request: The entity sends a request to a trusted Certificate Authority (CA), including their public key and identity information.
  3. Certificate Issuance: The CA verifies the entity's identity and issues a digital certificate that binds the public key to the entity's identity.
  4. Signing Data: To sign data (e.g., a document or email), the entity calculates a hash (digital fingerprint) of the data. The entity then encrypts this hash using their private key, creating a digital signature.
  5. Signature Verification: To verify the digital signature, the recipient performs the following steps:
     1. Calculates the hash of the received data.
     2. Obtains the sender's public key from their digital certificate.
     3. Uses the public key to decrypt the digital signature, revealing the original hash.
     4. Compares the decrypted hash with the calculated hash of the received data.
     5. If the hashes match, the signature is valid, and the data is authentic and unmodified.