1 Hands-On Ethical Hacking and Network DefenseChapter 12 Cryptography Last modified 11/30/2016 –jw

2 Objectives Summarize the history and principles of cryptographyDescribe symmetric and asymmetric cryptography algorithms Explain public key infrastructure (PKI) Describe possible attacks on cryptosystems Compare hashing algorithms and how they ensure data integrity

3 Understanding Cryptography BasicsCryptography is the process of converting plaintext into ciphertext Plaintext: readable text (also called cleartext) Ciphertext: unreadable or encrypted text Cryptography is used to hide information from unauthorized users Decryption is the process of converting ciphertext back to plaintext

4 Confidentiality and StrengthCryptographic systems ensure the confidentiality of the information being used. Strength - The effectiveness of a cryptographic system in preventing unauthorized decryption. Strong cryptographic system are difficult to crack. Work Factor - describes an estimate of the amount of time and effort that would be needed to break a system .

5 Integrity Cryptographic system can also involve providing assurance that a message wasn’t modified during transmission. Integrity can be accomplished by adding information such as redundant data that can be used as part of the decryption process.

6 Cryptanalysis Study of the process of breaking encryption algorithmsWhen a new encryption algorithm is developed, cryptanalysts study it and try to break it Or prove that it is impractical to break it (taking too much time and too many resources)

7 History of CryptographyAround for thousands of years Encrypted Egyptian hieroglyphics Biblical book of Jeremiah was written using a cipher Substitution cipher Replaces one letter with another letter based on a key Example: Julius Caesar’s Cipher Used a key value of 3 (Shift 3 letters) ABCDEFGHIJKLMNOPQRSTUVWXYZ DEFGHIJKLMNOPQRSTUVWXYZABC

8 The War Machines Enigma machine Most famous encryption deviceDeveloped by Arthur Scherbius Used by Germans during World War II Enigma substituted each letter typed by an operator Substitutions were computed using a key and set of switches or rotors Code was broken by Polish cryptographers Machine for breaking the code was called the Bombe The War Machines Enigma machine Most famous encryption device Developed by Arthur Scherbius Used by Germans during World War II Enigma substituted each letter typed by an operator Substitutions were computed using a key and set of switches or rotors Code was broken by Polish cryptographers Machine for breaking the code was called the Bombe

9 Enigma Used by the Germans during World War IIReplaced letters as they were typed Substitutions were computed using a key and a set of switches or rotors Image from Wikipedia https://en.wikipedia.org/wiki/Enigma_machine

10 The War Machines The Purple MachineDeveloped by Japanese during World War II Used techniques discovered by Herbert O. Yardley Code was broken by William Frederick Friedman Known as the Father of U.S. Cryptanalysis The War Machines The Purple Machine Developed by Japanese during World War II Used techniques discovered by Herbert O. Yardley Code was broken by William Frederick Friedman Known as the Father of U.S. Cryptanalysis Steganography Process of hiding data in plain view in pictures, graphics, or text

11 Steganography The process of hiding data in plain view in pictures, graphics, or text Example: changing colors slightly to encode individual bits in an image The image on the left contains the image on the right hidden in it

12 Algorithms An algorithm is a mathematical function or program that works with a key Security comes from A strong algorithm—one that cannot be reversed without the key A key that cannot be found or guessed

13 Keys Cryptographic Key Entropystring of bits used by an algorithm to transform plain text into cipher text or vice versa. Remains private to ensure secure communication Is the core part of cryptographic operations Entropy measure of randomness Random keys are better than predictable keys

14 Keys Keyspace Keyspace examples The range of allowable valuesThe larger the keyspace, the more random sequenced keys that can be created The more random keys that can be created, the more difficult to guess the key Keyspace examples 4 digit pin code has 104 = values 8-bit key has 28 = 256 values in keyspace 24-bit key has 224 = 16 million values 56-bit key has 256 = 7 x 1016 values 128-bit key has 2128 = 3 x 1038 values

15 Keys and Brute Force (not in textbook)In 1997 a 56-bit key was broken by brute force Testing all possible 56-bit keys Used 14,000 machines organized via the Internet It took 3 months

16 Keys and Brute Force In 1998 a 56-bit key was broken by brute forceTesting all possible 56-bit keys Used a single desktop computer It took just 56 hours Remember - it took 3 months in 1971

17 DeCSS Commercial DVDs are encoded with a 40-bit keyIt’s simple to crack it by brute force 240 = 1 Trillion values Three hackers did that in 1999 https://en.wikipedia.org/wiki/DeCSS Legislation such as the DMCA made it illegal to publish the algorithm See Illegal Prime Number https://en.wikipedia.org/wiki/Illegal_prime

18 How Many Bits Do You Need?How many keys could all the computers on Earth test in a year? Pentium 4 processor: 109 cycles per second One year = 3 x 107 seconds There are less than 1010 computers on Earth One per person 109 x 3 x 107 x 1010 = 3 x 1026 calculations 128 bits should be enough (3 x 1038 values) Unless computers get much faster, or someone breaks the algorithm Moore’s states that computing power doubles every 18 – 24 months.

19 Symmetric CryptographyOne key encrypts and decrypts data Cleartext with Key makes Ciphertext Ciphertext with Key makes Cleartext Winning Lotto #s: Winning Lotto #s:

20 Symmetric Cryptography AlgorithmsSymmetric algorithms have one key that encrypts and decrypts data Advantages Symmetric algorithms are fast They are difficult to break if a large key size is used Only one key needed

21 Symmetric Cryptography AlgorithmsDisadvantages Symmetric keys must remain secret Difficult to deliver keys (key distribution) Symmetric algorithms don’t support authenticity or nonrepudiation You can’t know for sure who sent the message, since two people have the same key

22 Symmetric Cryptography AlgorithmsTypes of symmetric algorithms Stream ciphers Operate on plaintext one bit at a time Block ciphers Operate on blocks of plaintext

23 Data Encryption Standard (DES)National Institute of Standards and Technology (NIST) Wanted a means of protecting sensitive but unclassified data Invited vendors in early 1970 to submit data encryption algorithms IBM proposed Lucifer A 128-bit encryption algorithm

24 Data Encryption Standard (DES)The National Security Agency (NSA) reduced the original Lucifer key size from 128 bits to 64 bits and created DES Only 56 bits of the key are actually used

25 Data Encryption Standard (DES) (continued)In 1988, NSA thought the standard was at risk to be broken In 1997, a DES key was broken in 3 months In 1998, the EFF (Electronic Frontier Foundation) built a a computer system that cracked a DES key in 3 days https://w2.eff.org/Privacy/Crypto/Crypto_misc/DESCracker/HTML/ _deschallenge3.html

26 Triple DES (3DES) Triple Data Encryption System (3DES)3DES served as a quick fix to the vulnerabilities of DES 3DES performed three DES encryptions 256 times stronger than DES More secure but slower to compute than DES https://en.wikipedia.org/wiki/Triple_DES

27 Symmetric Algorithms Advanced Encryption StandardNIST put out request for a new encryption standard Required submittals for a symmetric block cipher be capable of supporting 128-, 192-, and 256-bit keys Five finalists Rijndael (winner) MARS RC6 Serpent Twofish Symmetric Algorithms Advanced Encryption Standard NIST put out request for a new encryption standard Required submittals for a symmetric block cipher be capable of supporting 128-, 192-, and 256-bit keys Five finalists Rijndael (winner) MARS RC6 Serpent Twofish Hands-On Ethical Hacking and Network Defense, 3rd Edition

28 Advanced Encryption Standard (AES)Became effective in 2002 as a standard The process took 5 years Block cipher that operates on 128-bit blocks of plaintext Keys can be 128, 192, or 256 bits Uses Rindjael algorithm

29 International Data Encryption Algorithm (IDEA)Block cipher that operates on 64-bit blocks of plaintext It uses a 128-bit key Developed by Xuejia Lai and James Massey Designed to work more efficiently in computers used at home and in businesses IDEA is free for noncommercial use It is included in PGP encryption software IDEA NXT is the successor algorith https://en.wikipedia.org/wiki/IDEA_NXT

30 Blowfish Block cipher that operates on 64-bit blocks of plaintextThe key length can be as large as 448 bits Successors - Twofish and Threefish algorithms Developed as a public-domain algorithm by Bruce Schneier https://en.wikipedia.org/wiki/Blowfish_(cipher)

31 RC4 Stream cipher used in WEP, WPA and SSLKnown for its simplicity and speed in software. Especially vulnerable when non random keys are used (example – WEP). Created by Ronald L. Rivest in 1987 for RSA Data Security

32 RC5 Block cipher that can operate on different block sizes: 32, 64, and 128 The key size can reach 2048 bits Created by Ronald L. Rivest in 1994 for RSA Data Security

33 Cracking RC5 56-bit and 64-bit key RC5s have already been crackedbit key took only 250 days to find 2002 – 64bit key took only 1,757 days to find The RC5-72 project is underway, trying to crack a 72-bit key At the current rate, it will take 1000 years

34 Symmetric Algorithms (Private-key)Name Key size Notes DES 56 bits Insecure 3DES 168 bits Replaced by AES AES 128,192, or 256 US Govt classified info IDEA 128 bits Used in PGP Blowfish 32 to 448 Public domain RC5 Up to 2040 Secure for 72-bits or more

35 Asymmetric Cryptography AlgorithmsUse two keys that are mathematically related Data encrypted with one key can be decrypted only with the other key Another name for asymmetric key cryptography is public key cryptography Public key: known by the public Private key: known only by owner

36 Asymmetric CryptographyCleartext with Public Key makes Ciphertext Ciphertext with Private Key makes Cleartext Winning Lotto #s: Winning Lotto #s:

37 Asymmetric CryptographyProvides message authenticity and nonrepudiation in addition to confidentiality, integrity and availability Authenticity validates the sender of a message Nonrepudiation means a user cannot deny sending a message

38 Asymmetric CryptographyAsymmetric algorithms are more scalable but slower than symmetric algorithms Scalable: can adapt to larger networks Each person needs only one key pair Everyone can use the same public key to send you data Each person signs messages with their own private key

39 RSA Developed in 1977 by Ronald L. Rivest, Adi Shamir, and Leonard M. Adleman First algorithm used for both encryption and digital signing Many browsers using the TLS protocol use RSA Based on difficulty of factoring large numbers Uses a one-way function to generate a key Mathematical formula easy to compute in one direction

40 Diffie-Hellman Developed by Whitfield Diffie and Martin HellmanDoes not provide encryption but is used for key exchange Two parties agree on a key without ever sending it directly over the network The numbers transmitted can be used to compute the key, but only by the parties holding secret private numbers Prevents sniffing attacks https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://www.youtube.com/watch?v=U62S8SchxX4

41 Diffie-Hellman Key Exchange

42 Elliptic Curve Cryptosystems (ECC)It is an efficient algorithm requiring few resources Memory Disk space Bandwidth ECC is used for encryption as well as digital signatures and key distribution Popular in smaller devices like smartphones.

43 Elgamal Public key algorithm used to Written by Taher Elgamal in 1985Encrypt data Create digital signature Exchange secret keys Written by Taher Elgamal in 1985 The algorithm uses discrete logarithm problems Solving a discrete logarithm problem can take many years and require CPU-intensive operations

44 Asymmetric Algorithms (Public-key)Name Notes Diffie-Hellman Key exchange, not encryption RSA Secure, used by SSL ECC Efficient newer technique Elgamal Used in GPG and PGP

45 What Cryptography Should You Use?Whether you are using asymmetric or symmetric cryptography, it is important to use only proven cryptography technologies. In cryptology, one of the key principles is the Kerckhoffs’s principle, which was first stated by Auguste Kerckhoffs in the 19th century. Kerckhoffs’s principle states that the security of an algorithm should depend only on the secrecy of the key and not on the secrecy of the algorithm itself.

46 Digital Signatures A hash value ensures that the message was not altered in transit (integrity) Provides message integrity, authenticity and nonrepudiation

47 From Wikipedia https://en.wikipedia.org/wiki/Digital_signature

48 Digital Signature Standard (DSS)Established by the NIST in 1991 Ensures that digital signatures rather than written signatures can be verified Federal government requirements RSA and Digital Signature Algorithm (DSA) must be used for all digital signatures Hashing algorithm must be used to ensure the integrity of the message NIST required that the Secure Hash Algorithm (SHA) be used

49 PKI

50 PKI Disaster In 2011, when a string of SSL digital certificate providers, including Comodo, DigiNotar and GlobalSign, were breached, fake certificates were created (since revoked) for major companies like Google. Dutch-based Vasco Security Systems, went bankrupt as a result of the hack, especially after the Dutch government banned use of DigiNotar certificates.

51 Public Key Infrastructure (PKI)Not an algorithm A structure that consists of programs, protocols, and security protocols Uses public key cryptography Enables secure data transmission over the Internet

52 PKI Components Certificate: a digital document that verifies the identity of an entity Contains a unique serial number and must follow the X.509 standard

53 PKI Components Public keys are issued by a certification authority (CA) CA is a neutral third-party organizations that provide notarization services for digital certificates

54 PKI Components A certificate that the CA issues to a company binds a public key to the recipient’s private key

55 Certificate Expiration and RenewalA period of validity is assigned to each certificate After that date, the certificate expires A certificate can be renewed with a new expiration date assigned If the keys are still valid and remain uncompromised

56 Certificate Revocation and SuspensionReasons to suspend or revoke a certificate A user leaves the company A hardware crash causes a key to be lost A private key is compromised Revocation is permanent Suspension can be lifted

57 Certificate Revocation and SuspensionCertificate Revocation List (CRL) Contains all revoked and suspended certificates Issued by CAs

58 Backing Up Keys Backing up keys is criticalIf keys are destroyed and not backed up properly, encrypted business-critical information might be irretrievable The CA is usually responsible for backing up keys A key recovery policy is also part of the CA’s responsibility

59

60 Microsoft Root CA You can set up your own Certificate Authority ServerAvailable in Windows Server since Server 2000 Install the Certificate Services Note that after installing this service the name of the domain or computer cannot change

61 Microsoft Root CA Specify options to generate certificates, includingCryptographic Service Provider Hash algorithm Key length

62 Hashing Algorithms Hashing is a one-way processConverting a hash back to the original data is difficult or impossible A hash is a unique “signature” or fingerprint for a set of data This signature, called a hash or digest, represents the contents If the message is changed later, the hash value changes

63 Hashing Algorithms Hashing is used only for integrity to ensure that:Information is in its original form (Comparison Purposes) No unauthorized person or malicious software has altered the data Common hash algorithms MD, SHA

64 Hashing Algorithms (cont’d.)Hash values are often posted on download sites Used to verify file integrity after download

65 Hashing Algorithms (cont’d.)Secure hashing algorithm characteristics Fixed size Short and long data sets have the same size hash Unique Two different data sets cannot produce the same hash, which is known as a collision Original Dataset cannot be created to have a desired or predefined hash Secure Resulting hash cannot be reversed to determine original data

66 Hashing Algorithms (cont’d.)If two different data inputs produce the same hash value, it results in a collision A good hashing algorithm must be collision-free

67 Hashing Algorithms (cont’d.)Collisions – Weakness Normally a hash is used to verify that a file has not been altered. If two files have the same hash value, they are expected to be identical. If two non identical files have the same hash value, then a Collision has occurred Security+ Guide to Network Security Fundamentals, Fourth Edition

68 Message Digest (MD) Algorithmcommon hash algorithm Three versions Message Digest 2 (MD2) Takes plaintext of any length and creates 128 bit hash Padding added to make short messages 128 bits Considered too slow today and rarely used Message Digest 4 (MD4) Has flaws and was not widely accepted Suffer from collisions Not secure

69 Message Digest (MD) Algorithm (cont’d.)Designed to address MD4’s weaknesses Message length padded to 512 bits Weaknesses in compression function could lead to collisions Some security experts recommend using a more secure hash algorithm Security+ Guide to Network Security Fundamentals, Fourth Edition

70 Secure Hash Algorithm (SHA) (cont’d.)Designed by NSA More secure than MD No weaknesses identified

71 Secure Hash Algorithm (SHA) (cont’d.)Patterned after MD4, but creates a hash that is 160 bits in length instead of 128 bits SHA-1 is one of the most popular hashing algorithms

72 Secure Hash Algorithm (SHA) (cont’d.)SHA-1 has been broken Collisions were found in 2004 and 2005 As of March 15, 2005, the NIST recommends not using SHA 1 applications Microsoft, Google and Mozilla have all announced that their respective browsers will stop accepting SHA-1 SSL certificates by 2017. https://en.wikipedia.org/wiki/Cryptographic_hash_function https://en.wikipedia.org/wiki/SHA-1

73 Secure Hash Algorithm (SHA) (cont’d.)

74 Secure Hash Algorithm (SHA) (cont’d.)Comprised of four variations, named after their digest lengths (in bits) SHA-224, SHA-256, SHA-384, and SHA-512 Considered to be a secure hash Windows XP SP2 and earlier, and Android 2.2 and earlier, do not support SHA2 certificates.

75 SHA-3 The SHA-3 standard was released by NIST on August 5, 2015https://en.wikipedia.org/wiki/SHA-3

76 Whirlpool Algorithm Whirlpool Recent cryptographic hashHas received international recognition and adoption by standards organizations Creates hash of 512 bits Used by TrueCrypt

77 RIPEMD Algorithm Race Integrity Primitives Evaluation Message Digest (RIPEMD) Two different and parallel chains of computation Results are combined at end of process

78 Hashing Algorithms (cont’d.)Hashed Message Authentication Code (HMAC) Hash variation providing improved security Uses secret key possessed by sender and receiver Receiver uses key to decrypt the hash May be used to simultaneously verify both the data integrity and the authenticity Any cryptographic hash function, such as MD5 or SHA-1, may be used in the calculation of an HMAC; the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA1 accordingly

79 Using HMAC A MITM attacker could change the "correct" hash value to fool the recipient The general solutions for such MITM attacks are A trusted third party A shared secret HMAC uses a shared secret key for this reason

80 Password Hashes Another use for hashes is in storing passwordsWhen a password for an account is created, the password is hashed and stored The Microsoft NT family of Windows operating systems hashes passwords in two different forms LAN Manager hash New Technology LAN Manager (NTLM) hash

81 LANMAN Password HashesUsed in Microsoft Windows through Windows XP to hash passwords Very old and weak, easily cracked with rainbow tables Too insecure to be trusted Should be disabled in Local Security Policy on Windows XP or earlier systems

82 Disabling LANMAN Hashes

83 LANMAN Algorithm Password: Xydke23498Qq Break into 7-character fieldsChange letters to UPPERCASE XYDKE23 498QQ Hash each field separately, using DES

84 NTLM Password Hashes Microsoft's replacement for LANMANNTLMv1 uses MD4 Considered compromised Still used for logon passwords NTLMv2 uses MD5 More secure, used for network authentication

85 NTLMv2 in Windows XP

86 NTLMv2 in Windows VersionsFrom the Windows 7 Local Security Policy setting's "Explain" tab

87 Password Hashes (cont’d)Linux and Apple Mac strengthen password hashes by including random bit sequences Known as a salt Make password attacks more difficult Apple Mac OS X uses SHA-1 hashes Most Linux Systems use MD5 hashes

88 Password Hashes (cont’d)Key Stretching processes used to take a key that might be a bit weak and make it stronger, usually by making it longer. The key (or password/passphrase) is input into an algorithm that will strengthen the key and make it longer, thus less susceptible to brute-force attacks.

89 Password Hashes (cont’d)Algortihms specifically for hashing passwords Bcrypt Bcrypt is used with passwords, and uses a derivation of the Blowfish algorithm, converted to a hashing algorithm, to hash a password and add Salt to it. PBKDF2 (Password-Based Key Derivation Function 2) It applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key. SHA-512 crypt

90 Hashing Algorithms Name Notes MD2 Written for 8-bit machines, no longer secure MD4 No longer secure MD5 Security is questionable now SHA-1 The successor to MD5, Used in: TLS, SSL, PGP, SSH, S/MIME, IPsec No longer completely secure SHA-2 Not yet broken, but no longer recommended. SHA-3 NIST newest hashing algorithm Bcrypt Specifically for Password Hashing PBKDF2 Specifically for Password Hashing

91 Cryptographic Protocol Suites

92 Pretty Good Privacy (PGP)Developed by Phil Zimmerman as a free encryption program Zimmerman was almost arrested Any kind of “unbreakable” encryption was seen as a weapon and compared to selling arms to the enemy Internet standard for PGP messages is OpenPGP Uses certificates similar to those in public key infrastructure (PKI) Does not use a centralized CA Verification of CA is not as efficient as PKI

93 Pretty Good Privacy (PGP)PGP is a free public key encryption program It uses certificates similar to those in public key infrastructure (PKI) PGP does not use a centralized CA Verification of a CA is not as efficient as PKI

94 Pretty Good Privacy (PGP) (continued)Algorithms supported by PGP IDEA RSA DSA Message Digest 5 (MD5) SHA-1

95 GnuPGP aka GPG GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP) https://www.gnupg.org

96 Secure Multipurpose Internet Mail Extension (S/MIME)Is another public key encryption standard used to encrypt and digitally sign Can encrypt messages containing attachments Can use PKI certificates for authentication S/MIME version 2 defined in RFC 2311 S/MIME version 3 defined in RFC 2633

97 Secure Multipurpose Internet Mail Extension (S/MIME) continuedIssues Not all clients handle S/MIME signatures, resulting in an attachment called smime.p7s that may confuse people.

98 Privacy-Enhanced Mail (PEM)Internet standard that is compatible with both symmetric and asymmetric methods of encryption Can use the X.509 certificate standards and encrypt messages with DES Not used as much today MIME Object Security Services (MOSS) is a newer implementation of PEM

99 Cryptographic Attacks

100 Understanding Cryptographic AttacksSniffing and port scanning are passive attacks – just watching Active attacks attempt to determine the secret key being used to encrypt plaintext Cryptographic algorithms are usually public Follows the open-source culture Except the NSA and CIA and etc.

101 Birthday Attack If 23 people are in the room, what is the chance that they all have different birthdays? x 365 x 365 x 365 x 365 x 365 x = 49% So there’s a 51% chance that two of them have the same birthday See https://en.wikipedia.org/wiki/Birthday_attack

102 Birthday Attack If there are N possible hash values,You will find collisions when you have calculated 1.2 x sqrt(N) values SHA-1 uses a 160-bit key Theoretically, it would require 280 computations to break SHA-1 has already been broken, because of other weaknesses

103 Mathematical Attacks Properties of the algorithm are attacked by using mathematical computations Categories Ciphertext-only attack The attacker has the ciphertext of several messages but not the plaintext Attacker tries to find out the key and algorithm used to encrypt the messages Attacker can capture ciphertext using a sniffer program such as Ethereal or Tcpdump

104 Mathematical Attacks Categories Known plaintext attackThe attacker has messages in both encrypted form and decrypted forms This attack is easier to perform than the ciphertext-only attack Looks for patterns in both plaintext and ciphertext Chosen-plaintext attack The attacker has access to plaintext and ciphertext Attacker has the ability to choose which message to encrypt

105 Mathematical Attacks Categories (continued) Chosen-ciphertext attackThe attacker has access to the ciphertext to be decrypted and to the resulting plaintext Attacker needs access to the cryptosystem to perform this type of attack

106 Brute Force Attack An attacker tries to guess passwords by attempting every possible combination of letters Requires lots of time and patience Password-cracking programs that can use brute force John the Ripper Cain and Abel Ophcrack Also uses memory to save time – “Rainbow tables”

107 Man-in-the-Middle AttackVictim Attacker Server Victim sends public key to Server Attacker generates two “false” key pairs Attacker intercepts the genuine keys and send false keys out Both parties send encrypted traffic, but not with the same keys These false keys will not be verified by a CA

108 Dictionary Attack Attacker uses a dictionary of known words to try to guess passwords There are programs that can help attackers run a dictionary attack Programs that can do dictionary attacks John the Ripper Cain and Abel

109 Replay Attack The attacker captures data and attempts to resubmit the captured data The device thinks a legitimate connection is in effect If the captured data was logon information, the attacker could gain access to a system and be authenticated Most authentication systems are resistant to replay attacks

110 Rainbow Tables A rainbow table attack focuses on identifying a stored value. By using values in an existing table of hashed phrases or words (think of taking a word and hashing it every way you can imagine) and comparing them to values found, a rainbow table attack can reduce the amount of time needed to crack a password significantly.

111 Password Cracking Password cracking is illegal in the United StatesIt is legal to crack your own password if you forgot it You need the hashed password file /etc/passwd or /etc/shadow for *NIX The SAM database in Windows Then perform dictionary or brute-force attacks on the file

112 Password Cracking Remember – Hashes can't be mathematically unscrambled! In other words, hashing algorithms are not reversible! The only way to reverse a hash is to run plaintext guesses through the same cryptographic hash function until an identical hash is generated.

113 Password Cracking and SaltPassword Cracking countermeasure Salting the addition of bits at key locations, either before or after the hash. Using Salted password A password cracking attack on a salted password hash will yield a letter combination other than the actual password.

114 Password cracking programsJohn the Ripper Cain and Abel Hydra (THC) HashCat EXPECT L0phtcrack Pwdump3v2 Ophcrack does it all for you – gathering the SAM database and cracking it

115 RSA – MS Security AdvisoryWindows update KB ensures that our operating systems no longer trust any security certificate of fewer than 1024 bits.

116 RSA Certificates As of January 1, 2014, to comply with Certification Authority/Browser forum requirements (based on NIST Special Publication A), all web browsers and Certification Authorities (CAs) will no longer sell or support 1024-bit RSA certificates.

117 RC4 Google, Microsoft, and Mozilla will drop RC4 encryption https://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_browsers

118

119

120 Recent SSL VulnerabilitiesSslstrip MITM Convert secure connection to insecure one Works on mixed-mode authentication pages like Twitter

121 Recent SSL VulnerabilitiesWildcard certificates *\0.evil.com Fools browser Renegotiation vulnerability Can break any SSL/TLS session https://www.ietf.org/proceedings/76/slides/tls-7.pdf

122 Recent SSL VulnerabilitiesHeartBleed https://www.youtube.com/watch?v=oAJNnowrxSA Poodle - SSL 3.0 vulnerabilities https://en.wikipedia.org/wiki/POODLE Shellshock https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://www.eff.org/deeplinks/2014/12/three-vulnerabilities-rocked-online-security-world-2014-review

123 Recent SSL VulnerabilitiesBEAST https://blogs.akamai.com/2012/05/what-you-need-to-know-about-beast.html

124 Recent SSL VulnerabilitiesBrowser SSL Vulnerability Check Are you safe with your Web Browser using SSL / TLS? https://www.howsmyssl.com/

125 Summary Cryptography Ciphertext Cleartext or plaintextIn existence for thousands of years Ciphertext Data that has been encrypted Cleartext or plaintext Data than can be intercepted and read by anyone Symmetric cryptography Uses one key to encrypt and decrypt data Asymmetric cryptography Uses two keys, one to encrypt and another decrypt Summary Cryptography In existence for thousands of years Ciphertext Data that has been encrypted Cleartext or plaintext Data than can be intercepted and read by anyone Symmetric cryptography Uses one key to encrypt and decrypt data Asymmetric cryptography Uses two keys, one to encrypt and another decrypt

126 Summary RSA, ECC, and ElGamal Digital Signature Standard (DSS) OpenPGPUse only a one-way function to generate a key Digital Signature Standard (DSS) Ensures that digital signatures can be verified OpenPGP Free public key encryption standard Hashing algorithms Used to verify data integrity Public key infrastructure (PKI) Structure of components used to encrypt data Summary RSA, ECC, and ElGamal Use only a one-way function to generate a key Digital Signature Standard (DSS) Ensures that digital signatures can be verified OpenPGP Free public key encryption standard Hashing algorithms Used to verify data integrity Public key infrastructure (PKI) Structure of components used to encrypt data

127 Summary Digital certificate Active attack Passive attackBinds a public key to information about its owner Issued by a Certificate Authority (CA) Active attack Attempts to determine secret key used to encrypt plaintext Passive attack Uses sniffing and scanning tools that don’t affect the algorithm (key), message, or any parts of the encryption system Summary Digital certificate Binds a public key to information about its owner Issued by a Certificate Authority (CA) Active attack Attempts to determine secret key used to encrypt plaintext Passive attack Uses sniffing and scanning tools that don’t affect the algorithm (key), message, or any parts of the encryption system