Time
10 hours 32 minutes
Difficulty
Beginner
CEU/CPE
11

Video Transcription

00:01
welcome back to the second part of section 6.1 on comparing and contrasting basic concepts of cryptography.
00:09
In the first part, I started discussing numerous terms associated with cryptography.
00:15
Many of these terms you see on your screen such a symmetric versus asymmetric encryption and the difference between diffusion confusion stream versus block.
00:26
I'll continue talking about these concepts in this video.
00:30
Hashing
00:31
is a digital fingerprint, where you take a string of any length and create a fixed length string for output that's always should be unique
00:42
for the file. So, for example, I provide you with a file and I provide hash associated with it.
00:49
If I change the file, the hash will also change. Their numerous hashing algorithms will talk about in a future video.
00:58
You see examples on your screen, though, with input working through a hash algorithm, providing a hash, some hash them again. It's always the fixed length. Some of the rules associated with hash the speed should be seen. New me. It matter that data size, no matter how large of a block of data I used for the hash
01:18
speed, should be consistent.
01:19
I should not be able to generate the original message based on the hash summer hash value.
01:26
To avoid those hash collisions that's having the same hash value for two different files or documents.
01:34
Each message should have its own half,
01:38
and changing the original
01:40
should change that end hash value. So even if I change one character,
01:45
it'll completely alter the hash value.
01:48
We'll talk a lot more about hashing in future videos.
01:53
There are numerous issues associated when computing hashing.
01:57
If I'm able to determine that hash value based on common words such as a rainbow table, remember the discussion on that tax. Rainbow Table is a list of common words and their computed hash values. They tend to be very large in size.
02:15
Defeat that use what's known as assault salting uses a prefix consisting of a random string of characters,
02:23
say, adding them to passwords before their hashed
02:28
collision attacks. We try to find to input strings of a hash. Functions have the same hash value. Same output.
02:38
Collision attacks have been known with some of the earlier hashing algorithms, something to be aware of.
02:46
Cryptography continues to be a changing field. It's based on ancient ideas,
02:52
but even the mathematics are changing based on new computational power and abilities.
02:58
The first to be aware of is E. C C. Elliptical curve cryptography. It's an asymmetric public key, so public and private key asymmetric crypto system
03:08
based on very complex mathematical structures. If you ever took calculus and physics,
03:15
limp sees elliptical curve
03:19
E. C. C is able to use a lot smaller key sizes. It's more efficient and fast.
03:25
Quantum cryptography uses physics rather than math to base cryptography,
03:34
the idea of photons and how they work.
03:38
It is also known to be more secure
03:40
a lot more.
03:43
You'll see a lot more about quantum cryptography in future years as their new developments occurring all of the time.
03:51
As you're working with cryptography, you should always use proven crypto algorithms. Don't try to create your own, as we call it. Roll your own
04:00
missed National Institute of Standards and Technology documents and publishes known good krypto and hashing algorithm, so you should leverage those
04:12
some ideas for crypto best practices. Mentioned used known approved algorithms here to AH required minimum key guidance for the that chosen algorithm. Use approved cryptographic modes. Don't try to generate your own. Lastly, you strong random number generators
04:30
we talked about earlier. The idea of pseudo random numbers.
04:34
I want that to be a strong as possible
04:39
and associated concept with cryptography is obfuscation and steganography.
04:45
Obfuscation is the act of making something difficult to understand or to find maybe like hiding with in plain sight.
04:54
It should rely on something not known or widely discovered.
05:00
Security through obscurity is only a partial solution, but it's something to consider as your studying cryptography.
05:09
By the way,
05:10
obscurity does not provide strong security
05:15
common method for obscuring data within other data files. It's steganography. Steganography means hidden writing. It's hiding messages in other media. So could hiding a message within a word document or within a picture
05:30
so that the unintended recipients are not even where there's a message.
05:34
It's actually how terrorists share Information will post a picture on Facebook using steganography with a hidden message. In it, they have the algorithm and the key to pull out that hidden message. It's a fascinating science. I recommend you dive into it, learn more about steganography.
05:55
Steganography is one
05:57
use case. It's important, understand the three states of data
06:01
data at rest say, within a flat file or a database did it in transit across the network, and then data in use were being processed. Each of those could have some crypto algorithms to protect it. While it's in the that state.
06:16
Cryptography has other use cases associated with that. C I. A. Confidentiality, integrity, availability of security.
06:25
So confidentiality might be the most obvious. Ensuring the privacy of data
06:30
by encrypting it so it can't be read by anybody without that key
06:35
integrity. Making short data does not change. Hashing proves integrity of data for hash that file. And then that file changes. The hash will change
06:48
non repudiation
06:50
digital signatures proving who sent that
06:54
document that file
06:56
mostly authentication. How do we prove identity so digital certificates can be used for authentication?
07:03
Also, passwords are hashed that way. We send the hash of the password over the network
07:10
rather than the actual password itself.
07:13
We'll cover a few other use cases.
07:15
Security systems are often about managing and making appropriate tradeoffs.
07:20
Cryptography, for example, consumes additional resource is in the system and carries a cost. Modern computing systems and algorithms need to be efficient. Low Leighton see is one of the concerns I want to make sure does not increase the late and say, say across a network.
07:40
High resiliency make sure can survive types of attacks
07:45
previously mentioned. Supporting confidentiality, integrity, authentication.
07:50
It's that balance of resource is and security that were always challenged with
07:56
in cyber security.
07:58
Be familiar with these and other use cases found in your study materials.
08:03
This concludes my discussion of common terms associated with cryptography, encryption and P K I. Let's practice on a few sample quiz questions.
08:13
Question one.
08:15
You're using asymmetric encryption. Want to sign a file to prove you sent it
08:20
and that it hasn't been altered?
08:24
Which key do you use? Use your public in your private Kenya recipients public. He or your recipients? Private key.
08:31
The answer is, you sign it with your private key,
08:35
which then can be validated with your public key
08:41
question, too.
08:43
Which type of cipher encrypts data and fixed length group of bits?
08:50
The answer is B. A block cipher.
08:54
We'll talk a lot more about encryption and algorithms in future videos.
09:00
This concludes two videos on Section six, that one where you need to compare and contrast basic concepts of cryptography
09:09
work through each of these terms, become very familiar with them because we'll be talking about them again through each of the videos in the six domain of Security, plus
09:18
refer to your study material for Maur information.

Up Next

CompTIA Security+

CompTIA Security Plus certification is a great place to start learning IT or cybersecurity. Take advantage of Cybrary's free Security+ training.

Instructed By

Instructor Profile Image
Ron Woerner
CEO, President, Chief Consultant at RWX Security Solutions LLC
Instructor