Time
4 hours 53 minutes
Difficulty
Beginner
CEU/CPE
5

Video Transcription

00:03
to complete our tour of encryption as a service capabilities involved. We're gonna look at the H Mac capabilities and how those congee used to establish irrefutable ity. That is, knowing a message was signed by an individual and having strong confidence in that and verifying that
00:20
we're gonna then generate a secret. And the Associated H Mac, we will run the H Mac verification process on that secret. And then we're gonna try to change the secret a little bit and see, Does the H Mac verification add up? Or does it tell us this message is invalid for the provided age back?
00:38
Once again, we'll drill into the Enterprise is a service secrets engine and will use the M I six key. Let's perform some actions here. Let's do H Mac. So what is the input? What is the message that we want to tell James Bond? We want to tell him.
00:55
Return to headquarters Turnabout to, say, return to H Q
00:59
bang. Very important message. Right. Return to H Q. We're gonna base 64 code that
01:03
and then we're gonna use thes particular default hashing algorithm, which gives us this h back. And I'm gonna copy that. So if you could imagine a situation where this message is going to go to James Bond and then that being returned to H Q. And then this here
01:21
is going to be also accompanying that message and this is saying, Here's my verification signature
01:27
that using the M I six key
01:30
this message I've signed this message. It is it is authentic. It is from me. And here's exactly what it says
01:37
involved through the Web. AP I. And then, of course, the http AP I provides us with the ability to verify the different H Mac messages. So here we go. Let's let's say the again. The thing is returned to H Q. That is gonna be the message.
01:56
If we base 64 encode that
01:59
and we paste in the H Max signature that was just generated. Let's run verification.
02:05
The input is valid. Great.
02:07
But what if we were in a situation where the message got to us and said something like Return
02:15
to the safe house, right? The bad guy wants toe. Have James Bond go to the safe house, and then he can watch him, and then he learns where the local safehouses. We're gonna code that base 64. And then he just spits in the normal H. Mac
02:30
that was sent with the original message. Right? Maybe this this message was somehow intercepted,
02:36
altered, and then forward it on. So does this add up? Does the message align with the H Mac?
02:43
And sure enough, it says no. No, it doesn't. Um, we can try altering the H. Mac, and that's also not gonna work out. Right? Return to safe house. This is our altered message. Here's the original H. Mac. I'm just gonna delete a character and replace it with the number four and we'll run a verification. And again, what
03:01
got to do? A base 60 foreign coating.
03:04
Let's give it a shot. But as expected, the input is also not valid.
03:08
So if you didn't know much about H. Mac and what the whole purpose was, you definitely picked that up quickly. And also now you can see how vault can help in generating the Ace Max and verifying the H. Max and these h max taken account and are based off of the current version of the M I six key
03:28
this video Also ends are module on encryption as a service. So just a recap of module in its entirety. We exercise the capabilities of the transit secret ended right? That's the basis for encryption as a service that vault provides. We performed the encrypted decrypt operations using this case, the M I six key.
03:47
We talked about handling
03:49
in rotations of those encryption keys by creating a new version of M I six ke re wrapping existing secrets, upping the ante for the minimum version of the key that any future encryption or decrypt operations would have to use. We managed key generation and distribution with the data keys capability.
04:06
This is really valuable when the encryption itself is going to take place outside a vault.
04:11
Maybe you're handing off keys to, ah, third party and you you don't want them to persist the actual encryption keys. But you do want to give them a safe, encrypted version of those encryption keys. And then last we learned about verifying messages using H Mac
04:28
and the capabilities. We did all this through the Web interface because it was just a lot easier to exercise.
04:32
Of course, in a real world, when you're doing this programmatically you're going to be relying on the http AP I interfaces and you confined full, detailed documentation using the A P I Explorer, which you can access through the Web interface. If you recall by simply launching the command line
04:50
and just typing a P I.
04:54
And then now this will give us a nice capability here. If you wanted to look at the exercise various secrets as a service using the rest AP I say you're building out of programmatic way. And then, of course, there are the libraries to interface with the H C G p a p I power shell goal ings java C sharp.
05:13
You name it those kind of adapters as well.
05:15
So that gives you a great to review of encryption as a service. And it rounds out the three different pillars a vault that we discussed at the very beginning of this training

Up Next

Vault Fundamentals

Learn how HashiCorp Vault can improve your security posture when it comes to storing sensitive passwords, maintaining confidential keys, implementing encryption, and establishing robust access management.

Instructed By

Instructor Profile Image
James Leone
Cloud, IoT & DevSecOps at Abbott
Instructor