Encoding vs Encryption vs Hashing
[Signature, Certificate] is a good example
Encoding
Public context. Represent data in some specific format
Example: Encoding is used for saving and transporting cryptographic keys, Certificate Signing Request(CSR), certificates
American Standard Code for Information Interchange (ASCII)
- has 128 code points. It contains general(and some additional) symbols with corresponding representations like ASCII Code, binary(8 bit)
ASCII symbol - a
ASCII Code - 097
ASCII binary - 01100001
Base64
- has 64 code points with corresponding symbol, Base64 Code, binary(6 bit). Converts every 24 bites of data into 4(24/6) Base64 symbols. If there are no binary in a final block - 0 is used, if there are no final block - padding(=
) is used
For example:
ASCII symbols: aa
ASCII binary: 01100001 01100001
Base64 binary: 011000 010110 000100 000000
Base64 symbols: YWE=
//aa == YWE=
Encryption
Private context. Is used to transform data using private key. And a side who knows private key can work with this data
Cryptography
symmetric
asymmetric
1. Rivest–Shamir–Adleman(RSA)
3. Diffie–Hellman Key Exchange(DHKE)
[Subject] Elliptic-curve cryptography (ECC)
3. Elliptic Curve Diffie–Hellman(ECDH)
Symmetric and Asymmetric cryptography is used for secure exchanging messaging between sides (e.g. side1 and side2, Alice and Bob, client and server...) in non secure environment
Symmetric-key(symmetric) cryptography
(e.g. DES, AES) uses the same key for encode and decode. It is a kind of a private key because it should be kept private to have a private comunication
Public-key(asymmetric) cryptography
(e.g. ECC, RSA) uses a pair of mathematically-related private/public keys. If data is encrypted by public key is decrypted by private key and vice verse if data which is encrypted by private key is decrypted by public key
Use cases of asymmetric cryptography:
Public key encryption
(Subject Public Key Algorithms) - data is encrypted by public key is decrypted by private key
Digital signature(DS)
(Signature Algorithms) - check sum which is encrypted by private key is decrypted by public key
1. Rivest–Shamir–Adleman(RSA)
mathematic with prime numbers. Multiplying prime numbers to get a larger number is a simple task while factoring larger numbers back to the original primes is much more difficult. generation keypair(private/publick keys), sharing public key, encryption/decryption
2. Diffie–Hellman Key Exchange(DHKE) algorithm
Using the same shared secret key which is calculated based on public numbers(p, g), private key and another public key. This shared secret key is used as a key for encrypt/decrypt by two sides. It is based on a simple property of modular exponentiations
Static vs Ephemeral Keys:
- Static - long term key which implicit authenticity[About]
- Ephemeral - generated every new time and provides forward secrecy(FS) - if key was leaked - passed communications in secure because used different keys
//side_1
public numbers(p, g) AND my private key(random) => public key
side_2 public key AND private key AND public numbers(p) => shared secret key
Example:
//public info
`p = 11` is a **public** prime number (prime). e.g [2, 3, 5, 7, 11, 13, 17, 19, 23...]
`g = 8`, is a **public** primitive root modulo `p`. e.g [2, 6, 7, 8] is primitive root modulo 11
//creating private keys
`a = 6` is any **private** key of side1(Alice)
`b = 9` is any **private** key of side2(Bob)
//calculating public keys
//<my_public_key> = g^<my_private_key> mod p
`A = 3` = g^a mod p = 8^6 mod 11 = 262144 mod 11. is a **public** key of side1(Alice)
`B = 7` = g^b mod p = 8^9 mod 11 = 134217728 mod 11. is a **public** key of side2(Bob)
//calculating shared secret key for every side
//s = <another_public_key>^<my_private_key> mod p
//Side1(Alice) has p,g,a,A,B
`s = 4` = B^a mod p = 7^6 mod 11
//Side1(Bob) has p,g,b,B,A
`s = 4` = A^b mod p = 3^9 mod 11
As a result two sides has the same shared secret key
Let's say that we have a side3(Eve) which try to read messaging between side1(Alice) and side2(Bob). In this case Eve has:
//public info
`p = 11`
`g = 8`
//public Keys from Alice and Bob
`A = 3`
`B = 7`
To solve this task Eve has to know one of private keys(Alice's or Bob's).
When Eve generates it's own private/public keys and calculate shared secret key depends on another public key(Alice's or Bob's) it will be another result(Eve-Alice or Eve-Bob) - it will be new shared secret key between Eve and another side(public key of which was used to generate shared secret key)
[Subject] Elliptic-curve cryptography (ECC)
Large subject of asymmetric cryptography which uses mathematic with elliptic curves. Is better then RSA because of correlation of key size and ability to maintain security. generation keypair(private/publick keys), sharing public key, encryption/decryption
3. Elliptic Curve Diffie–Hellman(ECDH)
Key Exchange algorithm - is very similar to DHKE algorithm, but it uses ECC point multiplication instead of modular exponentiations
In very simple representation
//Side_1
public info AND random private key => key pair(private/public key)
Side_2 public key AND private key => shared secret key
For example:
- you generate ECC key pair(private/public) + specify public info(curve e.g P-384) which were used for generation(e.g. as a part of certificate)
- another side is able to use public info(from certificate) to generate own private/public key pair and send you own public key
- you are able to calculate shared secret key
Hashing
One-Way Hash Functions
Public context. Unique representation of data which everybody can calculate based on open algorithm that is why it is used for verifying originality of the data(data was not changing transforming)
Hash algorithms: MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512...
- Encryption
- Integrity - can receiver check originality of the message(message was not changed)
- Authentication - can receiver check originality of the sender
- Non-repudiation - if receiver sends this message to side3(some body else) can side3 check originality of the sender
Is used for:
Hash function - Encryption, Integrity
Message Authentication Code(MAC) - Encryption, Integrity, Authentication - Authenticate a message. When receiver gets a message and MAC it can check and verify originality using symmetric key.
- Hash-based Message Authentication Code(HMAC)
Digital signature - Encryption, Integrity, Authentication, Non-repudiation - Used with asymmetric key. Sign/verify(calculate checksum) of data
creating:
MAC(symmetric_key, message) -> MAC_data_tag
HMAC(symmetric_key, message, hash_func) -> hash
sending:
message
MAC_data_tag
using:
(MAC(symmetric_key, message) -> MAC_data_tag2) == MAC_data_tag
creating:
Encrypt(private_key, (Digital signature(message) -> check_sum)) -> Encrypted(check_sum)
sending:
message
Encrypted(check_sum)
using:
1. Decrypt(public_key, Encrypted(check_sum)) -> check_sum
2. (Digital signature(message) -> check_sum2) == check_sum
Key Derivation Functions (KDF) - transform password/weak key into strong key(this process called key stretching). For example it allows to apply KDF with password on back side and save it's result(e.g. hash) in DB instead of saving real passwords. HMAC-based key derivation(HKDF)
KDF(weak_key) -> key
HKDF(salt, weak_key, hash_func) -> hash
[Hash code vs Check sum]