X.509, Web Certificates, and Hashing

0:00All right, now under the current requirements for the 020-100 exam, there's a term that you have to know about it's called X 509. Okay, it's kind of a weird name, but it's just a standard that identifies various types of formats for a certificate. Okay, that's really all it is. It's the formatting standard. It's pretty much the standard that's being used. A lot of the common fields you'll see there will be things such as which format is being used, and it's the X dot 509 format. The issue were in the subject that's who issued the certificate and who's receiving the certificate.

0:34The public key, which will appear there, the digital signature, validity period , key usage extension and revocation. Okay, now I kind of rushed through those, didn't I? But the reason why is because we actually have those all, and we've seen a lot of that already in the past, all right? So, for example, issued two, that's the subject, issued by or issued ER, that's whoever issued it. This one's a self-signed certificate, so my own computer issued it and they issued it to itself. Okay, so that's kind of the idea there. The validity period, we're seeing that right there. That's just a X dot 509 field.

1:07Okay, if we look at the details, we see more of these kinds of fields that we might see again. There's the subject, in other words, who's receiving this certificate. There's our public key, which we see right down here. Up here, there's also signature algorithms, in other words, which signature is being used. We'll talk again more about hashes and that sort of thing in an upcoming skill. There's also enhanced key usage, in other words, what the purpose of the key would be. And also, we didn't really see it here, but extensions, that would be things such as maybe an alternative name.

1:40That's a very common one, for example, for a website, for example. So, maybe we used to have a company that was named YZ.com, and our certificates are generally for XYZ.com, but we got acquired by another company called ABC.com. And so, you can add that into an extension for a certificate. So, now, the certificate would be valid for either one of these DNS names. But anyway, those are some examples of what you'll see as far as X dot 509 certificates and the common fields that are there.

0:00And now I just kind of want to talk to you about issuing certificates for something like a website or predominantly really websites. So years ago, my wife asked me to go to a website and buy something for it. I don't really remember what it was, but it was a shopping website. And so I went there and I started to look at it and I added whatever she wanted to the shopping cart and went to the checkout process. And then as I was going, it recorded me, hmm, I haven't checked to see if this is a secure website or not. So I was at the website and you know how this is up here.

0:31It used to be a padlock that we would see right up here. A lot of browsers will still show a padlock either here or over to the right. Anyway, I looked up there and there was no padlock and it occurred to be, oh, this is not even a secured website. It's just using HTTPS or just using HTTP, excuse me, using port 80. And anything I type into it is subject to being intercepted and stolen by anybody on the internet, for example. So in other words, it was not using transport layer security or TLS.

1:02It was not using a certificate. It was not a secured website. And therefore, I said, I'm not going to enter in my credit card information. I told my wife I couldn't buy it for probably the only thing I haven't bought for. Anyway, so in fact, I actually even asked the company. They had an 800 number or something. So I called the company. I said, hey, why don't you guys have a, don't you have a secure website somewhere and I can order your products? I said, oh no, those websites are too expensive. We're just a small company. We can't afford that kind of thing.

1:32Well, there's no longer an excuse for that. There's no longer a barrier for entry there. There are some that are still retail that you can use if you want. There's a lot of different sources out there. But if you take a look at this, for example, I'm just at digisert.com, common issue of certificates. And you can see here, for example, they have a basic SSL certificate that you could buy. So if I click buy there, let's see how much it adds up to. Look, that's still on the way. That's still $809. So again, for a small company, that might seem a little bit expensive.

2:04Now you can get additional features with a higher level one here. They have some things they've added on that are apparently company specific here. But anyway, you can buy the secure site SSL. We can see here that this does include some things that you might be interested in. It supports a single domain subject to alternative names and wild card domains. Remember, we looked at that earlier, we were looking at the badasssl.com website, right? It was asterisk.badssl.com. Okay, that would be a wild card type of a domain. And this type of a certificate that you might buy would include that.

2:37And it's $1,100. No, wait a minute, $1,331. So again, it's can be a little bit expensive, but you also have support for this. Going back level, what if we went up to the higher level? And apparently they have additional things in here as well. If we were to buy that one, has some of the things that we talked about before. But look at this one, $2,293. And again, it might be worth it to get a paid for certificate. There are free ones out there which we'll talk to you about in a moment.

3:07But what do you get with this one? Well, you get 24/5 chat. I have never heard of 24/5. I guess that's, yeah, five days a week. I guess that makes sense. Usually I'm, I hear that as 24/7, you know, 24/7, 365, that kind of thing. But it's five days a week, 24 hour support for those five days apparently. And you get the highest rated certificate authority, customer service worldwide . Who wouldn't want that? It doesn't get free reissues and replacements for the lifetime of the certificate.

3:39So yeah, I mean, there are some things there's that the support and everything might be worth it to you to go ahead and pay for. However, there are some other options too. So one of those would be let's encrypt. And by the way, CBT Nuggets own website. Let me just go to CBT Nuggets. If we go over here and we go to the site set coming to CB connection is secure item here and take a look at this certificate. You can see that we're using the let's encrypt certificate. These are good certificates and they're free.

4:09If you just go to let's encrypt.org, you'll see that this nonprofit organization gives you the capability of working with these certificates. And getting them really for free. You go to documentation. The documentation is pretty good. You know, you can click on getting started. It gives you a pretty good start on how to work with this. I think it's kind of weird. I'm not sure what's going on here. This is Russian. It says Pasmotryt Nauruskim, which means to read this in page in Russian. It is an American company. I think they're based out of California.

4:39I'm not sure why they have that there, but just for fun. Let's turn on Russian. Hey, so there it is. Anyway, the main point with this is you can get this in a variety of languages. You do get really just all the major features of a certificate that you would need. The reason why they've developed this organization is they just wanted to lower the barriers barriers of entry. And in fact, if we go to the about us page, I think it shows it in here. Oh, it's in the home page. These are all the organizations that are that have thrown in with let's encrypt that have put in backing behind it.

5:11Amazon Web Services, Chrome, Mozilla, Cisco, a meta, which is Facebook and Instagram, Shopify. You can see all kinds of different major, major companies that have thrown in with this to make it available until lower the barrier to entry for a secure Internet. And that's the main goal of this is to make it easy to do that. You can see, remember where you looked at earlier at. Let me show you this again. This hierarchy that you might see in a lot of organizations where you'll have a root CA and one or two intermediate CAs and then some issuing CAs.

5:45They also follow somewhat that that organization except they don't even use directly the same chain of trust here. Take a look at it. They have the root CAs up here, all of which are offline, by the way, like I meant, like I recommended. And then they go right to intermediate CAs, which are also the issuing CAs. Then they have cross certificate trusts. That's why they go kind of horizontally across here. These are different roots, but they're not hierarchical to one another. They trust each other laterally this direction.

6:16I think there's a newer standard over there that trying to adopt and that's probably what's involved there. Next question is, okay, so you can get a certificate. It is free. How do you actually paste it onto your website? You know, do you just drag and drop it? What do you do? Well, that's what cert bots for. Okay, so if you go to cert bot, look at the URL up here at the top. Just go to this, right there. This is a website that depending upon your operating system, like for example, here, I'm specifying that my website would be on patchy or Nginx or, you know, what are the any of these others.

6:51I'll just say Apache, that's the most common web server out there. Usually they will run on Linux operating systems. Anyway, so let's say it's running on Ubuntu version 20. You can see other options right here as well. Windows, Mac, whatever else. But again, some flavor of Linux is very, very common for this. Let's stay there again with Ubuntu 20. But once you do that and you have your certificate in hand, then it tells you the actual steps you'll take in order to make this work.

7:21So they'll go down here and they'll tell you do this log, go to your SSH into your server, install snap D, okay, utility to make this work. You'll install cert bot. You know, there's the command line for it. So it just tells you all the instructions for all of this and then you can confirm that it actually works. So this is a very handy website for those of us that may have never done this before and need a little bit of guidance in order to get from a to Z. Now here's another website you could go to. You could go to SSL labs.com, just as an FYI.

7:52You don't have to memorize this. I just wanted to let you know that you could go here to test the security of your website. And what you do is you'll type in your browser there, not your browser, but you 'll type in your website right here and hit submit. And it'll tell you what your security score is based upon your certificate and some other factors there. And these are just all things that, you know, the internet public can enter something in here. So you can see that different people have various points entered in things. Oh my gosh, I just saw something a little inappropriate. Anyway, I assure you, these are not websites that I have typed in.

8:25Anyway, so let's just use my own website, for example. I have a photography website at James Conrad.fotos. I could say do not show the results on the boards if I want to. Perhaps somebody should have. But anyway, let's click on submit here and it's going to resolve my names. And it's really, it's really another website that does the hosting. Zen folio is who I use for mine. I think I'm on a great B. I'm not quite sure why. But it's testing it against my IP version six address, my IP version four address and so forth.

8:57I'll give it a little bit of time to percolate and we'll see what score I wind up with here. All right, so it gave me a great B for the first one right there. I'm not going to sit here and do all the rest of them. I took a little while to choose just through that one. And you know, B's not too bad. That's the highest score I ever got in school. So anyway, we'll take it. Let's do something else that we know should be in a Amazon.com. Oh, that's already been done. Oh, look, they also got B's. See, so I guess I'm pretty secure after all if I can compare with Amazon.com.

9:27But anyway, these are just a few websites that will help you on your journey if you do need to set up a secure website.

0:00Or let's take a look here at how TLS actually happens. So TLS is kind of the modern way of making a secure connection typically over the internet. It doesn't have to be, but it usually happens over an HTTPS connection. So the HTTPS protocol will carry the traffic for a TLS connection. So they're all kind of interrelated, if you will. Now over HTTPS, in the past, we would have used Secure Sockets layer, or SSL.

0:30And colloquially speaking, we still say SSL a lot of times, but we don't really mean it. OK. Usually what we really mean is TLS. That's the more modern method for making a connection. And you're not really going to find SSL very much, unless you have a very old unmonitored web server that nobody's really been keeping up with. Just kind of sitting there and somebody forgot about it. OK. So we're generally going to be using TLS here, or transport layer security. Now, what happens with this? Well, first of all, there has to be a connection made. So if you're sitting at the client and you're trying to communicate with this server over here, there has to be a connection made first.

1:06And this is going to be an insecure connection. And it's going to be what we call a TCP three-way handshake. Three-way handshake. I'll just put three HS. And so what happens here is that from the client side of things, it will send a packet to the server. And this is going to happen over any kind of TCP connection. It doesn't have to be over the internet. It doesn't have to be with a web server. It doesn't even have to be using HTTPS or TLS or any of that stuff. It could be just a normal file transfer from a file server in your own land. It could be why you're retrieving email or something like this.

1:37So anyway, these connections will start with a sin packet. That's why N. And the sin packet will be sent from the client to the server. When the server receives it, it acknowledges that someone's trying to establish a connection with me. OK. So then it will send back to the client a sin act. OK. And then once the client receives that, the client side will send back an act over to the server. And that would then complete the three-way handshake. We now have a session going on where we've agreed upon the protocol.

2:12And we can start to transmit data back and forth. And once that happens, then in this case, we're ready to start the next stage of things if we're going to communicate with a TLS secure web server. We need to start getting things secured here. OK. So at this point, which we've made the three-way handshake, the connection is still unsecured, or some people would say insecure. But anyway, it's not secure regardless. So what happens next? We need to establish security using certificates initially here.

2:42OK. So what will happen here is the client will acknowledge that it's connecting usually with an HTTPS server. And it knows it's using that protocol, because that's what's been typed into the browser, for example, or it's been redirected to an HTTPS server. So the client will start a conversation within our established TCP connection, and it will send a hello. OK. Over here to the server. And then there's several other packets that go back and forth. But basically what happens here is it's a certificate check that occurs, but the server will send back its hello, and it will also send back a certificate.

3:16That's supposed to look like a certificate. Anyway, so it's sending back now also a certificate to the client side, and it will also send back another packet over here that just says, it's a hello done packet. It just completes that send over to the client. Now it looks a little one-sided because the client only sent one hello, and the server sent three messages back to the client, but it doesn't have to be equal. OK. That's just how it works out. So now what happens, though, is that the client has a copy of that certificate.

3:47Now remember, the server is not going to send out a certificate with a private key. OK, so it's only going to have the public key on there, and that's really all we need. So the client then needs to use that certificate to number one, check that certificate because it's probably been received from a certification authority somewhere else. OK. So if it was issued from, say, Let's Encrypt, then this is going to be signed by Let's Encrypt, and it's going to validate that with Let's Encrypt here, and also check to see locally if there are any revoked certificates or anything like that that would cause us not to trust that certificate.

4:23But assuming that it is a trustworthy certificate, something else will occur. What's going to happen here is that we need to establish a session key. OK. And the session key is actually going to be using what we call symmetric encryption. I might say, James, I thought for sure you said that with TLS, we use awesome metric encryption. It's kind of a half truth, kind of like the things I told my wife before we got married. Yes, half truth. If I told her the whole truth, she would have never married me. So anyway, so what we have here is a session key that's going to actually be used for symmetric encryption.

5:00OK. The key here, though, is that that session key is then encrypted. So we have a encrypted copy. Let's put an E in there. So we have an encrypted copy here of that session key. OK. How was it encrypted with this public certificate? OK. Because we have that public key in the certificate. So now we can encrypt it. Now, remember what we've talked about with awesome metric encryption? Who can decrypt something that was encrypted with a public key? Only the holder of the certificate that also has the private key.

5:34OK. So since we have that now encrypted with the public key, it gets sent over here to the server side. Now, the server has that session key, and it's decrypted because it's got the private key. So it's decrypted it, and now it sees the same session key over on this side of things. Now, what happens is any data that gets transmitted back and forth will be using the same session key. So it's kind of both. It uses a symmetric key, but the key was encrypted and sent to the server by using awesome metric encryption.

6:10In other words, it encrypted it with a public key that only the server could decrypt with the private key. And so now if I have some data, let's just say that this is some kind of a data , whatever it is, when we send it, it gets encrypted with the session key here. That data then gets received by the server on this side, and then it gets dec rypted as well by the same session key. And so that's the essential details of how this encryption happened. Now, a couple of things to keep in mind here, after the TCP three way handshake , when it starts to establish that TLS connection, one of the things that it will do is it will establish and agree upon the two server and the client here, which version of TLS is in use.

6:51So there's a version 1.0, which is considered insecure. There's also a 1.1, 1.1, which is also considered insecure, but TLS 1.2 and 1.3 are good. Okay, those are considered secure. And they also established this session faster than the older TLS 1.0 and 1.1. Okay, so we showed pretty much three different exchanges that took place through here, basically two round trips after the TLS connection.

7:23Well, with this with 1.2 and 1.3, it only needs one round trip in order to establish the secure connection. And TLS 1.3 is probably what's most common right now, and it's supported in all major browsers. You shouldn't have to dig for it. Also, that session key that was established, which we exchanged with the server , and now both sides have that, it uses a Diffie-Hellman exchange. We talked about that in the past in a previous skill, but Diffie-Hellman uses a unique method of math that will calculate the session key independently on both sides.

7:59And yet, they will both come up with the same result. Also, just so you're aware of where we've come from with SSL here, SSL would use a hash, it would be using an MD5 or a SHA1 hash. These are just two algorithms that are used for performing hashing. Well, those are considered insecure, not because someone can reverse engineer them and derive the original message, but because they're vulnerable to collisions. Yes, there's actual math that could occur where you would have two separate messages that would wind up with the same hash digest or the same result.

8:37So for that reason, both of these were no longer considered secure because they could kind of be "bool", if you will. Also, SSL used encryption that was DES, again, we've talked about that in the past, digital encryption standard. That was insecure, and RC4 was also considered insecure. So, those are the reason why SSL is no longer really in use. However, when it comes to TLS, TLS does hashing with SHA-256, which is collision resistant is what we say.

9:10And for the encryption, it's going to be using the advanced encryption standard , which we've also previously discussed, and it's a pretty solid encryption mechanism. And so that's kind of a high-level overview of how TLS works.

0:00Or would I have an important message for you today? And here it is. Can you guess what that is? Yeah, nobody can, right? It's going to be pretty difficult to try to figure out what I'm saying. This is really just a brief sentence that I have hashed into something that's pretty well obfuscated and you can't guess. And that's exactly what hashing data is. Now, it often gets confused with encryption because both of them, you can't figure out the original, right? It's the difference is encryption.

0:30You can decrypt it hashing. You can never reverse it. Okay. So it's not the same as encryption, although sometimes especially when people are getting started in cryptography and things, they kind of tend to confuse the terms, right? So with hashing, what we do is we input some data. I'm going to show you that here in a little while. And what will happen next is it will apply what we call a one way algorithm. It's math that you use that is applied against whatever the input is. And then it generates a unique result.

1:01There should not be any possibility mathematically or in the universe of two exact results being produced with different data. If you put the exact same data in, you should be able to get the exact same result out of it with the same result that we mentioned here. Okay. You'll see that again here in a moment. All right. So some hash implementations. Why would we use it and where would we use it? One of those places we would use it would be something called data integrity. This is simply because we want to make sure that maybe data that we download is authenticated in the sense that it's the original.

1:38It's not changed data. So we have a website here and we're trying to download a file. Sometimes you'll see that on that webpage, they will say our hash is and then they'll put something strange like that. Now there's a number of different ways this could go. For example, some hashes depending on if it's using base 64, which is a numbering system, or whether it's using hex, whether it's going to be able to produce these kind of results because the hex doesn't use an X or a Y or an exclamation point, but base 64 could. So anyway, but the point is it's going to be obfuscated into something weird, right?

2:12And only this, this specific file running through a specific hash should be able to produce that result. On my computer down here, you know, here's my computer, when I receive that same file, I should be able to run it through the same hash and get the exact same result. It should look exactly the same. What does this do for me? It validates that I'm downloading the exact original file as the source. No, it's not just because a hacker might have manipulated it in transit or something like this or planted malware.

2:43It could also be simply that my Wi-Fi hiccups and then it corrupted the file on the way down. So that could have also happened. But regardless, you want to make sure that the file has integrity that it needs to have. The other thing you could use there for it would be password storage. We don't really normally do that in terms of us directly applying a password hash to a password. But what happens there normally is that whatever operating system you're using will apply a specific hash to the user's passwords in that way they're then obfuscated.

3:17So for example, here I am on a Linux Mint computer and on most distributions of Linux you'll find this password file in the same place. There's a file in the Etsy directory called shadow. This is what's going to contain information about our user accounts in addition to the fact that it will contain the password. However, it's not the actual password as you will see here when I run sudo, which elevates my privilege and run cat, that's just a simple word processor if you will. It just kind of dumps out onto the screen what I'm trying to see.

3:48And then there's the passwords file, which is actually kind of a file that contains information about our user accounts. That's called shadow. So if I press enter here, then we see some user accounts here. So for example, this is my trainer account with the password hash. Okay. Trying to figure out what the password is out of that. And in fact, it even identifies for me what kind of a hash it's using. So for in this case, there's something called yes crypt, which is a little bit of a misnomer because it's not actually not actually encrypting something.

4:19It's really just hashing something. But anyway, it's called yes crypt. And I can tell by looking at the prefix to this right here, dollar sign, why dollar sign means that it's yes crypt. If we would have instead have see dollar sign, $5 sign, that would be shot to 56. So there's different codes. The beginning of that actually, there's an article for it all. I got to hear somewhere. I'll link it at the bottom so you can see that anyway. After that, this is the hash of my password. By the way, all of my users here, as I recall, at least they, I think they're all using the same exact password.

4:55But if we look at the hash, they should match. If they're all using the same password, they should match, right? But look, there's me, right? My trainer account kind of just memorize that real quick. And then there's Lalo here. There's actually another wonderful trainer we have here at CBT Nuggets, but that has to look the same. Okay. It starts the same because we're using yes crypt, but after that, it kind of falls apart. We don't really have anything in common here. So how are they using the same password then if the hashes don't match? Well, there's something there called salt, S-A-L-T.

5:26It will take the hash and it will combine it with a unique value. It's just completely randomized and it will combine that mathematical value with the original algorithm and then produce a unique result there. So even though we have the same password, I can't tell by looking. And the advantage of that, by the way, is that if a hacker were to get a hold of this file and to be able to see one of these password hashes and somehow figured out , for example, they could run a brute force attack against it. They could run a rainbow table against it, something like this, then they would be able to identify any other hashes that looked exactly the same.

6:03They did no right away that we were using the same password for both of those accounts. All right. Another way that it's used would be for digital signatures. We actually have seen that too. Let me show you. So if I bring over a certificate, for example, that's just on my computer here, you will see here that we have a signature hash algorithm here that's being used because there's a unique signature affixed to this particular certificate that validates that it was truly signed by whichever authority signed it.

6:34That way that signature cannot be faked. It's also useful for data deduplication. Let me explain a little bit what that's about. So let me explain it this way. I was at the Grand Canyon a few years ago. I'm also a photographer. And here in this photograph, there was an obstruction. I can't remember exactly where it was, but let's just say it was a twig. I think it might have been out of here or something. And it kind of shot way up into here and it looked kind of weird. It was a little distracting. So I just photoshopped it out. No, it wasn't a twig. What was it?

7:04Oh, it was a rock. It's down on the bottom here. You can't really see it from this viewpoint, but let's see if there was a rock down here. And it was an exposed rock and it just looked kind of, it was at a frame from where we are right now, but it just, it was distracting. So I wanted to get rid of it. I have photoshopped it out. I also have a backup of this file. So before I removed that rock, I had the original file and it would back up. Okay. So the way backup works is it backs up in blocks of data. Okay. So my backup program would back this up. It would back this up, back this up, back this up, back this up, this up and, you know, it would be this chunk of trees and this part of the sky and so forth all along .

7:42So it backs up a block of data at a time. But there's a unique signature assigned to the file once it's done backing up the entire file. Let's just say I'll put, you know, a real small hash here, you know, five AC when it's done with its full backup. Okay. So it's a full backup and let's just say the hashes five AC. I'm abbreviating of course, because you saw that hashes are super long. I'm not going to write all that out. Anyway, then when I came back in and I edit this file so that I remove that rock, all of these blocks up along the top of the same, that hasn't changed.

8:17Okay, that hasn't changed. That hasn't changed. That hasn't changed. None of that stuff's changed down here. There's a noted change that data is not the same. Therefore my hash is not going to be the same. And it's going to know that it needs to back up this file again. Now there's a couple of things that will happen here. Let's say we're using something called an incremental backup and I'm getting off topic a little bit, but still makes the point an incremental backup only backs up the changes. So as soon as it notices the change to the hash, it knows the file needs to be backed up again.

8:47But as it looks through the data, it can identify only the change to data and only backup the change where I remove the rock at the bottom of the screen instead of having to backup all of the original data all over again. It's also useful for something called data deduplication. It kind of follows a similar criteria here. So let's say I've got a couple of big files here, you know, 10 gigabyte files. Turns out these are the same file. They might be stored in different directories. It just so happens that we have the same copy of files, two separate directories.

9:19So therefore our backup routine since it sees them in different directories, it backs them both up separately. And as a result, now we've kind of wasted 10 gigabytes here because we already had the file here. We don't really need another copy here. So what data deduplication does is it will run a hash against both of these files. And if the result is the same, it knows that it can delete one of these files because we really actually already have it. And then what it'll do is it will just kind of put a marker, think of like a shortcut or something like that. It'll just put a marker in its place.

9:51So if we do need to recover this data from that folder, then we'll actually just recover this file and put it in that folder. And then there's also blockchain, which you may be familiar with. That's used a lot in crypto. And that's a lot of different hashing algorithms go into this. But that again is how it can validate that data has not been cheated and someone hasn't artificially manufactured a Bitcoin for themselves or something like this. So the transactions really is what happens in the blockchain so that transactions cannot be cheated. I might send somebody a 1/100 of a Bitcoin and with a blockchain in place, it can validate that they did not add or subtract anything from that.

10:31So instead of a 1/100, it's a 10th so that they didn't change the value there. And that again is how the blockchain is used in crypto. And it's very oversimplified, but it does use hashing to make sure that data is not manipulated. So remember that message that I put it at the beginning of the video here was a hashed value. It looked like that. Okay, and why? Because I had hashed this sentence. Okay. Like that in, you can't guess this sentence.

11:03And when I hashed it, it hashed it to exactly that value. And in that case, I was using an MD five hash. Okay, I'm going to go back to this value. You can see different ways you can use you can use hex lowercase hex with u ppercase different format of hex, which is a colon separated here. And you can use base 64, which is just a different numbering system as well. I'm just going to take this all caps version. It's a little bit easier to read. And I'm going to copy that into notepad. Oh, I forgot I had this left open. Might as well mention this member earlier, I mentioned I had a smishing attempt .

11:35This was a certificate that was attached to that website. Okay, remember I said it's really just mostly a bunch of text. There it is. Anyway, I'm going to paste in that hashed value and make that a little bigger. So it's easier to read. And there we have it. Okay. Now, notice what happens here if I go back and I make any change to this whatsoever, instead of an exclamation point, I put a period in, then we'll be run the hash again. It's just an MD five. And I'm using that partially because it processes fast and it doesn't take very long to run. Now when I look at this hex value, go back to notepad and paste that and notice that it's completely different.

12:12It's not just as if the two changed to a three or something like that at the end, because that was the last day that we changed was a little period or an exclamation point at the end. We call the avalanche effect where any change wildly affects the entire result. And that's useful because if a hacker was able to see that, oh, that just changed from a two to a three or something like that, then they would say, oh, I know I'm almost there. Maybe I'll just change the punctuation at the end and be able to figure out what the password is. So this prevents that sort of thing from happening. Now there's also kinds of other things here that are kind of useful actually.

12:44This is pretty handy little website and I just Googled for this. And if we go back here, you can see they have a whole bunch of other different conversions that we can use here, different hash methods that we can use. Some of them I haven't even heard of might be kind of obscure. Oh, whirlpool reminds me, I need to do the laundry. Anyway, so we also have some of the more common ones that you might see shot 256. That's very common. 384. I haven't seen a lot, but it's out there. And then shot to shop five 12 is another common one as well. 95 is common, blowfish is common, not usually in windows, but in other operating systems.

13:19So those are some of the more common ones that you might see out there. So as another example here, I've gone here to tally.org. Callie Linux is it's just a distribution of Linux. Callie Linux is a hackers version of Linux. I think the guts of it are actually Debbie and Linux, but it's got a bunch of tools installed along with it, which are very handy for hackers to be able to use. Now you could come up with your own installation of Linux and download all the tools and find them. But a lot of them honestly are also packed with malware of their own.

13:51So Callie Linux, they go through great lengths to make sure we're getting clean copies of any utilities that we use so that we can pack other people in good conscience. So anyway, you can see here that there is a file that we can use. We can actually put this on a phone. Okay, this is a full installation of Callie Net Hunter Pro. It's used for mobile devices and we could download and install this onto a micro SD card, put it in our device and then boot from that device and run kind of a very thin version of Callie Linux on our phones.

14:27Anyway, the point I'm getting with this is if I want to download it, look at this Callie Linux image with Bosch or Pinephone, I could check the sum of this, the check sum, check sum and that's a SHA-256 sum. In other words, just the hash of that data, right? I'm going to copy that, put that in my clipboard right here. Then I'm going to download it and I'm going to run that through that same hash generator to see if I get the same result. And then I've got the file downloaded right here and it was too big for the online version and you have to upgrade or something like that.

15:03So I have a local copy of a utility that I could use with this as well. So I'm just going to go ahead and open this up here and we can see here that it is now hash this data and there it is. So hash that, let me put that back in my clipboard and we should see that character for character it should match up exactly. So this tells me then that I know I downloaded the exact same copy of that file and it has not been modified in any way.

0:00So let's kind of summarize here the differences between encryption and hashing just to avoid again any potential overlap in the concepts here. The purpose for encryption is to protect the confidentiality. We don't want somebody else to be able to read that same data that we're trying to protect. Only the intended parties should be able to read that data, but while it's encrypted, nobody can read it, even including people that are supposed to be able to read it. Okay, then there's also the verification of integrity under hashing. We're not trying to encrypt anything.

0:32Although, to be honest, it does kind of work that way as well. Remember, I was showing you earlier, the shadow file in Linux. Well, that was hash values. And so then it obfuscated , or if you will, encrypted that data. But the difference there is whether or not it's really reversible. Okay, so we were able to verify the integrity of the passwords there. But when it comes to reversibility, encryption is reversible. So the person that we want to be able to read the data, it's not very much use unless they can decrypt data that has been previously encrypted.

1:05Otherwise, might as well just be erased, useless. Hashing is irreversible. I cannot take a hashed value and reverse the math and figure out what the original was. The output length for encryption is variable. So, you know, I might be encrypting an entire disk and all of the different blocks on the disk. It usually does it a block at a time. Well, with encryption like that , which is again, remember, which is going to be symmetric if we're using something like BitL ocker. Well, since the data is variable in size, so is the result. However, with hashing, it 's always a fixed result. It's a fixed length. I can encrypt a period, or I can encrypt entire paragraph. And the length will be the same depending on the encryption algorithm I'm using. So common uses for encryption files, of course, or entire drives. We used EFS for files or drives. You can use Veracrypt, you could use BitLocker, that sort of thing. It's also used in e- commerce. So, when we use TLS across secure websites, we are encrypting that data to the destination. And then on the destination, though, web server or whatever it is that's receiving that data can then decrypt that data. So for hashing, we can fact we can hash file downloads. We can hash email to make sure that that hasn't been modified in transit passwords, which we already saw

2:21there. And just again, for overall integrity to make sure that something has not been changed, such as in the blockchain, or the algorithms we have the grants and advanced encryption standard RSA and digital encryption standard for algorithms under encryption and lots of other ones. Some of the common ones we use under hashing would be MD five, which is messes digest five, SHA one, which is not considered secure, but still out there. And then Shaw 256.

0:00Alright, let's go ahead and take a look at this validation. We're just going to get some practice and working with some of the things that we looked at in this particular skill. So, first of all, let's go ahead and look at this website. There's a link for it. You should be able to just click there and it will take you. I've already got the website open and enter in the name of your own company's web server or some other server of your choosing if you want. And then let's see what kind of a security score your site got. Okay, so I'm going to go over here and because some people enter in crazy websites here, I kind of had to move my browser down to conceal some things.

0:36Anyway, let's just enter something in. I'll enter in Microsoft this time. How about that? Microsoft.com. And look, what do you know, but they are a plus all the way down through, even more secure than Amazon apparently. So anyway, that's just a good way to check out. And it gives you kind of a thumbnail idea of the level of security that your web server has. If you click on these, by the way, like I just clicked on that first link there for the first IP address, then it shows me various details about why it got such a good grade.

1:08Okay, so for example, this server supports TLS 1.3. We talked about that earlier. That's the most recent version and the most secure version. So that's certainly going to add to the score of an A plus here. It shows us all the common names that are going to be in use for that particular website. Alternative names. Wow, Microsoft's got a lot of different names. Okay, probably somewhere in here is the alternative name of the evil empire. Anyway, so they've got a lot of stuff in here. You can see this serial number.

1:39By the way, all of this stuff is stuff you should be able to see if you just open their certificate like we did in our last skill. By the way, this is interesting. Let me go down here and zoom in a little bit. Microsoft has actually had some certificates revoked because there were some certificates that got compromised in the past years ago now. And I think it was a social engineering attack. We'll talk more about that in a future skill, but there's a certificate revocation list that Microsoft publishes and then this is accessible from the Internet.

2:12And then your browser will in the background can automatically go to that CRL and see if they're accessing a certificate that has been revoked. Anyway, this is kind of a bottomless pit. I'm tempted to kind of keep exploring here, but look, it shows what TLS protocols it supports. Remember, I said it was already 1.3, but it could be communicating with another web server that only supports 1.2, which is still good. But notice that it's not compatible with, oh, you know, 1.1, 1.0, any of these other kinds because they're just not trustworthy.

2:44Also, what kind of cipher suites it supports? AES, why don't we talk about that earlier? AES 128 on its own is really good security, but this will go up to 256 according to this. Oh, actually goes up to 384 judging from that. So anyway, I won't go through that much further, but it's definitely a very good website to go to to get more details about various types of certificates and to learn more about them. So here we went to cert bot. This is the next item in instructions. Let's go down here. Go to this site. That's where I just was.

3:14Select a web server and operating system, and then look for the instructions on how to install the web server's certificate. Okay, so if I had Nginx, for example, and I was running it on, you could just pick anything. It's kind of arbitrary. Let's say I was putting it on to ODB in 10, which is another flavor of Linux. Then this actually tells me specifically all the details I need to do in order to install it. Now, we haven't been doing that. We're not installing it. We're actually going through the steps, but I want you to know where you can go .

3:46It's quite easy to use. If you need to find the steps necessary to get a certificate installed on your web server. So it's really, really very handy. And they have a lot of interactions here as well with let's encrypt, which remember, this is where we can get those free certificates. All right. And then the next thing was go to this site and hash any data you want. Okay, so this is the same website I was at earlier in our particular skill. And you can just choose one of these. Let's just choose something that is not very common. I haven't ever actually heard of this one. Ripe MD, doctor that doesn't wear deodorant, apparently.

4:18Anyway, let's go down here and just enter something in this hash stinks. Okay. And we'll just put that in there and start it. And it should then go ahead and hash it for us. Now, notice that it does take a little bit of time. It's not instant. Depending upon the level of hashing you're using, the more computationally expensive it is. And that's why sometimes depending upon the security requirements, an organization might use a less complicated hash simply because it requires fewer computational cycles and they'd rather have performance over a very high level of security.

4:54They're willing to take an acceptable risk, in other words, in order to be able to get the performance out of it. So here we go. We got a value out of this. And again, there's several different ways that it can be expressed. We didn't get into a lot of detail on it earlier, but this is actually the same hex value. It's just that it's separated by colons to make it more readable because this will make you a cross side trying to read that out loud or something like that. But this at least in terms of human readability makes it a little bit easier. Now, the other thing was we could go back and make a change to this.

5:26So you can use notepad if you want or if you've memorized that. Well, great. I wish I could memorize something that easily. Anyway, I'm just going to enter in notepad here and just enter in that value. Just going to paste that in. And then I'm going to go back and make one small change, maybe add another ex clamation point. So now we have two exclamation points, a little bit of time to percolate here once again. And now I see that I've got this hex value. And since I didn't remember the previous hex value, I don't know if it's the same or not, but I'm sure it's not.

5:56Because I added an exclamation point. Remember, this is where we have a cascading that takes place in Avalanche effect, that is, where even the smallest change will completely change all of the results. And this is also known as by the way, a digest. So you took the data and you digested it, so to speak, through the mathematical algorithm. And this then is what was digested or that's the digest. So that was the third thing we did there. And that then concludes this particular skill. I hope this has been informative for you. I'd like to thank you for viewing.