X.509, Web Certificates, and Hashing

0:00All right, now under the current requirements for the 020-100 exam, there's a

0:04term that you have to know about it's called X 509.

0:08Okay, it's kind of a weird name, but it's just a standard that identifies

0:13various types of formats for a certificate.

0:17Okay, that's really all it is. It's the formatting standard. It's pretty much

0:20the standard that's being used.

0:22A lot of the common fields you'll see there will be things such as which format

0:25is being used, and it's the X dot 509 format.

0:29The issue were in the subject that's who issued the certificate and who's

0:32receiving the certificate.

0:34The public key, which will appear there, the digital signature, validity period

0:39, key usage extension and revocation.

0:40Okay, now I kind of rushed through those, didn't I?

0:43But the reason why is because we actually have those all, and we've seen a lot

0:46of that already in the past, all right?

0:48So, for example, issued two, that's the subject, issued by or issued ER, that's

0:54whoever issued it.

0:55This one's a self-signed certificate, so my own computer issued it and they

1:00issued it to itself.

1:01Okay, so that's kind of the idea there.

1:03The validity period, we're seeing that right there. That's just a X dot 509

1:07field.

1:07Okay, if we look at the details, we see more of these kinds of fields that we

1:11might see again.

1:12There's the subject, in other words, who's receiving this certificate.

1:16There's our public key, which we see right down here.

1:18Up here, there's also signature algorithms, in other words, which signature is

1:22being used.

1:23We'll talk again more about hashes and that sort of thing in an upcoming skill.

1:29There's also enhanced key usage, in other words, what the purpose of the key

1:33would be.

1:34And also, we didn't really see it here, but extensions, that would be things

1:37such as maybe an alternative name.

1:40That's a very common one, for example, for a website, for example.

1:43So, maybe we used to have a company that was named YZ.com, and our certificates

1:49are generally for XYZ.com,

1:52but we got acquired by another company called ABC.com.

1:56And so, you can add that into an extension for a certificate.

2:00So, now, the certificate would be valid for either one of these DNS names.

2:06But anyway, those are some examples of what you'll see as far as X dot 509

2:10certificates

2:11and the common fields that are there.

0:00And now I just kind of want to talk to you about issuing certificates for

0:03something like a website or predominantly really websites.

0:07So years ago, my wife asked me to go to a website and buy something for it.

0:13I don't really remember what it was, but it was a shopping website.

0:16And so I went there and I started to look at it and I added whatever she wanted

0:21to the shopping cart and went to the checkout process.

0:24And then as I was going, it recorded me, hmm, I haven't checked to see if this

0:27is a secure website or not.

0:28So I was at the website and you know how this is up here.

0:31It used to be a padlock that we would see right up here.

0:34A lot of browsers will still show a padlock either here or over to the right.

0:37Anyway, I looked up there and there was no padlock and it occurred to be, oh,

0:42this is not even a secured website.

0:44It's just using HTTPS or just using HTTP, excuse me, using port 80.

0:50And anything I type into it is subject to being intercepted and stolen by

0:55anybody on the internet, for example.

0:58So in other words, it was not using transport layer security or TLS.

1:02It was not using a certificate.

1:03It was not a secured website.

1:05And therefore, I said, I'm not going to enter in my credit card information.

1:09I told my wife I couldn't buy it for probably the only thing I haven't bought

1:13for.

1:14Anyway, so in fact, I actually even asked the company.

1:18They had an 800 number or something.

1:20So I called the company.

1:21I said, hey, why don't you guys have a, don't you have a secure website

1:24somewhere and I can order your products?

1:26I said, oh no, those websites are too expensive.

1:29We're just a small company.

1:30We can't afford that kind of thing.

1:32Well, there's no longer an excuse for that.

1:33There's no longer a barrier for entry there.

1:36There are some that are still retail that you can use if you want.

1:39There's a lot of different sources out there.

1:41But if you take a look at this, for example, I'm just at digisert.com, common

1:45issue of certificates.

1:47And you can see here, for example, they have a basic SSL certificate that you

1:51could buy.

1:52So if I click buy there, let's see how much it adds up to.

1:55Look, that's still on the way.

1:57That's still $809.

2:00So again, for a small company, that might seem a little bit expensive.

2:04Now you can get additional features with a higher level one here.

2:08They have some things they've added on that are apparently company specific

2:11here.

2:11But anyway, you can buy the secure site SSL.

2:15We can see here that this does include some things that you might be interested

2:18in.

2:18It supports a single domain subject to alternative names and wild card domains.

2:22Remember, we looked at that earlier, we were looking at the badasssl.com

2:27website, right?

2:28It was asterisk.badssl.com.

2:31Okay, that would be a wild card type of a domain.

2:33And this type of a certificate that you might buy would include that.

2:37And it's $1,100.

2:39No, wait a minute, $1,331.

2:42So again, it's can be a little bit expensive, but you also have support for

2:48this.

2:48Going back level, what if we went up to the higher level?

2:51And apparently they have additional things in here as well.

2:54If we were to buy that one, has some of the things that we talked about before.

2:57But look at this one, $2,293.

3:00And again, it might be worth it to get a paid for certificate.

3:05There are free ones out there which we'll talk to you about in a moment.

3:07But what do you get with this one?

3:08Well, you get 24/5 chat.

3:13I have never heard of 24/5.

3:16I guess that's, yeah, five days a week.

3:18I guess that makes sense.

3:19Usually I'm, I hear that as 24/7, you know, 24/7, 365, that kind of thing.

3:25But it's five days a week, 24 hour support for those five days apparently.

3:29And you get the highest rated certificate authority, customer service worldwide

3:34.

3:34Who wouldn't want that?

3:35It doesn't get free reissues and replacements for the lifetime of the

3:38certificate.

3:39So yeah, I mean, there are some things there's that the support and everything

3:43might be worth it to you to go ahead and pay for.

3:46However, there are some other options too.

3:48So one of those would be let's encrypt.

3:50And by the way, CBT Nuggets own website.

3:52Let me just go to CBT Nuggets.

3:54If we go over here and we go to the site set coming to CB connection is secure

4:00item here and take a look at this certificate.

4:02You can see that we're using the let's encrypt certificate.

4:05These are good certificates and they're free.

4:09If you just go to let's encrypt.org, you'll see that this nonprofit

4:12organization gives you the capability of working with these certificates.

4:17And getting them really for free.

4:19You go to documentation.

4:20The documentation is pretty good.

4:21You know, you can click on getting started.

4:23It gives you a pretty good start on how to work with this.

4:26I think it's kind of weird.

4:27I'm not sure what's going on here.

4:29This is Russian.

4:30It says Pasmotryt Nauruskim, which means to read this in page in Russian.

4:35It is an American company.

4:37I think they're based out of California.

4:39I'm not sure why they have that there, but just for fun.

4:41Let's turn on Russian.

4:42Hey, so there it is.

4:43Anyway, the main point with this is you can get this in a variety of languages.

4:48You do get really just all the major features of a certificate that you would

4:52need.

4:52The reason why they've developed this organization is they just wanted to lower

4:56the barriers barriers of entry.

4:58And in fact, if we go to the about us page, I think it shows it in here.

5:03Oh, it's in the home page.

5:05These are all the organizations that are that have thrown in with let's encrypt

5:09that have put in backing behind it.

5:11Amazon Web Services, Chrome, Mozilla, Cisco, a meta, which is Facebook and

5:18Instagram, Shopify.

5:19You can see all kinds of different major, major companies that have thrown in

5:24with this to make it available until lower the barrier to entry for a secure

5:29Internet.

5:29And that's the main goal of this is to make it easy to do that.

5:33You can see, remember where you looked at earlier at.

5:35Let me show you this again.

5:36This hierarchy that you might see in a lot of organizations where you'll have a

5:41root CA and one or two intermediate CAs and then some issuing CAs.

5:45They also follow somewhat that that organization except they don't even use

5:50directly the same chain of trust here.

5:52Take a look at it.

5:53They have the root CAs up here, all of which are offline, by the way, like I

5:57meant, like I recommended.

5:58And then they go right to intermediate CAs, which are also the issuing CAs.

6:03Then they have cross certificate trusts.

6:06That's why they go kind of horizontally across here.

6:09These are different roots, but they're not hierarchical to one another.

6:13They trust each other laterally this direction.

6:16I think there's a newer standard over there that trying to adopt and that's

6:20probably what's involved there.

6:21Next question is, okay, so you can get a certificate.

6:25It is free.

6:26How do you actually paste it onto your website?

6:28You know, do you just drag and drop it?

6:30What do you do?

6:31Well, that's what cert bots for.

6:33Okay, so if you go to cert bot, look at the URL up here at the top.

6:36Just go to this, right there.

6:38This is a website that depending upon your operating system, like for example,

6:43here, I'm specifying that my website would be on patchy or Nginx or, you know,

6:50what are the any of these others.

6:51I'll just say Apache, that's the most common web server out there.

6:55Usually they will run on Linux operating systems.

6:58Anyway, so let's say it's running on Ubuntu version 20.

7:01You can see other options right here as well.

7:03Windows, Mac, whatever else.

7:06But again, some flavor of Linux is very, very common for this.

7:11Let's stay there again with Ubuntu 20.

7:13But once you do that and you have your certificate in hand, then it tells you

7:18the actual steps you'll take in order to make this work.

7:21So they'll go down here and they'll tell you do this log, go to your SSH into

7:26your server,

7:27install snap D, okay, utility to make this work.

7:30You'll install cert bot.

7:32You know, there's the command line for it.

7:33So it just tells you all the instructions for all of this and then you can

7:37confirm that it actually works.

7:39So this is a very handy website for those of us that may have never done this

7:43before and need a little bit of guidance in order to get from a to Z.

7:47Now here's another website you could go to.

7:48You could go to SSL labs.com, just as an FYI.

7:52You don't have to memorize this.

7:53I just wanted to let you know that you could go here to test the security of

7:57your website.

7:58And what you do is you'll type in your browser there, not your browser, but you

8:02'll type in your website right here and hit submit.

8:04And it'll tell you what your security score is based upon your certificate and

8:09some other factors there.

8:10And these are just all things that, you know, the internet public can enter

8:13something in here.

8:14So you can see that different people have various points entered in things.

8:18Oh my gosh, I just saw something a little inappropriate.

8:20Anyway, I assure you, these are not websites that I have typed in.

8:25Anyway, so let's just use my own website, for example.

8:28I have a photography website at James Conrad.fotos.

8:33I could say do not show the results on the boards if I want to.

8:36Perhaps somebody should have.

8:38But anyway, let's click on submit here and it's going to resolve my names.

8:42And it's really, it's really another website that does the hosting.

8:45Zen folio is who I use for mine.

8:48I think I'm on a great B. I'm not quite sure why.

8:51But it's testing it against my IP version six address, my IP version four

8:56address and so forth.

8:57I'll give it a little bit of time to percolate and we'll see what score I wind

9:00up with here.

9:01All right, so it gave me a great B for the first one right there.

9:05I'm not going to sit here and do all the rest of them.

9:08I took a little while to choose just through that one.

9:10And you know, B's not too bad.

9:12That's the highest score I ever got in school.

9:14So anyway, we'll take it.

9:17Let's do something else that we know should be in a Amazon.com.

9:20Oh, that's already been done.

9:21Oh, look, they also got B's.

9:23See, so I guess I'm pretty secure after all if I can compare with Amazon.com.

9:27But anyway, these are just a few websites that will help you on your journey if

9:31you do need to set up a secure website.

0:00Or let's take a look here at how TLS actually happens.

0:04So TLS is kind of the modern way of making a secure connection

0:08typically over the internet.

0:10It doesn't have to be, but it usually happens over an HTTPS connection.

0:14So the HTTPS protocol will carry the traffic for a TLS connection.

0:20So they're all kind of interrelated, if you will.

0:23Now over HTTPS, in the past, we would have used Secure Sockets layer,

0:28or SSL.

0:30And colloquially speaking, we still say SSL a lot of times,

0:33but we don't really mean it.

0:34OK.

0:35Usually what we really mean is TLS.

0:38That's the more modern method for making a connection.

0:41And you're not really going to find SSL very much, unless you have a very old

0:45unmonitored web server that nobody's really been keeping up with.

0:49Just kind of sitting there and somebody forgot about it.

0:50OK.

0:51So we're generally going to be using TLS here, or transport layer security.

0:55Now, what happens with this?

0:57Well, first of all, there has to be a connection made.

0:59So if you're sitting at the client and you're trying to communicate with this

1:02server over here,

1:04there has to be a connection made first.

1:06And this is going to be an insecure connection.

1:09And it's going to be what we call a TCP three-way handshake.

1:12Three-way handshake.

1:13I'll just put three HS.

1:14And so what happens here is that from the client side of things,

1:17it will send a packet to the server.

1:19And this is going to happen over any kind of TCP connection.

1:22It doesn't have to be over the internet.

1:23It doesn't have to be with a web server.

1:25It doesn't even have to be using HTTPS or TLS or any of that stuff.

1:28It could be just a normal file transfer from a file server in your own land.

1:34It could be why you're retrieving email or something like this.

1:37So anyway, these connections will start with a sin packet.

1:40That's why N.

1:42And the sin packet will be sent from the client to the server.

1:46When the server receives it, it acknowledges that someone's trying to establish

1:50a connection with me.

1:51OK.

1:52So then it will send back to the client a sin act.

1:56OK.

1:57And then once the client receives that, the client side will send back an act

2:02over to the server.

2:04And that would then complete the three-way handshake.

2:06We now have a session going on where we've agreed upon the protocol.

2:12And we can start to transmit data back and forth.

2:14And once that happens, then in this case, we're ready to start the next stage

2:19of things

2:19if we're going to communicate with a TLS secure web server.

2:23We need to start getting things secured here.

2:26OK.

2:26So at this point, which we've made the three-way handshake,

2:29the connection is still unsecured, or some people would say insecure.

2:34But anyway, it's not secure regardless.

2:36So what happens next?

2:38We need to establish security using certificates initially here.

2:42OK.

2:42So what will happen here is the client will acknowledge that it's connecting

2:46usually

2:46with an HTTPS server.

2:48And it knows it's using that protocol, because that's what's been typed into

2:51the browser,

2:52for example, or it's been redirected to an HTTPS server.

2:56So the client will start a conversation within our established TCP connection,

3:01and it will send a hello.

3:03OK.

3:03Over here to the server.

3:05And then there's several other packets that go back and forth.

3:07But basically what happens here is it's a certificate check that occurs,

3:11but the server will send back its hello, and it will also send back a

3:15certificate.

3:16That's supposed to look like a certificate.

3:18Anyway, so it's sending back now also a certificate to the client side,

3:22and it will also send back another packet over here that just says,

3:26it's a hello done packet.

3:27It just completes that send over to the client.

3:31Now it looks a little one-sided because the client only sent one hello,

3:34and the server sent three messages back to the client,

3:38but it doesn't have to be equal.

3:39OK.

3:40That's just how it works out.

3:41So now what happens, though, is that the client has a copy of that certificate.

3:47Now remember, the server is not going to send out a certificate with a private

3:51key.

3:51OK, so it's only going to have the public key on there,

3:53and that's really all we need.

3:55So the client then needs to use that certificate to number one,

4:00check that certificate because it's probably been received from a certification

4:04authority somewhere else.

4:05OK.

4:06So if it was issued from, say, Let's Encrypt, then this is going to be signed

4:11by Let's Encrypt,

4:12and it's going to validate that with Let's Encrypt here,

4:15and also check to see locally if there are any revoked certificates or anything

4:20like that

4:21that would cause us not to trust that certificate.

4:23But assuming that it is a trustworthy certificate, something else will occur.

4:27What's going to happen here is that we need to establish a session key.

4:32OK.

4:32And the session key is actually going to be using what we call symmetric

4:38encryption.

4:39I might say, James, I thought for sure you said that with TLS,

4:43we use awesome metric encryption.

4:45It's kind of a half truth, kind of like the things I told my wife before we got

4:49married.

4:49Yes, half truth.

4:51If I told her the whole truth, she would have never married me.

4:52So anyway, so what we have here is a session key that's going to actually be

4:57used for symmetric encryption.

5:00OK.

5:00The key here, though, is that that session key is then encrypted.

5:05So we have a encrypted copy.

5:07Let's put an E in there.

5:09So we have an encrypted copy here of that session key.

5:13OK.

5:13How was it encrypted with this public certificate?

5:16OK.

5:17Because we have that public key in the certificate.

5:19So now we can encrypt it.

5:21Now, remember what we've talked about with awesome metric encryption?

5:24Who can decrypt something that was encrypted with a public key?

5:29Only the holder of the certificate that also has the private key.

5:34OK.

5:34So since we have that now encrypted with the public key, it gets sent over here

5:39to the server side.

5:41Now, the server has that session key, and it's decrypted because it's got the

5:45private key.

5:46So it's decrypted it, and now it sees the same session key over on this side of

5:51things.

5:52Now, what happens is any data that gets transmitted back and forth will be

5:57using the same session key.

6:00So it's kind of both.

6:01It uses a symmetric key, but the key was encrypted and sent to the server by

6:08using awesome metric encryption.

6:10In other words, it encrypted it with a public key that only the server could

6:13decrypt with the private key.

6:14And so now if I have some data, let's just say that this is some kind of a data

6:18, whatever it is, when we send it,

6:21it gets encrypted with the session key here.

6:24That data then gets received by the server on this side, and then it gets dec

6:29rypted as well by the same session key.

6:32And so that's the essential details of how this encryption happened.

6:36Now, a couple of things to keep in mind here, after the TCP three way handshake

6:40, when it starts to establish that TLS connection,

6:43one of the things that it will do is it will establish and agree upon the two

6:47server and the client here,

6:49which version of TLS is in use.

6:51So there's a version 1.0, which is considered insecure.

6:55There's also a 1.1, 1.1, which is also considered insecure, but TLS 1.2 and 1.3

7:05are good.

7:06Okay, those are considered secure.

7:09And they also established this session faster than the older TLS 1.0 and 1.1.

7:15Okay, so we showed pretty much three different exchanges that took place

7:19through here, basically two round trips after the TLS connection.

7:23Well, with this with 1.2 and 1.3, it only needs one round trip in order to

7:28establish the secure connection.

7:30And TLS 1.3 is probably what's most common right now, and it's supported in all

7:35major browsers.

7:36You shouldn't have to dig for it.

7:38Also, that session key that was established, which we exchanged with the server

7:44, and now both sides have that,

7:45it uses a Diffie-Hellman exchange.

7:47We talked about that in the past in a previous skill, but Diffie-Hellman uses a

7:52unique method of math that will calculate the session key independently on both

7:58sides.

7:59And yet, they will both come up with the same result.

8:02Also, just so you're aware of where we've come from with SSL here, SSL would

8:07use a hash, it would be using an MD5 or a SHA1 hash.

8:13These are just two algorithms that are used for performing hashing.

8:17Well, those are considered insecure, not because someone can reverse engineer

8:21them and derive the original message,

8:24but because they're vulnerable to collisions.

8:26Yes, there's actual math that could occur where you would have two separate

8:31messages that would wind up with the same hash digest or the same result.

8:37So for that reason, both of these were no longer considered secure because they

8:42could kind of be "bool", if you will.

8:43Also, SSL used encryption that was DES, again, we've talked about that in the

8:49past, digital encryption standard.

8:51That was insecure, and RC4 was also considered insecure.

8:55So, those are the reason why SSL is no longer really in use.

8:59However, when it comes to TLS, TLS does hashing with SHA-256, which is

9:08collision resistant is what we say.

9:10And for the encryption, it's going to be using the advanced encryption standard

9:15, which we've also previously discussed,

9:17and it's a pretty solid encryption mechanism.

9:19And so that's kind of a high-level overview of how TLS works.

0:00Or would I have an important message for you today?

0:02And here it is.

0:03Can you guess what that is?

0:04Yeah, nobody can, right?

0:06It's going to be pretty difficult to try to figure out what I'm saying.

0:10This is really just a brief sentence that I have hashed into something that's

0:15pretty

0:16well obfuscated and you can't guess.

0:18And that's exactly what hashing data is.

0:21Now, it often gets confused with encryption because both of them, you can't

0:26figure out

0:27the original, right?

0:28It's the difference is encryption.

0:30You can decrypt it hashing.

0:32You can never reverse it.

0:33Okay.

0:34So it's not the same as encryption, although sometimes especially when people

0:37are getting

0:38started in cryptography and things, they kind of tend to confuse the terms,

0:43right?

0:43So with hashing, what we do is we input some data.

0:47I'm going to show you that here in a little while.

0:49And what will happen next is it will apply what we call a one way algorithm.

0:54It's math that you use that is applied against whatever the input is.

0:59And then it generates a unique result.

1:01There should not be any possibility mathematically or in the universe of two

1:08exact results being

1:09produced with different data.

1:12If you put the exact same data in, you should be able to get the exact same

1:16result out of

1:17it with the same result that we mentioned here.

1:20Okay.

1:21You'll see that again here in a moment.

1:22All right.

1:23So some hash implementations.

1:24Why would we use it and where would we use it?

1:26One of those places we would use it would be something called data integrity.

1:30This is simply because we want to make sure that maybe data that we download is

1:35authenticated

1:36in the sense that it's the original.

1:38It's not changed data.

1:39So we have a website here and we're trying to download a file.

1:45Sometimes you'll see that on that webpage, they will say our hash is and then

1:49they'll

1:50put something strange like that.

1:52Now there's a number of different ways this could go.

1:53For example, some hashes depending on if it's using base 64, which is a

1:57numbering system,

1:59or whether it's using hex, whether it's going to be able to produce these kind

2:02of results

2:03because the hex doesn't use an X or a Y or an exclamation point, but base 64

2:06could.

2:07So anyway, but the point is it's going to be obfuscated into something weird,

2:11right?

2:12And only this, this specific file running through a specific hash should be

2:16able to produce

2:17that result.

2:18On my computer down here, you know, here's my computer, when I receive that

2:23same file,

2:24I should be able to run it through the same hash and get the exact same result.

2:28It should look exactly the same.

2:30What does this do for me?

2:32It validates that I'm downloading the exact original file as the source.

2:37No, it's not just because a hacker might have manipulated it in transit or

2:40something like

2:41this or planted malware.

2:43It could also be simply that my Wi-Fi hiccups and then it corrupted the file on

2:48the way

2:49down.

2:50So that could have also happened.

2:51But regardless, you want to make sure that the file has integrity that it needs

2:55to have.

2:56The other thing you could use there for it would be password storage.

2:59We don't really normally do that in terms of us directly applying a password

3:05hash to

3:05a password.

3:07But what happens there normally is that whatever operating system you're using

3:12will apply a

3:12specific hash to the user's passwords in that way they're then obfuscated.

3:17So for example, here I am on a Linux Mint computer and on most distributions of

3:22Linux

3:22you'll find this password file in the same place.

3:25There's a file in the Etsy directory called shadow.

3:29This is what's going to contain information about our user accounts in addition

3:32to the

3:32fact that it will contain the password.

3:35However, it's not the actual password as you will see here when I run sudo,

3:39which elevates

3:40my privilege and run cat, that's just a simple word processor if you will.

3:44It just kind of dumps out onto the screen what I'm trying to see.

3:48And then there's the passwords file, which is actually kind of a file that

3:51contains information

3:52about our user accounts.

3:53That's called shadow.

3:55So if I press enter here, then we see some user accounts here.

3:58So for example, this is my trainer account with the password hash.

4:03Okay.

4:04Trying to figure out what the password is out of that.

4:05And in fact, it even identifies for me what kind of a hash it's using.

4:11So for in this case, there's something called yes crypt, which is a little bit

4:15of a misnomer

4:15because it's not actually not actually encrypting something.

4:19It's really just hashing something.

4:21But anyway, it's called yes crypt.

4:23And I can tell by looking at the prefix to this right here, dollar sign, why

4:27dollar sign

4:28means that it's yes crypt.

4:30If we would have instead have see dollar sign, $5 sign, that would be shot to

4:3656.

4:37So there's different codes.

4:38The beginning of that actually, there's an article for it all.

4:41I got to hear somewhere.

4:42I'll link it at the bottom so you can see that anyway.

4:45After that, this is the hash of my password.

4:48By the way, all of my users here, as I recall, at least they, I think they're

4:53all using the

4:54same exact password.

4:55But if we look at the hash, they should match.

4:58If they're all using the same password, they should match, right?

5:01But look, there's me, right?

5:02My trainer account kind of just memorize that real quick.

5:05And then there's Lalo here.

5:07There's actually another wonderful trainer we have here at CBT Nuggets, but

5:11that has

5:11to look the same.

5:12Okay.

5:13It starts the same because we're using yes crypt, but after that, it kind of

5:15falls apart.

5:17We don't really have anything in common here.

5:18So how are they using the same password then if the hashes don't match?

5:22Well, there's something there called salt, S-A-L-T.

5:26It will take the hash and it will combine it with a unique value.

5:32It's just completely randomized and it will combine that mathematical value

5:36with the original

5:37algorithm and then produce a unique result there.

5:40So even though we have the same password, I can't tell by looking.

5:43And the advantage of that, by the way, is that if a hacker were to get a hold

5:46of this

5:47file and to be able to see one of these password hashes and somehow figured out

5:52, for example,

5:53they could run a brute force attack against it.

5:55They could run a rainbow table against it, something like this, then they would

5:59be able

5:59to identify any other hashes that looked exactly the same.

6:03They did no right away that we were using the same password for both of those

6:07accounts.

6:08All right.

6:09Another way that it's used would be for digital signatures.

6:12We actually have seen that too.

6:13Let me show you.

6:14So if I bring over a certificate, for example, that's just on my computer here,

6:19you will

6:19see here that we have a signature hash algorithm here that's being used because

6:24there's a

6:25unique signature affixed to this particular certificate that validates that it

6:30was truly

6:31signed by whichever authority signed it.

6:34That way that signature cannot be faked.

6:36It's also useful for data deduplication.

6:39Let me explain a little bit what that's about.

6:41So let me explain it this way.

6:42I was at the Grand Canyon a few years ago.

6:45I'm also a photographer.

6:47And here in this photograph, there was an obstruction.

6:50I can't remember exactly where it was, but let's just say it was a twig.

6:53I think it might have been out of here or something.

6:55And it kind of shot way up into here and it looked kind of weird.

6:58It was a little distracting.

7:00So I just photoshopped it out.

7:02No, it wasn't a twig.

7:03What was it?

7:04Oh, it was a rock.

7:05It's down on the bottom here.

7:06You can't really see it from this viewpoint, but let's see if there was a rock

7:08down here.

7:09And it was an exposed rock and it just looked kind of, it was at a frame from

7:13where we are

7:13right now, but it just, it was distracting.

7:15So I wanted to get rid of it.

7:16I have photoshopped it out.

7:17I also have a backup of this file.

7:20So before I removed that rock, I had the original file and it would back up.

7:25Okay.

7:26So the way backup works is it backs up in blocks of data.

7:30Okay.

7:31So my backup program would back this up.

7:33It would back this up, back this up, back this up, back this up, this up and,

7:37you know,

7:38it would be this chunk of trees and this part of the sky and so forth all along

7:42.

7:42So it backs up a block of data at a time.

7:46But there's a unique signature assigned to the file once it's done backing up

7:50the entire

7:51file.

7:52Let's just say I'll put, you know, a real small hash here, you know, five AC

7:57when it's

7:57done with its full backup.

7:59Okay.

8:00So it's a full backup and let's just say the hashes five AC.

8:03I'm abbreviating of course, because you saw that hashes are super long.

8:06I'm not going to write all that out.

8:07Anyway, then when I came back in and I edit this file so that I remove that

8:13rock, all

8:14of these blocks up along the top of the same, that hasn't changed.

8:17Okay, that hasn't changed.

8:18That hasn't changed.

8:19That hasn't changed.

8:20None of that stuff's changed down here.

8:23There's a noted change that data is not the same.

8:26Therefore my hash is not going to be the same.

8:28And it's going to know that it needs to back up this file again.

8:32Now there's a couple of things that will happen here.

8:35Let's say we're using something called an incremental backup and I'm getting

8:37off topic

8:38a little bit, but still makes the point an incremental backup only backs up the

8:42changes.

8:42So as soon as it notices the change to the hash, it knows the file needs to be

8:46backed

8:46up again.

8:47But as it looks through the data, it can identify only the change to data and

8:52only backup the

8:53change where I remove the rock at the bottom of the screen instead of having to

8:57backup

8:58all of the original data all over again.

9:01It's also useful for something called data deduplication.

9:04It kind of follows a similar criteria here.

9:07So let's say I've got a couple of big files here, you know, 10 gigabyte files.

9:11Turns out these are the same file.

9:13They might be stored in different directories.

9:15It just so happens that we have the same copy of files, two separate

9:18directories.

9:19So therefore our backup routine since it sees them in different directories, it

9:23backs them

9:23both up separately.

9:25And as a result, now we've kind of wasted 10 gigabytes here because we already

9:29had the

9:29file here.

9:30We don't really need another copy here.

9:33So what data deduplication does is it will run a hash against both of these

9:37files.

9:38And if the result is the same, it knows that it can delete one of these files

9:42because

9:42we really actually already have it.

9:44And then what it'll do is it will just kind of put a marker, think of like a

9:47shortcut

9:48or something like that.

9:49It'll just put a marker in its place.

9:51So if we do need to recover this data from that folder, then we'll actually

9:55just recover

9:56this file and put it in that folder.

9:58And then there's also blockchain, which you may be familiar with.

10:01That's used a lot in crypto.

10:03And that's a lot of different hashing algorithms go into this.

10:07But that again is how it can validate that data has not been cheated and

10:10someone hasn't

10:11artificially manufactured a Bitcoin for themselves or something like this.

10:16So the transactions really is what happens in the blockchain so that

10:19transactions cannot

10:20be cheated.

10:21I might send somebody a 1/100 of a Bitcoin and with a blockchain in place, it

10:27can validate

10:28that they did not add or subtract anything from that.

10:31So instead of a 1/100, it's a 10th so that they didn't change the value there.

10:37And that again is how the blockchain is used in crypto.

10:40And it's very oversimplified, but it does use hashing to make sure that data is

10:46not

10:47manipulated.

10:48So remember that message that I put it at the beginning of the video here was a

10:52hashed

10:53value.

10:54It looked like that.

10:55Okay, and why?

10:57Because I had hashed this sentence.

10:58Okay.

10:59Like that in, you can't guess this sentence.

11:03And when I hashed it, it hashed it to exactly that value.

11:06And in that case, I was using an MD five hash.

11:09Okay, I'm going to go back to this value.

11:11You can see different ways you can use you can use hex lowercase hex with u

11:16ppercase different

11:17format of hex, which is a colon separated here.

11:19And you can use base 64, which is just a different numbering system as well.

11:23I'm just going to take this all caps version.

11:25It's a little bit easier to read.

11:26And I'm going to copy that into notepad.

11:29Oh, I forgot I had this left open.

11:30Might as well mention this member earlier, I mentioned I had a smishing attempt

11:35.

11:35This was a certificate that was attached to that website.

11:38Okay, remember I said it's really just mostly a bunch of text.

11:40There it is.

11:41Anyway, I'm going to paste in that hashed value and make that a little bigger.

11:46So it's easier to read.

11:47And there we have it.

11:48Okay.

11:49Now, notice what happens here if I go back and I make any change to this

11:52whatsoever, instead

11:53of an exclamation point, I put a period in, then we'll be run the hash again.

11:58It's just an MD five.

11:59And I'm using that partially because it processes fast and it doesn't take very

12:03long to run.

12:05Now when I look at this hex value, go back to notepad and paste that and notice

12:09that

12:10it's completely different.

12:12It's not just as if the two changed to a three or something like that at the

12:16end, because

12:16that was the last day that we changed was a little period or an exclamation

12:18point at

12:19the end.

12:20We call the avalanche effect where any change wildly affects the entire result.

12:26And that's useful because if a hacker was able to see that, oh, that just

12:28changed from

12:29a two to a three or something like that, then they would say, oh, I know I'm

12:33almost there.

12:34Maybe I'll just change the punctuation at the end and be able to figure out

12:37what the password

12:38is.

12:39So this prevents that sort of thing from happening.

12:41Now there's also kinds of other things here that are kind of useful actually.

12:44This is pretty handy little website and I just Googled for this.

12:48And if we go back here, you can see they have a whole bunch of other different

12:52conversions

12:52that we can use here, different hash methods that we can use.

12:56Some of them I haven't even heard of might be kind of obscure.

12:59Oh, whirlpool reminds me, I need to do the laundry.

13:02Anyway, so we also have some of the more common ones that you might see shot

13:06256.

13:07That's very common.

13:08384.

13:09I haven't seen a lot, but it's out there.

13:10And then shot to shop five 12 is another common one as well.

13:1395 is common, blowfish is common, not usually in windows, but in other

13:18operating systems.

13:19So those are some of the more common ones that you might see out there.

13:22So as another example here, I've gone here to tally.org.

13:26Callie Linux is it's just a distribution of Linux.

13:29Callie Linux is a hackers version of Linux.

13:32I think the guts of it are actually Debbie and Linux, but it's got a bunch of

13:36tools installed

13:38along with it, which are very handy for hackers to be able to use.

13:41Now you could come up with your own installation of Linux and download all the

13:45tools and find

13:46them.

13:47But a lot of them honestly are also packed with malware of their own.

13:51So Callie Linux, they go through great lengths to make sure we're getting clean

13:54copies of

13:55any utilities that we use so that we can pack other people in good conscience.

14:00So anyway, you can see here that there is a file that we can use.

14:05We can actually put this on a phone.

14:07Okay, this is a full installation of Callie Net Hunter Pro.

14:11It's used for mobile devices and we could download and install this onto a

14:17micro SD card,

14:19put it in our device and then boot from that device and run kind of a very thin

14:24version

14:25of Callie Linux on our phones.

14:27Anyway, the point I'm getting with this is if I want to download it, look at

14:31this Callie

14:31Linux image with Bosch or Pinephone, I could check the sum of this, the check

14:37sum, check

14:38sum and that's a SHA-256 sum.

14:41In other words, just the hash of that data, right?

14:43I'm going to copy that, put that in my clipboard right here.

14:48Then I'm going to download it and I'm going to run that through that same hash

14:52generator

14:53to see if I get the same result.

14:55And then I've got the file downloaded right here and it was too big for the

15:00online version

15:01and you have to upgrade or something like that.

15:03So I have a local copy of a utility that I could use with this as well.

15:07So I'm just going to go ahead and open this up here and we can see here that it

15:12is now

15:12hash this data and there it is.

15:15So hash that, let me put that back in my clipboard and we should see that

15:20character for character

15:22it should match up exactly.

15:23So this tells me then that I know I downloaded the exact same copy of that file

15:28and it has

15:28not been modified in any way.

0:00So let's kind of summarize here the differences between encryption and hashing

0:04just to avoid

0:04again any potential overlap in the concepts here. The purpose for encryption is

0:10to protect

0:10the confidentiality. We don't want somebody else to be able to read that same

0:14data that we're trying

0:15to protect. Only the intended parties should be able to read that data, but

0:21while it's encrypted,

0:22nobody can read it, even including people that are supposed to be able to read

0:25it. Okay, then

0:27there's also the verification of integrity under hashing. We're not trying to

0:31encrypt anything.

0:32Although, to be honest, it does kind of work that way as well. Remember, I was

0:36showing you earlier,

0:38the shadow file in Linux. Well, that was hash values. And so then it obfuscated

0:43, or if you will,

0:44encrypted that data. But the difference there is whether or not it's really

0:48reversible. Okay,

0:50so we were able to verify the integrity of the passwords there. But when it

0:54comes to reversibility,

0:55encryption is reversible. So the person that we want to be able to read the

0:59data, it's not very

1:00much use unless they can decrypt data that has been previously encrypted.

1:05Otherwise,

1:06might as well just be erased, useless. Hashing is irreversible. I cannot take a

1:12hashed value

1:13and reverse the math and figure out what the original was. The output length

1:18for encryption

1:19is variable. So, you know, I might be encrypting an entire disk and all of the

1:23different blocks on

1:24the disk. It usually does it a block at a time. Well, with encryption like that

1:29, which is again,

1:30remember, which is going to be symmetric if we're using something like BitL

1:32ocker. Well,

1:33since the data is variable in size, so is the result. However, with hashing, it

1:37's always a fixed

1:38result. It's a fixed length. I can encrypt a period, or I can encrypt entire

1:43paragraph. And

1:44the length will be the same depending on the encryption algorithm I'm using. So

1:48common uses

1:49for encryption files, of course, or entire drives. We used EFS for files or

1:54drives. You can use

1:54Veracrypt, you could use BitLocker, that sort of thing. It's also used in e-

1:58commerce. So,

1:59when we use TLS across secure websites, we are encrypting that data to the

2:04destination. And then

2:06on the destination, though, web server or whatever it is that's receiving that

2:09data can then decrypt

2:11that data. So for hashing, we can fact we can hash file downloads. We can hash

2:16email to make

2:17sure that that hasn't been modified in transit passwords, which we already saw

2:21there. And just

2:22again, for overall integrity to make sure that something has not been changed,

2:25such as in the

2:26blockchain, or the algorithms we have the grants and advanced encryption

2:30standard RSA and digital

2:31encryption standard for algorithms under encryption and lots of other ones.

2:35Some of the common ones

2:36we use under hashing would be MD five, which is messes digest five, SHA one,

2:41which is not considered

2:42secure, but still out there. And then Shaw 256.

0:00Alright, let's go ahead and take a look at this validation.

0:02We're just going to get some practice and working with some of the things that

0:05we looked at in this particular skill.

0:07So, first of all, let's go ahead and look at this website.

0:11There's a link for it. You should be able to just click there and it will take

0:14you.

0:14I've already got the website open and enter in the name of your own company's

0:19web server

0:19or some other server of your choosing if you want.

0:22And then let's see what kind of a security score your site got.

0:26Okay, so I'm going to go over here and because some people enter in crazy

0:31websites here,

0:32I kind of had to move my browser down to conceal some things.

0:36Anyway, let's just enter something in.

0:38I'll enter in Microsoft this time. How about that? Microsoft.com.

0:41And look, what do you know, but they are a plus all the way down through,

0:45even more secure than Amazon apparently.

0:47So anyway, that's just a good way to check out.

0:50And it gives you kind of a thumbnail idea of the level of security

0:54that your web server has.

0:57If you click on these, by the way, like I just clicked on that first link there

1:01for the first IP address, then it shows me various details about why it got

1:07such a good grade.

1:08Okay, so for example, this server supports TLS 1.3.

1:13We talked about that earlier. That's the most recent version and the most

1:16secure version.

1:17So that's certainly going to add to the score of an A plus here.

1:22It shows us all the common names that are going to be in use for that

1:25particular website.

1:26Alternative names. Wow, Microsoft's got a lot of different names.

1:29Okay, probably somewhere in here is the alternative name of the evil empire.

1:35Anyway, so they've got a lot of stuff in here.

1:37You can see this serial number.

1:39By the way, all of this stuff is stuff you should be able to see

1:42if you just open their certificate like we did in our last skill.

1:46By the way, this is interesting. Let me go down here and zoom in a little bit.

1:50Microsoft has actually had some certificates revoked because there were some

1:56certificates

1:57that got compromised in the past years ago now.

2:00And I think it was a social engineering attack.

2:02We'll talk more about that in a future skill, but there's a certificate

2:05revocation list

2:07that Microsoft publishes and then this is accessible from the Internet.

2:12And then your browser will in the background can automatically go to that CRL

2:16and see if they're accessing a certificate that has been revoked.

2:20Anyway, this is kind of a bottomless pit.

2:22I'm tempted to kind of keep exploring here, but look, it shows what TLS

2:27protocols it supports.

2:27Remember, I said it was already 1.3, but it could be communicating with another

2:31web server

2:32that only supports 1.2, which is still good.

2:35But notice that it's not compatible with, oh, you know, 1.1, 1.0, any of these

2:41other kinds

2:42because they're just not trustworthy.

2:44Also, what kind of cipher suites it supports?

2:46AES, why don't we talk about that earlier?

2:48AES 128 on its own is really good security, but this will go up to 256

2:53according to this.

2:54Oh, actually goes up to 384 judging from that.

2:57So anyway, I won't go through that much further, but it's definitely a very

3:01good website to go to

3:02to get more details about various types of certificates and to learn more about

3:07them.

3:07So here we went to cert bot.

3:09This is the next item in instructions.

3:11Let's go down here.

3:12Go to this site. That's where I just was.

3:14Select a web server and operating system, and then look for the instructions on

3:17how to install

3:19the web server's certificate.

3:21Okay, so if I had Nginx, for example, and I was running it on, you could just

3:27pick anything.

3:27It's kind of arbitrary.

3:28Let's say I was putting it on to ODB in 10, which is another flavor of Linux.

3:33Then this actually tells me specifically all the details I need to do in order

3:38to install it.

3:39Now, we haven't been doing that.

3:41We're not installing it.

3:42We're actually going through the steps, but I want you to know where you can go

3:46.

3:46It's quite easy to use.

3:47If you need to find the steps necessary to get a certificate installed on your

3:51web server.

3:52So it's really, really very handy.

3:54And they have a lot of interactions here as well with let's encrypt, which

3:57remember, this is where we can get those

3:59free certificates.

4:00All right. And then the next thing was go to this site and hash any data you

4:02want.

4:03Okay, so this is the same website I was at earlier in our particular skill.

4:08And you can just choose one of these.

4:10Let's just choose something that is not very common.

4:12I haven't ever actually heard of this one.

4:14Ripe MD, doctor that doesn't wear deodorant, apparently.

4:18Anyway, let's go down here and just enter something in this hash stinks.

4:23Okay.

4:24And we'll just put that in there and start it.

4:27And it should then go ahead and hash it for us.

4:30Now, notice that it does take a little bit of time.

4:32It's not instant.

4:33Depending upon the level of hashing you're using, the more computationally

4:37expensive it is.

4:38And that's why sometimes depending upon the security requirements, an

4:42organization might use a less complicated hash simply

4:46because it requires fewer computational cycles and they'd rather have

4:50performance over a very high level of security.

4:54They're willing to take an acceptable risk, in other words, in order to be able

4:59to get the performance out of it.

5:01So here we go.

5:02We got a value out of this.

5:04And again, there's several different ways that it can be expressed.

5:07We didn't get into a lot of detail on it earlier, but this is actually the same

5:10hex value.

5:11It's just that it's separated by colons to make it more readable because this

5:14will make you a cross side trying to read that out

5:17loud or something like that.

5:18But this at least in terms of human readability makes it a little bit easier.

5:23Now, the other thing was we could go back and make a change to this.

5:26So you can use notepad if you want or if you've memorized that.

5:29Well, great.

5:31I wish I could memorize something that easily.

5:34Anyway, I'm just going to enter in notepad here and just enter in that value.

5:37Just going to paste that in.

5:39And then I'm going to go back and make one small change, maybe add another ex

5:43clamation point.

5:44So now we have two exclamation points, a little bit of time to percolate here

5:48once again.

5:49And now I see that I've got this hex value.

5:51And since I didn't remember the previous hex value, I don't know if it's the

5:54same or not, but I'm sure it's not.

5:56Because I added an exclamation point.

5:58Remember, this is where we have a cascading that takes place in Avalanche

6:01effect, that is, where even the smallest change will completely change all of

6:07the results.

6:08And this is also known as by the way, a digest.

6:10So you took the data and you digested it, so to speak, through the mathematical

6:14algorithm.

6:15And this then is what was digested or that's the digest.

6:19So that was the third thing we did there.

6:22And that then concludes this particular skill.

6:25I hope this has been informative for you. I'd like to thank you for viewing.