1 00:00:00,060 --> 00:00:00,960 In this lesson, 2 00:00:00,960 --> 00:00:03,360 we're going to cover asymmetric algorithms. 3 00:00:03,360 --> 00:00:05,010 Now, unlike symmetric algorithms, 4 00:00:05,010 --> 00:00:08,580 asymmetric algorithms do not require a shared secret key. 5 00:00:08,580 --> 00:00:10,410 For this reason, we often refer to them 6 00:00:10,410 --> 00:00:12,000 as public key cryptography 7 00:00:12,000 --> 00:00:13,980 because their key is considered to be freely 8 00:00:13,980 --> 00:00:16,650 and openly available to anyone in the public. 9 00:00:16,650 --> 00:00:18,390 Now, with asymmetric algorithms, 10 00:00:18,390 --> 00:00:19,650 we are going to use a key pair 11 00:00:19,650 --> 00:00:22,950 to encrypt and decrypt our data using two different keys. 12 00:00:22,950 --> 00:00:25,620 These are known as a public and a private key. 13 00:00:25,620 --> 00:00:27,930 Now, public key cryptography can provide us 14 00:00:27,930 --> 00:00:29,610 with confidentiality, integrity, 15 00:00:29,610 --> 00:00:31,680 authentication, and non-repudiation 16 00:00:31,680 --> 00:00:34,560 for the different pieces of data or messages being sent. 17 00:00:34,560 --> 00:00:36,360 To provide confidentiality of the data, 18 00:00:36,360 --> 00:00:37,560 the data needs to be encrypted 19 00:00:37,560 --> 00:00:39,660 using the receiver's public key. 20 00:00:39,660 --> 00:00:42,330 So if I want to send a document to my friend Mary, 21 00:00:42,330 --> 00:00:43,650 as you can see here on the screen, 22 00:00:43,650 --> 00:00:46,890 I'm going to encrypt that document using Mary's public key. 23 00:00:46,890 --> 00:00:49,530 By doing so, only Mary is going to be able to read it 24 00:00:49,530 --> 00:00:52,500 because only Mary is going to have Mary's private key. 25 00:00:52,500 --> 00:00:54,690 Now, this is going to be used to decrypt the contents 26 00:00:54,690 --> 00:00:56,580 and ensure the message I sent is safe 27 00:00:56,580 --> 00:00:58,650 from anybody else's prying eyes. 28 00:00:58,650 --> 00:00:59,940 Now, once I encrypt this data 29 00:00:59,940 --> 00:01:02,280 that I'm going to send to Mary using her public key, 30 00:01:02,280 --> 00:01:05,040 nobody else in the world can read it except for Mary. 31 00:01:05,040 --> 00:01:06,240 Even I can't read it. 32 00:01:06,240 --> 00:01:07,290 And I was the sender. 33 00:01:07,290 --> 00:01:08,910 Because I can't decrypt the information 34 00:01:08,910 --> 00:01:12,000 because I only had her public key, not her private key. 35 00:01:12,000 --> 00:01:13,740 So essentially, when I encrypt it, 36 00:01:13,740 --> 00:01:16,050 it's a one-way encryption when I use a public key 37 00:01:16,050 --> 00:01:17,850 because the only person who can decrypt it 38 00:01:17,850 --> 00:01:19,680 and get it back to readable plain text 39 00:01:19,680 --> 00:01:22,830 is going to be the receiver using their private key. 40 00:01:22,830 --> 00:01:25,020 Now, when it comes to non-repudiation, 41 00:01:25,020 --> 00:01:26,940 this message should be encrypted using 42 00:01:26,940 --> 00:01:28,560 the sender's private key. 43 00:01:28,560 --> 00:01:29,760 So in this case, 44 00:01:29,760 --> 00:01:32,220 I can encrypt that message using my private key. 45 00:01:32,220 --> 00:01:35,100 When I do that, anyone in the world can decrypt that 46 00:01:35,100 --> 00:01:37,500 because my public key is out there in the open 47 00:01:37,500 --> 00:01:38,970 and anybody can download it 48 00:01:38,970 --> 00:01:40,830 and then open that message and read it. 49 00:01:40,830 --> 00:01:43,050 That isn't going to give us any kind of confidentiality 50 00:01:43,050 --> 00:01:46,290 if I encrypt a message using my private key. 51 00:01:46,290 --> 00:01:47,940 Instead, what I'm worried about here 52 00:01:47,940 --> 00:01:50,220 is making sure that people know I really was the person 53 00:01:50,220 --> 00:01:51,690 who sent that message, 54 00:01:51,690 --> 00:01:53,550 and that is non-repudiation. 55 00:01:53,550 --> 00:01:55,080 Now, to make sure this happens, 56 00:01:55,080 --> 00:01:57,180 only I can sign it using my private key 57 00:01:57,180 --> 00:01:59,640 because only I have that private key. 58 00:01:59,640 --> 00:02:00,870 Now, in most organizations, 59 00:02:00,870 --> 00:02:03,930 we don't want just confidentiality or non-repudiation. 60 00:02:03,930 --> 00:02:05,550 We want both of those things. 61 00:02:05,550 --> 00:02:08,250 And in addition to confidentiality and non-repudiation, 62 00:02:08,250 --> 00:02:09,750 it'd be great if we could have integrity 63 00:02:09,750 --> 00:02:11,220 and authentication as well 64 00:02:11,220 --> 00:02:12,840 to make sure the message being sent 65 00:02:12,840 --> 00:02:14,700 is going to be sent where nobody can read it, 66 00:02:14,700 --> 00:02:15,840 we know where it came from, 67 00:02:15,840 --> 00:02:18,210 and that it wasn't changed in transit. 68 00:02:18,210 --> 00:02:20,100 Now, to accomplish all of this with our emails, 69 00:02:20,100 --> 00:02:22,740 we often use a process to create a hash digest 70 00:02:22,740 --> 00:02:24,300 based on the message being sent. 71 00:02:24,300 --> 00:02:25,890 And then we encrypt that hash digest 72 00:02:25,890 --> 00:02:27,900 using the sender's private key. 73 00:02:27,900 --> 00:02:29,790 This is known as a digital signature, 74 00:02:29,790 --> 00:02:31,170 and it's going to provide us with the integrity 75 00:02:31,170 --> 00:02:32,520 of the message that's being sent 76 00:02:32,520 --> 00:02:34,410 because we have that hash of the message 77 00:02:34,410 --> 00:02:36,120 as well as giving us non-repudiation 78 00:02:36,120 --> 00:02:38,220 because only the sender could encrypt that hash 79 00:02:38,220 --> 00:02:39,840 using their private key. 80 00:02:39,840 --> 00:02:42,240 Then we take the message that we're going to send, 81 00:02:42,240 --> 00:02:44,730 and we encrypt it using the receiver's public key. 82 00:02:44,730 --> 00:02:46,860 This will give us confidentiality of the message 83 00:02:46,860 --> 00:02:50,280 because only the receiver can decrypt the message itself. 84 00:02:50,280 --> 00:02:53,130 So now I've got integrity of the message using the hash, 85 00:02:53,130 --> 00:02:55,320 I have non-repudiation by encrypting that hash 86 00:02:55,320 --> 00:02:56,670 using my private key, 87 00:02:56,670 --> 00:02:58,140 and then we get confidentiality 88 00:02:58,140 --> 00:03:01,020 by encrypting the message itself using your public key 89 00:03:01,020 --> 00:03:02,370 as the receiver. 90 00:03:02,370 --> 00:03:05,040 So now that you understand how asymmetric algorithms work 91 00:03:05,040 --> 00:03:06,150 at a basic level, 92 00:03:06,150 --> 00:03:08,460 let's look at some specific asymmetric algorithms 93 00:03:08,460 --> 00:03:09,390 that you may encounter 94 00:03:09,390 --> 00:03:11,490 while working as a cybersecurity professional, 95 00:03:11,490 --> 00:03:13,560 including Diffie-Hellman, RSA, 96 00:03:13,560 --> 00:03:17,490 and ECC, also known as Elliptic Curve Cryptography. 97 00:03:17,490 --> 00:03:19,560 First, we have Diffie-Hellman. 98 00:03:19,560 --> 00:03:21,840 Now, Diffie-Hellman is named for its two inventors, 99 00:03:21,840 --> 00:03:23,340 and it's used to conduct key exchanges 100 00:03:23,340 --> 00:03:25,140 and secure key distribution. 101 00:03:25,140 --> 00:03:27,360 In fact, Diffie-Hellman is widely used 102 00:03:27,360 --> 00:03:29,160 whenever you're setting up a VPN tunnel 103 00:03:29,160 --> 00:03:30,330 or other encryption tunnels 104 00:03:30,330 --> 00:03:32,910 that require a symmetric algorithms shared secret key, 105 00:03:32,910 --> 00:03:34,230 which is a private key, 106 00:03:34,230 --> 00:03:35,370 to be exchanged first 107 00:03:35,370 --> 00:03:37,380 before setting up that symmetric tunnel. 108 00:03:37,380 --> 00:03:40,080 And then using asymmetric algorithms like Diffie-Hellman, 109 00:03:40,080 --> 00:03:43,050 we can do that in a secure and scalable manner. 110 00:03:43,050 --> 00:03:45,120 Now, Diffie-Hellman is also susceptible 111 00:03:45,120 --> 00:03:48,150 to on-path or person-in-the-middle attacks. 112 00:03:48,150 --> 00:03:49,980 So if you want to secure yourself, 113 00:03:49,980 --> 00:03:52,260 you need to make sure you have some form of authentication 114 00:03:52,260 --> 00:03:54,870 such as requiring a password or digital certificate 115 00:03:54,870 --> 00:03:57,300 at the beginning of that exchange process. 116 00:03:57,300 --> 00:03:58,800 Now, whenever you see Diffie-Hellman, 117 00:03:58,800 --> 00:04:00,780 I want you to remember two main things. 118 00:04:00,780 --> 00:04:03,720 First, this is considered to be an asymmetric algorithm. 119 00:04:03,720 --> 00:04:06,120 And second, it's going to be used for key exchange 120 00:04:06,120 --> 00:04:08,340 inside of creating a VPN tunnel establishment 121 00:04:08,340 --> 00:04:09,690 as part of IPSec, 122 00:04:09,690 --> 00:04:11,640 or to be able to do a key exchange 123 00:04:11,640 --> 00:04:13,770 of any kind over the Internet. 124 00:04:13,770 --> 00:04:15,690 Second, we have RSA. 125 00:04:15,690 --> 00:04:17,250 RSA was named for its creators, 126 00:04:17,250 --> 00:04:20,550 Ron Rivest, Adi Shamir, and Leonard Adleman. 127 00:04:20,550 --> 00:04:23,070 RSA is widely used for key exchange encryption 128 00:04:23,070 --> 00:04:24,390 and digital signatures. 129 00:04:24,390 --> 00:04:26,670 And the algorithm itself relies on the difficulty 130 00:04:26,670 --> 00:04:29,310 of mathematically factoring large prime numbers, 131 00:04:29,310 --> 00:04:32,310 and this helps protect its public and private key pairs. 132 00:04:32,310 --> 00:04:33,990 RSA can support key sizes 133 00:04:33,990 --> 00:04:37,710 between 1024 bits and 4,096 bits. 134 00:04:37,710 --> 00:04:41,100 Now, RSA is widely used in organizations around the world. 135 00:04:41,100 --> 00:04:41,933 If you happen to have one 136 00:04:41,933 --> 00:04:43,680 of those secure tokens on your key chain 137 00:04:43,680 --> 00:04:46,710 where every 30 to 60 seconds that six digit number changes 138 00:04:46,710 --> 00:04:48,150 and you're going to use that as part of your login 139 00:04:48,150 --> 00:04:49,650 and multifactor authentication, 140 00:04:49,650 --> 00:04:50,490 well guess what? 141 00:04:50,490 --> 00:04:52,110 You're actually using RSA 142 00:04:52,110 --> 00:04:53,070 because that token 143 00:04:53,070 --> 00:04:56,010 is storing RSA asymmetric one-time-use keys 144 00:04:56,010 --> 00:04:58,320 that you're going to enter in as a form of authentication 145 00:04:58,320 --> 00:05:01,110 showing you have possession of that token. 146 00:05:01,110 --> 00:05:03,540 Third, and finally, we have ECC, 147 00:05:03,540 --> 00:05:06,300 also known as Elliptic Curve Cryptography. 148 00:05:06,300 --> 00:05:08,550 Now, Elliptic Curve Cryptography is heavily used 149 00:05:08,550 --> 00:05:09,630 in mobile devices, 150 00:05:09,630 --> 00:05:11,220 and it's based on the algebraic structure 151 00:05:11,220 --> 00:05:14,520 of elliptical curves over finite fields to define its keys 152 00:05:14,520 --> 00:05:15,870 because it's very efficient 153 00:05:15,870 --> 00:05:18,000 and a great way of providing better security 154 00:05:18,000 --> 00:05:20,940 than an equivalent RSA key of the same size. 155 00:05:20,940 --> 00:05:24,330 In fact, ECC's algorithm is about six times more efficient 156 00:05:24,330 --> 00:05:25,860 than an RSA algorithm. 157 00:05:25,860 --> 00:05:29,430 So if you're going to have a 256-bit key with ECC, 158 00:05:29,430 --> 00:05:32,910 you'd actually have to have a 2,048-bit key with RSA 159 00:05:32,910 --> 00:05:34,680 to be just as secure. 160 00:05:34,680 --> 00:05:37,080 For this reason, you're going to see ECC used 161 00:05:37,080 --> 00:05:39,780 in a lot of things like tablets and smartphones 162 00:05:39,780 --> 00:05:41,670 and other mobile-based implementations 163 00:05:41,670 --> 00:05:42,720 because these devices 164 00:05:42,720 --> 00:05:44,730 have much less processing power available 165 00:05:44,730 --> 00:05:46,980 than a standard desktop or laptop might. 166 00:05:46,980 --> 00:05:49,380 Now, there are a few variations of ECC as well 167 00:05:49,380 --> 00:05:50,880 that you may come across in the field, 168 00:05:50,880 --> 00:05:54,900 including ECDH, ECDHE, and ECDSA. 169 00:05:54,900 --> 00:05:56,610 So let's talk about those. 170 00:05:56,610 --> 00:05:59,190 ECDH, or the Elliptic Curve Diffie-Hellman, 171 00:05:59,190 --> 00:06:00,600 is an ECC version 172 00:06:00,600 --> 00:06:03,540 of the popular Diffie-Hellman key exchange protocol. 173 00:06:03,540 --> 00:06:05,760 ECDHE, or the Elliptic Curve 174 00:06:05,760 --> 00:06:08,580 Diffie-Hellman Ephemeral protocol is another variant. 175 00:06:08,580 --> 00:06:09,930 And this one uses a different key 176 00:06:09,930 --> 00:06:12,480 for each portion of the key establishment process 177 00:06:12,480 --> 00:06:14,940 inside of the Diffie-Hellman key exchange. 178 00:06:14,940 --> 00:06:18,300 ECDHE, or the Elliptic Curve Digital Signature Algorithm, 179 00:06:18,300 --> 00:06:20,430 is going to be used as a public key encryption algorithm 180 00:06:20,430 --> 00:06:21,450 by the US Government 181 00:06:21,450 --> 00:06:23,640 for all of their digital signature needs. 182 00:06:23,640 --> 00:06:26,220 Now, whenever you hear the term Elliptic Curve Cryptography, 183 00:06:26,220 --> 00:06:28,860 or ECC, I want you to remember that ECC 184 00:06:28,860 --> 00:06:29,880 and all of its variants 185 00:06:29,880 --> 00:06:32,130 are most commonly used for mobile devices 186 00:06:32,130 --> 00:06:33,990 and low-power computing devices 187 00:06:33,990 --> 00:06:36,060 because they give you an equivalent level of protection 188 00:06:36,060 --> 00:06:39,150 to other asymmetric algorithms with a lower key size, 189 00:06:39,150 --> 00:06:41,430 which means they require less processing power 190 00:06:41,430 --> 00:06:43,530 to encrypt and decrypt the data. 191 00:06:43,530 --> 00:06:45,930 So remember, when it comes to asymmetric encryption, 192 00:06:45,930 --> 00:06:47,880 also known as Public Key Cryptography, 193 00:06:47,880 --> 00:06:49,770 there is this system of encryption in place 194 00:06:49,770 --> 00:06:51,540 that's going to use two different keys, 195 00:06:51,540 --> 00:06:54,300 one for the encryption and one for decryption. 196 00:06:54,300 --> 00:06:55,380 There are three basic types 197 00:06:55,380 --> 00:06:57,840 of asymmetric algorithms you should be aware of, which are: 198 00:06:57,840 --> 00:07:01,200 Diffie-Hellman, RSA, and Elliptic Curve Cryptography. 199 00:07:01,200 --> 00:07:03,810 Diffie-Hellman is focused on conducting key exchanges 200 00:07:03,810 --> 00:07:05,670 when you're creating VPN tunnel establishment 201 00:07:05,670 --> 00:07:07,680 as part of the IPSec protocol. 202 00:07:07,680 --> 00:07:08,910 RSA, on the other hand, 203 00:07:08,910 --> 00:07:11,040 is widely the used for key exchange, encryption, 204 00:07:11,040 --> 00:07:12,510 and digital signatures. 205 00:07:12,510 --> 00:07:15,090 Elliptic Curve cryptography is an asymmetric algorithm 206 00:07:15,090 --> 00:07:17,400 that's heavily used for encryption by mobile devices, 207 00:07:17,400 --> 00:07:19,893 tablets, and other low-power computing devices.