In this lesson,
we're going to cover asymmetric algorithms.
Now, unlike symmetric algorithms,
asymmetric algorithms do not require a shared secret key.
For this reason, we often refer to them
as public key cryptography
because their key is considered to be freely
and openly available to anyone in the public.
Now, with asymmetric algorithms,
we are going to use a key pair
to encrypt and decrypt our data using two different keys.
These are known as a public and a private key.
Now, public key cryptography can provide us
with confidentiality, integrity,
authentication, and non-repudiation
for the different pieces of data or messages being sent.
To provide confidentiality of the data,
the data needs to be encrypted
using the receiver's public key.
So if I want to send a document to my friend Mary,
as you can see here on the screen,
I'm going to encrypt that document using Mary's public key.
By doing so, only Mary is going to be able to read it
because only Mary is going to have Mary's private key.
Now, this is going to be used to decrypt the contents
and ensure the message I sent is safe
from anybody else's prying eyes.
Now, once I encrypt this data
that I'm going to send to Mary using her public key,
nobody else in the world can read it except for Mary.
Even I can't read it.
And I was the sender.
Because I can't decrypt the information
because I only had her public key, not her private key.
So essentially, when I encrypt it,
it's a one-way encryption when I use a public key
because the only person who can decrypt it
and get it back to readable plain text
is going to be the receiver using their private key.
Now, when it comes to non-repudiation,
this message should be encrypted using
the sender's private key.
So in this case,
I can encrypt that message using my private key.
When I do that, anyone in the world can decrypt that
because my public key is out there in the open
and anybody can download it
and then open that message and read it.
That isn't going to give us any kind of confidentiality
if I encrypt a message using my private key.
Instead, what I'm worried about here
is making sure that people know I really was the person
who sent that message,
and that is non-repudiation.
Now, to make sure this happens,
only I can sign it using my private key
because only I have that private key.
Now, in most organizations,
we don't want just confidentiality or non-repudiation.
We want both of those things.
And in addition to confidentiality and non-repudiation,
it'd be great if we could have integrity
and authentication as well
to make sure the message being sent
is going to be sent where nobody can read it,
we know where it came from,
and that it wasn't changed in transit.
Now, to accomplish all of this with our emails,
we often use a process to create a hash digest
based on the message being sent.
And then we encrypt that hash digest
using the sender's private key.
This is known as a digital signature,
and it's going to provide us with the integrity
of the message that's being sent
because we have that hash of the message
as well as giving us non-repudiation
because only the sender could encrypt that hash
using their private key.
Then we take the message that we're going to send,
and we encrypt it using the receiver's public key.
This will give us confidentiality of the message
because only the receiver can decrypt the message itself.
So now I've got integrity of the message using the hash,
I have non-repudiation by encrypting that hash
using my private key,
and then we get confidentiality
by encrypting the message itself using your public key
as the receiver.
So now that you understand how asymmetric algorithms work
at a basic level,
let's look at some specific asymmetric algorithms
that you may encounter
while working as a cybersecurity professional,
including Diffie-Hellman, RSA,
and ECC, also known as Elliptic Curve Cryptography.
First, we have Diffie-Hellman.
Now, Diffie-Hellman is named for its two inventors,
and it's used to conduct key exchanges
and secure key distribution.
In fact, Diffie-Hellman is widely used
whenever you're setting up a VPN tunnel
or other encryption tunnels
that require a symmetric algorithms shared secret key,
which is a private key,
to be exchanged first
before setting up that symmetric tunnel.
And then using asymmetric algorithms like Diffie-Hellman,
we can do that in a secure and scalable manner.
Now, Diffie-Hellman is also susceptible
to on-path or person-in-the-middle attacks.
So if you want to secure yourself,
you need to make sure you have some form of authentication
such as requiring a password or digital certificate
at the beginning of that exchange process.
Now, whenever you see Diffie-Hellman,
I want you to remember two main things.
First, this is considered to be an asymmetric algorithm.
And second, it's going to be used for key exchange
inside of creating a VPN tunnel establishment
as part of IPSec,
or to be able to do a key exchange
of any kind over the Internet.
Second, we have RSA.
RSA was named for its creators,
Ron Rivest, Adi Shamir, and Leonard Adleman.
RSA is widely used for key exchange encryption
and digital signatures.
And the algorithm itself relies on the difficulty
of mathematically factoring large prime numbers,
and this helps protect its public and private key pairs.
RSA can support key sizes
between 1024 bits and 4,096 bits.
Now, RSA is widely used in organizations around the world.
If you happen to have one
of those secure tokens on your key chain
where every 30 to 60 seconds that six digit number changes
and you're going to use that as part of your login
and multifactor authentication,
well guess what?
You're actually using RSA
because that token
is storing RSA asymmetric one-time-use keys
that you're going to enter in as a form of authentication
showing you have possession of that token.
Third, and finally, we have ECC,
also known as Elliptic Curve Cryptography.
Now, Elliptic Curve Cryptography is heavily used
in mobile devices,
and it's based on the algebraic structure
of elliptical curves over finite fields to define its keys
because it's very efficient
and a great way of providing better security
than an equivalent RSA key of the same size.
In fact, ECC's algorithm is about six times more efficient
than an RSA algorithm.
So if you're going to have a 256-bit key with ECC,
you'd actually have to have a 2,048-bit key with RSA
to be just as secure.
For this reason, you're going to see ECC used
in a lot of things like tablets and smartphones
and other mobile-based implementations
because these devices
have much less processing power available
than a standard desktop or laptop might.
Now, there are a few variations of ECC as well
that you may come across in the field,
including ECDH, ECDHE, and ECDSA.
So let's talk about those.
ECDH, or the Elliptic Curve Diffie-Hellman,
is an ECC version
of the popular Diffie-Hellman key exchange protocol.
ECDHE, or the Elliptic Curve
Diffie-Hellman Ephemeral protocol is another variant.
And this one uses a different key
for each portion of the key establishment process
inside of the Diffie-Hellman key exchange.
ECDHE, or the Elliptic Curve Digital Signature Algorithm,
is going to be used as a public key encryption algorithm
by the US Government
for all of their digital signature needs.
Now, whenever you hear the term Elliptic Curve Cryptography,
or ECC, I want you to remember that ECC
and all of its variants
are most commonly used for mobile devices
and low-power computing devices
because they give you an equivalent level of protection
to other asymmetric algorithms with a lower key size,
which means they require less processing power
to encrypt and decrypt the data.
So remember, when it comes to asymmetric encryption,
also known as Public Key Cryptography,
there is this system of encryption in place
that's going to use two different keys,
one for the encryption and one for decryption.
There are three basic types
of asymmetric algorithms you should be aware of, which are:
Diffie-Hellman, RSA, and Elliptic Curve Cryptography.
Diffie-Hellman is focused on conducting key exchanges
when you're creating VPN tunnel establishment
as part of the IPSec protocol.
RSA, on the other hand,
is widely the used for key exchange, encryption,
and digital signatures.
Elliptic Curve cryptography is an asymmetric algorithm
that's heavily used for encryption by mobile devices,
tablets, and other low-power computing devices.