Module: Cryptography

CyberOps Associate
v1.0
Module
Objectives
Module Title: Public Key Cryptography

Module Objective: Explain how the public key infrastructure (PKI) supports
network security.
. Topic Title Topic Objective
Integrity and Authenticity Explain the role of cryptography in ensuring the integrity and
authenticity of data.
Confidentiality Explain how cryptographic approaches enhance data confidentiality.
Public Key Cryptography Explain public key cryptography.
Authorities and the PKI Trust System Explain how the public key infrastructure functions.

Applications and Impacts of Cryptography Explain how the use of cryptography affects cybersecurity operations.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 10

Confidential
21.1 Integrity and
Authenticity

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 11

Confidential
Cryptograp
hy
Securing
Communications
• Organizations must provide support to secure the data internally as well as
externally.
• The four elements of securing communications are:

• Data Integrity - Guarantees that the message was not altered.

• Origin Authentication - Guarantees that the message is not a forgery and it
actually
comes from whom it states.
• Data Confidentiality - Guarantees that only authorized users can read the
message.
• Data Non-Repudiation - Guarantees that the sender cannot repudiate, or
refute, the validity of a message sent.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 12

Confidential
Cryptograp
hy
Cryptographic Hash
Functions
• Hashes are used to verify and ensure data
integrity.
• Hashing is based on a one-way
mathematical function that is
relatively easy to compute, but
significantly harder to reverse.
• A hash function takes a variable block of
binary data, called the message, and
produces a fixed-length, condensed
representation, called the hash.
• The resulting hash is also sometimes
called the message digest, digest,
or digital fingerprint.
• With hash functions, it is computationally
infeasible for two different sets of © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 13

data to come up with the same hash

Confidential
Cryptograp
hy
Cryptographic Hash
Operation
• Mathematically, the equation h= H(x) is used to explain how a hash algorithm
operates.
• As shown in the figure, a hash function H takes an input x and returns a fixed-size
string hash
value h.
• A cryptographic hash function should have
the following properties:
• The input can be any length.
• The output has a fixed length.
• H(x) is relatively easy to compute for given
x.
• H(x) is one way and not reversible.
• H(x) is collision free, meaning that
two different input values will result © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
14

in different hash values.

Cryptograp
hy
MD5 and
• Hash functions are used to ensure the integrity of a message either accidentally or
SHA
intentionally.
• In the figure, the sender is sending a $100 money transfer to Alex. The sender
wants to ensure that the message is not altered on its way to the receiver.
There are four well-known hash functions:
• MD5 with 128-bit digest - A one-way
function that produces a 128-bit
hashed message. MD5 is a legacy
algorithm.
• SHA-1 - Very similar to the MD5 hash
functions. SHA-1 creates a 160-bit
hashed message and is slightly
slower than MD5.
• SHA-2 - If you are using SHA-2, then
SHA- 256, SHA-384, and SHA-512 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 15

algorithms should be used. Confidential

Cryptograp
hy
MD5 and SHA
(Contd.)
• While hashing can be used to detect accidental changes, it cannot be used to
guard against
deliberate changes that are made by a threat actor.
• There is no unique identifying information from the sender in the hashing
procedure.
• This means that anyone can compute a hash for any data, as long as they have
the correct
hash function.
• Therefore, hashing is vulnerable to man-in-the-middle attacks and does not
provide security to transmitted data. To provide integrity and origin
authentication, something more is required.

Note: Hashing algorithms only protect against accidental changes and does not protect the
data from changes deliberately made by a threat actor.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 16
Confidential
Cryptograp
hy
Origin
Authentication
• To add origin authentication and integrity assurance, use a keyed-hash
message
authentication code (HMAC).
• HMAC uses an additional secret key as input to the hash function.

Note: Other Message Authentication Code (MAC) methods are also used.
However, HMAC is used in many systems including SSL, IPsec, and SSH.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 17

Confidential
Cryptograp
hy
Origin Authentication
(Contd.)
HMAC Hashing Algorithm
• An HMAC is calculated using any cryptographic
algorithm that combines a cryptographic hash
function with a secret key.
• Only the sender and the receiver know the secret
key, and the output of the hash function
depends on the input data and the secret
key.
• Only parties who have access to that secret
key can compute the digest of an HMAC
function.
• If two parties share a secret key and use HMAC
functions for authentication, a properly
constructed HMAC digest of a message
that a party has received indicates that the © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 18
Confidential
other party was the originator of the
Cryptograp
hy
Origin Authentication
(Contd.)
Creating the HMAC Value
• As shown in the figure, the
sending device inputs data
into the hashing algorithm
and calculates the fixed-
length HMAC digest.
• This authenticated digest is
then attached to the
message and sent to the
receiver.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 19

Confidential
Cryptograp
hy
Origin Authentication
(Contd.)
Verifying the HMAC Value
• In the figure, the receiving device
removes the digest from the
message and uses the plaintext
message with its secret key as
input into the same hashing function.
• If the digest that is calculated by the
receiving device is equal to the
digest that was sent, the
message has not been altered.
• Additionally, the origin of the
message is authenticated
because only the sender possesses
a copy of the shared secret key.
The HMAC function has ensured the © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
20

authenticity of the message.

Cryptograp
hy
Origin Authentication
(Contd.)
Cisco Router HMAC Example
• In the figure, HMACs are used by Cisco
routers that are configured to use Open
Shortest Path First (OSPF) routing
authentication.
• R1 is sending a link state update
(LSU) regarding a route to
network [Link]/16:
• R1 calculates the hash value using the
LSU message and the secret key.
• The resulting hash value is sent with
the LSU
to R2.
• R2 calculates the hash value using the
LSU and its secret key. R2 accepts the © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
21

update if the hash values match. If

21.2 Confidentiality

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 23

Confidential
Confidentiality
Data
Confidentiality
• There are two classes of encryption used to provide data confidentiality;
asymmetric and symmetric. These two classes differ in how they use keys.
• Symmetric encryption algorithms such as Data Encryption Standard (DES),
3DES, and Advanced Encryption Standard (AES) are based on the
premise that each communicating party knows the pre-shared key.
• Data confidentiality can also be ensured using asymmetric algorithms,
including Rivest, Shamir, and Adleman (RSA) and the public key
infrastructure (PKI).
• The figure highlights some differences between symmetric and asymmetric
encryption.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 24

Confidential
Confidentiali
ty
Symmetric
Encryption
• Symmetric algorithms use the same pre-shared key (secret key) to encrypt and
decrypt data.
• Symmetric encryption algorithms are commonly used with VPN traffic because
they use less CPU resources than asymmetric encryption algorithms.
• When using these algorithms, the longer the key, the longer it will take for
someone to discover
the key.
• Most encryption keys are between 112 and 256 bits. Use a longer key for
more secure communications.
• Symmetric encryption algorithms are sometimes classified as a block cipher
or a stream cipher.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 25

Confidential
Confidentiali
ty
Symmetric Encryption
(Contd.)
Block Ciphers
• Block ciphers transform a fixed-length block of plaintext into a common block of
ciphertext of
64 or 128 bits.
• Common block ciphers include DES with a 64-bit block size and AES with a
128-bit block size.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 26

Confidential
Confidentiali
ty
Symmetric Encryption
(Contd.)
Stream Ciphers
• Stream ciphers encrypt plaintext one byte or one bit at a time.

• Stream ciphers are basically a block cipher with a block size of one byte or bit.

• Stream ciphers are typically faster than block ciphers because data is
continuously encrypted.
• Examples include RC4 and A5 which is used to encrypt GSM cell phone
communications.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 27

Confidential
Confidentiality
Symmetric Encryption
(Contd.)
Well-known symmetric encryption algorithms are described in
the table. Encryption
Symmetric Description
Algorithms
Data
This is a legacy algorithm. It uses a short key length that makes it
Encryption
insecure.
Standard
(DES)
This is the replacement for DES and repeats the DES algorithm three
3DES (Triple DES) times. It should be avoided as it is scheduled to be retired in 2023. If
implemented, use very short key lifetimes.

Advanced Encryption It offers combinations of 128-, 192-, or 256-bit keys to encrypt 128, 192,
Standard (AES) or 256 bit- long data blocks.
Software-
It is a stream cipher that uses a 160-bit encryption key and has a lower
Optimized
impact on
Encryption
the CPU compared to other software-based algorithms.
Algorithm (SEAL)
Rivest ciphers RC4 is a stream cipher that was used to©Confidential
secure web
2020 Cisco and/or traffic.
its affiliates. It has
All rights reserved. Cisco been
28

(RC) series found to

Confidentiali
ty
Asymmetric
Encryption
• Asymmetric algorithms, also called public-key algorithms, are designed in a way
that the
encryption and the decryption keys are different.
• Asymmetric algorithms use a public key and a private key. Both keys are
capable of the encryption process, but the complementary paired key is
required for decryption.
• The process is also reversible. Data that is encrypted with the public key
requires the private
key to decrypt.
• Asymmetric algorithms achieve confidentiality and authenticity by using this
process.
• Asymmetric encryption can use key lengths between 512 to 4,096 bits.
• Asymmetric algorithms are substantially slower than symmetric algorithms.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 29

Confidential
Confidentiality
Asymmetric Encryption
(Contd.)
Common examples of asymmetric encryption algorithms are described
inAsymmetric
the [Link]
Key Length Description
Algorithms
This algorithm allows two parties to agree on a key that
512, 1024, they can use to encrypt messages they want to send to
Diffie-Hellman (DH) 2048, each other. The security depends on the assumption that it
3072, is easy to raise a number to a certain power, but difficult to
4096 compute which power was used, given the number and the
outcome.
Digital Signature It specifies DSA as the algorithm for digital signatures.
Standard (DSS) DSA is a public key algorithm based on the ElGamal
512 – 1024
and Digital signature scheme. Signature creation speed is similar
Signature to RSA, but is 10 to 40 times slower for verification.
Algorithm (DSA)
Elliptic curve cryptography can be used to adapt many
224 or
Elliptic curve cryptographic algorithms, such as Diffie-Hellman or
higher
techniques ElGamal. The main advantage of elliptic curve cryptography
is that the keys can be much smaller.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
30
Confidentiali
ty
Asymmetric Encryption -
•Confidentiality
Asymmetric algorithms are used to Example: Data exchange between Bob and
provide confidentiality without pre- Alice
sharing a password.
• The confidentiality objective of
asymmetric algorithms is
initiated when the encryption
process is started with the public key.
• The process can be summarized
using the formula: Public Key
(Encrypt) + Private Key Alice acquires and Bob decrypts the
(Decrypt) = Confidentiality uses Bob’s public message with the
• When the public key is used to key to encrypt a private key and as he
encrypt data, the private key message and then is the only one with
must be used to decrypt data. send it to Bob. the private key,
• Only one host has the private confidentiality is
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 31
Confidential
achieved.
key;
Confidentiali
ty
Asymmetric Encryption -
•Authentication
The authentication objective of asymmetric algorithms is initiated with the
private key
encryption process.
• The process can be summarized using the formula: Private Key (Encrypt) +
Public Key (Decrypt) = Authentication
• When the private key is used to encrypt the data, the corresponding public
key must be
used to decrypt the data.
• Because only one host has the private key, only that host could have
encrypted the message, providing authentication of the sender.
• When a host successfully decrypts a message using a public key, it is
trusted that the private key encrypted the message, which verifies who
the sender is. This is a form of authentication.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 32

Confidential
Confidentiali
ty
Asymmetric Encryption - Authentication
(Contd.)
• Let's see how the private and public keys can be used to provide authentication
to the data
exchange
Alice between
uses her privateBob
keyand Alice. Bob decrypts using the public key
Alice encrypts a message using After Bob obtains Alice’s public key, he uses it to
her decrypt
private key and sends it to Bob. the message and to authenticate that the
message
has been received from Alice.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 33

Confidential
Confidentiali
ty
Asymmetric Encryption -
Integrity
• Combining the two asymmetric encryption processes provides message
confidentiality, authentication, and integrity. In this example, a message will
be ciphered using Bob’s public key and a ciphered hash will be encrypted
using Alice’s private key.

Alice uses Alice encrypts Bob uses Bob uses his

Bob’s Public a hash using Alice’s public private key to
Key her private key to decrypt decrypt the
key the hash message
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
34
Confidentiali
ty
Diffie-
•Hellman
Diffie-Hellman (DH) is an asymmetric mathematical algorithm that allows two
computers to
• generate an identical
The new shared key isshared secret without having communicated before.
never actually
exchanged between the sender and
receiver.
• The key can be used by an encryption
algorithm to encrypt traffic between
the two systems as both parties
know it.
• Following are two examples of
instances when DH is
commonly used:
• Data is exchanged using an IPsec
DH
VPN operation
• SSH data is exchanged © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 35
Confidential

•
Confidentiali
ty
Diffie-Hellman
(Contd.)
• Diffie-Hellman uses different DH groups to determine the strength of the key
that is used in the key agreement process. The higher group numbers are
more secure, but require additional time to compute the key.
• The following identifies the DH groups supported by Cisco IOS Software and their
associated prime number value:
• DH Group 1: 768 bits
• DH Group 2: 1024 bits
• DH Group 5: 1536 bits
• DH Group 14: 2048 bits
• DH Group 15: 3072 bits
• DH Group 16: 4096 bits
Note: A DH key agreement can also be based on elliptic curve cryptography. DH groups 19, 20, and 24,
are supported by Cisco IOS Software.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 36

Confidential
21.3 Public Key
Cryptography

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 41

Confidential
Public Key
Cryptography
Using Digital
• Digital signatures are a mathematical technique used to provide authenticity,
Signatures
integrity, and
nonrepudiation.
• Digital signatures use asymmetric cryptography.
• Digital signatures are commonly used in the following two situations:
• Code signing - Code signing is used to verify the integrity of executable files
downloaded from a vendor website. It also uses signed digital certificates to
authenticate and verify the identity of the site that is the source of the files.
• Digital certificates - These are used to authenticate the identity of a system with
a vendor
website and establish an encrypted connection to exchange confidential data.
• The Digital Signature Standard (DSS) algorithms used for generating and
verifying digital signatures are:
• Digital Signature Algorithm (DSA)
• Rivest-Shamir Adelman Algorithm (RSA) © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
42

•
Public Key
Cryptography
Digital Signatures for Code
Signing
• Digital signatures are commonly used to provide assurance of the authenticity
and integrity of software code.
• Executable files are wrapped in a digitally signed envelope, which allows the end
user to
verify the signature before installing the software.
• Digitally signing code provides several assurances about the code:
• The code is authentic and is actually sourced by the publisher.
• The code has not been modified since it left the software publisher.
• The publisher undeniably published the code. This provides nonrepudiation
of the act of publishing.
• The purpose of digitally signed software is to ensure that the software has not
been tampered with, and that it originated from the trusted source as claimed.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 43

Confidential
Public Key Cryptography
Digital Signatures for Code Signing
(Contd.)
The properties of a file that has a digitally signed
certificate are as follows:
Properties Description
File This executable file was downloaded from the
Properties internet and
it contains a software tool from Cisco Systems.
Digital This tab reveals that the file is from a trusted
Signature organization, Cisco Systems Inc.
s
Digital
This window reveals that the file was signed by Cisco
Signature
Systems, Inc mentioning the given year, month and
s Details
time.
The General tab provides information such as who
Certificate
the certificate was issued to, and who issued the
Information
certificate. It also displays the period for which
the certificate is valid.
Certificat In this tab, you can see the file was signed © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
44

e Path by Cisco Systems, as verified to DigiCert.

Public Key
Cryptography
Digital Signatures for Digital
Certificates
• A digital certificate enables users, hosts,
and organizations to securely
exchange information over the
Internet.
• It is used to authenticate and verify that a
user who is sending a message is
who they claim to be.
• Digital certificates can also be used to
provide confidentiality for the receiver
with the means to encrypt a
reply.
• Digital certificates are similar to physical
certificates.
• Digital certificate independently verifies
an identity. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 45
Confidential
• In other words, a certificate verifies an
Public Key
Cryptography
Digital Signatures for Digital Certificates
(Contd.)
This scenario will help you
understand how a digital
signature is used.
• Bob is confirming an order with
Alice, which she is ordering
from Bob’s website.
• Bob confirms the order and
his computer creates
a hash of the
confirmation.
• The computer encrypts the hash
with Bob's private key.
• The encrypted hash, which is the
digital signature, is added to the
document.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 46

• The order confirmation is then Confidential

Public Key
Cryptography
Digital Signatures for Digital Certificates
(Contd.)
When Alice receives the digital
signature, the following process occurs:
• Alice's receiver accepts the order
confirmation with the digital
signature and obtains Bob's
public key.
• Alice's computer then decrypts the
signature using Bob's public
key which reveals the assumed
hash value of the sending device.
• Alice's computer creates a hash of the
received document, without its
signature, and compares this hash to
the decrypted hash.
• If the hashes match, the document is
authentic. This means the
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 47
Confidential
21.4 Authorities and the
PKI Trust System

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 48

Confidential
Authorities and the PKI Trust
System
Public Key
Management
• When establishing an asymmetric connection between two hosts, the hosts will
exchange their public key information.
• Trusted third parties on the Internet
validate the authenticity of these
public keys using digital certificates.
The third-party issues credentials that
are difficult to forge.
• From that point forward, all
individuals who trust the third party
simply accept the
credentials that the third-party
issues. Illustrates how a driver’s
• The Public Key Infrastructure (PKI) license is analogous to a
• consists of
The Certificate specifications,
Authority systems,
(CA) creates digital certificate
digital certificates by tying a public key to
and tools that
a confirmed are used
identify, to acreate,
such as website or individual.
manage, distribute, use, store, and © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 49
Confidential
revoke digital certificates.
Authorities and the PKI Trust
System
The Public Key
• PKI is needed to
Infrastructure
support large-scale
distribution and
identification of public
encryption keys.
• The PKI framework
facilitates a highly
scalable trust
relationship.
• It consists of the
hardware,
software, people,
policies, and procedures
needed to create,
manage, store,
elements of the
distribute, and revoke
PKI. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 50

digital certificates.
Confidential
Authorities and the PKI Trust System
The Public Key Infrastructure
(Contd.)
• The below figure shows how the elements of the PKI
interoperate:

Note: Not all PKI certificates are directly received from a CA. A Registration Authority (RA) is a subordinate
CA
and is certified by a root CA to issue certificates for specific
uses. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 51
Confidential
Authorities and the PKI Trust
System
The PKI Authorities
System
• Many vendors provide CA servers as a Class Description
managed service or as an end-user Used for testing in situations in which no
0
product. checks have been performed.
• Organizations may also implement Used by individuals who require
1
verification of
private email.
PKIs using Microsoft Server or Open Used by organizations for which proof of
2
SSL. identity is required.
• CAs issue certificates based on classes 3 Used for servers and software signing.
Used for online business transactions
which determine how trusted a 4
between companies.
certificate is.
Used for private organizations or
• The class number is determined by 5
government
how rigorous the procedure was Note: security.
An enterprise can also implement PKI
that verified the identity of the for internal use. PKI can be used to
holder when the certificate authenticate employees who are accessing
was issued. the network. In this case, the enterprise is its
• The higher the class number, the own CA. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
52
Authorities and the PKI Trust
System
The PKI Trust
• PKIs can form different topologies of trust which are as follows:
System
• Single-Root PKI Topology: The simplest is the single-root PKI topology. The root CA
issues all the certificates to the end users within the same organization. On larger
networks, PKI CAs may be linked using two basic architectures:
• Cross-certified CA topologies: A peer-to-peer model in which individual CAs
establish trust relationships with other CAs by cross-certifying CA certificates.
• Hierarchical CA topologies: The root CA (highest level CA), can issue
certificates to end
users and to a subordinate CA.

Single-Root Cross-certified Hierarchical CA

PKI CA Topologies
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Authorities and the PKI Trust
System
Interoperability of Different PKI
Vendors
• Interoperability between a PKI and
its supporting services is a
concern because many CA vendors
have proposed and
implemented proprietary solutions.
• To address this interoperability
concern, the IETF published the
Internet X.509 Public Key
Infrastructure Certificate Policy and
Certification Practices Framework
(RFC 2527).
• The X.509 version 3 (X.509 v3)
standard defines the
format of a digital certificate.
Note: LDAP and X.500 are protocols that are
X.509v3
used to query a directory service, such as © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 54
Confidential
Applications
Microsoft Active Directory, to verify a username
Authorities and the PKI Trust
System
Certificate Enrollment, Authentication and
Revocation
• All systems that leverage the PKI must have the CA’s public key, which is called the
self-signed
certificate.
• The CA public key verifies all the certificates issued by the CA and is vital for
the proper operation of the PKI.
• The certificate enrollment process is used by a host system to enroll with a PKI. To
do so, CA certificates are retrieved in-band over a network, and the
authentication is done out-of-band (OOB) using the telephone.
• The system enrolling with the PKI contacts a CA to request and obtain a digital
identity
certificate for itself and to get the CA’s self-signed certificate.
• The final stage verifies that the CA certificate was authentic and is performed
using an out-of- band method such as the POTS to obtain the fingerprint of the
valid CA identity certificate.
• A digital certificate can be revoked if key is compromised or if it is no longer
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 55

needed. Confidential
21.5 Applications and
Impacts of Cryptography

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 57

Confidential
Applications and Impacts of
Cryptography
PKI
Applications
The following provides a short list of common uses
of PKIs:
• SSL/TLS certificate-based peer authentication
• Secure network traffic using IPsec VPNs
• HTTPS Web traffic
• Control access to the network using 802.1x
authentication
• Secure email using the S/MIME protocol
• Secure instant messaging
• Approve and authorize applications with Code
Signing
• Protect user data with the Encryption File System
(EFS)
• Implement two-factor authentication with smart © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 58
Confidential
cards
Applications and Impacts of
Cryptography
Encrypted Network
Transactions
• Threat actors can use SSL/TLS to introduce
regulatory compliance violations, viruses,
malware, data loss, and intrusion
attempts in a network.
• Other SSL/TLS-related issues may be
associated with validating the certificate of a
web server. When this occurs, the web
browsers will display a security warning.
PKI-related issues associated with security
warnings include:
• Validity date range - The X.509v3 certificates
specify “not before” and “not after” dates. If
the current date is outside the range, the
web browser displays a message.
• Signature validation error - If a browser cannot
validate the signature on the certificate, there is © 2020 Cisco and/or its affiliates. All rights reserved. Cisco
Confidential
59

no assurance that the public key in the certificate

Applications and Impacts of
Cryptography
Encryption and Security
Monitoring
• Network monitoring becomes more challenging when packets are encrypted.

• As HTTPS introduces end-to-end encrypted HTTP traffic (via TLS/SSL), it is not

as easy to peek into user traffic.
• Security analysts must know how to circumvent and solve these issues. Here is
a list of some
of the things that a security analyst could do:
• Configure rules to distinguish between SSL and non-SSL traffic, HTTPS and
non-HTTPS SSL traffic.
• Enhance security through server certificate validation using CRLs and OCSP.
• Implement antimalware protection and URL filtering of HTTPS content.
• Deploy a Cisco SSL Appliance to decrypt SSL traffic and send it to intrusion
prevention system (IPS) appliances to identify risks normally hidden by SSL.

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 60

Confidential
Applications and Impacts of
Cryptography
Encryption and Security Monitoring
(Contd.)
• Cryptography is dynamic and always changing. A security analyst must
maintain a good understanding of cryptographic algorithms and operations
to be able to investigate cryptography-related security incidents.
• There are two main ways in which cryptography impacts security
investigations.
• First, attacks can be directed to specifically target the encryption algorithms
themselves.
• After the algorithm has been cracked and the attacker has obtained the keys,
any encrypted data that has been captured can be decrypted by the attacker
and read, thus exposing private data.
• Secondly, the security investigation is also affected because data can be hidden
in plain sight
by encrypting it.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 61
Confidential
21.6 Public Key
Cryptography
Summary

© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 62

Confidential
Public Key Cryptography
Summary
What Did I Learn in this
Module?
• The four elements of secure communications: data integrity, origin
authentication, data confidentiality, and data non-repudiation.
• A hash function takes a variable block of binary data, called the message, and
produces a fixed-length, condensed representation, called the hash.
• There are two classes of encryption that are used to provide data confidentiality:
asymmetric and symmetric.
• Symmetric encryption algorithms, such as DES, 3 DES, and AES are based on
the premise that each communicating party knows the pre-shared key.
• Asymmetric algorithms (public key algorithms) are designed so that the key that
is used for
encryption is different from the key used for encryption.
• Data confidentiality can also be ensured using asymmetric algorithms, including
Rivest, Shamir, and Aldeman (RSA) and PKI. The process is summarized using
this formula: Public key (Encrypt) + Private Key (Decrypt) = Confidentiality.
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco 63
Confidential
Public Key Cryptography
Summary
What Did I Learn in this Module?
• The authentication objective of an asymmetric algorithm is initiated when the
(Contd.)
encryption process is started with the private key. The process can be
summarized with this formula: Private Key (Encrypt) + Public Key
(Decrypt) = Authentication.
• Diffie-Hellman (DH) is an asymmetric mathematical equation algorithm that
allows two computers to generate an identical shared secret key
without having communicate before.
• Digital signatures are a mathematical technique used to provide three basic
security services: authenticity, integrity, and non-repudiation. Digital signatures
are commonly used in code signing and digital certificates.
• The Public Key Infrastructure (PKI) consists of specifications, systems, and tools
that are used
to create, manage, distribute, use, store, and revoke digital certificates.
• There are many common uses of PKIs including a few listed here: SSL/TLS
certificate-based peer authentication, HTTPS Web traffic, secure instant
message, and securing USB storage devices. © 2020 Cisco and/or its affiliates. All rights reserved. Cisco 64
Confidential