You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/12-cryptography.livemd
+24-58Lines changed: 24 additions & 58 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ Like many concepts/technologies in security, cryptography is not new. Centuries
8
8
known and trusted senders/receivers while making those messages unreadable for enemies or anyone else for whom the message is not intended.
9
9
Secret codes, etc.
10
10
11
-
Cryptography, like speaking or writing in code, is used whenever there something that needs to be kept secret in an environment where there are multiple other parties who could see or hear the secret but are not the intentended receiptient. The sender and receiver agree upon a code to exchange messages. Additionally, written notes can be stored and unless a reader has the code, won't know what the actual message is.
11
+
Cryptography, like speaking or writing in code, is used whenever there something that needs to be kept secret in an environment where there are multiple other parties who could see or hear the secret but are not the intended recipient. The sender and receiver agree upon a code to exchange messages. Additionally, written notes can be stored and unless a reader has the code, won't know what the actual message is.
12
12
13
13
Cryptography is used throughout applications to protect sensitive information that while is needed for the operation of the application and it's components, is not intended to be openly shared. This module highlights how cryptography is applied
14
14
@@ -23,7 +23,7 @@ Cryptography is used throughout applications to protect sensitive information th
23
23
24
24
### Description
25
25
26
-
There are two categories of cryptography, symmetric and asymmetric and within these categories, there are a variety of algorthims that are distinguished by
26
+
There are two categories of cryptography, symmetric and asymmetric and within these categories, there are a variety of algorithms that are distinguished by:
27
27
-how data gets chopped up to be encrypted
28
28
-how many keys are involved in the encryption/decryption process
29
29
-how the keys get generated/used (symmetric/asymmetric)
@@ -32,7 +32,7 @@ There are two categories of cryptography, symmetric and asymmetric and within th
32
32
33
33
In symmetric encryption, which is also called secret key encryption, a single key used for both encryption and decryption. Symmetric cryptography is bested used when performance and efficiency are important to the application component using/accessing the data to be secured.
34
34
35
-
In asymmetric encryption, which is also called public-key cryptography, two related but separte keys are generated and then one is used for encrypting while the other for decrpyting. The keys include one that is meant to be shared (pubic key) and one that must always be kept secret(private) but in this public key infrastructure (PKI) system, both keys work to secure client-server interactions, secure VPN connectsion, certificates, digital signatures, and help ensure the technology and data in the system is only accessible by authenticated, and authorized entities with keys.
35
+
In asymmetric encryption, which is also called public-key cryptography, two related but separate keys are generated and then one is used for encrypting while the other for decrpyting. The keys include one that is meant to be shared (pubic key) and one that must always be kept secret(private) but in this public key infrastructure (PKI) system, both keys work to secure client-server interactions, secure VPN connectsion, certificates, digital signatures, and help ensure the technology and data in the system is only accessible by authenticated, and authorized entities with keys.
36
36
37
37
When selecting an algorithm, best practice is to never build your own, and to always use established and proven algorithms, vetted and recommended by industry experts like NIST.
38
38
@@ -41,35 +41,20 @@ When selecting an algorithm, best practice is to never build your own, and to al
Older ciphers/algorithms have been proven to be insecure usually due to the weakness of the mathematics invovled in the algorithm or due to the key lenght. Both of these can make it trivial for a malicious actor to decrypt information/data meant to be kept secret.
48
-
49
-
Newer (Resilient/proven secure by industry)
50
-
AES - symmetric; CBC and GCM modes most secure
51
-
52
-
Diffie-Hellman key exchange
53
-
RSA
54
-
55
-
```
56
-
57
44
## Implementation in Modern Applications
58
45
59
46
### Description
60
47
Modern applications have many components that store, process, transmit a variety of information and data. Often that information/data consists of "secrets" or is otherwise sensitive. This includes things like personal information on customers, user credentials, of anything else application developers would like to keep secret.
61
48
62
-
API keys, tokens, passwords and other credentials to access privileged components and features, senstivitve data (PII, healthcare), private keys, signing certificates, are all examples of information that should not be available for every users and indeed, kept internal to the organization.
63
-
64
-
Much of this information is not static, however, and need sto be transmitted between client and server, stored in databases, used in source code and thus to secure this data, look to implement cryptography both at rest and in transit.
65
-
66
-
Using. cryptography to protect this information wherever it is in the application, sent between services, stored in databases, used in source code is the best way to ensure it's security and confidentiality.
49
+
API keys, database credentials, tokens, admin passwords and other credentials to access privileged components and features, senstivitve data (PII, healthcare), private keys, signing certificates, are all examples of information that should not be available for every users and indeed, kept internal to the organization.
67
50
68
-
In-transit, dnsure all requests/responses are sent using the secure version of the HTTP protocol, HTTPS. HTTP over TLS. Additionally, For remote access into development environments, SSH, VPN - for access to sensitive development environment internal to an organization/remote accessover a network.
51
+
To secure this data, look to implement cryptography both at rest and in transit.
69
52
70
-
In elixir, https (enabled)
53
+
In-transit, ensure all requests/responses are sent using the secure version of the HTTP protocol, HTTPS. HTTP over TLS. Additionally, For remote access into development environments, SSH, VPN - for access to sensitive development environment internal to an organization/remote accessover a network.
Hash - Sometimes implemented alongside encryption but has a different purpose;
100
-
Cryptography used for confidentiality; keeping information secret except for intended recipient/audience. Hashes are used to ensure the
101
-
integrity of the data, meaning ensuring from it's creation/generation to it's final state, it remains unmodified and untampered with.
102
-
Hashes also used as a substitute for storing data in it's original form. A one way function that - compare starting hash from known good data, to end hash which will indicate changes. Hashing passwords is a common application. Comparing hashes to determine if correct password entered.
Hashing is sometimes implemented alongside encryption but has a different purpose. Cryptography used for confidentiality; keeping information secret except for intended recipient/audience.
112
79
113
-
```
80
+
Hashes are used to ensure the integrity of the data, meaning ensuring from it's creation/generation to it's final state, it remains unmodified and untampered with. Hash algorithms are one way functions that - compare starting hash from known good data, to end hash which will indicate changes. Hashing passwords is a common application. Comparing hashes to determine if correct password entered.
Cryptographic Failures are the number two most common issue on the OWASP Top 10
118
-
A02:2021 – Cryptographic Failures
119
-
120
-
Related weaknesses include
121
-
Notable Common Weakness Enumerations (CWEs) include CWE-327: Broken or Risky Crypto Algorithm, and CWE-331 Insufficient Entropy.
85
+
Cryptographic Failures are the number two most common issue on the OWASP Top 10 A02:2021 – Cryptographic Failures
122
86
123
-
All amount to data being inadvertently being sent in cleartext, sensitive data, the use of old, weak or custom cryptographic algorithms or protocols that are ineffective against attacker efforts to uncover keys, . Best practics is to never build your own crypto mechanisms. Use proven and secure:
124
-
Secure Hashes: SHA-1 has been deprecated as of 2011 with a transition plan released in 2022. Recommenation to move towards orther families SHA256
125
-
Secure Encryption Algorithms; AES is the current standard; secure modes must be emplemented
For authentication/TLS RSA, DSA, and ECDSA with 128-bit
128
-
security strength (for example, RSA with
129
-
3072-bit or larger key)
87
+
Related weaknesses include CWE-327: Broken or Risky Crypto Algorithm, and CWE-331 Insufficient Entropy.
130
88
131
-
Beware of hardcoding keys, private keys, in source code where they can be discovered by malicious actors. Avoid building your own crytographic mechanisms or using outdated protocols.
89
+
Most of the concerns around cytography amount to data being inadvertently being sent in cleartext, sensitive data, the use of old, weak or custom cryptographic algorithms or protocols that are ineffective against attacker efforts to uncover keys, . Best practics is to never build your own crypto mechanisms. Use proven and secure methods like the following:
90
+
-Secure Hashes: SHA-1 has been deprecated as of 2011 with a transition plan released in 2022. Recommenation to move towards orther families SHA256
91
+
-Secure Encryption Algorithms; AES is the current standard; secure modes must be emplemented
132
92
133
93
Follow NIST Recommendations for configuring the most secure algorithms when building your applications and securing secrets and data.
134
94
95
+
Beware of hardcoding keys, private keys, in source code where they can be discovered by malicious actors. Avoid building your own crytographic mechanisms or using outdated protocols.
0 commit comments