CMU6XX

Ethical Hacking

Session 11: Cryptography for Professionals

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Apply Symmetric (AES) and Asymmetric (RSA/ECC) cryptography correctly.
  • Understand the mechanics of Key Exchange (Diffie-Hellman) and Forward Secrecy.
  • Deploy a Public Key Infrastructure (PKI) and generate X.509 certificates.
  • Differentiate between standard Hash Functions and Key Derivation Functions (KDFs).
  • Analyze cryptographic implementation failures (e.g., hardcoded IVs, bad random number generators).

Seminar Structure (3 Hours)

Part 1: Encryption & PKI (1.5 hrs)
  • Symmetric vs Asymmetric Crypto
  • Certificates and Trust Chains
  • Task 1: Practical PKI with OpenSSL
Part 2: Hashing & Passwords (1.5 hrs)
  • Hashes, Salts, and Peppers
  • Key Derivation Functions (PBKDF2, Argon2)
  • Task 2: Cryptographic Code Analysis

Part 1: Encryption & PKI

Duration: 1.5 Hours

Symmetric vs Asymmetric Crypto

Modern communication requires a hybrid approach.

  • Symmetric (AES): Same key encrypts and decrypts. Extremely fast. Used to encrypt the actual bulk data (like an HD video stream). Problem: How do you share the key safely?
  • Asymmetric (RSA/ECC): A mathematical key pair (Public and Private). Anyone can encrypt with the Public Key, but only the Private Key can decrypt. Extremely slow.
  • The Hybrid Solution (TLS): Use Asymmetric crypto to safely establish a Symmetric key, then use the Symmetric key for the rest of the session.

Digital Signatures

Asymmetric cryptography run in reverse.

  • If you encrypt data with your Private Key, anyone can decrypt it using your Public Key.
  • This doesn't provide secrecy, but it provides Non-Repudiation and Authentication.
  • If the Public Key successfully decrypts the file, it proves mathematically that the owner of the Private Key created it. This is how software updates are signed to prevent tampering.

Public Key Infrastructure (PKI)

How do you know Google's Public Key actually belongs to Google, and not an attacker?

  • Certificate Authorities (CAs): Trusted third parties (like Let's Encrypt or DigiCert) that verify identities.
  • They issue an X.509 Certificate, which binds a Public Key to a domain name (google.com) and is digitally signed by the CA.
  • Your browser implicitly trusts a hardcoded list of Root CAs. If a certificate is signed by one of them, the connection is trusted (the padlock icon appears).

Introduction to Task 1

Pentesters must know how to generate and inspect certificates to conduct MITM attacks, establish encrypted C2 (Command and Control) channels, and audit client infrastructure.

We will use OpenSSL to manually build a functional cryptographic certificate.

Task 1: Practical PKI with OpenSSL

Timing: 45 minutes

Using the command line and OpenSSL:

  1. Write the command to generate a new 2048-bit RSA Private Key (server.key).
  2. Write the command to generate a Certificate Signing Request (CSR) using that key. (This is what you would send to a CA).
  3. Explain the difference between a Self-Signed Certificate and a CA-Signed Certificate. Why will a browser throw a warning for a Self-Signed cert?

15 Minute Break

Please return promptly for Part 2.

Part 2: Hashing & Passwords

Duration: 1.5 Hours

Hashes and Salts

Databases should never store passwords in plaintext. They store Hashes.

  • A Hash (e.g., SHA-256) is a one-way mathematical function. You cannot "decrypt" a hash back to the password.
  • The Rainbow Table Attack: Attackers pre-compute the hashes for millions of common passwords. If your database hash matches their pre-computed hash, you lose.
  • The Solution (Salting): Appending a long, random string (the Salt) to the password before hashing it. This makes pre-computed rainbow tables useless.

The Speed Problem

Standard hash functions (MD5, SHA-256) are designed to be extremely fast.

  • This is great for verifying file integrity, but terrible for passwords.
  • A modern GPU cluster can calculate billions of SHA-256 hashes per second, allowing an attacker to brute-force a salted password rapidly.
  • We need a hash function that is intentionally slow.

Key Derivation Functions (KDFs)

KDFs are algorithms explicitly designed for securely storing passwords.

  • Bcrypt / PBKDF2: CPU-hard functions. They loop the hashing algorithm thousands of times to slow it down.
  • Argon2: The current state-of-the-art. It is Memory-Hard. It requires huge amounts of RAM to compute the hash. GPUs have thousands of cores but very little RAM per core, effectively neutralizing hardware cracking rigs.

Introduction to Task 2

A major part of penetration testing is reviewing source code and identifying cryptographic implementation failures.

We will act as a security auditor reviewing a client's authentication code.

Task 2: Cryptographic Code Analysis

Timing: 50 minutes

You find the following Python code snippet during a White-Box pentest:

import hashlib
def store_password(password):
    hash_obj = hashlib.md5(password.encode())
    db.save(hash_obj.hexdigest())
  1. Identify the three critical cryptographic failures in this snippet.
  2. Explain how "Collision Vulnerabilities" affect MD5, and why that makes it unsuitable for security applications.
  3. Rewrite the conceptual logic to correctly utilize a Salt and a modern KDF (like Argon2 or Bcrypt).

Summary & Next Steps

  • Never "roll your own" cryptography. Always use established, peer-reviewed libraries.
  • The strength of cryptography relies entirely on the secrecy of the keys, not the secrecy of the algorithm.
Next Week: Pen-Testing Reporting & Ethics (Professional Documentation)