Revision as of 00:23, 24 July 2015

Until it is destroyed ^[1], or we run out of resources to maintain its cables, bridges, root servers and data centers, or some idiot(s) replace(s) the current internet with a panopticon-like or a military-and-corporate-only global network, the web seems to be here to stay ... but it has an ad-hoc security model added post-hoc and it is up to us to make it better!?! WTF?

And there's a whole lot of information that we may not want other people to see:

• Credit-card information
• Social security numbers
• Private correspondence
• Personal details
• Bank-account information
• Medical health records ­
• Other sensitive information

For centuries, nations around the world have operated Black Chambers, secret rooms where they attempted to decode the messages being sent by their rivals. The French operated the Cabinet Noir, in Vienna the Geheime Kabinets-Kanzlei was the home of Austria's greatest codebreakers, and in Britain there was Room 40 and then Bletchley Park. Visit Simon Singh's virtual Black Chamber, where you can learn about codes and codebreaking, encrypt your own messages, crack those of your enemies, and play with interactive enciphering programmes http://www.simonsingh.net/The_Black_Chamber/

Before the digital age, the biggest users of cryptography were governments, particularly for military purposes. With the advent of the net we can all use it for:

• Enabling authorized transactions.
• Defending free expression.
• Protecting our space, our objects and channels, from unauthorized access.
• Collectively failing to put crypto into our own hands.

Also, see anonymising your traffic with linux and clean up all the things.

Using removable storage media

A simple but straightforward security method is to keep all sensitive information on removable storage media like portable flash memory drives or external hard drives that you only mount the device when you need access to it. You can turn old harddrives into external harddrives by taking them out of an old PC and putting them in a portable HDD USB storage kit (alias harddrive enclosure). These "DIY" kits are available for 2.5 inch and 3.5 inch HDD using either IDE or SATA connections and cost way less than a manufactured USB HDD.

You may have a permission problem accessing it. If so, change the group of /media/[externaldisk] to storage, change permissions to 775 and add users that need to be able to write to disk to the storage group (re-log required before changes are visible).

As root (or use sudo) do:

# chgrp storage /media/[externaldisk]
# chmod 775 /media/[externaldisk]
# gpasswd -a [user] storage

This way everyone will be able to read the disk, but only root and users in storage group will be able to write to it. If you want everyone to be able to read/write, use chmod 777. If the operation isn't permitted while running it as root you probably need to add support for the NTFS file system first:

# apt-get update
# apt-get install ntfs-3g

But the most popular forms of security all rely on encryption, the process of encoding information in such a way that only the person (or computer) with the key can decode it.

Crypto concepts

The imitation game is a nail-biting race against time following Alan Turing (pioneer of modern-day computing and credited with cracking the German Enigma code) and his brilliant team at Britain’s top-secret code-breaking centre, Bletchley Park, during the darkest days of World War II. Turing, whose contributions and genius significantly shortened the war, saving thousands of lives, was the eventual victim of an unenlightened British establishment, but his work and legacy live on http://theimitationgamemovie.com/

The Crypto Museum is a virtual museum that can only be visited on the internet. The main purpose of the Crypto Museum is to preserve history. This is done by collecting, restoring and describing historical cipher machines such as the well-known Enigma machine, spy equipment and the likes http://www.cryptomuseum.com/

• The science of sending concealed messages is known as steganography (concealed writing). It is not very secure by itself. If someone finds the hidden message, all its secrets are revealed.
• Manipulating a message so that it can not be read even if it were intercepted is known as cryptography(hidden writing).
• Cryptography takes two forms: codes and ciphers.
• A code is essentially a secret language invented to conceal the meaning of a message, a system for hiding the meaning of a message by replacing each word or phrase in the original message with another character or set of characters (codegroups). The list of replacements is contained within a codebook. To protect a message in this way is called encoding. Encoding has no built-in flexibility.
• A cipherconceals a plaintext message by replacing or scrambling its letters. This process is known as enciphering and results in a ciphertext message. Converting a ciphertext message back to a plaintext message is known as deciphering. Each cipher can be split into two halves: the algorithm and the key. The key gives a cipher some built in flexibility.
• There are two classes of ciphers. A substitution cipher changes the letters in a message to another set of letters, or cipher alphabet, while a transposition cipher shuffles the letters around.
• Coded messages are often enciphered to improve their security, a process known as superencipherment.
• Encryption covers both the act of encoding and enciphering.
• Decryption covers both decoding and deciphering.
• Cryptotext covers both codetext and ciphertext but encicode is sometimes used instead.
• The science of breaking cryptotext or encicode is known as cryptanalysis.
• The two fields cryptography and cryptanalysis together make up the science of cryptology.

Most forms of cryptography used today rely on computers. Ciphers are better known today as algorithms, the guides for encryption -- they provide a way in which to craft a message and give a certain range of possible combinations. A key, on the other hand, helps a person or computer figure out the one possibility on a given occasion.

Symmetric-key encryption

In symmetric key cryptography (alias secret key cryptography) the same key is used to encrypt and decrypt the data.

There are many different algorithms using symmetric key cryptography, offering anything from minimal to nearly unbreakable security. Some of these algorithms offer strong security, easy implementation in code, and rapid encryption and decryption. Such algorithms are very useful for encrypting files stored on a computer to protect them in case an unauthorised individual gains access to the machine. They are somewhat less useful for sending messages from one computer to another, because both ends of the communication channel must possess the key and must keep it secure. Distribution and secure storage of such keys can be difficult and can open security vulnerabilities.

Asymmetric key cryptography

In asymmetric key cryptography (alias public-key encryption) different keys are used for encrypting and decrypting a message. The asymmetric key algorithms that are most useful are those in which neither key can be deduced from the other. In that case, one key can be made public while the other is kept secure. This provides some distinct advantages over symmetric encryption: the necessity of distributing secret keys to large numbers of users is eliminated, and the algorithm can be used for authentication as well as for cryptography.

Diffie-Hellman key agreement

The Diffie-Hellman key agreement algorithm was developed by Dr. Whitfield Diffie and Dr. Martin Hellman in 1976 to enable two parties who are involved in communication to generate a shared secret key for exchanging information confidentially.

1. Alice and Bob exchange public keys. These keys must have the same modulo portion, a prime p. (see RFC 5114)
2. Alice and Bob each encrypt a shared, non-secret value, g (also usually taken from RFC 5114), using their private keys, and they exchange these encrypted values.
3. Alice encrypts the encrypted value received from Bob with her private key, and vice versa. These values are used as a shared session key.

For example, Alice says: 5,23 (base g = 5 and prime number p = 23, randomly chosen)

   O_/                                         7_O_/
 _/|      ---------------5,23-------------->    (/
 __)\                                           /\/'
`    \                                          7
Alice                                          Bob

Bob says: 8

   O_/                                         7_O_/
 _/|      <----------------8----------------    (/
 __)\                                           /\/'
`    \                                          7
Alice                                          Bob

Alice says: 19

   O_/                                         7_O_/
 _/|      -----------------19--------------->    (/
 __)\                                           /\/'
`    \                                          7
Alice                                          Bob

Alice: Now I know the key is 2. Bob: Now I know the key is 2. And both encrypt their communication with 2. How did they compute the numbers?

Modulus or modulo (abbreviated as "mod") is the Latin word for "remainder, residue" or more in "what is left after parts of the whole are taken". Thus, "modular" or "mod arithmetic" is really "remainder arithmetic". For example:

• When 7 is divided by 3 it leaves a remainder of 1, thus: 7 mod 3 = 1
• When 8 is divided by 3 it leaves a remainder of 2: 8 mod 3 = 2
• When 9 is divided by 3 it leaves no remainder: 9 mod 3 = 0.

In the example of Bob and Alice setting up a shared key, private numbers are x = 6 and y = 15. The public numbers are g = 5, n = 23, X = 8 and Y = 19.

5, 23 = (g,p) = (base,prime)

8 = X = g^x mod p

19 = Y = g^y mod p

The keys then are:

key1 = 2 - [Y^x mod p] = 2 - [19⁶ mod 23]

key2 = 2 - [X^y mod p] = 2 - [8¹⁵ mod 23]

This solves the problem of how to pass a secret key between two parties without having any eavesdropper knowing the key. This does not solve the man in the middle attack (authentication): Someone can pretend to be Bob and share a key with Alice and Alice will send encrypted information to "Bob".

Rivest Shamir Adleman (RSA)

Ron Rivest, Adi Shamir, and Len Adleman released the Rivest-Shamir-Adleman (RSA) public key algorithm in 1978. This algorithm can be used for encrypting and signing data. The encryption and signing processes are performed through a series of modular multiplications.

Basic RSA algorithm for confidentiality:

Ciphertext = (plaintext)^e mod n

Plaintext = (ciphertext)^d mod n

Private Key = {d, n}

Public Key = {e, n}

Basic RSA algorithm for authentication:

Ciphertext = (plaintext)^d mod n

Plaintext = (ciphertext)^e mod n

Private key = {d, n}

Public key = {e, n}

Elliptic Curve Cryptography (ECC)

Elliptic Curve Cryptography provides similar functionality to RSA and is implemented in smaller devices like cell phones. It requires less computing power than RSA. ECC encryption systems are based on the idea of using points on a curve to define the public/private key pair.

El Gamal

El Gamal is an algorithm used for transmitting digital signatures and key exchanges. The method is based on calculating logarithms. The algorithm is based on the characteristics of logarithmic numbers and calculations. The Digital Signature Algorithm (DSA) is based on the El Gamal algorithm.

Digital Signature Algorithm (DSA)

The Digital Signature Algorithm (DSA) was developed by the United States government for digital signatures. DSA can be used only for signing data and it cannot be used for encryption. The DSA signing process is performed through a series of calculations based on a selected prime number. Although intended to have a maximum key size of 1,024 bits, longer key sizes are now supported.

Cryptographic hash functions

Digital signatures

Digital certificates

Cryptanalysis

Resources

• Hands-on Diffie–Hellman demonstration http://ds9a.nl/tmp/dh.html

Related

• Installing linux
• Linux applications
• Linux security
• Kinky linux command-line
• Object encryption on linux
• Anonymising your traffic with linux
• Clean up all the things
• Shell scripting

References

1. ↑ How to destroy the internet http://gizmodo.com/5912383/how-to-destroy-the-internet