jay/notes
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tidy up

Browse Source
This commit is contained in:
John Gatward committed 2026-10-04 15:24:17 +01:00
1 parent d0f27f276b
commit d6f54d4ec2
103 files changed
+3663 -3779
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/lectures/cryptography/16_crypto_protocols.md
+19 -18
View File
@@ -3,8 +3,8 @@
### Message Authentication Codes
- Provide integrity and authenticity - not confidentiality
- Protecting system files
- Ensuring messages haven’t been altered
- Protecting system files
- Ensuring messages haven’t been altered
- Calculate a keyed hash of the message, then append this to the end of the message
![1653664490.png](img/1653664490.png)
@@ -18,7 +18,7 @@
#### Authenticated Encryption (AEAD)
- It’s common to attach MACs to the end of ciphertext, that this is now usually built into ciphers as part of AEAD mode
- It’s common to attach MACs to the end of ciphertext; this is now usually built into ciphers as part of AEAD mode
- You’re often able to authenticate non-encrypted “associated” data too
![1653664720.png](img/1653664720.png)
@@ -30,19 +30,19 @@
- TLS is a protocol that provides *authenticated* and *encrypted* sessions
- Secure Socket Layer (SSL) came first, then after `v3.0` it became TLS
- Transport Layer Security has two layers
1. The record layer
- Using established symmetric keys and other session info, will encrypt application packets, very like IPsec
2. The handshake layer
- Used to establish session keys, as well as authenticate either party - usually the server using a public key certificate
1. The record layer
- Using established symmetric keys and other session info, will encrypt application packets, very like IPsec
2. The handshake layer
- Used to establish session keys, as well as authenticate either party - usually the server using a public key certificate
##### TLS Handshake
- The TLS handshake allows us to
- Establish the master secret
- Resume sessions
- Authenticate the identity of the server or client
- Establish the master secret
- Resume sessions
- Authenticate the identity of the server or client
- This is for TLS 1.2 - ECDHE_RSA
- Elliptic curve with Diffie-Hellman ephemeral with RSA
- Elliptic curve with Diffie-Hellman ephemeral with RSA
![1653665054.png](img/1653665054.png)
@@ -71,6 +71,7 @@ Random Number: 16cf43a...
Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
[Session ID]
```
Random nonce used to stop replay attacks
**Certificate**
@@ -97,7 +98,7 @@ Digital Signature calculated over the DH parameters
**[Certificate Request]**
Optional request for a certificate and singature from the client - only used in mutual TLS
Optional request for a certificate and signature from the client - only used in mutual TLS
Imagine two banks communicating where both parties need to prove their identity.
@@ -117,7 +118,7 @@ Optional client certificate, verified by the server using PKI
**[Certificate Verify]**
Digital signature computed over the bytes send in the handshake so far
Digital signature computed over the bytes sent in the handshake so far
**Change Cipher Spec**
@@ -147,7 +148,7 @@ Mitigates man-in-the-middle attacks
## Public Key Infrastructure
#### Why do we need PKI?
#### Why do we need PKI?
![1653666858.png](img/1653666858.png)
@@ -184,7 +185,7 @@ Mitigates man-in-the-middle attacks
##### Who manages the Root Certificates?
- Major OS vendors operate *root certificate programs*
- Apple for iOS and OS X
- Microsoft for Windows
- Mozilla maintains root certificate store
- Used in linux & firefox
- Apple for iOS and OS X
- Microsoft for Windows
- Mozilla maintains a root certificate store
- Used in Linux & Firefox