                  _________________

                 /_               /\

                  \/  _______    /  \

                  /  /      /   /   /

                 /  /______/   /   /

                /           __/   /

               /  _______   \  __/

              /  /      /   /  \

             /  /______/   /   /

           _/             /   /

          /______________/   /       BLACK SUN RESEARCH FACILITY

          \              \  /      	   http://blacksun.box.sk/

           \______________\/

    ENCRYPTION AND AUTHENTICATION

    =================================================

       WRITTEN BY                 [ cos125@hotmail.com                :E-MAIL    ]

               BINARY RAPE        [ 114603188                         :ICQ#      ]

                                  [ http://blacksun.box.sk/           :TURORIALS ]

    CONTENTS

    =======================================

    1.  Introduction.

    2.  Key Systems.

        2.1 Symmetric Key

        2.2 Public Key

    3.  Digital Certificates.

    4.  Hash Algorithms.

    5.  Authentication.

        5.1 Usernames and Passwords

        5.2 Passcards

        5.3 Digital Signatures

        5.4 Checksum

    6.  Biometrics.

    7.  Steganography.

    8.  Last Words.

    ____________________________________________________________________________________________

    1.0 INTRODUCTION

    =======================================

    In recent times privacy and security has become increasingly important

    especially with newer technologies like wireless networking and the

    potential problems they represent. Encryption has always been an

    effective way to conceal information and before the digital era it was

    mostly used my governments such as the germans and americans during the

    second world war and has been seen as far back as the times of the great

    Roman Empire. There is alot of information that we would like to keep

    private like credit card and financial information and personal letters

    and conversations, encryption and the science of cryptography allows us

    to do this.

    2.0 KEY SYSTEMS

    =======================================

    There are two different kinds of systems used to handle encryption and

    convert data these are called Symmetric and Public key encryption.

    2.1 SYMMETRIC KEY

    =======================================

    Symmetric key encryption involves 2 computers on a network each with a

    "key" installed on it. This key allows each of the computers to decode

    the encrypted data that was sent to it. For example computer A is sending

    an encrypted packet to computer B for this example we will use a very

    simple kind of encryption, for every letter in the data we move down

    the alphabet 2 places A becomes C and B becomes D, using this information

    we can both encrypt and decrypt the information.

    Computer	 	Symmetric Key	    Computer

    ========	 	============= 	    ========

       A    --->----- Shift 2 places --->----    B

    Using the shift 2 places key A can send the message 'Hello' to B, Hello

    will be shifted by the key and B will recieve "Jgnnq" this just looks like

    gibberish until B looks at its key and it knows to shift the letters 2

    places, doing this B can see that it says Hello, of course this is a bit

    simplified but you can see how this method can be built upon to form

    greater, more sophisticated levels of encryption.

    2.2 PUBLIC KEY

    =======================================

    Public Key encryption relies upon 2 keys, the public key and the private key.

    The private key is held by your computer, when you want to send secure

    data between a computer and your own you give your public key to that person

    then every computer that wants to communicate with you has a copy of your

    public key. To decode any messages you send to those computers they must use

    a combination of both your public key and their own private key, this method

    of encryption is most popularly used with the encryption program pgp, you

    can get this software from www.pgp.com.

    Most computers use a mixture of symmetric and public key encryption because

    of the amount of processing that is required. When starting a secure connection

    the first computer uses a symmetric key and sends this to the second computer

    using public key encryption. The two computers then use symmetric encryption

    for the rest of the transaction. Once the session is completed the key is

    discarded and a new key must be created for all following sessions, this means

    that even if somehow a person gets your key, once the session has ended it wont

    matter and the key will be useless.

    3.0 DIGITAL CERTIFICATES

    =======================================

    Public Key encryption wouldn't be practical to use for applications such as

    web servers for online transactions, for this purpose Digital Certificates

    were developed. The digital certificate is a small file provided to each

    computer by an independent system called a certification body, this tells

    each computer that the other one is who it says it is and that it can be

    trusted, the certification body then sends the public keys of each computer

    to the other and they are free to communicate.

    The digital cert method is mostly used in SSL (Secure Sockets Layer). SSL

    was developed by netscape and quickly adopted for browser to web server

    communication, especially by sites dealing in e-commerce and financial trans-

    actions such as amazon.com or dabs.com.

    SSL is a part of larger security protocol called TLS (Transport Layer Security)

    which has a large backing from microsoft. In your web browser there is 2 tell

    tale signs that such precautions are in place, the first is the small pad-lock

    that appears in your status bar if it appears to be locked the site is secure,

    otherwise there is no security between your connection, another sign is the

    address in the bar at the top, if you had a secure transaction in place with

    blacksun's site your address bar would read https://blacksun.box.sk instead

    of the usual http:// beofore the address. You may also notice some Certificate

    or digitally signed alerts you recieve when you try to download certain software

    or access certain websites, this is just to tell you that the site *should*

    essentially be trustworthy altough the average web surfer wont have a clue what

    its talking about.

    4.0 HASH ALGORITHMS

    =======================================

    To get a public key we use a hash value, to get this value the computer uses

    an input value usually a large one like 12,537, then puts that number trough

    the hashing algorithm and we get an ouput, if we had a simple algorithm like

    multiply the input number by 124 we would end up with 1,554,588, it would be

    very hard to guess the original number was 12,537 unless you knew to divide

    the output by 124 to get the original number. Most Hash algorithms are much

    more sophisticated than this.

    Hash algorithms can be very long and use massive hash values, the level of

    encryption is measured by its hash value and this can go up to 128 bit numbers

    which would give us a hash value of anything between 2 to the power of 0 and

    2 to the power of 128, which in decimal terms is anywhere inbetween 0 and

    3,402,823,669,209,384,634,633,746,074,300,000,000,000,000,000,000,000,000,000,000,000,000.

    which would be a little more difficult :).

    5.0 AUTHENTICATION

    =======================================

    Another option in computer security which is often used hand in hand with

    encryption is authentication systems. There are several different commonly

    used authentication systems including the following.

    5.1 USERNAMES AND PASSWORDS

    =======================================

    This method has been used for many years to gaurd the personal information

    and privacy of different users on a computer system or network. This is

    the most popular method and is in place in one form or another on every

    operating system to varying degrees of success. The computer encrypts the

    password and compares it with an earlier encrypted version of the users

    password, if the two files match then the password is correct. A password

    cracker operates by encrypting a series of words and comparing them with

    the password file, once it finds a match it alerts the user of the cracking

    software with both username and password.

    5.2 PASS CARDS

    =======================================

    There are several types of pass cards mostly used in offices, these range

    from standard swipe cards, similiar to credit cards they have a magnetic

    strip holding the users information, to smart cards containg a small chip,

    this method is used most commonly on the macintosh where you place a small

    card into the keyboard on the left, some software such as Quark Express

    uses this method to ensure that a licence for the software has been purchased.

    5.3 DIGITAL SIGNATURES

    =======================================

    Digital signatures are a form of public key encryption. The signer of the

    document(e-mail, text file etc..) uses his private key and a four part

    public key to digitally sign the document, the algorithm used is the

    Digital Signature Algorithm (DSA) which is endorsed by the US government.

    If any changes occur to the contents of the document after it has been

    signed the signature is rendered invalid.

    5.4 CHECKSUM

    =======================================

    Checksum methods arent usually used for security purposes but can be used

    as such. TCP/IP uses a checksum technique, it gets the size of the packet

    and stores it in a field within the header, on arrival to the remote computer

    it checks the size of the packet and then compares it with the value of the

    field within the header, if the 2 dont match, the packet is discarded this

    is usually because of errors or loss during transport but this and similiar

    methods can be used to ensure data is not altered by a person.

    6.0 BIOMETRICS

    =======================================

    Biometrics operate on the fact that every person has a certain unique

    set of features about them and these features are then used as a basis

    of authentification to that person. Biometric authentication can use

    several features of the person including,

    Face scan			- Identifying a person based on the features of their face.

    Retina Scan		- Identified upon the patterns of the eyes retina.

    Fingerprints		- Identifies the person on their unique fingerprint.

    Voice Identification	- Based upon levels and pitch of voice.

    DNS Fingerprinting		- Not very common, checks the DNA structure from biological material.

    7.0 STEGANOGRAPHY

    =======================================

    Steganography is the process of storing information within common everyday

    material. This method is most commonly used with images such as gif or jpeg

    files however the technology has been extended to other areas such as mp3

    files or common internet traffic within the headers. There are many programs

    available across the internet for hiding information with steganogaphy.

    As an example of steganography heres an example of storing some information

    within normal web traffic:

    within the ip header theres a field called the ttl or Time-To-Live, which

    holds a numeric value, by storing the numerical value of an ascii characther

    we can send short messages 1 charachter at a time, the maximum value of an

    ascii characther is 255 so this value would not seem very uncommon so far as

    ttl fields in ordinary traffic. You would have to ensure the remote computer

    was on the same network so that the hop count could be predicted, move 1

    charachter up for each hop to handle the ttl being decremented. A better

    example would be to use icmp, icmp has alot of room left within its body

    as it doesnt usually carry a payload, by storing information with the payload

    of an icmp packet you could transfer information similiarly to normal traffic

    and it is uncommon for this to be checked or logged by systems, this could be

    further improved by encrypting the payload and this method is not bound by

    prolems such as calculating the hops and has much more room to transmit data,

    despite limitations heres an example of transmitting a word in ttl fields >>

    Packet-1

    192.62.4.1->192.62.4.2, win:512, ttl:72, id:20482

    (72 = 'H')

    Packet-2

    192.62.4.1->192.62.4.2, win:512, ttl:69, id:21436

    (69 = 'E')

    Packet-3

    192.62.4.1->192.62.4.2, win:512, ttl:76, id:22132

    (76 = 'L')

    Packet-4

    192.62.4.1->192.62.4.2, win:512, ttl:76, id:23019

    (76 = 'L')

    Packet-5

    192.62.4.1->192.62.4.2, win:512, ttl:79, id:24149

    (79 = 'O')

    Packet-6

    192.62.4.1->192.62.4.2, win:512, ttl:10, id:25218

    (10 = '\r\n'[Carriage return or New Line])

    This transfers H-E-L-L-O\r\n, which is of course the

    word hello, its terminated by a carriage return to

    track the end of each word.

    8.0 LAST WORDS

    =======================================

    By using a mixture of these technologies it is possible to make communiceation

    and information more secure from unwelcome eyes and ears. Thanks to these

    methods digital transmissions are more secure than other kinds like mail

    or even phone calls, especially on cellular phones, altough it pays to

    remember that nothing is truely secure, especially in the way that the

    encryption algorithms were so quickly cracked and captured using radio

    antennas on wireless networks or from programs such as john the cracker.

    Well thats the end of this little tutorial and i hope you learnt more about

    both encryption and authentication and their processes.

    SHOUTS

    =======================================

    Starman_Jones		- Thanks for everything over the years (especially for my own room).

    Vsus			- I am never drinking Tsambuca with you again :P.

    Delusive			- Nice arse luv :P.

    BSRF			- Thanks to every-1 at BSRF for releasing this and for being a good laugh :).

    ALL @ IRC.BOX.SK