Alice & Bob
8-9 november 2013, Maastricht
Public key cryptography 101
Without this there would be
no internet as we know today
example “encryption” algorithms
3, 15, 4, 5
A = 1, B = 2, C = 3, ...., Z = 26
C O D E
W I N G D I N G S
c = (m + k) mod 26
Message: C O D E
Ciphertext (key=1): D P E F
Ciphertext (key=2): E Q F G
Ciphertext (key=-1): B M C D
Ciphertext (key=0): C O D E
Ciphertext (key=26): C O D E
Ciphertext (key=52): C O D E
➡ Key is too easy to guess.
➡ Key has to be send to Bob.
➡ Prone to frequency analysis.
➡ ‘E’ is used 12.7% of the times in english texts.
➡ The ‘Z’ only 0.074%.
➡ ‘E’ is used 17.4% of the times in german
texts, the ‘Q’ only 0.022%
gl 7291 i owioa okddilnk ylgm hiu uﬂm mk cwgukl bs i
dgegmiws okywm jkw i owgdf mvfs ngnl'm okddgm. mvfuf dﬂ
cwkdcmes fuoicfn jwkd i dixgdyd-ufoywgms umkoainf mk mvf
eku ilqfefu ylnfwqwkyln. mknis, umgee hilmfn bs mvf
qkrfwldﬂm, mvfs uywrgrf iu ukengfwu kj jkwmylf. gj sky virf i
cwkbefd, gj lk klf feuf oil vfec iln gj sky oil jgln mvfd., disbf sky
oil vgwf, mvf i- mﬁd.
In 1972 a crack commando unit was sent to prison by a
military court for a crime they didn't commit. These men
promptly escaped from a maximum-security stockade to the
Los Angeles underground. Today, still wanted by the
government, they survive as soldiers of fortune. If you have a
problem, if no one else can help and if you can ﬁnd them,
maybe you can hire, The A- Team.
Determinism and the ability to apply
frequency analysis are “bad things”
➡ Previous examples were symmetrical encryptions.
➡ Same key is used for both encryption and decryption.
➡ Good symmetrical encryptions: AES, Blowﬁsh, (3)DES.
➡ They are fast and secure.
Q: How does Alice send over the message +
key securely to Bob? Everybody’s listening!
Another encryption system:
Asymmetrical encryption or public key encryption.
public key - available for everybody.
private key - For your eyes only!
It is NOT possible to decrypt the message
with same key that is used to encrypt.
Use public key to encrypt: private key to decrypt
private key to encrypt: public key to decrypt.
Awesome! So why not using asymmetrical
encryption for everything??
It’s too slow!
✓ not resource intensive.
✓ encryption only
✓ useful for small and large
✗ need to send over the key
to the other side.
✓ no need to send over the
✓ can be used for encryption and
✗ very resource intensive.
✗ only useful for small messages.
Q: How does Alice send over the message + key
securely to Bob? Everybody’s listening!
A: Use symmetrical encryption for the (large)
message and encrypt the key used with an
asymmetrical encryption method.
➡ Alice generates a random string:
➡ Alice encrypts this string with Bobs
PUBLIC key => “sdfafkjasdgaag”
(slow) public key encryption
➡ Bob received “sdfafkjasdgaag”
➡ Bob decrypts the message with his
PRIVATE key => “monkeypooh”
(fast) symmetrical encryption using key “monkeypooh”
omglolbbq! haha hacker noobs!
✓ not resource intensive
✓ useful for small and large messages
✓ safely exchange key data
➡ Maybe even more important than
➡ Signing is authenticating that a message is
actually send by the sender and is not
compromised in any way.
➡ Bob creates a message:
“i don’t like mondays”.
➡ Bob creates a md5() from this message:
➡ Bob encrypts this MD5 with his PRIVATE
key => “43tt34tqegadsgadsgA”
“i don’t like mondays”
➡ Alice decrypts the hash with Bob’s
➡ Alice creates a md5() from the message =>
➡ Alice checks if both hashes match.
➡ Can’t change message, because encrypted
hash would not match.
➡ Can’t change hash, because only Bob’s
private key can encrypt.
Great,.. but not really convinced...
How many of you are actually using this
encryption and signing in practice??
➡ When we go to a HTTPS website, we are
establishing a symmetrical encryption.
➡ We use asymmetrical encryption to
exchange the (random) key used.
➡ The public key we need to use is found in
How do we know that the site is actually
run by the ones we think they are?
➡ It is signed (by somebody else) that states:
this certiﬁcate / URL truly belongs to them.
➡ Signed by their PRIVATE key, so we can use
their PUBLIC key to check the signature.
➡ (Root) Certiﬁcate Authorities
➡ They are automatically built into your
browser / OS and you will automatically
➡ We are forced to trust companies that
make a living on selling as many certiﬁcates
➡ It’s a ﬂawed system, but the best we have :(
➡ But, we can ﬁx pretty much everything else!
➡ Email: privately communicate between you
and somebody else.
➡ Making sure your email isn’t tampered with
and actually comes from you.
➡ Enigmail / gpgsuite
➡ Pretty easy to setup and use
➡ Every time you commit something to version
control / github, you sign it with your key!
➡ Download new software (yum, apt, packagist)
lots of ppl with keys lots of implementations
not many ppl with keys no implementations
no implementations not many ppl with keys
Here’s another problem:
➡ Everybody can create a key
➡ And everybody can pretend to be anyone else
➡ We use a system called: web-of-trust
➡ How do we create the web-of-trust?
➡ Every time you meet a person in real life.
➡ key signing parties on meetups,
conferences, places where enough people
➡ No need for a computer / laptop. Only
your key (ﬁngerprint) and something that
identiﬁes you being you (driving license, ID
➡ Add GPG/PGP extension to your email
client (enigmail / gpgsuite etc).
➡ Create a keypair.
➡ Worry about the web-of-trust later!
➡ PKE enables us to (automatically) enrich
your content with security and/or privacy.
➡ It’s still hard to implement, but it’s getting
better and easier.
➡ (e-)mail was hard too!
➡ We *need* it.
Find me on twitter: @jaytaph
Find me for development and training: www.noxlogic.nl
Find me on email: [email protected]
Find me for blogs: www.adayinthelifeof.nl