Have you ever wondered how the magic behind online security works? What keeps your passwords and personal data safe from malicious cyber hackers? Well, get ready for a journey through the exciting world of cybersecurity, as we explore concepts such as Hashing, SHA algorithms, HMAC, PKI, Certificates, and TLS/SSL. Fasten your seatbelts? Let’s go!

Hashing: The Secret Under Lock and Key

Imagine you have a secret password, something like “IloveCats123.” In an ideal world, we’d store it as is in a database, but in real life, that would be a disaster. Enter Hashing, which takes that password and turns it into a series of seemingly random numbers and letters. This is essential because, even if a hacker accesses the database, they will only see that code instead of your actual password. Practical example: if you run the md5sum command on Linux at “IloveCats123,” you’ll get a long hash like “d19df3a7ee0ef3722b87b37b9c9e953e.” Mysterious, right?

Hashing is used in a variety of scenarios:

• Passwords: When you create an account on a website, your password is stored as a hash in the database. Every time you log in, the site compares the hash of your entered password with the one they have stored.
• Data integrity: Hashing is used to verify whether data has been altered during transmission. When you download a file from the internet, the hash provided by the website is used to make sure that the file hasn’t been modified in transit.
• Digital signatures: In cryptography, digital signatures use hashing to verify the authenticity of a message or document. If the hash of the message matches the digital signature, you can be sure that the message has not been altered.

There are several tools that are used to create hashes in different environments. Some of the most common tools are:

Command Line Commands:

1. Linux/Unix: On Linux/Unix-based systems, you can use commands such as  md5sum, sha256sum, sha512sum  , and openssl to compute hashes of files or text strings.
2. Windows: On Windows systems, you can use CertUtil or  third-party tools like HashCalc or File Checksum Utility to calculate hashes.

Software Tools:

1. HashTab (Windows): This is a tool that integrates into Windows Explorer and allows you to calculate file hashes by simply right-clicking on a file and selecting “Properties”.
2. WinRAR and 7-Zip: These file compression programs can also compute file hashes when creating or verifying compressed files.

Programming Languages:

1. Many programming languages, such as Python, Java, and C++, have built-in libraries and functions for calculating hashes. For example, in Python, you can use the hashlib module.

Online Tools:

1. There are numerous online tools that allow you to calculate hashes of text strings or upload files to get their hashes. Examples include OnlineMD5, OnlineSHA1, and many more.

Security Applications:

1. Some security and antivirus apps also offer hashing features. For example, programs like McAfee and Norton can compute hashes of files to verify their integrity.

The choice of tool will depend on your operating system, personal preferences, and the purpose for which you need to calculate hashes. Make sure you’re using reliable and secure tools, especially if you’re handling sensitive or security-critical data.

SHA-224, SHA-256, SHA-384 and SHA-512: More Than Random Numbers and Letters

SHA (Secure Hash Algorithm) algorithms are like magic wands of security.

SHA-224, SHA-256, SHA-384, and SHA-512 are some of the most popular. What are you doing? They take data and transform it into unique hashes. SHA algorithms are a family of cryptographic hash functions designed to take an input and produce a unique hash value. Each member of this family differs in the length of output and the complexity of their calculations. Below, let’s explore the four SHA algorithms mentioned and their distinguishing features:

•  SHA-224: This algorithm produces a 224-bit (28-byte) hash and is a lighter variant of SHA-256. Although less common, it is still used in some cases to conserve memory and bandwidth.
• SHA-256: It is one of the most widely used SHA algorithms. It produces a 256-bit (32-byte) hash and is used in web applications, cryptocurrencies such as Bitcoin, and many other areas due to its balance between security and efficiency.
•  SHA-384: Produces a longer hash of 384 bits (48 bytes) and is considered more secure than SHA-256. It is suitable for applications that require a higher level of security.
• SHA-512: The most robust version of the SHA family, it produces a 512-bit (64-byte) hash. It is used in high-security applications and is especially useful in environments where security is critical.

Examples of commands:

• SHA-224
  • echo -n “Text to hash” | OpenSSL dgst -sha224

• SHA-256
  • echo -n “Text to hash” | OpenSSL DGST -SHA256

• SHA-384
  • echo -n “Text to hash” | openSSL dgst -sha384

• SHA-512
  • echo -n “Text to hash” | OpenSSL dgst -sha512

• RIPEMD-160
  • echo -n “Text to hash” | OpenSSL DGST -RIPEMD160

Note: Make sure you have the openssl package  installed on your system.

In these examples, “Text to hash” represents the string you want to hash. The echo -n command  is used to prevent a newline character from being included in the hash. When you run one of these commands, you’ll get the corresponding hash for the string provided.

Remember that these commands are specific to Unix/Linux-based systems. If you’re using Windows, you can use tools like Cygwin or Windows Subsystem for Linux (WSL) to access similar commands.

RIPEMD-160: A Contender in the World of Hashes

The RIPEMD-160 (RACE Integrity Primitives Evaluation Message Digest) algorithm is a cryptographic hash function designed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel. Although not as well-known as SHA algorithms, RIPEMD-160 has its own interesting features:

• Output Length: RIPEMD-160 produces a 160-bit (20-byte) hash.
• Designed for Security: RIPEMD-160 was built with a focus on collision resistance, meaning two different inputs are less likely to produce the same hash.
• Use in Cryptocurrencies: Some cryptocurrencies, such as Bitcoin, use RIPEMD-160 to calculate wallet addresses. In this context, it is used in combination with other algorithms to increase security.

HMAC is a message authentication technique that uses cryptographic hashing functions and a shared secret key to verify the integrity and authenticity of a message. Its main function is to ensure that a message has not been altered by a third party during its transmission.

HMAC Key Details:

• Use a Secret Key: HMAC requires a secret key shared between the sender and receiver. This key is essential for calculating and verifying the HMAC.
• Protects Integrity: The sender calculates an HMAC based on the message and secret key, and sends it along with the message. The receiver performs the same calculation and compares the result with the HMAC received. If they match, the message has not been altered.
• Uses Cryptographic Hash Functions: HMAC uses a cryptographic hash function, such as SHA-256 or SHA-512, to compute the authentication code. The choice of hash function is important for security.
• Attack Resistance: HMAC is designed to withstand a wide range of attacks, such as brute force attacks, extended-length attacks, and more. The security of HMAC is highly dependent on the quality of the secret key.

Example of Using HMAC:

Suppose Peter wants to send a message to John securely using HMAC. Here’s how it might work:

1. Initial Preparation: Peter and John agree on a shared secret key, which only they know.
2. Sending the Message: Peter creates his message and calculates the HMAC of the message using the shared secret key.
3. HMAC Delivery: Along with the message, Peter sends the calculated HMAC.
4. Reception and Verification: John receives the message and the HMAC. He then calculates his own HMAC from the received message using the same secret key. If the HMAC it calculates matches the one received from Peter, this means that the message has not been altered and is coming from Peter.

Example of a Command to Compute HMAC with OpenSSL (SHA-256):

echo -n “Message to Authenticate” | openssl dgst -sha256 -hmac “SecretKey” 

In this command, “Message to Authenticate” is the message you want to authenticate, and “SecretKey” is the shared secret key. The command uses SHA-256 as the cryptographic hash function to compute the HMAC.

PKI: The Public Key Infrastructure

Public Key Infrastructure (PKI) is a framework of policies, procedures, and technologies used to manage, distribute, and revoke public keys and digital certificates. Its main purpose is to facilitate the security of communication and authentication of parties in an online environment. Here’s a more detailed breakdown:

Key Components of a PKI:

• Certificate Authorities (CAs): CAs are trusted entities that issue digital certificates. These certifications bind a public key to an individual, entity, or online server. CAs are also responsible for revoking certificates in the event of loss or compromise of the private key.

CAs are trusted bodies that play a central role in a PKI. Some important aspects of CAs include:

• Certificate Issuance: CAs issue digital certificates, which link the identity of a user or entity to a public key. They issue certificates in accordance with established security policies and procedures.
• Certificate Signing: CAs digitally sign the certificates they issue using their private key. This signature provides authenticity and guarantees the integrity of the certificate.
• Key Management: CAs must ensure that their private keys are secure. Losing or compromising a CA’s private key could have serious consequences.
• Certificate Revocation: If a certificate is lost or compromised, the CA must provide a way to revoke it to prevent misuse. This is achieved through certificate revocation lists (CRLs) and online verification services.

• Digital Certificates: A digital certificate is an electronic file that contains the public key of a user or entity along with identifying information (such as name, email address, and organization). Digital certificates are used to verify the identity and authenticity of the parties to an online communication.

Some key points about certificates include:

• Certificate Content: A digital certificate contains identifying information about the holder, a copy of their public key, and details about the CA that issued the certificate.
• Certificate Usage: Certificates can have a variety of uses, such as user authentication, server authentication, digital signature, and encryption.

• Registration Authorities (RAs): RAs are responsible for verifying the identity of individuals or organizations requesting a digital certificate before the CA issues the certificate.

• Public Key Infrastructure: The infrastructure itself includes servers and systems that store and manage digital certificates, public keys, and private keys. This includes directories, databases, and key management systems. RAs play an important role in authenticating the certificate holder and validating their identity.

Some aspects of public key infrastructure include:

• Certificate Databases: Store information about issued certificates, expiration dates, revocation lists, and other related data.
• Public Key Servers: Store public keys that are used to verify digital signatures and decrypt encrypted data.
• Public Key Directories: These directories allow you to search and retrieve public keys.

• Root Certificates: These are trusted digital certificates issued by root certificate authorities, which are used to sign and validate other certificates. Web browsers and operating systems maintain a list of trusted root certificates.

Uses and Benefits of PKI:

• Authentication: PKI allows for strong authentication, which means that parties to a communication can be assured of the other party’s identity.
• Encryption: Public keys are used to encrypt data that can only be decrypted by the corresponding private key, ensuring the confidentiality of the information.
• Digital Signatures: Private keys are used to digitally sign documents, emails, and other data. This allows verification of the integrity and authenticity of the documents.
• Network Security: PKI is critical in network security, especially in environments such as SSL/TLS, VPNs, and network authentication.
• Secure Email: PKI is used in email authentication, which helps prevent spoofing and ensures the integrity of messages.

PKI Challenges:

• Key Management: Proper key management, including private key protection, is essential in a PKI.
• Cost and Complexity: Implementing and maintaining a PKI can be costly and complex, especially in large organizations.
• Regulatory Compliance: PKIs must comply with regulations and security standards, such as the Payment Card Industry Data Security Standard (PCI DSS) and the General Data Protection Regulation (GDPR).

In short, PKI is an essential infrastructure in cybersecurity that enables secure authentication, encryption, and data integrity in online environments. Its use extends to many areas, from network security to email authentication and digital signing of documents. Despite its challenges, PKI plays a critical role in protecting information and trust in online communications.

Transport Layer Security (TLS)

Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols used to provide security in communication over the Internet. Although SSL was developed first, TLS is considered the most secure and up-to-date evolution. Here’s a deep dive into TLS/SSL:

TLS/SSL: Web Communication Security

History of SSL and TLS:

• SSL (Secure Sockets Layer): SSL was developed by Netscape in the 1990s as a security protocol to protect communication on the web. The initial versions were SSL 1.0 and SSL 2.0, but these had significant vulnerabilities.

• TLS (Transport Layer Security): To address SSL’s weaknesses, TLS was developed as its successor. TLS 1.0, also known as SSL 3.1, was introduced in 1999. Since then, TLS has continued to evolve, with later versions such as TLS 1.2 and TLS 1.3.

• Main Function:

TLS/SSL encrypts communication between a client and a web server, protecting it from unauthorized eavesdropping and tampering. This ensures that the data transmitted between the user’s browser and the web server is confidential and complete.

• Encryption and Authentication:

TLS/SSL uses strong encryption algorithms to protect communication. It also uses digital certificates to authenticate the server and, in some cases, the client. Digital certificates are issued by trusted Certificate Authorities (CAs).

• Usage Flow:
  • When a user accesses a TLS/SSL-protected website (e.g., https://www.ejemplo.com), the browser and server establish a secure connection.
  • The server presents your digital certificate to the browser, which verifies the authenticity of the certificate.
  • Encryption algorithms are negotiated, and a session key is established to encrypt the communication.
  • From that moment on, communication between the browser and the server is carried out in a secure and encrypted manner.

• Benefits:
  • Confidentiality: The transmitted information is encrypted and can only be decrypted by the rightful recipient.
  • Integrity: TLS/SSL ensures that transmitted data has not been altered during transmission.
  • Authentication: Helps verify the identity of the server, protecting users from malicious man-in-the-middle attacks.
  • MITM Attack Protection: Mitigates malicious man-in-the-middle attacks that could intercept or disrupt communication.

• Common Uses:

TLS/SSL is used in web applications, email, VPNs, instant messaging, and other forms of online communication. It is essential for the security of online transactions, such as online shopping and e-banking.

• TLS 1.3: The latest version, TLS 1.3, has improved security and performance. It has focused on eliminating weak protocols and encryptions, reducing latency in connection establishment, and strengthening overall security.

In short, TLS/SSL is critical to internet security and ensures that communication between the user’s browser and the web server is secure and reliable. As it evolves and improves with new releases, it remains an essential part of the online security infrastructure.

Digital Certificates

There are several types of certificates used in exposed website scenarios on the internet, depending on security and authentication needs. Here are some common types of certificates and examples of use in a website scenario:

1. Domain Validated SSL/TLS Certificate (DV SSL/TLS Certificate):
   • Usage: This type of certificate is used to encrypt communication between a web browser and a server, providing a secure connection (HTTPS). Validation is limited to the domain owner.

1. Usage Flow:
   1. A user accesses a website (https://www.ejemplo.com).
   2. The site server has a validated domain SSL/TLS certificate installed.
   3. The user’s browser verifies that the certificate is valid and that the domain matches the address they are trying to access.
   4. The communication between the browser and the server is encrypted, protecting data in transit.

2. Validated Organization SSL/TLS Certificate (OV SSL/TLS Certificate):
   • Usage: This type of certificate is used for websites that require more rigorous validation. It not only verifies the ownership of the domain, but also the existence and authenticity of the organization.

2. Usage Flow:
   1. A user accesses a financial institution (https://www.ejemplo-banco.com) website.
   2. The site server has a validated organization SSL/TLS certificate installed.
   3. The user’s browser verifies that the certificate is valid and that the organization is authenticated.
   4. The communication between the browser and the server is encrypted, providing additional security in financial transactions.

3. Extended Validation SSL/TLS Certificate (EV SSL/TLS Certificate):
   • Usage: This type of certificate offers the highest level of validation and trust. It is used on high-profile websites and organizations that want to highlight their authenticity and security.

3. Usage Flow:
   1. A user accesses an e-commerce website (https://www.tiendalujosa.com).
   2. The site server has an Extended Validation SSL/TLS certificate installed.
   3. The user’s browser displays a green address bar and the name of the organization in the address bar to indicate that the site has gone through extensive validation.
   4. The communication between the browser and the server is encrypted, providing maximum security and confidence in the authenticity of the site.

4. Wildcard SSL/TLS Certificate:
   • Usage: These certificates are used to secure multiple subdomains under a single primary domain. They are convenient in scenarios where you have multiple subdomains.

4. Usage Flow:
   1. A company has a wildcard certificate for *.ejemplo.com.
   2. The server protects multiple subdomains such as correo.ejemplo.com, tienda.ejemplo.com, blog.ejemplo.com, etc., with the same certificate.
   3. Users access these subdomains and the browser verifies the validity of the certificate, allowing a secure connection.

5. Multiple Domain Certificate (SAN SSL/TLS Certificate):
   • Usage: These certificates are used to secure several different domain names into a single certificate, which is useful for websites with multiple domains or subdomains.

5. Usage Flow:
   1. A business has a SAN certificate that covers www.ejemplo-uno.com and www.ejemplo-dos.com.
   2. The server protects both domains with the same certificate.
   3. Users access either site, and the browser verifies the validity of the certificate to enable a secure connection.

Each type of SSL/TLS certificate accommodates different security and authentication needs. The choice depends on the nature and purpose of the website, as well as the amount of validation required to ensure users’ trust.

Signed & Self-Signed

Signed certificates and self-signed certificates are two types of SSL/TLS certificates that differ in the authority issuing them and the level of trust they offer. Here’s the difference between them:

Signed Certificate:

• Issuer: These certificates are issued by a trusted Certificate Authority (CA), which is a third-party entity that is responsible for verifying and validating the identity of the certificate owner. CAs are trusted entities recognized by web browsers and operating systems.
• Trust: Certificates signed by CAs are widely trusted. Web browsers and operating systems trust CAs and, therefore, the certificates issued by them. This means that users can access secure websites without warnings or security issues.
• Common Use: Signed certificates are used on public websites, businesses, and any environment where a high level of trust and authentication is required, such as online stores, banks, social media, and more.
• Usage Flow Example:
  • A website owner purchases a signed certificate from a trusted CA.
  • The CA performs rigorous validation of the site owner’s identity before issuing the certificate.
  • Website visitors see a green padlock in the browser’s address bar, indicating that the connection is secure and authenticated.

Self-Signed Certificate:

• Issuer: Self-signed certificates are issued by the owner of the website or entity itself, without the intervention of a third-party CA. There is no validation of identity by a trusted external entity.
• Trust: Self-signed certificates are not inherently trusted, as there is no trusted authority to back up the authenticity of the certificate. Web browsers and operating systems often display warnings when accessing sites that use self-signed certificates.
• Common Use: Self-signed certificates are commonly used in development, test, or private intranet environments where validation from an external CA is not necessary and security is not a primary issue.
• Usage Flow Example:
  • A developer or network administrator creates a self-signed certificate to encrypt communication on a private intranet.
  • Users trying to access the website may see warnings in the browser, indicating that the certificate is not trusted.

The process of creating, validating, installing, and using a digital certificate involves several steps. The following is a general description of this process:

Creation of a Digital Certificate:

• Key Generation: The first step is to generate a pair of cryptographic keys: a private key and a public key. The private key must be kept secret, while the public key will be included in the certificate.
• Certificate Request: The owner of the certificate (either an individual or an entity) creates a certificate request that contains identifying information, the public key, and other details. This request is signed with the requestor’s private key.
• Submission of the Application to a Certificate Authority (CA): The application is sent to a trusted CA for review and issuance. The CA conducts a validation process to confirm the identity of the requestor.

Certificate Validation:

• Identity Validation: The CA verifies the information provided in the application, such as the applicant’s name, organization, and email address. This may include verifying documents and communicating with the applicant.
• Domain Validation (in the case of DV and OV): For Domain Validated (DV) and Organization Validated (OV) certificates, the CA verifies that the applicant has control over the domain of the website to be certified.
• Extended Validation (in the case of EV): In the case of Extended Validation (EV) certificates, the CA performs a more in-depth and rigorous validation of the requesting entity. This may require more documents and verification from the organization.
• Certificate Signing: Once the CA is satisfied with the validation, it signs the certificate request with its private key. The resulting digital certificate is the document that links the applicant’s public key to their identity.

Installation and Use of the Certificate:

• Delivery of the Certificate: The CA delivers the digital certificate to the applicant. The certificate contains the public key and other details, and is usually provided in file format (e.g., PEM or PKCS#12).
• Web Server Installation: The website owner installs the certificate on the web server. This usually involves configuring the server to use the certificate on SSL/TLS connections.
• Use by Users: When users access the website, the server presents their certificate. Users’ web browsers verify the authenticity of the certificate, the correspondence of the domain, and its validity. If everything is valid, a secure connection (HTTPS) is established.
• Encryption and Authentication: The certificate is used to encrypt the communication between the user’s browser and the server, ensuring the confidentiality of the data. It is also used to authenticate the server, allowing users to trust the website’s identity.

This general flow represents how a digital certificate is created, validated, installed, and used in a web server environment. Digital certificates are essential to ensure security and authentication in online communications, and their process of obtaining involves validation of the applicant’s identity by a trusted entity, such as a CA.

Examples of commands for generating cryptographic keys, both a private key and a public key, using OpenSSL, a tool commonly used on Unix/Linux-based systems:

1. Generating an RSA Private Key:

To generate a 2048-bit RSA private key and save it to a file, you can use the following command:

openssl genpkey -algorithm RSA -out private-key.pem 

This will generate a private key and save it in a file called “private-key.pem”. You can rename the file according to your preference.

2. Generating an RSA Private Key with Password:

If you want to protect the private key with a password, you can add the -aes256 option  to the above command:

openssl genpkey -algorithm RSA -aes256 -out private-key-password.pem 

The command will prompt you to enter and confirm a password to protect the private key.

3. Extracting the Public Key from the Private Key:

After generating a private key, you’ll often need to extract the corresponding public key. You can do this with the following command:

openssl rsa -pubout -in private-key.pem -out public-key.pem 

This command will extract the public key from the private key and save it to a file called “public-key.pem”.

4. Generation of a Private Key and a Self-Signed Certificate (not recommended for production):

If you want to generate a private key and a self-signed certificate for development or testing purposes, you can do so with the following command:

openssl req -x509 -newkey rsa:2048 -keyout private-key.pem -out self-signed-certificate.pem

This command will generate a private key, a self-signed certificate, and save them in separate files. The use of self-signed certificates in production environments is not recommended.

In short, cybersecurity is an exciting dance of hashing, SHA, HMAC, PKI, and TLS/SSL algorithms. Each of these concepts works hard behind the scenes to ensure your data is safe and your secrets are safe. The next time you’re surfing the internet or logging into your online banking account, remember that this invisible magic is protecting you.

So, instead of worrying about hackers, sit back, enjoy your online experience, and witness cybersecurity in action. Until the next digital adventure!

Thank you for reading friend.