Linux: Describes encryption and decryption algorithms and how to issue security certificates to yourself.

Encryption and decryption technology:
Symmetric encryption
The encryption and decryption Parties use the same key. The encryption and decryption speed is very fast.
Data blocks are generally the same size. If the remaining data blocks are not the same as those of other data blocks
If the size is the same, add some padding for it, and then encrypt each data block one by one,
Then, send the encrypted data block to the other party, and manage each data block,
However, how to deal with the encrypted block, because each block is processed separately, when the other party cracks the data
Each piece of independent cracking, that is to say, this encryption process is not helpful for anti-cracking,
There are two ways to process encrypted data blocks:
ECB: each piece is encrypted separately, and one transmission is encrypted,
CBC: Encrypted or ciphertext blockchain. It is implemented through or computation. Each data block is sent to the other party.
Previously, this data block is executed or computed with the previous data block, and the result is sent to the other party.
So if you don't get the first block, it's useless to get others. Even the first block will work with a random number.
Or operation
The biggest benefit is that data can be restored after two operations.

Algorithm: des: Data Encryption Standard, with 56-bit key length
AES: Advanced Encryption Standard, which can contain three types of keys: 128, 192, and 256.
3DES: the original encryption is performed three times,
Blowfish
Twofish
Rc6
Idea
Cast5

Defects: 1. Too many passwords need to be recorded when a person communicates with many objects
2. Key Distribution is difficult and is the biggest challenge. There is no reliable means to send a key
Objects not seen

 

Asymmetric encryption

Public key encryption algorithm: DSA, RSA, EIGamal
Encryption and decryption Parties use different keys
Function: encryption/Decryption
Both RSA and user identity authentication can be implemented, while DSA can only encrypt data.
Public Key and Private Key
The public key is a feature extracted from the private key. The public key is hidden in the private key.
Currently, the mainstream key length is 2048.

Defects: 1. encryption speed is slow, which is 1000 times slower than symmetric encryption by 3 orders of magnitude and 10 times faster than symmetric encryption.
2. public key encryption is generally not used to encrypt data. It is mainly used for user authentication and data encryption.
It is implemented through symmetric encryption.
How to Implement User Authentication:
Now let's assume that there are two communication objects, one of which is relatively small, the other is relatively small, and the other is very small.
An email, but Tom does not want the content of his email to be tampered with when receiving the email,
Then, Xiao Hei encrypts the email content and says that he is Xiao Hei, and generates a public key and a private key,
Private Key blacklist will be carried with you
And it cannot be leaked. The public key is sent to Tom along with the email.
For decryption, it means that the blacklist is the blacklist... This achieves authentication. However, if the data encrypted by the blacklist is large
It takes a long time to encrypt the public key. After encryption is completed, the hacker is speechless, so the data encrypted by the hacker is not
But the feature value of the data section. When it comes to the feature value, let's talk about one-way encryption."

Unidirectional encryption
Avalanche effect: the input data is slightly different and the results are significantly different. The main objective is to prevent brute-force cracking.

One-way encryption is used to calculate the feature values of a piece of data. The encryption process is irreversible. It is used to calculate the features of a piece of data and is unique and used
Data Integrity Verification

No matter how long the data you input is, the output results are of the same length.
MD5: Message Digest, with a fixed output length of BITs
Sha1: secure hash algorithm, with a fixed output length of BITs

Identity Authentication:
One-way encryption does not encrypt the entire data segment when implementing user identity authentication. Instead, the feature value of this data segment is calculated first,
Encrypt the feature value with the private key, attach it to the data after encryption, and send it to the other party. After the other party receives the data
Two aspects of content can be verified: the identity of the first user and the integrity of the second data. The receiver decrypts the content with the sender's public key.
If the decryption succeeds, the sender is verified. Then, the receiver obtains the feature value of the data segment, and the receiver uses the same
The algorithm performs operations to obtain the feature values of a data. If the two feature values are the same, the data is intact during the transmission process.
If they are different, the data is changed.

Assume that both parties want to implement user identity authentication during data transmission,
What should I do if I can implement data encryption and data integrity?

Before sending data, Xiao Hei uses one-way encryption to calculate the feature value, and then uses the private key to decrypt and encrypt the feature value.
Next, we will generate a one-time password. We will encrypt the password with the public key of Tom and put it on the Data. Finally, we will use symmetric encryption.
Encrypt all the data. At this time, it is the ciphertext. After arriving at Tom, Tom will first use his private key to get the password, and then use
The password is decrypted to obtain the feature value of the data, and then one-way decryption is used to calculate an feature value. If the two values are the same, it indicates
If the data is in good condition, the above process achieves triple verification.
These three factors are the basis of e-commerce.
A tool that can implement this entire process:
Opssh
GPG

But there are still some problems in these two processes. How does Tom obtain the blacklist Public Key? It is also possible to transmit the Public Key
How can this problem be solved in case of spoofing?

IKE: Internet Key Exchange, enabling both parties to exchange keys with each other. The key itself is not on the Internet.
Propagation
PKI: Public Key Infrastructure, or public key infrastructure. The CA certificate authority places the public key information of the contact in the certificate.

How to communicate based on certificates:
Both parties present their creden during communication. This creden are issued by an authority, and only valid information in the creden is verified.
You can verify the identity of the other party, but how can you prevent fraud during the issuance?
This is another question about egg and egg. How can this problem be solved?
Therefore, some operating systems have already put the certificates of some authoritative issuing authority on your computer during installation, so to a certain extent
Some problems can be solved.

Certificate Format: X509, PKCS
Certificate Waste List: CRL

The most common attack "man in the middle" is that the identity of both parties cannot be verified.
Session hijacking,
Data insertion,
Data tampering,
These are common threats.

Encryption and decryption are used:

1. User Password/data sniffing password/Data sniffing2. Data manipulation3. Authentication manipulation authentication 4. equivalent to mailing on postcards

These aspects
Basic Principles of the encryption algorithm: kerckhoff's Principle

1. Generally, encryption does not rely on algorithms. Although algorithms are key to converting plaintext into ciphertext
However, in a real encryption process, whether your data will be cracked cannot rely heavily on the algorithm itself,
It depends on the password, and the algorithm has a long research cycle. It is very easy to change a password, but it is troublesome to change an algorithm.
Algorithms require a lot of effort. As long as the algorithms are not made public, they cannot be cracked.
2. In the e-commerce process, not only data encryption must be ensured, but also data should not be seen by others.

Algorithm:
1. Reliable random number Source

 

######## OpenSSL ######### L
Many common encryption algorithms are implemented in C language:
Three components:
1. The libcrypto library file is used to encrypt and decrypt the database file,
2. libssl library file is mainly used to implement the HTTPS protocol.
3. OpenSSL multi-purpose encryption tool. You can also create a ca.

Generally, OpenSSL is installed. You can see the use of OpenSSL with an incorrect option.
Option
Single-item encryption usage:

openssl enc -des3 -salt -a -in  inittab -out inittab.des3

ENC encryption for a file-des3 encryption algorithm-add impurities to Salt
-In followed by the file name-out, which file is put after Encryption

openssl enc -d -des3 -salt -a -in inittab.des3 -out inittab

-D Indicates decryption.

OpenSSL DGST-sha inittab indicates calculating the feature value of the inittab File

Passwd usage during user authentication. How can I help you generate a password similar to the one saved in the/etc/shadow file?
OpenSSL passwd-1-1 indicates that the MD5 algorithm is used.

[Root @ server46 ~] # OpenSSL passwd-1 Password: verifying-Password: $1 $ 7hw0kv8y $ intkynppqttq2fhaj1fmk1openssl passwd-1-salt impurity. The calculation result is the same.

[root@server46 ~]# openssl passwd -1Password: Verifying - Password: $1$7HW0kv8y$IntkyNppqtTQ2fHAJ1FMk1[root@server46 ~]# openssl passwd -1 -salt 7HW0kv8yPassword: $1$7HW0kv8y$IntkyNppqtTQ2fHAJ1FMk1

 

Man sslpasswd

Asymmetric encryption:

How to issue an OpenSSL Certificate:
Switch the directory to/etc/pki/tls/certs

Make *. key to generate a key make *. cert can generate a certificate. It mainly depends on the file suffix to generate a file. It is a convenient method provided by RedHat to make my. key to generate a key.

 

(Umask 66; OpenSSL genrsa 1024> my. Key)
Generate Private Key File
This is done in a sub-shell. umask is only valid for the subsequent command. After umask is executed, it will be restored to the original

Extract public key:

openssl rsa -in my.key -pubout -out myr.pubkey[root@server46 certs]# (umask 66; openssl genrsa 1024 > my.key)Generating RSA private key, 1024 bit long modulus...++++++........++++++e is 65537 (0x10001)[root@server46 certs]# cat my.key-----BEGIN RSA PRIVATE KEY-----MIICXQIBAAKBgQDRSlvZZ7p7sRbczdGhcw/8z5mzEKIjDZw63ffsxCDC9XWKO0vEFaxbPrgwZYF+iu8QHUKVzuJoqO8MmfY7p9aGz2WT2GQ/wUTnjsbL8mNbSclV/2m8K0XZqSLsKzuhaBOFC+sylQvnZiXP23slNWZIuV0EVh9k2ULSV4f8B5QtywIDAQABAoGATNkA4NM1pjVgL7NjReT5+dpAlX+GCVj2BKd8YXOik/ONNTSQnW9X2ikteJfM9KoPHdugl2FfwQ5GuFnQEBeQrUV5SnR09k2OZTsdOMVNXqamf4V/rXidOs+L3RVKQ4X6vpasS1CJ1/q/fCcsi1Nl0nLcV9stLXbmEzYqE6+hwAECQQDqxrbF5W9j5vVMZkKmvx1ViojwTJovlkOtl6RSkqHMR3msnHhizbc+iGrGiP/vH9H+AvDK7AJPNVngkHAa5YGbAkEA5DXX0dIajPoAdLvmNG1kNY1fp6IJjfR8UJRWeOwjhVjul1yp47hPbM/f55OmowdsQamfNVwk4P5iYIcZ8uwfkQJBAJoXToLYsaF6Rumb/IcAzLoGMRa20EQHdegLrVhc0UEIcH2wPPtsVab/VkV0SbaixerX9z7YZDOkqpbPdiTRGZ0CQBWv2DakVMmY6HovcQ0CaEd+i9yOVYIb/cRalG0hY67EaMgRkkOFvGaGyqxjJ67Ogccrq2mSvB51jjvGGv0u20ECQQCHvgJkF3xHkQnahqCTTgym0CNocHhVfyo6KveIfBAkVz69+zsGK2kKBOseSbgRKqVmM21Iqu0aZatjEevHwZIo-----END RSA PRIVATE KEY-----[root@server46 certs]# openssl rsa -in my.key -pubout -out my.pubkeywriting RSA key[root@server46 certs]# cat my.pubkey -----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRSlvZZ7p7sRbczdGhcw/8z5mzEKIjDZw63ffsxCDC9XWKO0vEFaxbPrgwZYF+iu8QHUKVzuJoqO8MmfY7p9aGz2WT2GQ/wUTnjsbL8mNbSclV/2m8K0XZqSLsKzuhaBOFC+sylQvnZiXP23slNWZIuV0EVh9k2ULSV4f8B5QtywIDAQAB-----END PUBLIC KEY-----

 

 

Issuing steps:
1. First generate a pair of keys (S/P keys)
2. Place the public key in a certificate issuing request (including your public key, name, address, and other column descriptions)
Send to Certificate Authority
3. The CRT certificate is generated.

Become a CA by yourself:
1. CD/etc/pki/CA
There is a private file specifically containing the private key file of CA
2. Generate a key for yourself

(Umask 66; OpenSSL genrsa 2048> private/cakey. pem [this can only be called cakey. pem]) ll Private

Send a certificate to yourself:

openssl req -new -x509 -key private/cake.pem -out cacert.pem

Next, you will be prompted to enter some information
After writing the certificate, it is a self-signed certificate.
Then you can issue a certificate to someone else.

  openssl req -new -x509 -key private/cake.pem -out cacert.pem -days3655

3. Edit the CA configuration file

Vim/etc/pki/tls/OpenSSL. CNF is defined here

Find the [ca_default] Field
Change dir to absolute path
Some directories do not need to be created manually, which can be found in this configuration file.
You can also modify the default information.
This is a complete ca.

4. Create a certificate for the Web Server:

CD/etc/httpdmkdir sslcd SSL (umask 66; OpenSSL genrsa 2048> Web. key) CD/etc/pki/camkdir certs CRL newcertstouch index.txt serialecho 01> serialopenssl req-New-key wed. key-out wed. CSR this is a certificate issuing request opssl ca-in wed. CSR-out web. certificate issued by CRT

Then press ENTER twice.