Encryption types and their algorithms

Others can get our encryption conversion rules, but do not know what the key is, you can still convert ciphertext to clear text!

More popular in recent years:

Symmetric encryption: Encrypted decryption with the same password

One-way encryption: Extract the data signatures, input the same, the output must be the same

Asymmetric encryption algorithm: Public key private key

IKE: Key exchange Shorthand

Analysis of discrete logarithm principle: (one-way encryption)

A: Generate x B: Generate y

A:g^x%p to B A takes the X-square of G to the p to B

B:g^y%p-A B takes the Y-square of G and passes it to a

We have passed 4 numbers on the Internet:

Four numbers are G, p, g^x%p, g^y%p, respectively.

After getting the number A: (g^y%p) ^x=g^yx%p

B: (g^x%p) ^y=g^xy%p take the square of their own hands respectively, the result is the same

This is the famous Diffie-hellman algorithm.

So the question comes again, when you two exchange numbers, how do you make sure it's the other person's hair?

So the birth of

Asymmetric Encryption algorithm:

Public key: P The public key is extracted from the private key and is public

Private key: S

I take your public key to encrypt, only your private key can decrypt;

Public key encryption encryption is too slow, so it is commonly used for authentication

Authentication is possible with your own private key encryption

PKI: Defines the correspondence between a CA and its CA and the CA's certificate revocation list

We have two kinds of PKI: (TLS; opengpg)

Certificate Authority:

Ca:

X509:

Public key and validity period

Legal owner of the certificate

How the certificate is used

Information about the CA

Check code for CA signature

Well-known online protocol Tls/ssl is the X509 certificate.

TLS: Transport Layer Security is similar to SSL and is an encryption mechanism

OPENGPG is also a certificate management mechanism

OSI Seven layer model:

Physical Layer

Data Link Layer

Network layer

Transport Layer

Session Layer

Presentation Layer

Application Layer

After a three-time handshake, negotiate which protocol to use is SSL or TLS

1. The server sends its own certificate to the client

2, the Client authentication certificate is not issued by the institution I trust, if it is only trust

3, verify that the certificate is not complete, if it is to take this certificate of the public key to use

4, the client generates a symmetric key, passed through the server side of the public key encryption later passed to the server

5, server side holding this password encrypted data sent to the client

This is the process of establishing an SSL session

The encryption algorithm is then negotiated between the two sides because there are many kinds of cryptographic algorithms for symmetric encryption.

Symmetric cryptography: Common algorithms

Des algorithm

3DES

AES: Advanced Encryption algorithm

Blowfish: Also a symmetric encryption algorithm

One-way encryption: Common algorithms

MD4

MD5

SH1

The bigger the sha192,sha256,sha512, the slower it gets.

CRC-32: Cyclic redundancy check code (not an encryption algorithm, is a check code mechanism)

Public Key Cryptography: (Encryption/signing)

Identity verification

Data encryption

Key exchange

Public Key cryptography: common Algorithms

RSA: Encryption; signature

DSA: Signed by the U.S. National Security Agency for public use

ElGamal: Business Algorithms

Symmetric encryption is implemented on Linux:

Openssl:ssl's Open Source implementation

Composition

Libcrypto: Universal Encryption Library

implementation of LIBSSL:TLS/SSL protocol; A library that implements identity authentication, data confidentiality, and session integrity based on sessions

OpenSSL: A multipurpose command-line tool that can also be emulated to implement a private certification authority

OpenSSL configuration file:/etc/pki/tls/openssl.cnf used to work with OpenSSL as a private CA

Encryption instance: Inittab This file with DES3 encryption algorithm add salt, save to the current directory is called Inittab.des3

OpenSSL enc-des3-salt-a-in inittab-out inittab.des3 will let you enter your password

Decryption Example: OpenSSL enc-des3-d-salt-a-in inittab.des3-out inittab

How to view signatures: md5sum +file/sha view various sum

Extracting signature based on OpenSSL: Openssl-dgst-sha inittab

Focus : OpenSSL creates a private CA

In the company to implement the HTTPS server, you must first send a certificate to the Web server

1, generate a pair of keys, the public key into a certificate

2. Generate self-signed certificate

GENRSA: Generate a private key

Stand on the CA directory for execution

One: OpenSSL genrsa 2048 > PRIVATE/CAKEY.PEM Use the RSA algorithm to generate the private key to save to the name Cakey.pem

Or: (Umask 077; OpenSSL GENRSA-OUT/PRIVATE/CAKEY.PEM 1024) makes the generated file permissions 600

Extracting the public key

II: OpenSSL rsa-in server.key-putout will be server.key in the public key extracted, generally do not need to manually

Req generate a self-signed certificate (the specified key file is Cakey.pem saved in the CACERT.PEM specified valid period is one year)

Stand on the CA directory for execution

III: OpenSSL req-new-x509-key/etc/pki/ca/private/cakey.pem-out cacert.pem-days 365

CN; Hebei; Zhengzhou; Renfang; yunwei;ca.mageedu.com; [Email protected]

Self-signed certificate ready to use this sentence to view the OpenSSL x509-text-in server.crt

Now the CA is ready.

Four: VIM/ETC/PKI/TLS/OPENSSL.CNF edit the CA's configuration file

Modification: Dir =/etc/pki/ca

The CA must also contain the following few lines of the named directory

You can also set the default personal information below, you will not have to fill in the

Five: The private key should be stored in the/etc/pki/ca/private directory called Cakey.pem

VI: Create mkdir certs newcerts CRL under CA

Seven, also to prepare two files: Touch index.txt touch serial; echo > Serial

Eight, on the other server mkdir/etc/httpd

cd/etc/httpd; mkdir ssl/; CD ssl/

Nine, this server needs to request to generate a private key (Umask 077; OpenSSL genrsa-out Httpd.key 1024)

Ten, also in the SSL directory for the certificate signing request

OpenSSL Req-new-key httpd.key-out HTTPD.CSR

The following city company departments must be consistent with the CA

Xi. because on a server, signing a certificate does not have to be sent remotely; The following is the process of issuing a CA

OpenSSL ca-in httpd.csr-out httpd.crt-days 365

12: There will be a HTTPD.CRT certificate in the current directory

13: Go back to CA cd/etc/pki/ca; Cat Index.txt will have a number No. 01 because we have an echo in front of a 01.

The. CRT is a certificate. A CSR is a request. Key is a generated key

This process needs to be backed up, and the process of making the current host into a CA is scripted, including modifying the configuration file

Additional knowledge point generation test User: cd/etc/pki/tls/certs/

Make HTTPD.PEM he will automatically generate a private key for you to fill in all kinds of information

A HTTPD.PEM is generated in the Certs directory (the private key is also inside, but the formal environment does not play this way) automatically determines what the file is defined in the makefile file according to the different suffix

Encryption types and their algorithms