-: In network security, integrity is usually provided through
the use of a hashing function.
Hashing is a one-way cryptographic function
which takes an input and produces
a unique message digest as its output.
Because this function is one-way, there's no way
to determine the original message based on the message hash
or hash digest it's outputted.
The resulting message digest acts like a digital fingerprint
for the original file.
Another unique thing about a hash digest
is that they are always the same length,
regardless of how long your input is.
Whether I input a file containing one word
or a file containing millions of words,
the output will always be the same length based
on the hashing algorithm chosen.
By far, the most commonly-used algorithm is MD5.
The MD5 algorithm creates a 128-bit hash value
that is unique to the input file.
Unfortunately, because the hash value outputted
is only 128 bits long, it can create only
a limited number of unique values, and this can lead
to two files having the exact same resulting hash digest.
When this occurs, this is known as a collision.
Due to the limited number of unique hash values associated
with MD5, a newer algorithm called
the Secure Hash Algorithm, or SHA, was created.
SHA-1, for example, creates a 160-bit hash digest,
which significantly reduces the number
of collisions that occurred.
SHA-2 is a family of hash functions
that contains longer hash digests.
This includes the SHA-224, SHA-256, SHA-348,
and SHA-512 hash functions, each of which has
a digest between 224 bits up to 512 bits.
Each version of SHA performs a different number
of rounds of mathematical computations to create
the hash digest, anywhere from 64 to 80 rounds,
but you don't need to know the specific number of rounds
for each version of SHA on the exam.
SHA-3 is the newest family of hash functions,
and its hash digest can go between 224 bits and 512 bits,
just like SHA-2.
The major increase in security, though, with SHA-3,
is that it uses 120 rounds of computations
to create its message digest for each unique file.
Now, there are other hash functions available
that you may come across in your daily work.
These include things like RIPEMD and HMAC.
RIPEMD is the RACE Integrity Primitive
Evaluation Message Digest.
It comes in 160-bit, 256-bit, and 320-bit versions.
But the 160-bit version is by far
the most common among these.
It's written as RIPEMD-160 and it's an open-source hashing
algorithm created as a competitor to the SHA family,
but it hasn't really gained the same level
of popularity that SHA has.
Another hashing algorithm is known as the HMAC,
or Hash-based Message Authentication Code.
This is used to check the integrity of a message
and provide some level of assurance
that its authenticity is real.
HMAC actually uses other hashing algorithms to do the work,
though, and it's called something like the HMAC-MD5,
the HMAC-SHA1, or the HMAC-SHA256,
depending on the underlying hash being used.
We already briefly spoke about collisions with hashes,
and while they're uncommon, they are something
that we have to be concerned with.
To prevent a collision from being used to spoof
the integrity of a file or message,
many professionals have turned to digital signatures.
A digital signature's created by hashing a file
and then taking that resulting hash digest
and encrypting it with a private key.
So, if I was going to send an email that is a couple pages long
and I wanted to digitally sign it to make sure you know
that nothing was changed inside that email,
I can run that email message through
a hashing algorithm, like SHA-1.
Then, I take that resulting 160-bit hash
and I encrypt it using my private key.
When I send the email to you, I'm going to attach
the resulting encrypted hash with it as well,
and this is going to prove the integrity of the message
and create non-repudiation.
When your system receives the email, it'll then decrypt
the digital signature using my public key,
which is going to provide you with
that original 160-bit hash digest.
Your system then takes my multiple-page email,
runs it through the SHA-1 algorithm,
and compares your message digest that you calculated
with the one that I sent as part of my digital signature.
If those two things match, then you can be assured
that the email was not modified in-transit between my system
and yours, and this provides us with that integrity check.
Now, since I also encrypted my SHA-1 digest
with my private key, and only I have my private key,
this also assures you that the person who sent the message
is the only person who could've sent you the message.
This provide us with the non-repudiation on the email.
This non-repudiation means I can't claim
that I didn't send the email to you because I'm
the only one who could have because I'm the only person
who has my private key.
For digital signatures to be utilized,
you should use either the Digital Security Algorithm, DSA,
the Rivest-Shamir-Adleman cipher, RSA,
or the Ecliptic Curve Cryptography version of DSA or SHA.
The federal government has decided to use
the Digital Security Standard, called DSS,
which relies upon a 160-bit message digest created by DSA.
Now, most commercial entities rely upon the RSA standard,
though, because it's faster and can be used
for digital signatures, encryption, and key distribution.
Digital signatures have been expanded beyond just email too.
Code signing of our files relies upon the digital signature
for a program or file.
For example, if I created a mobile app and I wanted
to put it into the app store like Google Play
or the Apple App Store, the installer file would have
to be digitally signed and that is called code signed.
Every developer must register with Apple or Google
and they receive a private key.
Just as in the email example I provided earlier,
the application file is hashed and that hash
is encrypted using the developer's private key.
This is known as code signing and ensures
that the installer hasn't been modified
or corrupted since that developer published it.
Now, I know I covered a lot already,
but there are three more hashes that we have to discuss,
and these are all focused around passwords.
In a Windows machine, passwords aren't stored in cleartext,
and they're not even stored in an encrypted format.
No, they're actually stored as hashes.
The original version of this was known as LANMAN,
or the LAN Manager hash, or simply the LM hash.
This was created all the way back in the late 1980s,
even before Windows and T-servers roamed the Earth.
This hash was based on the DES algorithm
and was limited to 14 characters.
Not only is this weak because it used DES,
but it's even worse because Microsoft had
the password broken into two seven-character chunks first
and then one of those was converted to uppercase
and then it was run through the encryption algorithm
to create the hash.
This reduced the number of possible combinations
and lead to decreased security in the LM hash.
Because of this, you should always disable the LM hash
on your modern Windows OS and, by default, it is disabled.
You should leave it that way unless you have some really,
really good reason for allowing it to be used.
To replace the LANMAN hashes, Microsoft created
a replacement known as the NTLM hash,
or NT LAN Manager hash.
This was created to replace the LM hash once NT servers
became popular in the early 1990s,
and it first shipped in 1993, beginning with NT 3.1.
That shows you how old this is.
The NTLM used RC4 instead of DES for the way it created
its hash, so again, something stronger is definitely needed.
On modern Windows machines, like the LM hash,
NTLM is disabled by default.
The final and newest version of password hashing for Windows
is known as NTLM version two.
It relies on the HMAC-MD5 hash,
and is therefore a little bit more difficult to crack.
It's been around since Windows NT version four,
but it's still used by any Windows machines
that don't rely on Kerberos for authentication.
If you're using Kerberos, such as in a domain environment,
then NTLM version two is simply not used.
Now, I know we covered a lot of information about hashes.
For the Security Plus exam, you should remember two
very important things about hashes.
First, hashing is used to ensure integrity.
Any time you see a question that mentions integrity
on the exam, you should instantly be thinking
that the answer has something to do with hashing.
So, for example, if I said Bob wants
to send some data across the network,
but he wants to ensure that it isn't changed
while it's in-transit.
What should Bob do?
Well, the answer's going to be something to do with hashing.
Something like digitally sign the file,
run the file through an MD5 algorithm,
or something like that.
Second, remember that the two most common hashes
in the world are MD5 and the SHA families of hashes,
but MD5 is less secure than SHA.
If you remember those two facts,
you're going to do really well on the exam.
(exciting electronic music)