CCNA 3 - Capitulo 3.9

CCNA 3 - Capitulo 3.9

1. NETWORK SECURITY CONCEPTS

   • CRIPTOGRAPHY
     • SECURING COMMUNICATIONS
       • FOUR ELEMENTS
         • 1. DATA INTEGRITY
           • ANY WILL CHANGES WILL BE DETECTED
           • HASH FUNCTIONS
             • THERE ARE TREE WEL KNOWN HASH FUNCTIONS
               • SHA HASHING ALGORITHM
                 • TYPE SHA 2
                   • SLOWER THAN MD5
                   • LEGACY
                   • TYPES
                     • SHA-224
                     • SHA-256
                     • SHA-384
                     • SHA-512
                 • TYPES SHA 3
                   • SHA-256
                     • 256 bits
                   • SHA-384
                     • 384 bits
                   • SHA-512
                     • 512 bits
                   • SHA-224
                     • 224 bits
                 • ITS IS RECOMENDED
                 • TYPE SHA 1
                   • IN 1995
                   • 160 bit HASHED
                   • LEGACY ALGORITHM
                   • IS SLIGHTLY SLOWER THAN MD5
                   • VERY SIMILAR MD5
                 • DEVELOPED BY NSA
               • MD5 WITH 128 - bits DIGEST
                 • ONE WAY FUNCTION THAT PRODUCES A 128-HASHED MESSAGE
                 • LEGACY ALGORITHM AND SHOULD BE AVOIDED
             • ONLY PROTECT AGAINST ACCIDENTAL CHANGES , DOES NOT PROTECT CHANGES DELIBERATELY
               • THEFORE , HASH IS VULNERABLE TO MITM , TO PROVIDE INTEGRITY AND ORIGIN AUTHENTICATION IS NECESSARY HMAC
           • EXAMPLE SOFTWARES VERIFY HASH ?
             • QUICKHASH , HASH CHECKER
           • WHATS IS PURPOSE ?
             • ENSURE MESSAGE WAS NOT ALTERED
             • IS ENSURED BY IMPLEMENTING ALGORITHMS OF HASH
               • SECURE HASH ALGORITHMS
                 • SHA 2
                 • SHA 3
               • MESSAGE DIGEST ALGORITHM
                 • MD5
                 • SHOULD BE AVOIDED
                 • INHERELTNLY INSECURE
           • A HASH ALGORITHM WORKS AS FOLLOW
             • 1. THE SENDER GENERATES A HASH (DIGITAL FINGERPRINT) OF THE MESSAGE. FIXED LENGHT
             • 2. THE MESSAGE AND ITS HASH ARE SENT TOGETHER TO THE RECEIVER.
             • 3. THE RECEIVER CALCULATES A NEW HASH OF THE RECEIVED MESSAGE AND COMPARES IT TO THE ORIGINAL HASH.
             • IF THEY MATCH
               • THE MESSAGE WAS NOT ALTERED (INTEGRITY PRESERVED).
             • IF THEY DO NOT MATCH
               • THE MESSAGE WAS MODIFIED AND CANNOT BE TRUSTED.
         • 2. ORIGIN AUTHENTICATION
           • WHATS IS PURPOSE ?
             • GUARANTEES THE MESSAGE IS NOT A FORGERY AND DOES FROM COME FROM WHOM IT STATE
             • ADD AUTHENTICATION TO INTEGRITY ASSURANCE
           • IS ENSURED BY IMPLEMENTING
             • HASH MESSAGE AUTHENTICATION CODE (HMAC)
               • CRYPTOGRAPHIC ALGORITHM + HASH FUNCTION
                 • FIXED LENGHT AUTHENTICATED HASH VALUE
           • HOW DOES IT WORK ?
             • HMAC THAT COMBINES
               • SHARED SECRET KEY
               • CRYPTOGRAPHIC HASH FUNCTION (EX : SHA256)
               • THIS COMBINATION PROTECTS AGAINST MITM
             • STEPS
               • 1. CREATING THE MAC
                 • 1.1.THE SENDER COMBINET THE MESSAGE WITH A SECRET KEY
                 • 1.2 RUNS THEM THROUGH A HASH ALGORITHM
                 • 1.3 PRODUCES A FIXED-LENGTH HMAC VALUE
                 • 1.4 SENDS THE MESSAGE + HMAC TO THE RECEIVER
               • 2. VERIFYING THE MAC
                 • 2.1 USES THE RECEIVED MESSAGE
                 • 2.2 USES TEH SAME SHARED SECRET KEY
                 • 2.3 RECALCULATES THE HMAC
                 • 2.4 COMPARES IT WITH THE RECEIVED HMAC
               • IF BOTH VALUES MATCH
                 • THE MESSAGE WAS NOT ALTERED ✔ THE SENDER KNOWS THE SECRET KEY
               • IF THEY DO NOT MATCH
                 • THE MESSAGE WAS MODIFIED OR THE SENDER DOES NOT HAVE THE CORRECT KEY
         • 3. DATA NON REPUDIATION
           • UNIQUE CHARECTERISTCS OR SIGNATURE
           • WHATS IS PURPOSE ?
             • ENSURE THAT THE SENDER CANNOT REPUDIATE OR REFUTE
               • VALIDITY OF A MESSAGE SENT