Hi everyone! Welcome to this first video of this new module about cybersecurity!
What does it mean to secure a system?
Whether it is a computer, a distributed system or an operating system, we can distinguish
2 kinds of properties :
We have the properties called 'liveness properties'. Basically the functionalities of the system.
what we can do with the system, what we should be able to do
and we have what we call 'safety properties' : everything we shouldn't be able to do with the system.
So securing a system, means listing all these safety properties and make sure they all hold.
It is more or less easy to list the functionalities of a system, but it is very hard to list all the things that
shouldn't be possible. You can think of 1000 attacks on your system and make sure you are immune
against all of them, but you never know if there is another 1001st attack that you never thought of.
that's why in my opinion cybersecurity is a difficult topic.
there is another reason why I believe it is difficult,
since it is about exploiting the flaws of a system, you first need to understand the system itself.
which means that I cannot explain to you what is a denial of service attack if you don't know how
the Internet works. I cannot explain how to hack a database with an SQL injection if you don't understand
how a database works. So in many of these videos we will reference other videos of other modules.
This is why it is difficult, you need a lot of prerequisite knowledge. Fortunately, there is a subtopic
called cryptography, for which you don't need particular prerequisite knowledge.
It will be the subject of this video and the next ones.
We can think of cryptography as a toolbox for designing secure systems.
For now, we will focus on the use of cryptography to secure messages we send over the Internet.
Since etymologically, 'cryptography' means 'write in a hidden way', we often think that it just means
to encrypt messages, so making sure that only the receiver is able to read them.
But as you will see, it is more complicated than that.
When A sends a message to B, he doesn't want an attacker to see the content during the transit.
that's what we call 'confidentiality'
But it is only one of the properties of secure communications
When B receives a message from someone claiming to be A, he wants to be sure
that the sender is indeed A. that's what we call 'authenticity'
When B receives a message from A, he wants to make sure the message hasn't been tampered in
between by an attacker. that's what we call 'integrity'
There are other properties when we talk about secure communications, but these 3 are the most important
they are essential in almost every application. If there is one thing you should remember from this video :
unlike what we hear in the medias everywhere, securing communications is not only encrypting
messages, it is 3 things : confidentiality, authenticity and integrity.
In this video and the next ones, we will start by talking about confidentiality
We will talk about the rest much later. But first let's define the problem more formally.
A wants to send a message m to B through a channel where resides an attacker who mustn't see m.
A wants a function called E that takes m as argument and transforms it into c such that
c is not understandable and only B will be able to recover m from c.
So the attacker sees c and cannot understand the content.
B receives c and uses another function D to recover m.
From now on, we will study several techniques to construct these 2 functions E and D.
The first techniques we will see is called the Cesar cipher, it was used in Roman times.
It is extremely simple. we will encrypt messages made only of letters from A to Z
To encrypt, we shift letters by a constant number of positions, for example 3
For example, if we take letter A, the next letter is B, then C and then D. So A is replaced by D
It is a cyclic system, which means Y will be replaced by B
A wants to encrypt the message 'SALUT'
I let you verify that 'VDOXW' is correct.
It is then sent to B. To decrypt, B will shift letters by 3 positions backwards.
For example, before V there is U, then T, then S. So for V the original letter is S.
We do the same for every letter.
In this example we used a shift of 3 positions. The attacker doesn't know the shift used by A and B.
So A and B need to meet beforehand in secret to decide on a shift to use later.
This shift is called the encryption/decryption key.
It is a very weak system. Since there are 26 letters in the alphabet, there are only 25 possible shifts.
So it is rather easy even for a human being to test all possibilities to recover the key and the plaintext.
There is something even worse : there is a better method to recover the key and plaintext.
If we know the language used in the message, we can count the frequency of apparition of each letter
In French, the most common letter is E. So if we see in the ciphertext a lot of Js for example,
Probably 'j' is the encrypted letter corresponding to 'e'.
There are 5 shifts between e and j, so the key is probably 5. So we just need to shift back by 5
positions every letter to recover the original message.
We need a better technique such that every letter is not encrypted each time the same way.
And we need to have A LOT more possible keys such that it is infeasible for a human to test them all.
At the end of the Middle Ages, a better technique appeared : the Vigenere cipher.
This time the shared secret key between A and B is a sequence of letters for example 'AREB'
we will place this key under the message to encrypt for example 'RARE'
Now each letter of the key is below a letter of the message.
the letter of the key is interpreted as a shift according to its position in the alphabet.
For example A is the first letter in the alphabet so R will be shifted by 1 position which gives S.
R is the 18th letter, so A is shifted by 18 positions which gives S
E is the 5th letter so we shift R by 5 positions. It gives W
B is the second letter so we shift E by 2 positions which gives G.
As you can see, in the plaintext m we have twice the letter R but once it is replaced by S and another time by W
In the ciphertext you see twice the letter S but originally it is not the same letter.
B will then receive c and decrypt by shifting backwards.
A is the first letter so S is shifted back to R
R is the 18th letter so we shift back S by 18 positions this gives A
E is the 5th letter, we shift W back to recover R
B is the 2nd letter so we shift back G by 2 positions and find E
We recover the initial message m
The great improvement is the number of possible letters
26 possibilities for the first letter, then 26 possibilities for the second letter for each possibility
of the first letter. and so on... it gives this total (screen)
this is only for a key of length 4
the attacker doesn't know the key length, but if he knows it is between 4 and 6 letters
I let you imagine if we go until keys of length 20. It is unfeasible for a human being to test all of these.
In this example we had a message of length 4 and a key of length 4, so it was easy.
if we have a message of length 8, we double the key and place it under the message
if the length of the message is not a multiple of 4, we will place only a part of the key under it.
In these 2 cipher techniques, we assumed the attacker knows the system used.
We have seen that the cesar cipher has only 25 possible keys but the attacker must first know that
we used the cesar cipher. Maybe he doesn't know, but when we study security, we always assume
that the attacker knows the whole design of the system except the key
This principle comes from a 19th century cryptographer, Kerckhoffs, who invented this principle that
says basically that the security of a cryptosystem must depend solely on the key and not the knowledge
of the design of the system. We assume the enemy knows it.
If at some point the design is leaked to the public, the system must remain secure while the key is unknown.
Today it is a common and obvious principle, even if still there are systems that don't follow it.
Many people have tried to hide the design of their system, but eventually some years later the design was
leaked and we discovered a flaw in the system. I think, among other, of GSM.
It initially was a private cryptosystem but got leaked and now everyone knows how awfully weak its
security is. But we will talk about that in another video.
Maybe you noticed that in the 2 systems we studied, we used the same key to encrypt and decrypt
The 2 participants must exchange this key in secret beforehand.
We call this symmetric cryptography, since we used the same key to encrypt and decrypt
There exists another kind of cryptography called asymmetric.
This time we use 2 keys : one to encrypt and one to decrypt.
It solves the problem of the key exchange.
That's the end of the video! in the next video we will focus more on symmetric cryptography
the one used today, not the one of the Roman times and Middle Ages
In the next-next video we will talk about asymmetric cryptography.
I hope you enjoyed, see you soon!
For more infomation >> René-Charles Angélil a 17 ans aujourd'hui, mais qui est-il? - Duration: 1:56. 
For more infomation >> Pledge of Allegiance - Duration: 0:22. 
For more infomation >> Las redes estallan contra Rajoy tras su bochornoso mensaje sobre las mujeres - Duration: 3:49. 
For more infomation >> Voici comment j'ai rendu mon fer à repasser comme neuf. Testez par vous même ! - Duration: 4:38. 
For more infomation >> Pourquoi créer des contenus plus courts ? - #EnjoyTheday - 082 - Duration: 2:36. 
For more infomation >> 5 bienfaits du chocolat noir sur la santé | Bienfaits sur la santé #10 - Duration: 2:51. 
For more infomation >> Made Of Paper Butterfly Origami. How To Make A Paper Butterfly. (Origami Corner) - Duration: 5:25. 
For more infomation >> UTILEV® - The Utility Lift Truck
For more infomation >> Nature AND Nurture: Can new science inform child policy? – interview with Jack Shonkoff | VIEWPOINT - Duration: 29:41. 
For more infomation >> 有妈像个宝！李宗瑞遭爆狱中"蹲着爽爽过"原来全靠这招拢络狱友…内行网友再爆！ - Duration: 3:46. 
No comments:
Post a Comment