Chapter 17 — Cryptography concepts | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Hashing"]
  N2["17.2 Weak hashes"]
  N3["17.3 Encryption"]
  N4["17.4 Signatures"]
  N5["17.5 TLS"]
  N6["17.6 Hashes as identifiers"]
  N7["17.7 Key management"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Hashing"]
  N2["17.2 Weak hashes"]
  N3["17.3 Encryption"]
  N4["17.4 Signatures"]
  N5["17.5 TLS"]
  N6["17.6 Hashes as identifiers"]
  N7["17.7 Key management"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Hashing]
    |
    v
[17.2 Weak hashes]
    |
    v
[17.3 Encryption]
    |
    v
[17.4 Signatures]
    |
    v
[17.5 TLS]
    |
    v
[17.6 Hashes as identifiers]
    |
    v
[17.7 Key management]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) explain hashing, encryption and signatures conceptually; (2) apply them to evidence integrity; (3) explain why encryption affects examinations; (4) recognise weak algorithms.

17.1 Hashing

A hash function produces a fixed-size digest from any input. Good cryptographic hashes make it infeasible to find two inputs with the same digest or to reconstruct input from digest. SHA-256 is widely used for evidence.

In evidence handling, the useful property is that any change to the input, even one bit, gives a completely different digest. That lets a short value, recorded in the acquisition record, stand for a disk of hundreds of gigabytes. Comparing the hash of the working copy with the recorded value is how Leah shows the image is unchanged.

17.2 Weak hashes

MD5 and SHA-1 have practical collision attacks. They may still detect accidental change, but they should not be relied on alone where deliberate manipulation is possible.

Some older tools and case records use MD5, so examiners still see it. Recording SHA-256 alongside MD5 keeps compatibility while providing a hash that resists deliberate manipulation. For the ws-114 image, Grace's team records SHA-256 as the primary hash, which matches the course's practice and the acquisition record Leah reviewed in Chapter 15's worked example.

17.3 Encryption

Symmetric encryption uses one key; public-key encryption uses a pair. Encrypted disks, messages and archives are unreadable without keys. Examiners record encryption and pursue lawful access, such as recovery keys held by the organisation.

If ws-114 had used full-disk encryption, imaging the disk without the key would give unreadable data. The university's recovery key, held by IT under policy, would provide lawful access. The examiner notes that the key was obtained, from whom and under what authority. Without such arrangements, encrypted evidence may simply be out of reach.

17.4 Signatures

A digital signature shows a document was signed with a specific private key and not changed afterwards. Signed reports and manifests strengthen integrity claims.

For a forensic report, signing the final version and the evidence manifest means any later change can be detected, and the signer is identified by the key used. This helps when a report passes through several hands before reaching its readers. The signature does not show that the content is correct, only that it has not changed since it was signed.

17.5 TLS

Web traffic is encrypted with TLS; network evidence usually shows endpoints and volumes, not content.

For ws-114, TLS hid the content of the fake page and the submitted data. The proxy still recorded the host, the time, the method and the size of each request, enough to show that something was submitted. Inspection proxies that decrypt traffic would show more, but they raise privacy questions and are not deployed for student labs at Harrowgate, by policy. Leah's report therefore makes no claim about what was typed on the page.

17.6 Hashes as identifiers

Known-bad file hashes identify specific malware samples; a one-byte change gives a different hash, so related variants are missed by exact matching.

A hash match for update.dll against a threat-intelligence list is strong evidence that the file is the listed sample. No match, however, does not mean the file is safe; it may be a new variant. Examiners therefore combine hash checks with behaviour and context, such as the run key and the process tree, which do not depend on exact bytes.

17.7 Key management

Keys must be protected; a leaked signing key undermines every signature made with it.

For Grace's team, the key used to sign reports is kept in a protected store with access limited to named staff. If it leaked, an attacker could sign a forged report that would appear genuine. Rotating keys and keeping a record of which key signed which report allows a compromised key to be revoked without casting doubt on every earlier document signed with other keys. The record also tells a reviewer which public key to use when checking a given report.

Randomness

Keys and nonces need unpredictable random numbers. Weak randomness has broken real systems. For students, the lesson is to use the operating system's cryptographic random source rather than general-purpose generators when security depends on it.

Worked example

update.dll's SHA-256 matches an entry in a threat intelligence feed the security office subscribes to. Leah records the match, the feed name and date, and notes that a match identifies the file as a previously reported sample, while a non-match would not have shown the file to be benign.

Synthetic case. The feed match is invented.

Errors and limits

Cryptography protects integrity and confidentiality; it does not establish who performed actions.

Exercises

EX049 — MD5 status. Why not rely on MD5 alone?
Show marking criteria
Rubric: 3 = practical collisions; deliberate manipulation possible; 2 = partial; 1 = fine; 0 = none.
EX050 — Hash match. What does a feed hash match show, and what would a non-match show?
Show marking criteria
Rubric: 3 = known reported sample; non-match not benign; 2 = one; 1 = vague; 0 = none.
EX051 — Encrypted disk. How should examiners handle an encrypted disk?
Show marking criteria
Rubric: 3 = record, seek lawful access (recovery keys); 2 = partial; 1 = break it; 0 = none.

Synthesis

Cryptography underpins evidence integrity and limits what can be read; know its strengths and limits.

Continue studying — chapter 17 of 40

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →