Chapter 17 — Cryptography concepts

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 What cryptography provides"]
  N2["17.2 How TLS protects connections"]
  N3["Lab — TLS version audit"]
  N4["17.3 Reading the audit"]
  N5["17.4 Keys and certificates"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 What cryptography provides"]
  N2["17.2 How TLS protects connections"]
  N3["Lab — TLS version audit"]
  N4["17.3 Reading the audit"]
  N5["17.4 Keys and certificates"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 What cryptography provides]
    |
    v
[17.2 How TLS protects connections]
    |
    v
[Lab — TLS version audit]
    |
    v
[17.3 Reading the audit]
    |
    v
[17.4 Keys and certificates]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) explain encryption, integrity and authentication; (2) describe TLS; (3) audit TLS versions.

17.1 What cryptography provides

Cryptography supports three services on networks. Encryption keeps data confidential from those without the key. Integrity checks, such as message authentication codes, detect if data were changed. Authentication, often through certificates and digital signatures, proves who is at the other end. Priya stresses to classmates that cryptography protects data in transit between two endpoints; it does nothing to stop an infected endpoint from misusing data, or a correctly authenticated user from doing something they should not. Knowing these limits prevents encryption from being treated as a complete security solution.

17.2 How TLS protects connections

Transport Layer Security protects most web and many other connections. At the start, client and server agree on a protocol version and algorithms, the server proves its identity with a certificate, and they establish shared keys. After that, data are encrypted and integrity-protected. TLS 1.3, described in RFC 8446, simplified this exchange and removed older, weaker options. NIST SP 800-52r2 advises that servers support TLS 1.2 and 1.3 and not older versions, which have known weaknesses. Clients that only support old versions are identified and replaced or isolated rather than allowed to hold back every server.

Lab — TLS version audit

"""Flag synthetic server TLS settings below a TLS 1.2 minimum, as SP 800-52r2 recommends (stdlib only)."""
servers = [("portal", "TLSv1.3"), ("booking", "TLSv1.2"), ("lab-results", "TLSv1.0"), ("email", "TLSv1.2"),
           ("old-intranet", "TLSv1.1"), ("vpn", "TLSv1.3"), ("pharmacy", "TLSv1.2"), ("printer-ui", "SSLv3")]
rank = {"SSLv3": 0, "TLSv1.0": 1, "TLSv1.1": 2, "TLSv1.2": 3, "TLSv1.3": 4}
weak = [s for s, v in servers if rank[v] < rank["TLSv1.2"]]
for s, v in servers: print(f"{s:13}{v:8}{'FIX' if s in weak else 'ok'}")
print(f"{len(weak)} of {len(servers)} below TLS 1.2 ({100*len(weak)/len(servers):.1f}%)")

Run with python3 lab_tls.py. Verified output:

portal       TLSv1.3 ok
booking      TLSv1.2 ok
lab-results  TLSv1.0 FIX
email        TLSv1.2 ok
old-intranet TLSv1.1 FIX
vpn          TLSv1.3 ok
pharmacy     TLSv1.2 ok
printer-ui   SSLv3   FIX
3 of 8 below TLS 1.2 (37.5%)

17.3 Reading the audit

The synthetic inventory shows three of eight services, 37.5 percent, below the TLS 1.2 minimum: the lab results service on TLS 1.0, an old intranet on TLS 1.1 and a printer's web interface on the obsolete SSL 3. The lab results service carries health data and is the priority. The printer interface is likely a device limitation, so the practical fix may be to restrict it to the management zone rather than upgrade it. Priya records each with an owner and a proposed action rather than a generic "upgrade everything".

17.4 Keys and certificates

Cryptography is only as strong as its key management. Certificates expire, private keys must be protected and trusted authorities must be chosen carefully. Priya finds the clinic's booking portal certificate expires in three weeks, with nobody assigned to renew it. An expired certificate causes browser warnings that train users to click through warnings, which is worse than the outage itself. She recommends an expiry register with reminders sixty days ahead and a named owner for each certificate. Private keys are stored only on the servers that need them, never emailed.

Worked example

The audit flags lab-results, old-intranet and printer-ui; the printer is moved to the management zone and the other two are scheduled for upgrade.

Synthetic case. Inventory is synthetic.

Errors and limits

Encryption on the wire does not protect data on an infected endpoint.

Exercises

• EX049 — Audit result. What share of services fall below TLS 1.2 in the lab?
  Show marking criteria

  Rubric: 3 = 3 of 8, 37.5%, naming them;; 2 = 37.5%;; 1 = some;; 0 = none.
• EX050 — Printer fix. Why restrict rather than upgrade the printer interface?
  Show marking criteria

  Rubric: 3 = device limitation; reduce exposure via management zone;; 2 = cannot upgrade;; 1 = ignore;; 0 = none.
• EX051 — Expiry harm. Why do expired certificates harm security beyond outages?
  Show marking criteria

  Rubric: 3 = users learn to ignore warnings;; 2 = warnings;; 1 = vague;; 0 = none.

Synthesis

TLS protects data in transit when versions are current and keys are well managed.

Continue studying — chapter 17 of 40

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →