◇ OpenCyber Academy
Technical · Chapter 9 · English

Chapter 9 — Cryptography and trust services: tools and methods

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Cryptography and trust services: tools and methods

Lesson map

Lesson 09 published. Map, example, EX033.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 The basic toolkit"]
  N2["9.2 Reading a handshake test"]
  N3["9.3 Tools that leak"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX033"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 The basic toolkit"]
  N2["9.2 Reading a handshake test"]
  N3["9.3 Tools that leak"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX033"]

[Learning outcomes]
    |
    v
[9.1 The basic toolkit]
    |
    v
[9.2 Reading a handshake test]
    |
    v
[9.3 Tools that leak]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX033]

Learning outcomes

You will (1) use openssl, ssh-keygen and Python's ssl module safely for inspection; (2) read a handshake test; (3) avoid tools that leak data to third parties.

9.1 The basic toolkit

Tomás's toolkit is small. openssl s_client connects to a server and prints the negotiated protocol, cipher suite and certificate chain. openssl x509 -noout -text reads a certificate file. ssh-keygen -l -f prints the fingerprint of an SSH public key so it can be compared with a recorded value. Python's ssl module can open a verified connection and report the protocol version in a few lines. Each tool reads public information or local files; none of them needs private keys. Priya insists he understands every flag he uses, because copying commands from forums often includes options that disable verification.

9.2 Reading a handshake test

Tomás runs s_client against the staging portal in the lab and reads the output top to bottom. He checks the protocol line, which should say TLSv1.3 or TLSv1.2; the verification result, which should read 0 (ok); the certificate subject and alternative names; and the notAfter date. A result such as unable to get local issuer certificate means the server did not send its intermediate. He records the command and output as evidence. He learns that a verification error in a test is a finding to report, never something to silence with an option that skips checks.

9.3 Tools that leak

Online certificate decoders, paste sites and public scanners are convenient, but they send data to a third party. Pasting a certificate is low risk because it is public; pasting a private key, a configuration with secrets or an internal hostname list is not. Public scanning services also record results that others can search. Tomás's rule is to use local tools for anything internal and to use public services only for public endpoints, with approval. He also checks that his own scripts never print secrets to the terminal, because terminal history and screen sharing both leak.

Worked example

Tomás tests the staging portal with s_client, finds a missing intermediate, records the evidence locally and refuses a colleague's suggestion to paste the server key into a web decoder.

Synthetic case. Hosts and outputs described are synthetic.

Errors and limits

Tool output varies across versions; record versions with evidence. A successful test from one network says nothing about clients elsewhere.

Exercises

Synthesis

Inspection tools are safe when they read only public data, keep verification on and stay local for internal material.

Continue studying — chapter 09 of 18

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →