WebFund 2016W Lecture 18 - Revision history

LeeCroft at 02:17, 21 March 2016

2016-03-21T02:17:21Z

@@ Line 140: / Line 140: @@
 **If you encrypt with a private key and decrypt with the public key, that’s a digital signature
 *This is what is used for HTTPS
 ====First Rule of Cryptography====

LeeCroft at 02:12, 21 March 2016

2016-03-21T02:12:49Z

← Older revision		Revision as of 02:12, 21 March 2016
Line 141:		Line 141:
	*This is what is used for HTTPS		*This is what is used for HTTPS

	===First Rule of Cryptography===		====First Rule of Cryptography====

	*Friends don’t let friends implement their own cryptography, algorithms or code because it’s hard to do it and be sure you’re secure		*Friends don’t let friends implement their own cryptography, algorithms or code because it’s hard to do it and be sure you’re secure

LeeCroft at 02:12, 21 March 2016

2016-03-21T02:12:34Z

← Older revision		Revision as of 02:12, 21 March 2016
Line 58:		Line 58:
	===Student Notes===		===Student Notes===

	====Additional Notes on ~~Openstack~~ Instances====		====Additional Notes on OpenStack Instances====

	*When selecting a floating IP address, the subnet must correspond to the network that you chose for your instance i.e. If you pick comp2406-net-31 you should use a 134.117.31 address and if you pick comp2406-net-26, use a 134.117.26 address. Mismatching will result in an error		*When selecting a floating IP address, the subnet must correspond to the network that you chose for your instance i.e. If you pick comp2406-net-31 you should use a 134.117.31 address and if you pick comp2406-net-26, use a 134.117.26 address. Mismatching will result in an error
Line 139:		Line 139:
	***For example, you can send the professor a secret message after downloading his public key and using it for encryption		***For example, you can send the professor a secret message after downloading his public key and using it for encryption
	**If you encrypt with a private key and decrypt with the public key, that’s a digital signature		**If you encrypt with a private key and decrypt with the public key, that’s a digital signature
			*This is what is used for HTTPS

	=====First Rule of Cryptography=====		===First Rule of Cryptography===

	*Friends don’t let friends implement their own cryptography, algorithms or code because it’s hard to do it and be sure you’re secure		*Friends don’t let friends implement their own cryptography, algorithms or code because it’s hard to do it and be sure you’re secure

LeeCroft at 02:07, 21 March 2016

2016-03-21T02:07:28Z

@@ Line 55: / Line 55: @@
     code
 </pre>
 ==Code==
 [http://homeostasis.scs.carleton.ca/~soma/webfund-2016w/code/analyzeLogs-ssl-template.zip analyzeLogs-ssl-template.zip]

Soma: Created page with "==Video== The video for the lecture given on March 17, 2016 [http://homeostasis.scs.carleton.ca/~soma/webfund-2016w/lectures/comp2406-2016w-lec18-17Mar2016.mp4 is now availab..."

2016-03-18T02:01:29Z

Created page with "==Video== The video for the lecture given on March 17, 2016 [http://homeostasis.scs.carleton.ca/~soma/webfund-2016w/lectures/comp2406-2016w-lec18-17Mar2016.mp4 is now availab..."

New page

==Video==

The video for the lecture given on March 17, 2016 [http://homeostasis.scs.carleton.ca/~soma/webfund-2016w/lectures/comp2406-2016w-lec18-17Mar2016.mp4 is now available].

==Notes==

===In Class===

(This is lecture 18, not 17!)

<pre>
Lecture 18
----------

Symmetric cryptography
- everyone uses the same key
- think secret decoder rings
- or, file encrypted with AES
- secret has to be shared between sender and receiver

Public-key cryptography
- but what if we don't have a shared secret?
- your password isn't good enough, and
- websites don't remember your password
- and how would you send them your password in
the first place
- instead, we split the key into two parts
- a public key
- a private key
- whatever one does, the other can undo

- if you encrypt with a public key and decrypt with a
private key
- private one-way communication
- e.g., you download Anil's public key and send
Anil a secret message
- if you encrypt with a private key and decrypt with
the public key
- that's a digital signature

First rule of cryptography
- friends don't let friends implement their own crypto
- algorithms OR code!

Why? You'll miss protections against attacks.
Example: timing attacks
- can extract secrets by watching execution time
- exploits the fact that some numbers take longer to
multiply & other operations

Everyone else messes up too
- so be prepared to update/replace all crypto-related
code
</pre>

==Code==

[http://homeostasis.scs.carleton.ca/~soma/webfund-2016w/code/analyzeLogs-ssl-template.zip analyzeLogs-ssl-template.zip]