Good.
Okay, let's go ahead and get started.
Okay, good morning, everyone. I'm sorry here some of you are tired, what I, what I'm planning on. I first before we start talking about stuff, I wanted to talk about my plan for the next several days so I basically decided I don't want to cover any more
real.
Yeah.
I don't want to cover like all the deep more Android details I think I've given you all enough to digest at this point I know a lot of you are still trying to get through the tutorials.
You still trying to finish up assignment three I know that assignment for is going to come out. So it's not out yet but it will be out within the next day or so.
So you've got, you know, you guys have playing on your plate assignment for is just based on tutorial nine so it's time you just bring our tutorial line will prepare you for doing the assignment.
So, by what I don't want to waste your time and I also want to do some things, talk about some things that will help you understand, mobile, mobile application development and implicit service TV teasers for later.
So today I was planning on talking about cryptography and how it relates to mobile applications on next Wednesday. I'll go through assignment three solutions, and now we're talking about language run times.
On April 1, so next Friday will the mid term solution so you'll have your midterm grades by then. And we'll go through.
And we'll discuss operating systems. So, so just so you know, that means that interviews, will be the week of.
Yeah, April 4 week of fourth.
Yes, you haven't to the 30th. Yes. You have until the 30th for assignment three Yes, exactly. mid term solution. And then, networking, I'll call on April six and note that, April six will be the last day for regular to triple check offs.
If you are going to try submitting a tutorial. If you want to get checked out for a tutorial. After that you have to get prior authorization from me and you have to have some extenuating circumstances because assignment for is do I go and solutions that
8 and you really should have the St Charles all done before you do the assignment for so April 6.
So you have all your tutorials check it off I'm not planning any check off after April six.
So,
can you resubmit your assignment I Yes you can, um,
How can the interview include both with UI and Caitlyn, it's the midterm is only on swift UI.
It's here.
It's about the midterm, so.
Um, so yeah. So, yes, I'm a little confused about the areas like so, and final exam.
April 14,
as I recall, that's the final exam. Yeah, two to 4pm.
And then I will have.
I will be doing so April 14.
So I'll plan on do I want to try doing interviews the week of April 18,
April, 18, through 22nd.
So.
Okay, any questions.
Okay, so let's, so I'm, I'm happy to answer. So I want to talk about cryptography stakes I don't want to cover any new material in terms of like the you're directly gonna be testing all this stuff all will help you understand how things work.
The question I have is, do. Does anyone have any questions on the assignments on tutorials. I am happy to spend time going through them otherwise I'm going to talk about cryptography, and how it relates to mobile applications.
Going what's.
Okay, twice. Moving on.
Okay.
Hello.
Okay.
Get.
Okay. You can unmute if you want to talk, but yeah.
Why, why do we want to talk about cryptography.
So, first off,
are we have an undergrad cryptography course.
The course numbering is changing.
So I'm trying to mirror what the current thing but.
So,
I'll tell you that we're very excited we think cryptography is very interesting it's not currently a required course, uh, it might be one day, I don't know that's a discussion, the fact that we have to do but I will tell you that it is.
It's rather important up cryptography is not security.
But it is a foundational technology that is relevant and lots of weird ways and there's lots of technical aspects of it that
that are worth studying formally, it's hard to pick up on your own. So, encourage you to take, you know take cryptography course.
If you can fit it in.
And today I'm going to try talking to you about some of the things.
Mystery of mine course, I'm
not exactly this it's actually much more for computer scientists, it's not it's not of.
It's more of, if you work in computers you should know this stuff at least the basics because it shows up in lots of weird places.
I want to give you a couple of things so the reason I want to talk about cryptography here is.
how do I know what code is ok to run by really is.
What food is
So much in order to.
There are lots of reasons on the good side is to prevent malicious code from running on your device on the bad side is to prevent you from doing things they don't want you to do with your device.
There's some digital rights management stuff also kind of there but both ways, modern devices particularly mobile devices but really all computers nowadays, but most computers, try to make sure that the code you're running is ok.
So, the basic idea is.
so that so you need to have digital signatures to on the, on any code that you're going to run to make sure it's approved by it. No, It's been approved by the appropriate authorities.
So for example, if you're going to install a Windows Update before windows installs it and make sure that it's been signed by Microsoft. Before your iPhone or your Android phone will install an update to the OS they'll do that.
Similarly, any applications.
Lies. So there's firmware there wasn't one devices.
operating systems
loaders
operating system
and applications.
So everything we want basically nowadays everything to be authorized and everything is authorized through a digital signature.
So the question is, is what is a digital signature.
So anyone know what a digital signature is.
And you know what, have you seen that I'm just curious if it's like people know about this already were.
Hmm.
So, you've heard of it before I've heard of things but I mean you've all seen notices related digital signatures.
Whenever you is when you start start from Windows nowadays it will say, this has been, you know, as this comes from an unknown publisher or if it's an unknown publisher.
verified checkmark but for code. Kind of, yeah. Yeah, it's like that you know for social media like oh you know you're, you're verified, but it's it's more than that.
It's his role, it's kind of up but in a technical mechanism, what does it actually doing
a digital signature provides.
So this is the two things that digital signature does it tells you who signed it, but also provides a measure of integrity, which is that it hasn't changed.
And to understand how this works, we first need to understand the integrity part, and then we'll discuss the authenticity part.
So the integrity part
from Secure Hash.
So the classic algorithms.
So there are these newer algorithms for doing you know these things which are that now.
If you've ever.
What's missing out well let's demonstrate.
So I'm going to go.
Okay so here we are lecture 19 and bigger, so you can see what's going on here, up. I'm gonna make a file.
So we'll just.
We'll just yeah we'll find.
Okay, so now I've created a file here.
Here it is.
So, if I run this, and test file.
This is the hash of it.
So.
So you can generate this hash now.
What this, so this.
hexadecimal.
Huh.
Okay, good.
anyone doesn't know hexadecimal I can quickly explain it.
Yeah so bit yeah so.
So,
because it's based 16 each, each character, you know, each digit represents a number. It represents four bits because it's zero to 15 and that's, you know, value need four bits to represent.
And so here you'll, if you look at how many letters there are here, there should be 256, divided by four. This is 64 characters.
Yeah.
So there's a 64 character hash. Now, what this
not gonna say in quite the cryptographic proper way but when you do become more informal idea of what of what properties is supposed to have one is it supposed to be.
certificates are based on this. Yes, I'm going to get two certificates.
The certificates. Yeah, they're, they're definitely coming.
But so, so Secure Hash to meet you I find my first, if you haven't documented be easy compute that, you know, you have it they have the document test file run the command get this very quickly to get the mountain.
But if I'm given a hash, it should be difficult when I mean difficult, and I mean in a cryptographic sense as a sense.
It should be part it's possible. It's just going to take me more time the computation the universe know kind of the it should take a very long time, very difficult to construct this.
And then also, you should have this.
So it's also difficult to find two documents that have the same passion. This is a slightly different. It's not that lets you change both documents at the same time, and visible filling with them to get them to converge on to the same hash.
So secure has to be processed by certain technique. No, no no no it's not like Morse code I mean, it's an algorithm.
It's a program for computing a value, it's a, it's literally, you know,
half of any kind.
I'm going to cover encryption.
This is not encryption,
there's basically three building blocks
for.
authentication codes.
So that's the those the building blocks.
So.
this is the cool thing is that if you.
Yeah, so, so you can just convert as it was we'll get to the safe part in a bit so so a secure house can be used to identify any digital data. So.
this is the classic way you do this so I'll show you an example of this.
If I go to Ubuntu.
And I go to download.
Okay, come on.
Oh come on to the fashion list
broker.
There we go.
So if you go here 2110. So here is it.
Okay, now you want to download stop stop I don't want to actually download it when I want to look his fault.
Oh.
Okay, look.
There we go.
releases so we're going to the.
So will the current release here, and then here you look here, this is for downloading an image. So an ISO image for this Linux distribution. If you look in here you'll see sign that says shot to 56 sums.
And you can see this, this list, the shot to 56 sums of these files. So I if I downloaded the file from some other source I want to make sure. Is it the one that I got from Ubuntu.
I just checked this hash. And if that's the same as the one here, I got it right.
So, houses or there's hash functions are very broad topic.
Whenever we use a dictionary data structure, it's actually a hash table, and the hash table uses hashes of strings. To do this, but they don't use cryptographic a secure access because they want to be fast, but they use simpler hash functions.
But if you look at the algorithm shot to be six you know it's on you can cut it up. Don't cut it up. That's another story but can this check can be automated Oh, it definitely can be automated.
And we're getting to that because.
Bit Torrent, and get.
So, BitTorrent get underneath, they're using secure houses all over the place to identify content.
Oh. Oh.
So this is a weird thing so basically, when you change one bit in the document. It should change on average, half, half the bits in the hash. So let me demonstrate so now here this is a test file.
So let me change this e to an F. So that's one letter ahead, that should be one or two bits I had to work out the Oscars I but it's it's a small change.
So.
So notice that the hash is now of the files are completely different.
But if I just change it back to E.
It's back to what it was. So, even a tiny change to it will completely change the hash.
Okay so so forest you're getting. you're getting it why we need digital signatures, so.
So how do you know you have the right hash for a file.
So you can you have a digital star guaranteed, this is, this is,
This is what use digital signatures before.
So, digital signatures are based on this concept known as public key cryptography. So before I just explained public key cryptography. I should explain symmetric cryptography.
So,
What was symmetric encryption
symmetric encryption work.
So, we have the key, you're playing text you have cipher text. So,
So we have, we have our algorithm.
So we say we have a function e, which takes ciphertext.
And the key
should produce plain text is increase the ciphertext.
Nice.
Prime.
Even a primer often same or normal is saying. And so the idea is that you give the encryption algorithm, plain text and the key and it produces the ciphertext, and if you can give the decryption algorithm the cipher text, the key, it gives you the plain
text.
So
decoder ring coteries.
Have you heard of a yes. Yes, is.
What's the block size of a yes.
Where's the block size.
Oh god.
Their advanced encryption algorithm a yes. So, original is Ryan doll Yeah, um,
What I want to look at so it's a block cipher block size 120 Kids Yes.
So
that's, you know, this is what you do then, now you might want to ask about.
You want to know how you do it for larger documents, there's a way to do it. It's called these things called block cipher modes is multiple ways of doing it.
I'll let you look that up.
But, basic idea here is, you have an album that does encryption with the key and things and.
so, with symmetric key encryption, the key for encryption.
And the key for decryption are the same. You use exactly the same, same information for both. So it's just like you use a secret decoder ring or something you both have to share a secret with both sides.
And if you both know the same secret, then you can exchange messages.
Here's the hard part was so that's key encryption is very strong.
As a very strong algorithm.
I'm not saying so might not break it.
I'm not saying so might not break it. Um, I haven't gotten to the public yet okay but publicly as basically I'm Liam's robot so how do you both parties get the same key public key cryptography.
So this is the basic ideas you have a public key and a private key as a matched pair.
They generate them when you create a key you have create them as a pair, and the public key you tell everyone about it, and the private key, you don't share it with anyone.
So call this will call the public key.
Call this
will call it will call this k will work on escape crime.
Okay.
So correspond with our things okay public key is private so now all we have is we have encryption, with the, with encryption with the kit, you know, plain text and and K know gives us a cipher tax.
No, gives us a cipher tax.
So, our decryption algorithm.
Now has to have its own key, that's different from the key that we had for encryption.
So this is, this is public key cryptography so.
only I so if you want to send me a secret document, you would download my public key, and then use it to encrypt the document and then send it to me, or you can even just publish it because it's encrypted.
The only I can read it.
because only, I have the corresponding private key.
So with a digital signature is just you reverse it now, I should note.
So while there are public key algorithms that we use for digital signatures and for encryption.
It's now a very common to use separate ones for the two roles.
You have one for the US one algorithm for things so like, You know, if you're a PGP to.
one thing on public key algorithms is they're not very good at dealing with large amounts of data. They really want to work with very small amounts of data with actually certain, you really want to be random data.
So, what we actually do is we have to use a digital signature algorithm you actually have to operate on a hash, and you have encryption says you if you are encrypted document you encrypt this a symmetric key note as a session key for signing the document.
If this sounds a little vague again. I'm covering a lot of ground, very quickly, but just want to give you a basic idea here so if you look at the new Privacy Guard.
You know, it's using hash functions.
So if you use new Privacy Guard there. That's what it is. And in fact, if you go back to this right here. You notice there is this shop to take sums and chart to hit sums GPG.
Come on.
I downloaded it fine.
So for the max.
Forget it. No, it's fine to show it to you.
So what's trying to actually.
This is the, this is a detached, digital signature of that other file.
This is, you know, say, you know, this is, this is the signature of the other of the passions.
And so, but I haven't done a little more ground to cover so that if I if I you do.
So we do this, so they asked you what kind of thing you want to do so by default it generates a key for signing and for encryption uses RSA RSA.
And then, otherwise it's generating DSA is for digital signature algorithm. That's where we use it doing signatures and el-gamal is used for encryption, or just during the DSA one for signing only or during an RSA algorithm for signing, you know, for
signing only or, you know, doing something so like this is all the ciphers they know and you can actually have does more ciphers This is just the ones that are built into this particular program.
So, so it's all there.
Now, what I have to point out though is.
So let's say I download from somewhere online, a public key.
And it happens to say that it is from Justin Trudeau.
Do I trust it.
What basis just because it's downloaded basically down from the right website.
We can do better.
So why don't use digital signatures to authenticate public keys, you know, recycle, reuse, reduce, reuse, recycle and you know we do the same. Use the same things over and over again.
While this I'll show you a certificate. So we go to a browser.
And let's just go here. So this is my website here. Now this is the wiki. And over here, there's a little lock icon. What does the lock icon tell you about all it tells you about is the connection between know was not about.
It's about a secured website but all the security is
this one.
This is only
me that lock icon says nothing about the security the web's other book websites on my wiki can be compromised all kinds of ways, who knows.
I've taken steps to try making sure that's not the case but that tells you nothing about it what this all this does it says how your connection is to it.
How's the data going over the wire to it will talk about. So, we say, so let me explain what that means that we say subscriptions cure. So it's saying is that you're securely connected the site verified by Let's Encrypt.
So here is the information that you know that came out here. So what's it saying, saying this website identity, this is homeostasis dot sec dot.ca.
I did not supply ownership information.
Nobody. And it's verified by this organization Let's Encrypt and expires on April 27 2022, so it's telling me about, I visited us is that computer a lot, like, Okay, and then it tells me the connection encrypted.
So notice it was using pls using AS 128.
gcm is actually the message authentication code, gosh, I got my decipher Sha 256 place to talk to six the hash function 128 bit keys the protocol, see all that stuff is in there.
But what does that really mean here.
So what this means here this is the information notice there Here is a shock to 56 hash lease a fingerprint that's the hash of the key itself it this is all metadata that's saying you know what I'll do let us know our show today is with the RSA encryption.
Just saying, you know, but what. So how is this know and it turns out this is known by, you know, this common name are three What's our three organization company are three so internet security research group.
So they've signed my thing. And then that signed by this is RG here so what this is saying is my key from my website was signed by the are three key, which was signed by ISRGISRG is kind of the root certificate certificate authority that we mentioned
that ca. This is it.
Why do I trust is RG
know.
It's because it came with my browser.
In fact, if I go to my settings.
I go to privacy and security let's go look here.
Views certificates certificate manager. Now you want to know the afforded what authorities will your browser considered to put a lock icon for basically say, if it presents a certificate has been signed by these people, you will consider it to be trusted.
These are all the people who your browser trusts,
please my browser and your browser may not be exactly the same but it's, these are the sticky authorities. It is a lot of people and look at some of these are kind of a little interesting.
So this is a firm trust. So, Amazon okay make sense Amazon's got one.
You know, Baltimore.
One us prophesying University oh I guess I installed that long time ago in my browser.
Did you Search interest is in here.
That's a local auto company. They're pretty good but so is the where's the ROI let's go daddy.
Hong Kong. Hong Kong post. Hmm.
in that security research group.
I saw RGX one is RGS one are three okay so, so, so this is all.
But these are all the secure, I actually I guess it's been signed by to certificate because there are three. I'm assuming that was a chain but it looks like that was actually one of the other.
have just one certificate installed in the browser to have more than one big with different expert actually probably have different expiration dates they both, both don't expire at the same time, so they can change them off because of course you're, if
you look at these exploration of these things so let's go to
see everyone's got more than one, Almost nobody has just one certificate.
Number from Microsoft has to, you know, let's pretty standard to have to at least.
So let's you know, if we view this is a big one. This expires.
2035.
This one expires, 2040.
So, see you see one of the, they have different expiration dates. So when one falls, they can switch over to the other one.
This one use elliptic curve. Oh, and they also use different algorithms. This is the elliptic curve cryptography this key size here P three four. And this one uses RSA with a 4096 bit key.
So, these are very belt and suspenders because cryptographic algorithms.
It was to get compromised your news to get installed automatically.
It gets if a server gets compromised, it gets revoked, and it can lead to a big scandal, and oftentimes the certificate authority may be cold, there has, there have been death sentences for certificate authorities because they've been considered to be
be too untrustworthy. But, but it depends. So let's say we go to.
We go to Carlson's website, who signed their certificate conditioning is just, you know, verified by and trust a local folks and trust us, you know sign the certificate for Carlton and entrust ease and his certificate is built into our browser.
So our thing doesn't complain, it's certainly possible to visit a website that's signed by authority that your browser doesn't trust, and then you get a big fat warning, or maybe as soon as it has expired you get another big fat warning or maybe one that
self signs or not it's not browsers complain a lot so there's an entire industry around, preventing your web browser from complaining, but the same technology here for certificates, is exactly what's used for signing coke.
It's all the same technology.
So.
so mobile devices basically only run code that's been properly song.
And that's why.
basically the signatures on the certificates exactly how you, they control what's on your device and why you have to go to the App Store meet for development, they'll sign your thing and let you run it on your phone.
But that's it.
You can't distribute that binary,
our websites just code anyway. Yeah, yeah.
Yes, exactly is that when you signed your swift you I ops when you saw your side you exactly got, that's what I just said.
So, websites, websites really shouldn't just be code but yeah and practice now they're mostly code, unfortunately.
So, so this is why you have to have the right signature on your synchronized between your phone and stuff in which right you know it works magically and when it does it, nothing will work.
Because of this.