- [Instructor] Hello again, and welcome to the seventh video
of Section Two: Cryptographic Tools and Hashes.
In the previous video, we have learned
about checksum and verification.
This video will introduce a few commonly used cryptographic
tools and a general set of algorithms
that these tools can handle.
Encryption techniques are used mainly to protect data
from unauthorized access.
There are many algorithms available, and we have discussed
the most commonly used ones.
There are a few tools available in Linux environment
for performing encryption and decryption.
Sometimes we use encryption algorithm hashes
for verifying data integrity.
Let's see how to use tools such as crypt, gpg, base64,
md5sum, sha1sum, and OpenSSL.
The crypt command is a simple,
and relatively insecure cryptographic utility,
that takes a file from standard in, and a passphrase
as input, and output encrypted data onto standard out.
And hence, we use redirection for the input
and output files.
It will interactively ask for a passphrase.
We can also provide a passphrase through
the command line arguments.
In order to decrypt the file, use...
Gpg, GNU Privacy Guard, is a widely used tool
for protecting files with encryption that ensures
that the data is not read until it reaches
the intended destination.
Here, we discussed how to encrypt, and decrypt a file.
Gpg signatures are also widely used in email communications
to sign email messages, proving the authenticity
of the sender.
In order to encrypt a file with gpg, use...
This command reads the passphrase interactively,
and generates filename.gpg.
In order to decrypt a gpg file, use...
This command reads a passphrase, and decrypts the file.
We don't cover gpg in much detail in this book.
If you're interested in more information,
please see en.wikipedia.org/wiki/gnu_privacy_guard.
Base64 is a group of similar encoding schemes
that represents binary data in an ASCII string format,
by translating it into radix-64 representation.
The base64 command can be used to encode
and decode base64 string.
In order to encode a binary file
into the base64 format, use...
It can read from std in.
Decode base64 data as follows.
Md5sum and sha1 are uni-directional hash algorithms,
which cannot be reversed to form any of the original data.
These are usually used to verify the integrity of data,
or for generating a unique key from a given data.
These types of hashes are commonly used
for storing passwords.
Passwords are stored as their hashes, and when a user
wants to authenticate, the password is read and converted
to the hash.
Then, its hash is compared to the one
that is stored already.
If they are the same, the password is authenticated,
and access is provided.
Otherwise, it's denied.
Storing plain text password strings is risky,
and poses a security risk.
Although commonly used, md5sum and sha1 are
no longer considered secure.
This is because of the rise of computing power
in recent times, that make it easier to crack them.
It's recommended to use tools,
such as bcrypt, or sha512sum, instead.
Read more about this
at codahale.com/howtosafelystoreapassword.
Shadow like hash, salted hash.
Let's see how to generate
a shadow like salted hash for passwords.
The user passwords in Linux are stored as their hashes
in the excetera shadow file.
A typical line in excetera shadow will look like this.
It's the shadow hash corresponding to its password.
In some situations, we may need
to write critical administration scripts that may need
to edit passwords, or add users manually
using a shell script.
In that case, we have to generate a shadow password string
and write a similar line as the preceding one
to the shadow file.
Let's see how to generate a shadow password using OpenSSL.
Shadow passwords are usually salted passwords.
Salt is an extra string added to obfuscate
and make the encryption stronger.
The salt consists of random bits that are used
as one of the inputs to a key derivation function,
that generates the salted hash for the password.
For more details on salt, see the Wikipedia page.
Replace salt_string with a random string, and password
with the password that you want to use.
Great.
We've successfully learned
about cryptography tools and hashes.
In the next video, we'll learn
about sorting unique and duplicates.