Applications of encryption in modern systems

 Asymmetric encryption applications

By nature asymmetric encryption allowed us to sign and verify information easily. Here are some application areas and we will deep dive into some complicated questions. 

• JWT 
• HTTPs

Json Web Tokens by nature considered secure authentication tokens. Its simple and effective implementation allowed developers to sign and verify tokens easily.

JWT consists of 3 parts - header, payload and signature.

header - contains all the signing algorithm related information mostly (such as which algorithm used, token type etc.)

payload - contains information developer wants to store in the token. These information should not be long and private but rather user specific values (such as session id, user id, expire date etc.).

signature - This part is the most important part of JWT which used to verify the token itself. 

Signature formed by header and payload values namely :

 SHA256( Base64(header) + "." + Base64(payload) + SECRET )

Output of this operation then used as input of RSA encryption with private key (if JWT algorithm is selected as RSA). Then output encoded as base64 and appended encoded and dot joined header and payload combination.

There are other algorithms we can use other than plain RSA such as HS256 (HMAC + SHA256) HS512 etc.

HMAC - Hash based Message Authentication Code is used protect integrity of the private data sent over internet. Let's say person A sending data to person B via network they employ hashing to check integrity. But attacker somehow gained access to local network and noticed the pattern text + --- + hash  as a result he altered and calculated the new hash value send to person B. As we can see it is possible to alter data namely affect the integrity of it. To overcome this HMAC created. For this algorithm we need extra secret and hash function. HMAC = hash(message+secret) . As simple as that. 

HMAC  - is used to prevent manipulation of data and symmetric way of encryption.

RSA - both prevent manipulation also identify the source (only who has private key can sign)

RSA - public keys always used for verification of JWT but on the other hand private key used to encrypt hash of the data (header + payload). So when system verifies, it first calculates hash of header + payload and compares with decrypted hash.

HTTPs

Most popular application area of encryption. HTTPs alone uses Hashing, AES, RSA (old) /Diffie-Helman (modern) algorithms to ensure secure communication.

Let's remember that in asymmetric encryption everyone can encrypt data using public key and only who has private key can decrypt it (Encryption of data). But opposite is also true, so we can use private key to encrypt and public key to decrypt the value (Verification). 

We must keep this in mind that public key can be derived from private key, vice versa is not true.

Let's deep dive into it:

When you enter https://google.com into your tab and press enter. (Neglecting all tcp handshake, dns resolution and focusing on just certificate validation and handshake part)

  

1. Browser sends related information such as version, which encryption it supports etc. to the server.

2. Server on the other hand sends its own certificate.

3. Client checks certificate validity :

• Checks expire date
• Checks issues of certificate 
• Calculates hash of certificate and decrypts signature via public key that comes with the cert. And compares final values (hashes). Certificate signature contains hash of certificate encrypted with private key.  Certificate root authorities sign the certificate embed public key inside and distributes.

4. If checks passed, client generates new random secret and encrypts it with public key in the certificate.

5. Server receives encrypted secret and decrypts it via private key.
6. Finally AES symmetric encryption used to encrypt communication between client and server.