Plaintext -> Hash function -> Hashed Text

File / Message Integrity check
- File data integrity and photo steganography
#### Good Hashing Practices
- Use long complex passwords and a password manager
- Use Single sign-on
- Use Multi-Factor Authentication.
### Message Authentication Code (MAC)
MAC in TLC is used for **Integrity and Authenticity**.

Hashing is good for integrity but not for security. MAC fixes this by adding authenticity as long as the shared secret is kept secret.

HMAC is a MAC generated using a hashing function. i.e. MAC Hashing Function?
#### Sender

#### Receiver

#### Integrity and Authenticity
if Sender MAC and Receiver MAC are equal then it this can confirm `Who` it came from and that it has not been `Tampered` with.
#### Non-Repudiation
MAC cannot confirm the original sender, therefore if the sender claims they didn't send it, there is no evidence that they did. 

> The original message could of been forged by the claimer as a false accusation.
### Symmetric Key Encryption
Symmetric key encryption is used in TLS for **Confidentiality**.

AES (Advanced Encryption Standard) is the most common used symmetric key encryption. It can accommodate keys as 128, 192 and 256 bit key. 

Very fast, so good for large data blocks. The *challenge* with AES is securely getting the key to the second party.
#### Sender

#### Receiver

!!! important "Important"
    The **same key** is used to encrypt as it is to decrypt.
### Asymmetric Key Encryption
Asymmetric Key Encryption in TLS focuses on **confidentiality**.

A common example of Asymmetric Key Encryption is RSA.

Asymmetric Key Encryption unlike symmetric uses a pair of complementary but different private and public key. The public key is made public. 

[Key Generation Source](https://www.ecs.umass.edu/ece/koren/FaultTolerantSystems/simulator/RSA/new_page_5.htm#:~:text=Explanation%20of%20RSA-,The%20key%20generation,-%3A)

<sub>RSA Key Generation</sub>

[Online Key Gen](https://cryptotools.net/rsagen)

<sub>RSA Generated Public Key</sub>

<sub>RSA Generated Private Key</sub>

#### Sender

#### Receiver

Problem with Asymmetric Key Encryption is that it can't be reassured where the public key came from.

Complex maths, so not useful for large data blocks.

Elliptic Curve is another popular asymmetric algorithm.

The NIST (National Institute of Standards and Technology) define crypto strength in "bits of security".
- 112 bits is good until about 2030
- Approximate equivalencies:
  - 2048 bit RSA key
  - 224 bit ECC key
  - 128 bit AES
### Secure Key Agreement
Secure Key Agreement is **different** to *Key Exchange*.

[Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) is a very popular method of `key agreement`.

Each party creates values that are exchanged and from those values, the secret keys are computed. 

The 'beauty' of this method is that the secret keys are not exchanged so they cannot be intercepted and if the values which are exchanged are intercepted then they can be used to compute the original shared secret.

Instead if there is a man in the middle they would been to intercept the changes and substitute both values. Therefore, to protect against this, the server value also provides a `digital signature` so that the value can't be changed without detection.

From the exchanged values, both parties can compute the same value which is the shared secret. Although, the shared secret could be used now for encryption, generally working keys based on these shared values will be seen in further aspects of TLS.
## Summary of Basic Properties
- Symmetric keys are the same for encryption and decryption and provide confidentiality.
  - Encryption and Decryption as a result is very fast
  - Securely getting the key to the 2nd party is the difficulty. Diffie-Helman is a popular approach to that problem as actual keys aren't exchanged but calculated based on the exchanged data.
  - AES is popular for symmetric encryption (in transit and at rest)

- Hash can be used for integrity as it is unique and a fixed length which is very sensitive to data change.

- MAC / HMAC (Hashed Message Authentication Code) used to provide security of the hash by mixing in a symmetric key so provides **Authenticity** and **Integrity**.

- Public Key Encryption - Keys are a pair and are different. Private (Secret) and Public.
  - Public key used to encrypt data for **confidentiality**.
  - Private key used to decrypt confidential data encrypted with public key.

- Private Key Encryption - Can be used to create Digital Signature
  - Provides **integrity**, **authenticity**, and **non-repudiation**.
  - Digital Signature is the equivalent to symmetric key HMAC but better as it provides *non-repudiation*.
- RSA and Elliptic Curve are popular for asymmetric encryption e.g. digital signature, and digital certificates.

---
# Digital Signature
Digital signature in TLS focuses on; **authenticity**, **integrity**, and **non-repudiation**.

It does not however allow **confidentiality**.

More secure alternative than a handwritten signature, by guaranteeing authenticity of the sender, therefore providing non-repudiation as long as the secret isn't shared for legal problems. E.g. Using HSM, or Smart Card to hold the secret key. Digital signatures also ensure integrity.

```mermaid
sequenceDiagram
    participant Bob
    participant Employee

    Bob->>Employee: Sends Public Key

    Bob->>Bob: Hashes contract to create a digest.

    Bob->>Bob: Encrypts digest using his private key.

    Bob->>Employee: Provides contract.csv, digest.txt

    Employee->>Employee: Decrypts Digital Signature using Bob's public key to get Hash value. (No Confidentiality)

    Employee->>Employee: Hash the contract file to get the digest (hash) to verify it's the same as Bob's (Integrity)

PlainText Message -> Hash Value -> Private Key -> Digital Signature
                Hashing       Digital
               Algorithm     Signature
            (MD5, SHA1, etc) Algorithm
                         (DSA, RSA, etc)

You install certbot on your server then using it in a single command it will:

▹ Send a server to let's encrypt (LE) server POST request with the domain name you want to register  
▹ Server receives a token from LE - basically a random string - this is a challenge step  
▹ Server POSTS back the token and a hash of the public key as a response to the challenge  
▹ Server POSTS a "Please validate the challenge" to LE  
▹ LE makes a get request to a web server on your server (typically port 80) asking for the token to check it matches  
▹ If it matches, certbot creates a key pair and a CSR containing the public key, domain names, and a digital signature proving  
ownership of the private key associated to the public key in the CSR and server sends it to LE  
▹ LE creates and returns cert.pem, chain.pem (the intermediate cert) and chain.pem (both in one file). We tend to use this one