DOCSLIB.ORG

Linuxcbt Security Edition Encompasses 9 Pivotal Security Modules: 1

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Linuxcbt Security Edition Encompasses 9 Pivotal Security Modules: 1 LinuxCBT Security Edition encompasses 9 pivotal security modules: 1. Security Basics (fundamentals) 2. Proxy Security featuring Squid 3. Firewall Security featuring IPTables 4. SELinux Security - MAC-based Security Controls 5. Network Intrusion Detection System (NIDS) Security featuring Snort® NIDS 6. Packet | Capture | Analysis Security featuring Ethereal® 7. Pluggable Authentication Modules (PAM) Security 8. Open Secure Shell version 2 (OpenSSHv2) Security 9. OpenPGP with Gnu Privacy Guard (GPG) Security LinuxCBT Security Edition is unparalleled in content, depth and expertise. It entails 89-hours, or ~ 2-weeks of classroom training. LinuxCBT Security Edition prepares you or your organization for successfully securing GNU/Linux & Open Source-based solutions. As a by- product, many of the covered concepts, utilities and tricks are applicable to heterogeneous computing environments, ensuring your coverage of the fundamentals of securing corporate infrastructures. Recommended Prerequisites for: • Any LinuxCBT Operating System Course (Classic/EL-4/SUSE/Debian Editions) Open mind & determination to master Linux and related open-source applications Basic understanding of networking concepts Access to a PC to follow the exercises Basic Security - Module 1 • Boot Security ○ Explore Dell PowerEdge BIOS Security-related features ○ Discuss concepts & improve Dell PowerEdge BIOS security ○ Explain run-time boot loader vulnerabilities ○ Explore single-user mode (rootshell) and its inherent problems ○ Modify default GRUB startup options & examine results ○ Secure boot loader using MD5 hash ○ Identify key startup-related configuration files & define boot security measures ○ Identify key boot-related utilities ○ Confirm expected hardware configuration ○ Discuss INIT process, runlevel configuration & concepts ○ Explore & tighten the security of the INIT configuration ○ ○ Shell Security ○ Confirm expected applications ○ Discuss Teletype Terminals (TTYs) and Pseudo Terminals (PTS) ○ Identify common TTYs and PTSs ○ Track current TTYs and PTSs - character devices ○ Discuss concepts related to privileged and non-privileged use ○ Restrict privileged login ○ Use SSH and discuss TTYs ○ Discuss the importance of consistent system-wide banners & messages ○ Define and configure system banners for pre and post-system-access ○ Identify user-logon history and correlate to TTYs ○ Identify current user-connections - console-based and network-based ○ Use lsof to identify open files and sockets ○ ○ Syslog Security ○ Discuss Syslog concepts and applications ○ Explain Syslog semantics - facilities & levels - message handling & routing ○ Focus on security-related Syslog facilities ○ Examine security logs managed by Syslog ○ Configure Network Time Protocol (NTP) on interesting hosts ○ Secure NTP configuration ○ Ensure time consistency to preserve log-integrity ○ Configure Syslog replication to preserve log-integrity ○ Identify log discrepancies between Syslog hosts ○ ○ Reconnaissance & Vulnerability Assessment Tools ○ Discuss Stage-1 host/network attack concepts ○ Upgrade NMAP reconnaissance tool to increase effectiveness ○ Identify NMAP files ○ Discuss TCP handshake procedure ○ Discuss half-open/SYN connections ○ Perform connect and SYN-based host/network reconnaissance ○ Identify potential vulnerabilities on interesting hosts derived from reconnaissance ○ Examine NMAP logging capabilities ○ Perform port sweeps to identify common vulnerabilities across exposed systems ○ Secure exposed daemons/services ○ Perform follow-up audit to ensure security policy compliance ○ Discuss vulnerability scanner capabilities and applications ○ Prepare system for Nessus vulnerability scanner installation - identify/install dependencies ○ Generate self-signed SSL/TLS certificates for secure client/server communications ○ Activate Nessus subscription, server and client components ○ Explore vulnerability scanner interface and features ○ Perform network-based reconnaissance attack to determine vulnerabilities ○ Examine results of the reconnaissance attack and archive results ○ Secure exposed vulnerabilities ○ ○ XINETD - TCPWrappers - Chattr - Lsattr - TCPDump - Clear Text Daemons ○ Install Telnet Daemon ○ Install Very Secure FTP Daemon (VSFTPD) ○ Explore XINETD configuration and explain directives ○ Configure XINETD to restrict communications at layer-3 and layer-4 ○ Restrict access to XINETD-protected daemons/services based on time range ○ Examine XINETD logging via Syslog ○ Discuss TCPWrappers security concepts & applications ○ Enhance Telnetd security with TCPWrappers ○ Confirm XINETD & TCPWrappers security ○ Discuss chattr applications & usage ○ Identify & flag key files as immutable to deter modifcation ○ Confirm extended attributes (XATTRs) ○ Discuss TCPDump applications & usage ○ Configure TCPDump to intercept Telnet & FTP - clear-text traffic ○ Use Ethereal to examine & reconstruct captured clear-text traffic ○ ○ Secure Shell (SSH) & MD5SUM Applications ○ Use Ethereal to examine SSH streams ○ Generate RSA/DSA PKI usage keys ○ Configure Public Key Infrastructure (PKI) based authentication ○ Secure PKI authentication files ○ Use SCP to transfer files securely in non-interactive mode ○ Use SFTP to transfer files securely in interactive mode ○ Configure SSH to support a pseudo-VPN using SSH-Tunnelling ○ Discuss MD5SUM concepts and applications ○ Compare & contrast modified files using MD5SUM ○ Use MD5SUM to verify the integrity of downloaded files ○ ○ GNU Privacy Guard (GPG) - Pretty Good Privacy (PGP) Compatible - PKI ○ Discuss GPG concepts & applications - symmetric/asymmetric encryption ○ Generate asymmetric RSA/DSA GPG/PGP usage keys - for multiple users ○ Create a local web of trust ○ Perform encrypts/decrypts and test data-exchanges ○ Sign encrypted content and verify signatures @ recipient ○ Import & export public keys for usage ○ Use GPG/PGP with Mutt Mail User Agent (MUA) ○ ○ AIDE File Integrity Implementation ○ Discuss file-integrity checker concepts & applications ○ Identify online repository & download AIDE ○ Install AIDE on interesting hosts ○ Configure AIDE to protect key files & directories ○ Alter file system objects and confirm modifications using AIDE ○ Audit the file system using AIDE ○ ○ Rootkits ○ Discuss rootkits concepts & applications ○ Describe privilege elevation techniques ○ Obtain & install T0rnkit - rootkit ○ Identify system changes due to the rootkit ○ Implement T0rnkit with AIDE to identify compromised system objects ○ Implement T0rnkit with chkrootkit to identify rootkits ○ T0rnkit - rootkit - cleanup ○ Implement N-DU rootkit ○ Evaluate system changes ○ ○ Bastille Linux - OS-Hardening ○ Discuss Bastille Linux system hardening capabilities ○ Obtain Bastille Linux & perform a system assessment ○ Install Bastille Linux ○ Evaluate hardened system components ○ top Proxy Security - Module 2 • Squid Proxy Initialization ○ Discuss Squid concepts & applications ○ Discuss DNS application ○ Configure DNS on primary SuSE Linux server for the Squid Proxy environment ○ Confirm DNS environment ○ Start Squid and evaluate default configuration ○ Install Squid Proxy server ○ ○ General Proxy Usage ○ Configure web browser to utilize proxy services ○ Grant permissions to permit local hosts to utilize proxy services ○ Discuss ideal file system layout - partitioning ○ Explore key configuration files ○ Use client to test the performance of proxy services ○ Discuss HIT/MISS logic for serving content ○ Configure proxy support for text-based (lftp/wget/lynx) HTTP clients ○ ○ Squid Proxy Logs ○ Discuss Squid Proxy logging mechanism ○ Identify key log files ○ Discuss & explore the Access log to identify HITS and/or MISSES ○ Discuss & explore the Store log to identify cached content ○ Convert Squid logs to the Common Log Format (CLF) for easy processing ○ Discuss key CLF fields ○ Configure Webalizer to process Squid-CLF logs ○ Revert to Squid Native logs ○ Discuss key Native log fields ○ Configure Webalizer to process Squid Native logs ○ ○ Squid Network Configuration & System Stats ○ Discuss cachemgr.cgi Common Gateway Interface(CGI) script ○ Explore the available metrics provided by cachemgr.cgi ○ Change default Squid Proxy port ○ Modify text/graphical clients and test communications ○ Discuss Safe Ports - usage & applications ○ ○ Squid Access Control Lists (ACLs) ○ Intro to Access Control Lists (ACLs) - syntax ○ Define & test multiple HTTP-based ACLs ○ Define & test ACL lists - to support multiple hosts/subnets ○ Define & test time-based ACLs ○ Nest ACLs to tighten security ○ Implement destination domain based ACLs ○ Exempt destination domains from being cached to ensure content freshness ○ Define & test Anded ACLs ○ Discuss the benefits of Regular Expressions (Regexes) ○ Implement Regular Expressions ACLs to match URL patterns ○ Exempt hosts/subnets from being cached or using the Squid cache ○ Force cache usage ○ Configure enterprise-class Cisco PIX firewall to deny outbound traffic ○ Configure DNS round-robin with multiple Squid Proxy caches for load-balancing ○ Discuss delay pool concepts & applications - bandwidth management ○ Configure delay pools - to support rate-limiting ○ Examine results of various delay pool classes ○ Enforce maximum connections to deter Denial of Service (DoS) attacks ○ Verify maximum connections comply with security policy ○ ○ Squid Proxy Hierarchies ○ Discuss Squid cache hierarchy concepts & applications ○ Ensure communications through a primary cache server - double-auditing ○ Discuss and configure parent-child bypass based on ACLs ○
Load more

Recommended publications
  • Can We Trust Cryptographic Software? Cryptographic Flaws in GNU Privacy Guard V1.2.3
    Can We Trust Cryptographic Software? Cryptographic Flaws in GNU Privacy Guard v1.2.3 Phong Q. Nguyen CNRS/Ecole´ normale sup´erieure D´epartement d’informatique 45 rue d’Ulm, 75230 Paris Cedex 05, France. [email protected] http://www.di.ens.fr/˜pnguyen Abstract. More and more software use cryptography. But how can one know if what is implemented is good cryptography? For proprietary soft- ware, one cannot say much unless one proceeds to reverse-engineering, and history tends to show that bad cryptography is much more frequent than good cryptography there. Open source software thus sounds like a good solution, but the fact that a source code can be read does not imply that it is actually read, especially by cryptography experts. In this paper, we illustrate this point by examining the case of a basic In- ternet application of cryptography: secure email. We analyze parts of thesourcecodeofthelatestversionofGNUPrivacyGuard(GnuPGor GPG), a free open source alternative to the famous PGP software, com- pliant with the OpenPGP standard, and included in most GNU/Linux distributions such as Debian, MandrakeSoft, Red Hat and SuSE. We ob- serve several cryptographic flaws in GPG v1.2.3. The most serious flaw has been present in GPG for almost four years: we show that as soon as one (GPG-generated) ElGamal signature of an arbitrary message is released, one can recover the signer’s private key in less than a second on a PC. As a consequence, ElGamal signatures and the so-called ElGamal sign+encrypt keys have recently been removed from GPG.
    [Show full text]
  • A History of End-To-End Encryption and the Death of PGP
    25/05/2020 A history of end-to-end encryption and the death of PGP Hey! I'm David, a security engineer at the Blockchain team of Facebook (https://facebook.com/), previously a security consultant for the Cryptography Services of NCC Group (https://www.nccgroup.com). I'm also the author of the Real World Cryptography book (https://www.manning.com/books/real-world- cryptography?a_aid=Realworldcrypto&a_bid=ad500e09). This is my blog about cryptography and security and other related topics that I Ûnd interesting. A history of end-to-end encryption and If you don't know where to start, you might want to check these popular the death of PGP articles: posted January 2020 - How did length extension attacks made it 1981 - RFC 788 - Simple Mail Transfer Protocol into SHA-2? (/article/417/how-did-length- extension-attacks-made-it-into-sha-2/) (https://tools.ietf.org/html/rfc788) (SMTP) is published, - Speed and Cryptography the standard for email is born. (/article/468/speed-and-cryptography/) - What is the BLS signature scheme? (/article/472/what-is-the-bls-signature- This is were everything starts, we now have an open peer-to-peer scheme/) protocol that everyone on the internet can use to communicate. - Zero'ing memory, compiler optimizations and memset_s (/article/419/zeroing-memory- compiler-optimizations-and-memset_s/) 1991 - The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations The US government introduces the 1991 Senate Bill 266, (/article/461/the-9-lives-of-bleichenbachers- which attempts to allow "the Government to obtain the cat-new-cache-attacks-on-tls- plain text contents of voice, data, and other implementations/) - How to Backdoor Di¸e-Hellman: quick communications when appropriately authorized by law" explanation (/article/360/how-to-backdoor- from "providers of electronic communications services di¸e-hellman-quick-explanation/) and manufacturers of electronic communications - Tamarin Prover Introduction (/article/404/tamarin-prover-introduction/) service equipment".
    [Show full text]
  • Gnu Privacy Guard (Gnupg) Mini Howto (Italiano)
    Gnu Privacy Guard (GnuPG) Mini Howto (italiano) Brenno J.S.A.A.F. de Winter (inglese) <[email protected]>, Michael Fischer v. Mollard (tedesco) <[email protected]>, Arjen Baart (olandese) <[email protected]>, Cristian Riga- monti (italiano) <[email protected]> Versione 0.1.4 12 maggio 2003 Questo documento spiega come usare GNU Privacy Guard (GnuPG), un sistema di crittografia Open Source e compatibile con OpenPGP. Per mantenere il programma totalmente libero, si `eevitato l’uso di RSA e di altri algoritmi brevettati. Il documento originale `escritto in tedesco da Michael Fischer v. Mollard, questa traduzione italiana, a cura di Cristian Rigamonti, `ebasata sulla traduzione inglese del testo originale. Indice 1 Concetti 2 1.1 Crittografia a chiave pubblica .................................... 2 1.2 Firme digitali ............................................. 2 1.3 Rete di fiducia ............................................ 3 1.4 Limiti alla sicurezza ......................................... 3 2 Installazione 3 2.1 Sorgenti di GnuPG .......................................... 3 2.2 Configurazione ............................................ 4 2.3 Compilazione ............................................. 4 2.4 Installazione .............................................. 5 3 Uso delle chiavi 5 3.1 Creare una chiave ........................................... 5 3.2 Esportare le chiavi .......................................... 6 3.3 Importare le chiavi .......................................... 6 3.4 Revocare una chiave ........................................
    [Show full text]
  • Crypto Projects That Might Not Suck
    Crypto Projects that Might not Suck Steve Weis PrivateCore ! http://bit.ly/CryptoMightNotSuck #CryptoMightNotSuck Today’s Talk ! • Goal was to learn about new projects and who is working on them. ! • Projects marked with ☢ are experimental or are relatively new. ! • Tried to cite project owners or main contributors; sorry for omissions. ! Methodology • Unscientific survey of projects from Twitter and mailing lists ! • Excluded closed source projects & crypto currencies ! • Stats: • 1300 pageviews on submission form • 110 total nominations • 89 unique nominations • 32 mentioned today The People’s Choice • Open Whisper Systems: https://whispersystems.org/ • Moxie Marlinspike (@moxie) & open source community • Acquired by Twitter 2011 ! • TextSecure: Encrypt your texts and chat messages for Android • OTP-like forward security & Axolotl key racheting by @trevp__ • https://github.com/whispersystems/textsecure/ • RedPhone: Secure calling app for Android • ZRTP for key agreement, SRTP for call encryption • https://github.com/whispersystems/redphone/ Honorable Mention • ☢ Networking and Crypto Library (NaCl): http://nacl.cr.yp.to/ • Easy to use, high speed XSalsa20, Poly1305, Curve25519, etc • No dynamic memory allocation or data-dependent branches • DJ Bernstein (@hashbreaker), Tanja Lange (@hyperelliptic), Peter Schwabe (@cryptojedi) ! • ☢ libsodium: https://github.com/jedisct1/libsodium • Portable, cross-compatible NaCL • OpenDNS & Frank Denis (@jedisct1) The Old Standbys • Gnu Privacy Guard (GPG): https://www.gnupg.org/ • OpenSSH: http://www.openssh.com/
    [Show full text]
  • IT Acronyms.Docx
    List of computing and IT abbreviations /.—Slashdot 1GL—First-Generation Programming Language 1NF—First Normal Form 10B2—10BASE-2 10B5—10BASE-5 10B-F—10BASE-F 10B-FB—10BASE-FB 10B-FL—10BASE-FL 10B-FP—10BASE-FP 10B-T—10BASE-T 100B-FX—100BASE-FX 100B-T—100BASE-T 100B-TX—100BASE-TX 100BVG—100BASE-VG 286—Intel 80286 processor 2B1Q—2 Binary 1 Quaternary 2GL—Second-Generation Programming Language 2NF—Second Normal Form 3GL—Third-Generation Programming Language 3NF—Third Normal Form 386—Intel 80386 processor 1 486—Intel 80486 processor 4B5BLF—4 Byte 5 Byte Local Fiber 4GL—Fourth-Generation Programming Language 4NF—Fourth Normal Form 5GL—Fifth-Generation Programming Language 5NF—Fifth Normal Form 6NF—Sixth Normal Form 8B10BLF—8 Byte 10 Byte Local Fiber A AAT—Average Access Time AA—Anti-Aliasing AAA—Authentication Authorization, Accounting AABB—Axis Aligned Bounding Box AAC—Advanced Audio Coding AAL—ATM Adaptation Layer AALC—ATM Adaptation Layer Connection AARP—AppleTalk Address Resolution Protocol ABCL—Actor-Based Concurrent Language ABI—Application Binary Interface ABM—Asynchronous Balanced Mode ABR—Area Border Router ABR—Auto Baud-Rate detection ABR—Available Bitrate 2 ABR—Average Bitrate AC—Acoustic Coupler AC—Alternating Current ACD—Automatic Call Distributor ACE—Advanced Computing Environment ACF NCP—Advanced Communications Function—Network Control Program ACID—Atomicity Consistency Isolation Durability ACK—ACKnowledgement ACK—Amsterdam Compiler Kit ACL—Access Control List ACL—Active Current
    [Show full text]
  • Gnuk — a Free Software USB Token Implementation Niibe Yutaka
    Gnuk — A Free Software USB Token Implementation Niibe Yutaka <[email protected]> What’s Gnuk? Free Software implementation of Cryptographic Token For GNU Privacy Guard Supports OpenPGP card protocol version 2 Runs on STM32 processor Named after NUK® My son used to be with his NUK®, always, everywhere I wish Gnuk Token can be a soother for GnuPG user NUK® is a registered trademark owend by MAPA GmbH, Germany. Cryptographic Token? Stores your Secret Keys Performs security operations on the device Digital signature Authentication Decryption No direct access of Secret Keys How useful? Can bring secret keys securely On the go, you can do: Make digital signature Authenticate yourself Read encrypted mail GNU Privacy Guard (GnuPG) Tool for Privacy by Cryptography Conforms to OpenPGP standard Usage: Digital Signature Encryption/Decryption Authentication Supports "OpenPGP card" OpenPGP card Smartcard to put GnuPG keys Follows OpenPGP protocol standard Features of v2.0: RSA 1024-bit, 2048-bit, 3072-bit Three keys: Sign, Decrypt, Auth Key generation on the card RSA accelerator OpenPGP card Applications GnuPG OpenSSH → gpg-agent TLS/SSL Client authentication Scute (Network Security Service) PAM Poldi Problem to solve Where and how we put our secret keys? On the disk of our PC Encrypted by passphrase Not Secure Enough OpenPGP card Good (portable, secure) Not easily deployed (reader is not common) FSIJ USB Token v1 (2008) Hardware: Built a PCB CPU: Atmel AVR ATmega 328 @20MHz Software: RSA computation routine for AVR RSA 1024-bit About 5sec Data objects
    [Show full text]
  • Gnu Privacy Guard (Gnupg) Mini Howto (English)
    Gnu Privacy Guard (GnuPG) Mini Howto (English) Brenno J.S.A.A.F. de Winter (English) <brenno@dew int er . com> Michael Fischer v. Mollard (German) <f i s cher @math .uni- goettingen. de> Arjen Baart <arj en@andromeda .nl> Version 0.1.4 August 10, 2004 This documents explains how to use the GNU Privacy Guard (GnuPG), an Open Source OpenPGP compatible encryption system To keep this program totally free the use of the RSA algorithm and other patented algorithm has been avoided. The document was originally written by Michael Fischer v. Mollar in German. The text has been translated and adjusted on some points and cannot be considered as a full one-on-one copy. Contents 1 Concepts 2 1.1 Public Key Encryption .............................................................................................................................................. 2 1.2 Digital Signatures ..................................................................................................................................................... 3 1.3 Web of trust .............................................................................................................................................................. 3 1.4 Boundaries to security .............................................................................................................................................. 3 2 Installation 4 2.1 Sources for GnuPG. .................................................................................................................................................
    [Show full text]
  • Final Resourcediscoverysecuritydistrsystems Thesis Linelarsen
    Resource discovery and Security in Distributed systems Resource discovery and Security in Distributed systems by Line Larsen Thesis is partial fulfilment of the degree of Master in Technology in Information and Communication Technology Agder University College Faculty of Engineering and Science Grimstad Norway May 2007 May 2007 – Line Larsen 1 Resource discovery and Security in Distributed systems Abstract To be able to access our files at any time and any where, we need a system or service which is free, has enough storage space and is secure. A centralized system can handle these challenges today, but does not have transparency, openness and scalability like a peer to peer network has. A hybrid system with characteristics from both distributed and centralized topologies is the ideal choice. In this paper I have gone through the basic theory of network topology, protocols and security and explained “search engine”, “Middleware”, “Distributed Hash Table” and the JXTA protocol. I then have briefly examined three existing peer to peer architectures which are “Efficient and Secure Information Sharing in Distributed, collaborative Environments” based on Sandbox and transitive delegation from 1999, pStore: A Secure Peer–to-Peer backup System” based on versioning and file blocks from 2001 and iDIBS from 2006, which is an improved versions of the SourceForge project Distributed Internet Backup System (DIBS) using Luby Transform codes instead of Reed-Solomon codes for error correction when reconstructing data. I have also looked into the security aspects related to using distributed systems for resource discovery and I have suggested a design of a resource discovery architecture which will use JXTA for backup of personal data using Super-peer nodes in a peer to peer architecture.
    [Show full text]
  • Hands-On Assignment
    MIT OpenCourseWare http://ocw.mit.edu 6.033 Computer System Engineering Spring 2009 For information about citing these materials or our Terms of Use, visit: http://ocw.mit.edu/terms. This course makes use ofAthena, MIT's UNIX-based computing environment. OCW does not provide access tothis environment. M.I.T. DEPARTMENT OF EECS 6.033 - Computer System Engineering Crypto Hands-On Assignment Hands-on 6: Cryptography and Certificates This hands-on assignment is due at the beginning of Recitation 23. The goal of this hands-on is to give you an introduction to mathematics and the algorithmic building blocks of moderns cryptographic protocols. Before attempting this hands-on, you should read Chapter 11 of the class notes. Part 1: Big Numbers and Brute-Force Attacks One way to unseal a sealed message is to try every possible key. This kind of attack is known as a brute-force attack or a key search attack. The longer the key, the harder the attack. Keys are almost always represented as blocks of binary data. Some cryptographic transformations use a fixed number of bits, while others allow a variable number. The table below lists some common cryptographic transformations and the key sizes that they use: Cipher Key Size The Data Encryption Standard (DES) 56 bits RC-2 40-1024 bits RC-4 40-1024 bits Advanced Encryption Standard (AES) 128, 192 or 256 bits Although there are many factors that come into play when evaluating the strength of a cryptographic transformation, the length of the key is clearly important. This is because an attacker who is in possession of a sealed message can always mount a brute-force attack.
    [Show full text]
  • Message-Layer Encryption in Ricochet
    Message-Layer Encryption in Ricochet by Liam Kirsh Computer Science Department College of Engineering California Polytechnic State University 2017 Date submitted: 06/07/17 Advisor: Dr. Bruce DeBruhl Table of Contents Background.........................................................................................3 Project Goals.......................................................................................6 Stronger cryptography................................................................................................6 Support for relay nodes..............................................................................................6 Implementation...................................................................................7 Choice of cryptographic protocol...............................................................................7 GPGME cryptographic library...................................................................................8 Modifications to the Ricochet client........................................................................10 Future Improvements........................................................................10 Use of the Signal Protocol in Ricochet....................................................................10 Use of Off-the-Record Messaging in Ricochet........................................................11 Ephemerality in D-H................................................................................................11 Ricochet Relays........................................................................................................11
    [Show full text]
  • Platform-Agnostic End-To-End Encryption for Modern Instant Messaging Platforms
    Platform-Agnostic End-to-End Encryption for Modern Instant Messaging Platforms Mikko Ilmonen [email protected] BSc (Hons), Computer Science, University of Aberdeen, 2020 A dissertation submitted in partial fulfilment of the requirements for the degree of Bachelor of Science (Honours) of the University of Aberdeen. Department of Computing Science 2020 Declaration No portion of the work contained in this document has been submitted in support of an application for a degree or qualification of this or any other university or other institution of learning. All verbatim extracts have been distinguished by quotation marks, and all sources of information have been specifically acknowledged. Signed: Date: 2020 Word Count: 17488 Abstract This dissertation investigates whether it is possible to perform end-to-end encryption over an ar- bitrary Instant Messaging Platform (IM-P), placing no implicit trust in such platform itself. In the current state of the world, people are fragmented across multiple different messaging platforms, alarmingly few of which are completely transparent about the data they collect and the security features they provide. Regardless of whether users trust their platform or not, they can be forced to use them for the simple reason of trying to reach someone they know. The dissertation proposes this implicit trust should not be required in the first place, and users can use additional software to communicate securely with a set of recipients, even if they do not trust the platform they communicate on. While this has already been done in the past with PGP encrypted e-mails transmitted over an unsecure medium, it has never been widely successful either due to the difficulty of setup, decline of e-mail as a messaging platform, or more likely a combination of the two.
    [Show full text]
  • LAB :: PGP (Pretty Good Privacy)
    LAB :: PGP (Pretty Good Privacy) GnuPG : GnuPG forms the heart of Gpg4win – the actual encryption software. Kleopatra : The central certificate administration of Gpg4win, which ensures uniform user navigation for all cryptographic operations. Download Gpg4win (GNU Privacy Guard for Windows) from https://www.gpg4win.org/index.html Install GnuPG & Related application 1. The installation assistant will start and you will see this welcome dialog: 2. Close all programs that are running on your computer and click on [ Next ] 3. The next page displays the licensing agreement – it is only important if you wish to modify or forward Gpg4win. If you only want to use the software, you can do this right away – without reading the license. Click on [ Next ] 4. On the page that contains the selection of components you can decide which programs you want to install. A default selection has already been made for you. You can also install individual components at a later time. Moving your mouse cursor over a component will display a brief description. Another useful feature is the display of required hard drive space for all selected components. Bellow are the application and there fucntion: a. GnuPG: Gnu Privacy Guard b. Kleopatra: Keymanager for OpenPGP c. GPA: GNU Privacy Assistant d. GpgOL: GnuPG for Outlook e. GpgEX: GnuPG Shell Extension f. Claws-Mail: Claws Mail user client g. Gpg4win Compedium: The Gpg4Win documentation Click on [ Next ] 5. The system will suggest a folder for the installation, e.g.: C:\Programme Files (x86)\GNU\GnuPG You can accept the suggestion or select a different folder for installing Gpg4win.
    [Show full text]