Applied cryptography: OpenSSL and GPG
TLS, certificates, key management and common mistakes.
Level 201 · 17 lessons · 15 practice labs
Lessons
Encoding and hashing
- Encodings: Base64, URL, hexadecimal: You learn what Base64, URL and hexadecimal encodings are for and how to recognise and decode them when you see them.
- Encoding is not confidentiality: You will understand that encoding does not hide data, it only changes its form, so it must never be used in place of encryption.
- sha256sum and digests: MD5, SHA-1, SHA-256: You learn what MD5, SHA-1 and SHA-256 digests (hashes) are, which are now considered weak, and why SHA-256 is preferred.
- Integrity with sha256sum: checksum files: You learn to use checksum files to verify that a file you downloaded was neither damaged nor altered.
- Telling which algorithm a hash came from with hashid: You learn to tell from its length and form which algorithm produced a hash, and to notice weak ones.
- Short task: decode the encoded values in a log and say which are really encrypted
OpenSSL
- AES and PBKDF2 with OpenSSL: You will learn to encrypt a file with a password using AES in OpenSSL and understand how PBKDF2 turns the password into a key.
- Generating keys with OpenSSL and the PEM and DER formats
- Signing and verifying files with OpenSSL
- Secure randomness: /dev/urandom and key generation
- Short task: encrypt, sign and verify a configuration file
GPG
- GPG key pairs and encryption: You learn to create a key pair with GPG, share the public key, and encrypt a file for a specific recipient.
- Detached signatures and verification with GPG: You learn to use a detached signature to verify who a file came from and that it has not changed, and to sign files yourself.
- The GPG web of trust, fingerprint checks and key revocation
- Signing Git commits with GPG
- Common cryptography mistakes: You learn to recognise common cryptography mistakes such as hard-coded keys, weak algorithms and poor randomness, and to avoid them in your own designs.
- Capstone: sign, encrypt and verify a backup archive with GPG: In a small task for a fictional company you sign and encrypt a backup archive, then verify and decrypt it on another machine.
Practice labs
- Decode the encoded values in a log: Decode the Base64, URL and hex-encoded values in a lab log and record what each one contains.
- Find an encoded password in a configuration and fix it: Find a Base64-hidden password in the lab configuration, explain why that is no protection and move it to secure storage.
- Prove which value is really encrypted: Sort mixed values from the lab data into encoding, hash and ciphertext and give your reasoning for each.
- Verify the checksum of a downloaded release: Verify the SHA-256 of a package in the lab software repository against the published checksum file and record the result.
- Build a checksum baseline for critical files: Create a hash list of the lab server's configuration files, catch a change against the baseline and report it.
- Find and fix a process that uses a weak hash for integrity: Detect that Pusulaya Sigorta's transfer script uses MD5, switch it to SHA-256 and prove both sides verify.
- Encrypt a configuration file with AES and PBKDF2: Encrypt the lab configuration file with password-based key derivation, note the iteration count and verify by decrypting it.
- Convert and verify key and certificate formats: Identify the PEM and DER files in the lab, convert them to the required format and verify the key matches the certificate.
- Detect a key generated with weak randomness: Find that a lab script uses a time-based source when generating keys, switch it to a secure random source and regenerate.
- Sign a file and verify it: Sign a lab release file with the private key, verify it with the public key and save the output as evidence.
- Catch a configuration whose signature is broken: Verify the signatures of five deployed configuration files, find the altered one and add a check that stops the deployment.
- Encrypt, sign and verify a configuration on the other side: Encrypt and sign Mavikaya Lojistik's branch configuration, then apply steps on the branch server that check the signature before the content.
- Create a GPG key pair and encrypt a file: Create a GPG key pair for the lab, encrypt a file to a recipient's key and show only the recipient can open it.
- Verify fingerprints and sign commits: Verify a teammate's key fingerprint over a second channel, sign your commits in the lab repo and detect an unsigned commit.
- Sign, encrypt and verify a backup archive with GPG: Sign and encrypt Selvikent Belediyesi's lab backup, verify the signature during restore and reject an archive signed with a revoked key.
About this course
TLS, certificates, key management and common mistakes.
What you will learn
- Encoding and hashing
- OpenSSL
- GPG
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.