Key Exchange Problems - Computerphile

Поділитися
Вставка
  • Опубліковано 5 лют 2025
  • Diffie Hellman has a flaw. Dr Mike Pound explains how a man in the middle could be a big problem, unless we factor it in...
    Public Key Cryptography: • Public Key Cryptograph...
    Elliptic Curve Cryptography: Coming Soon!
    / computerphile
    / computer_phile
    This video was filmed and edited by Sean Riley.
    Computer Science at the University of Nottingham: bit.ly/nottsco...
    Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com

КОМЕНТАРІ • 350

  • @NovemberBegin
    @NovemberBegin 7 років тому +100

    I love how he puts so much effort into the diagrams, and then they just make a digital animation for each diagram anyway

  • @daft_punker
    @daft_punker 7 років тому +207

    The man, the legend, Dr. Mike Pound!

  • @hiperalee
    @hiperalee 7 років тому +815

    "Oh yes, I'm Bob!"
    ...
    _But he isn't_

  • @ZombieBestOfficial
    @ZombieBestOfficial 7 років тому +84

    Please keep doing this!

  • @funkynicco
    @funkynicco 7 років тому +309

    RSA key exchange is fully susceptible by man in the middle as well. Sean has a private key and signs the data with its own key. Alice cannot know wether the data was encrypted and signed by Sean (man in the middle) or Bob since the real identity cannot be verified by an external authority. This is why we have certificates. SSL is what websites (HTTPS) are using to implement the whole chain of security features to finally become secure against man in the middle attacks.
    The final step that SSL does ontop of RSA key exchange is to verify the public key with the certificate that server sent to the client upon SSL negotiation, using a global certificate store. In short, certificates themself have to be signed by a certificate authority, which (typically) can only be modified by Windows Updates (for Windows) and alike.
    The certificates for HTTPS include the domain name in it's ServerName property to restrict the usage of the certificate to a particular website. The browser will make sure to verify this.
    I think this should have been mentioned in the video before people run off and use RSA by itself when it really isn't secure against man in the middle (but it is secure against capturing of the data where it is not re-encrypted).
    Side note, SSL includes all above mentioned features (configurable). If you're interested in playing around with this in programming, try out the OpenSSL library.
    Also HTTPS is typically using an SSL library such as OpenSSL. For example, Chrome uses "boringssl" which is a library 'forked' from (based on) OpenSSL.

    • @tubbalcain
      @tubbalcain 5 років тому +4

      Really great comment, I salute you.

    • @windmael47
      @windmael47 4 роки тому +2

      Thank you sir!

    • @aim2986
      @aim2986 4 роки тому

      I think only diffie hellman is also secure against just capturing the data and not re-encrypting.

    • @funkynicco
      @funkynicco 4 роки тому +1

      @YASH TRIVEDI Sorry for an extrodinarily late reply. I meant that RSA is secure against someone merely viewing the encrypted data. The RSA handshake has to be intercepted and new public/private key has to be generated in order to read (and potentially modify) the content. But this is what the certification process prevents.

    • @apall2764
      @apall2764 3 роки тому +1

      Excellent Extension for this video thanks!

  • @chinmayrath8494
    @chinmayrath8494 Рік тому +5

    I love how the host is so attentive and asked the question at the end. I had the same while watching the video

  • @klwthe3rd
    @klwthe3rd 6 років тому +19

    The best part of this video is when the interviewer says, "Diffie Hellman is dead in the water" and Dr. Mike Pound(with the most hilarious expression says, "Diffie Hellman is in REAL TROUBLE HERE!" I couldn't stop laughing and laughing! Awesome video.

    • @baatar
      @baatar 6 років тому +1

      Funny British humor :)

  • @Ribby00
    @Ribby00 7 років тому +72

    Mike Pound is love. Mike Pound is life.

    • @zzzzzz1039
      @zzzzzz1039 3 роки тому +1

      Mike Pounds the keyboard and your mom.

  • @andreicoco2427
    @andreicoco2427 4 роки тому +7

    Mike is absolutely phenomenal! Rarely you see someone so knowledgeable and soooo funny at the same time. To use one of his words - "brilliant"!! :-)

  • @appc23
    @appc23 7 років тому +328

    that thumbnail face tho

    • @kindlin
      @kindlin 7 років тому +20

      Came looking for this comment.

    • @UntouchedWagons
      @UntouchedWagons 7 років тому +20

      He's about to apply his Diffie Helmen key.

    • @appc23
      @appc23 7 років тому +5

      Not ashamed to say i saved it for future reference.

    • @akinoreh
      @akinoreh 7 років тому +7

      00:26 Caught it!

    • @billoddy5637
      @billoddy5637 5 років тому

      Emo Peter in his natural habitat

  • @Michael-vs1mw
    @Michael-vs1mw 7 років тому +233

    * waiting for the elliptic curve cryptography video impatiently *

    • @sheepphic
      @sheepphic 7 років тому +11

      * waiting for the Unbalanced Oil and Vinegar video impatiently *

    • @dansnelling9246
      @dansnelling9246 7 років тому +1

      Yes!!!

    • @vaibhavsingh9x
      @vaibhavsingh9x 7 років тому +5

      lattice cryptography video pls

    • @morgansaville8508
      @morgansaville8508 7 років тому +5

      Yes please do a video on ECDH

    • @durnsidh6483
      @durnsidh6483 7 років тому +1

      A video on PAKE would also be nice.

  • @AustinHarsh
    @AustinHarsh 7 років тому +7

    Not only does RSA hope that your private key doesn't get leaked, it also needs to assume that only Bob can get an RSA key pair for his domain name. Anyways, great video guys!

    • @recklessroges
      @recklessroges 7 років тому

      I create RSA for staff001.vpn.client_company_name_or_any_other_domain_that_I_want. My VPN only trusts my own CA. Create any domain that you like; unless you compromise my CA you are not getting in. (I also my Customer CA signing keys automatically roll on a monthly basis.)

    • @durnsidh6483
      @durnsidh6483 7 років тому

      Reckless Roges Do you offer SRP certificates?

  • @lillllliiill-r3e
    @lillllliiill-r3e 7 років тому +1

    I am taking network security class in college and this video explore a little more in depth of what I have learned so far. Very satisfied all the works from computerphile. :)

  • @Anvilshock
    @Anvilshock 7 років тому +10

    Dr. Conspicuously Inconspicuous Smirk is back!

  • @toniturnwald9890
    @toniturnwald9890 7 років тому +30

    thank you for uploading and have a happy new year. cheerio Toni. PS: I really like all of your films, they are totally informative for me, cheers

  • @richardslater677
    @richardslater677 3 роки тому

    I’ve watched most of this stuff on encryption and I don’t fully understand it, but this chap is brilliant at explaining what is going on plus the pros/cons of each system. Engrossing.

  • @AndreuPinel
    @AndreuPinel 2 роки тому

    I discovered this channel a few days ago and I am already addicted to it... I have watched a dozen of your videos already and I liked each and every single one. All the computerphile team has a gift, I wish I could explain things the way you do.
    One question came to my mind while watching this particular video though:
    After having watched this video it is clear why, even with the server's public key, an extra "final" key is needed (the one that is going to be used to encrypt the requests and the requests and the responses before the transmission) using the DH key "exchange" (I used the quotes because in another video it is very well explained that this key is not really exchanged but generated at both sides equally instead). But the generation of this key has a computing cost at both sides, especially at the server side which needs to generate DH symmetric keys for all clients that are connected to it.
    My question then is: wouldn't it be better that, instead of using DH, the client generated not a random symmetric key - not a good idea in case the server certificate's private key gets compromised, as it is explained in this video - but a random pair of private/public asymmetric keys and sent the public one to the server? (just keys, not certificates, no need to check any certification validity at this level), so the protocol would look something like
    1) client -> hello -> server
    2) server -> certificate with public key -> client
    3) client - checks the certification's validity and, if valid, generates a random pair of private/public keys
    4) client -> client's public key from step 3 encrypted with the server's public key from step 2 -> server
    5) server -> confirmation message encrypted with the server's private key (authenticity layer) + client's public key (confidentiality layer) -> client
    6) client - checks that the message from step 5 can be decrypted (this would confirm that its public key has really reached the server).
    7) client -> data request, encrypted with client's private key in 1st place (authenticity) + server's public key (confidentiality) -> server
    8) server -> requested data, encrypted with server's private key (auth.) and client's public one (conf.) -> client
    The benefit I see in this approach is that the cost of generating "final" asymmetric keys, even though it is going to be probably higher than using the DH process (maybe even higher than twice - the sum of the server's and the client's costs in DH), relies completely on the clients and this would give some rest to the server, which is the one that suffers the most. In case these keys generation part would take "too long" for the client, the keys generation could start asynchronously at the same time that the hello message is sent at step 1, and step 4 would have to wait until the client's keys are completed; of course, only if the server's certificate has been verified... but even if the server's certificate is not valid, that pair of keys could still be used/recycled by the client in a different session/web (even with a different server), so their generation would not be a waste of computing power, and would make the process faster for that other session - this would need a thorough testing by the client's developer to make sure that a pair of random keys is not erroneously flagged as "still-usable" (once assigned to a session, they should NOT be used by another one).
    Maybe this is all madness... but your videos made my imagination fly 😅

  • @IchBinKeinBaum
    @IchBinKeinBaum 7 років тому +174

    1:25 Not calling the attacker Eve. Instant dislike, unfollow and uninstall.

    • @qOvob
      @qOvob 6 років тому +14

      Maybe Mallory instead, Eve is for eavesdroppers.

    • @jeffgyldenbrand9754
      @jeffgyldenbrand9754 6 років тому +14

      or Trudy for intruder :-P

    • @juliavanderkris5156
      @juliavanderkris5156 5 років тому +2

      Or Mal/Mel

    • @macdjord
      @macdjord 4 роки тому +6

      No. Eve is always a _passive eavesdropper_ . The _malicious active attacker_ is Mallory.

    • @Triantalex
      @Triantalex 16 днів тому

      ??

  • @danielgrunberger2621
    @danielgrunberger2621 4 роки тому

    I have been wondering for a long time why we can't just encrypt the symmetric key with RSA and now i finally know the answer!!!!! Thank you :)

  • @ben-q2d
    @ben-q2d 7 років тому +18

    6:00 “Other nefarious people are available” 😂

  • @tomihawk01
    @tomihawk01 7 років тому

    Great video. Understanding these sort of key exchanges and realising how they can be broken by a Man in the Middle attack like this shows just what a huge security problem Superfish was (and probably still is on some computers). If you haven't seen it, look for the Computerphile video with Tom Scott from 2015 called "Man in the Middle Attacks & Superfish".

  • @fahadhussain783
    @fahadhussain783 7 днів тому

    I feel person making video raises very important questions. That solidifies learning.

  • @UntouchedWagons
    @UntouchedWagons 7 років тому

    I didn't understand much of this, but I love listening to Dr. Pound.

  • @lobrundell4264
    @lobrundell4264 7 років тому +3

    Holy moly Dr. Pound is amazingly charming! Especially so when discussing nefarious business! :D

  • @fuatkarakus298
    @fuatkarakus298 4 роки тому

    Clear explanation, I am master student at Turkey, security course lecturer doesn’t provide this explanatory. Thanks

  • @kindlin
    @kindlin 7 років тому +1

    OK, so...
    We use RSA to verify your identity versus a database of public keys, in order use Diffie-Hellman to make a short-lived shared key, all to send a one-time private key for use with AES for the final communication.
    I love it!

  • @altrag
    @altrag 7 років тому +5

    Forgot to mention the necessity of being able to safely share the public key, otherwise Sean could just nab that as well and do the same attack (why yes, I am Bob! You can verify that by checking me against the public key I just sent you!)
    That's where things like certificate authorities come in -- a (hopefully) trusted third party that can retain Bob's public key for him such that he doesn't have to send it to Alice himself and therefore Sean has no chance to inject himself into the conversation.
    Of course, that just punts the problem up a level: How can you trust that Bob's public key actually came from the CA? If Sean is operating at Alice's end of the connection, he could potentially intercept communication to the CA server as well as to Bob. As far as I know (and I might not be entirely accurate here..) this is resolved primarily by your OS and/or browser having a built-in list of trusted CAs (and we just assume that Sean hasn't been able to hack her browser or OS install.. if he had that level of access to Alice's machine, the whole question is moot anyway since he could just install a keylogger or whatever and capture the session directly.) So the CA send Bob's public key and authenticates themselves using their private key.. Alice can then use the CA's public key that she has stored locally to verify them, allowing her to safely retrieve Bob's public key and in turn use that to verify Bob.
    But that means trusting the CA (in the social sense, rather than the computational sense.) There was one big one from China this past year.. maybe 2..? that Google removed from Chrome's trusted list and the other major browsers slowly followed suit, because the CA wasn't acting trustworthy and could have potentially compromised security by double-issuing certificates and back-dating expiry dates and things like that. For the most part though, that's not a huge problem since CAs are basically out of business when the browsers stop trusting them -- meaning they have a huge incentive to play by the rules and those that don't won't matter for long either way.

  • @rikschaaf
    @rikschaaf 7 років тому +77

    But then, how can we verify that the public key is actually Bobs public key? *Insert root certificate explanation here

    • @KuraIthys
      @KuraIthys 7 років тому +11

      Root certificates are a whole other can of worms...
      There's a bunch of problems with it, but it gets kinda complex and I'm not a good person for explaining that...
      The Certificate issuing authorities are the heart of the problem in any event.

    • @0xSafety
      @0xSafety 7 років тому +1

      totally agree. OP should just google "Honest Achmed" to get a explanation to the extend of this mess.

    • @nullptr.
      @nullptr. 7 років тому +6

      Well here's a basic explanation. TLS guarantees the authenticity, Alice will know the key is Bob's public key because Sean cannot sign a certificate tied to his key that will be acknowledged by a certificate authority.

    • @recklessroges
      @recklessroges 7 років тому +5

      NO! Not root certificate rubbish. Much more fun: Key signing parties! (Web of Trust.)

    • @AhsimNreiziev
      @AhsimNreiziev 7 років тому +8

      +Kuralthes +Safety
      Certification Authorities, Root Certification Authorities and the Chain of Trust are not so much a mess, as much as they are simply *flawed* . Rather than rejecting the system outright because it doesn't perfectly defend against *every* conceivable attack, it should instead be a reminder that *NO* security mechanism is completely impervious to attacks -- especially not to attacks involving Human Error.

  • @debroy8648
    @debroy8648 6 років тому +10

    @2:10 "He isn't"
    That look though...XD

  • @novafawks
    @novafawks 7 років тому

    Finally, a computerphile video I actually understand, thanks to my knowledge with PGP

  • @patobrien2329
    @patobrien2329 2 роки тому +1

    lucid and succinct! nicely done!

  • @MaxPicAxe
    @MaxPicAxe 5 років тому

    This series of videos are the best explanations ever thank you so much

  • @Lue_eye77
    @Lue_eye77 3 роки тому

    my professor actually linked this video in the homework and had us watch it and the homework had questions about it

  • @Graanvlok
    @Graanvlok 6 років тому +1

    THANK YOU - this is the info I've been looking for everywhere!

  • @superscatboy
    @superscatboy 7 років тому

    Best. Thumbnail. Ever.

  • @Definitiv33
    @Definitiv33 3 роки тому

    These explanation Videos are superb!
    Now i have some hope, that i can get through my exams :D

  • @xcalibur1523
    @xcalibur1523 4 роки тому +1

    5:38 How did Alice knew what process had to be done with bg to get the same encrypted message which Bob made with his bg? Anyone help!

  • @LuciolaSama
    @LuciolaSama 7 років тому

    Mike Pound fan here, keep it up! :)

  • @231123goku
    @231123goku 2 роки тому

    This is awesome. Best explanation ever

  • @Modenut
    @Modenut 7 років тому

    Aaaah, the new pens are glorious. Thank you.

  • @pnc_luiz
    @pnc_luiz 4 роки тому +2

    If there are no certificates involved (like SSH), this will only work if the first exchange is safe, right? From what I understood, if the first exchange is compromised then the following ones will be too. Can someone please give me some insight?

  • @abhisheksinha9027
    @abhisheksinha9027 3 роки тому

    Eye opener. I was going to use ECDH. Thankfully now I know I should youe ECDH+RSA.

  • @flamencoprof
    @flamencoprof 7 років тому +1

    I'm just glad you people are thinking hard about this, whilst I do my on-line banking on faith alone (so far).

  • @741231478963
    @741231478963 7 років тому +21

    I didn`t get it. What is preventing Sean from acting exactly like Bob in the second scheme?

    • @AustinHarsh
      @AustinHarsh 7 років тому +9

      ¥δΣΩφ Sean does not have Bob's private key. We also assume that only Bob can get Bob's private key for the domain name he is hosting.

    • @togamid
      @togamid 7 років тому +9

      Yes, but couldn't he decrypt the message from Bob with Bob's public key, encrypt it with is own private key and intercept the message where Alice trys to get Bob's public key und send his own instead?

    • @maxweltevrede7745
      @maxweltevrede7745 7 років тому +1

      Ah I see what you mean now, this assumes of course that Sean cannot fake Bob's public key.

    • @hiqwertyhi
      @hiqwertyhi 7 років тому +2

      no, he'd need to have the private key to decrypt, he can't decrypt using the public key

    • @AndrewMeyer
      @AndrewMeyer 7 років тому +5

      * cue explanation of Certificate Authorities *

  • @thomassynths
    @thomassynths 7 років тому +83

    This video sidesteps a very important problem. How do I know I have Bob’s public key? For example, when Alice asks for Bob’s key, Sean can intercept that and send his own key, masquerading as Bob. You only pushed the problem one step down the stairs.

    • @DaRealBzzz
      @DaRealBzzz 7 років тому

      Yeah, noticed that as well. Maybe there's a clever bit that we missed...

    • @sada0101
      @sada0101 7 років тому +49

      Thats where certification authorities come in (i think). Only they can provide them. Essentially, certificates are the public key.

    • @voidvector
      @voidvector 7 років тому +16

      Depends on the implementation.
      * In case of the browser, there is a whole "SSL/TLS certificate" scheme, where the root cert you used to verify is already installed on your computer (by Google, Microsoft, Apple, or Mozilla).
      * In case of SSH, you store the PK from first visit.
      * In case of random apps, they either piggyback off the SSL/TLS certificate system, or just carry their own public key cert with them in the app for verification.

    • @GAoctavio
      @GAoctavio 7 років тому +4

      In the certification, the identification (among other things) is signed by the certfication authoritie, So alice will know she got Sean certificate and not Bobs

    • @sebastianelytron8450
      @sebastianelytron8450 7 років тому +28

      "Pushing the problem one step down the stairs" is what infosec is all about. The more stairs, the better.

  • @danhorus
    @danhorus 6 років тому

    This video is really great. I'm glad I found it

  • @ahmadalwazzan384
    @ahmadalwazzan384 7 років тому +2

    the scenario he explains is when the bob and alice already trust each other (they communicated before and alice knows bobs public key), but what about when a connection is being established for the first time (bob has to give his public key to alice)? is man in middle possible still?

  • @KarthikRao1995
    @KarthikRao1995 2 роки тому

    5:15, still the man in the middle can read the data right ? (not modify, but still read it)

  • @wolfhd7509
    @wolfhd7509 2 роки тому

    I'm glad Dr Pound listens to the 2 serving suggestion on the Pepsi haha

  • @JuraIbis
    @JuraIbis 7 років тому +3

    5:42 if the public key decrypts the message, how is this secure? And how can she know only he can have done that, anyone could have done that. You need a third party that's trusted that handed out both private keys in the first place to know 100% nobody else could have done it.

    • @AustinHarsh
      @AustinHarsh 7 років тому +8

      AvengerXP The RSA public key doesn't encrypt the message, it only signs it. It's meant to prove that the Bob sent the message. You use diffie hellman to provide the encryption.

    • @maxweltevrede7745
      @maxweltevrede7745 7 років тому +3

      This now pushes the same problem forward to: How can Sean not fake Bob's public key by giving his own public key to Alice?

    • @sada0101
      @sada0101 7 років тому

      You should see the other video they showed in the middle.
      The key pair means, one key encrypts the other decrypts. No other key can decrypt the message encrypted by the twin. They share a bond.

    • @JuraIbis
      @JuraIbis 7 років тому

      How do you get both parties to know how to crypt and decrypt without passing it through both parties unencrypted? The problem always remains the same. To me cyphering is impossible without blind trust in a 3rd party. This is probably why RSA on our systems here uses Soft Tokens to challenge the user.

    • @alexanderwikstrom1829
      @alexanderwikstrom1829 7 років тому +3

      The reason for why the public key is used to prove that only Bob could have sent the message is that no other person should have Bob's secret key. Therefor only Bob could have encrypted it. And when Alice encrypts the massage with Bob's public key, then only Bob's secret key decipher it.
      At the same time, nothing stops a man in the middle from playing Bob here too, and give Alice another public key that isn't Bob's public key. RSA has the same inherent flaw as Diffie Hellman.
      But if we were to have a Trusted third party, and this third party's public key is stored on our Computer and has been sent through secure channels, then we can have secure communication to the Third party, and they in turn talk to Bob, and through this ensure that we can setup a secure key that only Bob, Alice, and the third party knows.
      If one is paranoid, one can setup the shared secret with more then one trusted third party, where each party only knows a part of the key and therefor can't read the traffic.
      Do note, the third party is only used to set up a shared secret, then the communication is going directly to the server in a more normal fashion. (But with encryption of curse.)

  • @billy653
    @billy653 7 років тому +175

    I paid £9000 to learn this

    • @Teneban
      @Teneban 7 років тому +79

      I think you paid 9000£ to get a job. I don't think I could get a job in security by saying "I watch UA-cam videos", heh.

    • @ervinzhou8251
      @ervinzhou8251 7 років тому +8

      I paid OVER 9000 :OOOOOOO

    • @nikoerforderlich7108
      @nikoerforderlich7108 7 років тому +3

      +ervin zhou
      Nah, it's EXACTLY NINETHOUSAND!!!!

    • @gemyellow
      @gemyellow 7 років тому +27

      Mike Pound > 9k pound

    • @tgm607
      @tgm607 7 років тому +22

      I paid £9000 to have Mike Pound teach me this at University of Nottingham... well worth it!

  • @lucians6759
    @lucians6759 4 роки тому

    Nicely explained, thanks!

  • @ribalaladeeb8310
    @ribalaladeeb8310 3 роки тому +1

    I genuinely don't understand why use RSA public keys (which themselves have to be certified by a central authentication service) if we could just use a three-pass Diffie-Hellman without the need of a centralized authentication service to certify the RSA public keys in the first place. I'm pretty sure that without the central authentication a man in the middle can do the same thing to RSA public keys as they can with single-pass Diffie-Hellman. But if you could share ephemeral session secrets with 3-pass Diffie-Hellman why not do that. Those ephemeral could be the temporary RSA public keys (or anything else really) right?
    Edit: This is a legitimate question. I am taking an introductory infoSec undergrad course and I want to make sure that I understand DH and RSA correctly before the coming midterm. I appreciate any clarifications

  • @suivzmoi
    @suivzmoi 7 років тому +5

    we need a video on the Intel #Meltdown bug pronto

  • @jovan88
    @jovan88 7 років тому

    excellent video, are you going to do one on public key infrastructure to show how certificates are trusted, and how it ties into RSA?

  • @SouMorse
    @SouMorse 3 місяці тому

    The actual problem with using RSA for encryption of large amounts of information, like webpages and files instead of just key hashes, is that the larger the amount of information, the longer the calculation takes, so it's not efficient. Assymmetric encryption algorithms can take up to 2000x longer than symmetric encryption to encrypt and decrypt

  • @CrashM85
    @CrashM85 7 років тому

    Thank you for answering my question!

  • @DrPolarbear
    @DrPolarbear 7 років тому +1

    My name is Sean and I feel personally attacked. lmao

  • @FreedomForKashmir
    @FreedomForKashmir Рік тому

    I have a question ..... is 'g' same in both cases (Alice and Bob) or it can be different for both.
    How is 'g' and 'n' selected/shared before everything?

  • @KrzysztofWolny
    @KrzysztofWolny 7 років тому

    How RSA is preventing from MITM? MITM is not only about changing a message but also about reading it. So in presented scenario Shaun can still reads what Bob is sending to Alice and vice versa, as Bob in only signing a message, not encrypting it.

  • @telotawa
    @telotawa 7 років тому +4

    Meltdown and Spectre soon pls

  • @KhalilEstell
    @KhalilEstell 7 років тому

    Loved this video!

  • @Charliepinman
    @Charliepinman 7 років тому

    i think it needs more details? because people will assume that as long as you are the man in the middle at the start! you can still decrypt and get all the messages and just pretend to be bob, you couldnt jump in half way through for sure with this explanation, but you forgot to mention that certificate authorities give pre installed keys to peoples computers so that the initial handshake doesnt get hijacked. that is explained in a previous video as i remember

  • @pragtimehta4981
    @pragtimehta4981 3 роки тому

    Can someone please explain how does a key exchange take place in case of DES / AES algorithm or in that matter any symmetric key algorithm? By the way excellent videos!!

  • @seanc6128
    @seanc6128 7 років тому

    Thanks for spelling "Sean" correctly.

  • @srome0711
    @srome0711 7 років тому +6

    Do the Spectre CPU flaw!

  • @stitchvideos
    @stitchvideos 7 років тому

    Hi, i love ur videos :)
    Could you do Kerberos including weaknesses?

  • @charan_75
    @charan_75 2 роки тому

    As far as I understand
    Server sends the G, N and G^random signed with servers private key and sends along with the server certificate to client, once the client verifies the authenticity using PKI and he will send his G^random and encrypts this using servers public key. Thus they will both arrive at the shared secret key using DH with RSA. These keys are ephemeral, i.e a new key pair is generated for every new session with the server.

  • @majeddaas
    @majeddaas 4 роки тому

    I was waiting him to talk about certificate authorities to authenticate the public key of bob.. the video ended and I'm still waiting 🤣🤣🤣

  • @martijnjonkers8261
    @martijnjonkers8261 3 роки тому

    If I already have a pre-shared public key of bob and know for sure that it belongs to the private key of bob. Is DH enough to authenticate the server? I think the key exchange will always fail to produce the same value when there is someone else pretending to be bob. Right?

  • @shadow_rune6178
    @shadow_rune6178 4 роки тому

    I watch this because it lets me pretend I'm studying for Security+ while being entertained

  • @rekarrkr5109
    @rekarrkr5109 2 роки тому

    am i missing something? , for me RSA and DH(diffie hellman) could be used for the same thing ,why cant we share g to the b as a public key on the certificate, the problem of authentication is a totally different problem and these two algorithms both establish a secure channel , to know the other end u need certificate in a tree signed by root certificate that is embedded in browser or OS , also we could use RSA two time upon each other each time generating a new inner key pair, (i assume maybe DH is more performant and RSA more secure is the only cause ?, if so it should have been mentioned as such ,if not could someone correct me?)

  • @martinisbutik
    @martinisbutik 7 років тому +38

    Shaun? What happened to Eve? :)

    • @pierreabbat6157
      @pierreabbat6157 7 років тому +11

      I thought he was called Mallory. Eve can only eavesdrop; she can't alter messages or create new ones.

    •  7 років тому +5

      Lately, Eve got real stealthy and now controls both endpoints.

  • @Hans-jc1ju
    @Hans-jc1ju 7 років тому

    But does that not assume, that A knows B’s public key? So if it is not shared on a piece of paper, can’t Sean just MITM the public key exchange? Is there any way of fixing that without something like SSL/TLS?

  • @sada0101
    @sada0101 7 років тому

    Is the ephemeral key deleted from the server once its use is over?
    Like every day or so? (Or per session)
    If it is stored, it leads back to the same problem of using RSA key. If someone could break in to the server, they have got the keys (RSA AND ephemeral) and if they had stored the encrypted communication between client and server, security breaks down.

  • @dennisthegamer2376
    @dennisthegamer2376 6 років тому

    But if you can encrypt a message using the public key of someone else, and only they can decrypt it using their private key. Why would you still need a shared secret? Is it because after some time people can figure out the private key to your public key?

  • @PvblivsAelivs
    @PvblivsAelivs 6 років тому +8

    Strictly speaking, it's not RSA that rescues it, but A's existing knowledge of B's public key. Otherwise, the network can step in and say "I''m the server you requested, and this is my public key," and you have gotten nowhere. Usually, it is some certificate authority that is built into the browser. But the point is there needs to be a public key that the man in the middle can't lie about.

  • @RubenatorXY
    @RubenatorXY 7 років тому

    We need a video on speculative execution!

  • @dedbit6723
    @dedbit6723 7 років тому +1

    The digital signature doesn't stop the man-in-the-middle attack because the attacker can gain access to the public key for decryption. I mean both Alice and Bob can realize that their communication have been intercepted but if Bob in that scenario sends something important right from the very start, that's basically it

    • @kinslayer202
      @kinslayer202 7 років тому

      The public key is not to keep the message secret, it is only to show that Bob sent the message that says it came from Bob. Only he can sign the message with his private key, so any message that is de-signable with his public key definitely came from him. A man in the middle can learn what (g^a)%n and (g^b)%n are, but as we learned in the other videos, that isn't enough to decrypt the traffic

  • @CarlTSpeak
    @CarlTSpeak 6 років тому

    That is a genuinely terrifying thumbnail.

  • @sebastianmalton5967
    @sebastianmalton5967 7 років тому +1

    How does using RSA prevent Sean from spoofing Alice's request to get Bob's public key. Couldn't he not block that and send his own?

  • @SkinnyCow.
    @SkinnyCow. 6 років тому +1

    been wearing that same sweater in the last 3 videos bro!

    • @baatar
      @baatar 6 років тому

      Nothing wrong with having a video sweater.

  • @jeremyahagan
    @jeremyahagan 7 років тому

    I read somewhere long ago that not only was bulk encryption of data using RSA inefficient, but that there was issues with encrypting anything longer than the private key. I can't find where I read this, but could someone please explain this?

  • @Jure1234567
    @Jure1234567 5 років тому

    What do you think of this scheme: say a user wants to request from a website a page with url /pages/index.php. His browser prepares two requests forbthevserver and hashes the second request that it plans to send to the server later and saves the first two bytes of the hash result. Then the user's browser generates such ECDH key pair that the public one contains in any part of it the same two consecutive bytes as the hash's first two bytes by repeatedly recreating the key pairs. After that the public keys are negotiated with the remote server and the ECDH secret is calculated. And the second thing sent to the server is say an URL request (say get or post). As the server receives that request, it calculates the hash of the URL request it just received then gets the first two bytes of it and checks whether the public key which the server "thinks" belongs to the real user, actually contains those two consecutive hash bytes in it. The man in the middle attacker won't be able to prepare for the server such ECDH public key that would 100% contain that particular two byte sequence of the future request hash. Well, maybe not two bytes exactly, but one byte and say few bits to make calculations faster, it is even possible to set bit sequence in public keys instead of byte sequence and search for the sequence starting from any bit in the public key. And URL request is just a sample: of cause it can be any type of the second request the client plans to send to the server after establishing the encrypted link. We don't use the first request here to prevent the man in the middle from delaying server request until the first request is sent, as he could create proper keys after he gets the first request from the client.

  • @EpicWink
    @EpicWink 7 років тому

    Did you cover how the public key is distributed in the first place? How do we verify a public is not one just sent from Sean?

  • @fahoudey
    @fahoudey 7 років тому

    I have a stupid question.. so bare with me please
    You sayed that the server bob sign his 'gb' calculation with his private key.
    Does that mean he encrypt it with his private key just like what the public key can do ?!
    Im confused

    • @kinslayer202
      @kinslayer202 7 років тому

      Bob's public and private keys work as a pair. Whatever one encrypts, the other can decrypt, and vice versa. However, if you encrypt a message with the public key the result will look different than the same message encrypted with the private key. Therefore it is clear that when a message can be decrypted with someone's public key, it must have been signed with their private key, which means it has to have come from them

  • @adedejiemmanuel1
    @adedejiemmanuel1 5 років тому

    This is beautiful.

  • @bastawa
    @bastawa 7 років тому

    Awesome video!!! Thanks

  • @yash1152
    @yash1152 Рік тому

    1:09 g ^ a becomes ag is animation
    whattt?

  • @jaabel249
    @jaabel249 4 роки тому

    5:53 I dont understand how this stops a MITM atk if Bob's public key is public.

    • @qwerty.760
      @qwerty.760 4 роки тому

      The attacker can only decrypt using bob's public key , he cant change the contents and encrypt it again using bob's private key since it is only with bob. and for man in the middle attack, the attacker needs to change te content and encrypt it again.

  • @EverythingRox
    @EverythingRox 3 роки тому +1

    What a legend!

  • @armouredheart5389
    @armouredheart5389 7 років тому

    I have a few questions.
    If a Private Key can only be decrypted by a Public Key, and the example the Public Key is freely available, what is to stop a third party "Sean" from using the Public Key to unlock Bob's message?
    The only way RSA seems to work is if Alice is the only one who knows Bob's Public Key, in which case how does Alice get the key in the first place short of Bob physically giving her a note with the code on it?
    Please correct me if I am wrong.

    • @KapitanWasTaken
      @KapitanWasTaken 6 років тому

      When signing a message to confirm it's authenticity Private Key is used to encode message and Public Key is used to decode message (only owner can sign message but everyone can confirm it).
      The situation is different when you want to encode messages to hide their contents. Then Public Key is used to encode message and Private Key is used to decode said message (everyone can encode but only owner can decode).
      Of course both sets of keys should be different.

  • @TheCort3z
    @TheCort3z 7 років тому

    @Computerphile Why can't the same exact mechanism be used in public-private key encryption, as with the Diffie Hellman? Couldn't Sean make his own private and public keys, pretend that this key is the public key provided by Alice and Bob, and re-encrypt the content using their actual keys?

  • @pato9825
    @pato9825 7 років тому

    Hi, first of all thanks for these videos about encryption. As a programmer I often hear that I shouldn't create my own encryption protocol and use something like TLS, now I see why :D so after seeing this I have one question. How can one establish safe connection in decentralized p2p network where is no CA for RSA key-pair creation? It would be nice to have a video on this topic :)

  • @minxythemerciless
    @minxythemerciless 7 років тому +1

    What's to stop Sean doing the same man-in the middle attack on the private/public keys? It would require an out-of-band secure communication for Alice and Bob to know the true public key of each other.

  • @okbazoueghui6590
    @okbazoueghui6590 6 років тому

    thank you very much the video is really helpful

  • @DDranks
    @DDranks 7 років тому

    Now, since the basics are done, the only thing left is to talk about the SSL and Certiciface Authories and the delegation chain, right?

  • @dannyniu4268
    @dannyniu4268 7 років тому

    Please talk about Post-Quantum Cryptography!

  • @isaacng123456789
    @isaacng123456789 7 років тому

    I think there is an error in the animation. When Alice generate a key a, she debts out g^a, not g*a. And when bob send message back to Alice, bob debts out g^(ab) not g*a*b.

  • @PeregrineBF
    @PeregrineBF 7 років тому

    I feel like these videos gloss over too many of the important issues with RSA - Padding and the need to use different keys for signing and encryption being the biggest ones. A video on Bleichenbacher's Oracle would be a good thing.
    Also RSA is very slow compared to EdDSA or even ECDSA. Since we're not directly encrypting messages and just using it for signing there's not much reason to use it outside of backwards compatibility with very old devices. If you're building a new system use Ed25519 or Ed448 via Libhydrogen or Libsodium.