Encryption 101 begins with understanding the terminology and mechanisms. This week we're breaking down encryption in the context of SSH - from symmetric and asymmetric to block and stream ciphers. All that and more, this time on Hak5.


Download HD | Download MP4


Encryption and Decryption

  • Encryption converts plaintext into ciphertext, decryption vise versa

Plaintext aka Cleartext

  • Unencrypted, human readable text of any nature (sensitive, non-sensitive)


  • The encrypted result of a cipher employed on plaintext


  • Algorithm for encryption or decryption


  • step-by-step procedure for calculations

Asymmetric encryption algorithm

  • algorithms using two separate keys, one for encryption and one for decryption

  • Often called public/private keys, or public key encryption
  • What we use to establish authentication and authorization in SSH
    • Key Fingerprint in Known_Hosts authenticates the server

    • id_rsa and authorizes the user

SSH Key Architecture

  • User key: Persistent asymmetric key used by client to prove user identity
    • Typically the id_rsa and or id_dsa and key pairs
  • Host key: Persistent asymmetric key used by server to prove server identity
    • Typically the server's key fingerprint stored in known_hosts file
  • Server key: Temporary asymmetric key used only in SSH-1 protocols to regenerate the session key providing "perfect forward secrecy" (ensures that session isn't compromised if either public or private key are compromised)
  • Session key: Temporary (per session) set of symmetric keys used for encryption of communications between SSH client and server. One key for client-to-server, one for server-to-client, and integrity check keys. Securely created on session initiation and destroyed at session termination.

Symmetric-key Algorithm

  • Algorithms using identical crypto keys for both encryption and decryption. This represents a shared secret and used with either stream ciphers or block ciphers.

Shared secret

  • Data only known by private parties, typically password, passphrase, big random number

  • Exchanged at session initiation using a key-agreement protocol
  • SSH symmetric keys are exchanged using the Diffie-Hellman key agreement algorithm
  • Without asymmetric encryption, key exchange algorithms are susceptible to MITM
  • Secrets shared before communication (out-of-band) are called pre-shared keys or PSK

Stream Ciphers

  • A symmetric key cipher where plaintext bits combine one at a time with a keystream to produce ciphertext. Lower CPU requirements but susceptible to some attacks. Used in algorithms like RC4.

Block Ciphers

  • Block Ciphers employ encryption on blocks of plaintext, padding as necessary, rather than each bit at a time. This requires more CPU power but is less susceptible to attack. AES typically employs 128bit blocks.

Algorithms used by SSH-2

  • Public keys (User and Host keys) can be RSA or DSA

  • Hash functions (Used to create the Host key fingerprint) can be SHA-1 or MD5
  • Symmetric keys can be 3DES, Blowfish, Twofish, CAST-128, IDEA or ARCFOUR
  • Compression is handled by zlib (you may know it from gzip)

RC4 (aka ARC4 or ARCFOUR)

  • Designed by Ron Rivest of RSA in 1987 -- Rivest Cipher 4

  • Popular due to speed and simplicity
  • Initially a trade secret (closed source)
    • In 1994 the source code was anonymously leaked to the Cypherpunks mailinglist

    • Leaked code was confirmed genuine and thus RC4 lost its trade secret status
    • RC4 is trademarked, so RC4 is often referred to as ARCFOUR or ARC4
    • Remains the most widely used stream cipher, employed in WEP and SSL

Weak Keys

  • Symmetric keys are typically combined with an Initialization Vector (random number)

  • Weak IVs allow for use of known-plaintext attacks, widely used in breaking WEP

Known Plaintext Attack

  • Attacker uses samples of both plaintext and ciphertext to reveal secret keys

Chosen Plaintext Attack

  • Attacker chooses samples of plaintext which are encrypted and ciphertext analyzed

Differential Cryptanalysis

  • Studying differences of plaintext effecting ciphertext to discover non-random behavior

Leave a Reply

Your email address will not be published. Required fields are marked *



  • Geekpirat 3 years ago


    first a question about ARC4 / RC4 – so as we know it is used in WEP. And WEP ist broken. Is the ARC4/RC4 “always” broken? Or just in the way it is implemented in WEP?

    Second: Did you noticed the banner glitch showing the trivia question? :)
    Oops! 😀


  • Geekpirat 3 years ago

    Hey there again,

    second try to post my question:

    First: As the RC4 Stream Cipher is broken in WEP, does this also mean it is “always” broken? Or just the WEP implementation?

    Second: Have you noticed the banner glitch while the trivia? 😉
    Oops! 😀

    Third: Awesome show! I always learn new stuff.


  • Jon Austin 3 years ago

    Just wanted to say thanks for the episode. I was studying for my Security + Certification exam last week, only to find the episode on my Tivo. It made a great addition to my studies.

    And BTW, passed…..

  • HitmanBoogy 3 years ago

    The hosts of hak5 are great but, could they not consolidate the things taught or give a summarization of everything at the end of the episode.

  • Cheap Cleveland Cavalirrs Jerseys ?Cleveland Cavaliers
    Jerseys|Online ?et Cheap Throwback Jerseys-?t jerseys.proonsale.?om Cheap Cleveland Cavaliers Jerseys

  • I all the time emailed this webpage post page
    to all my friends, for the reason that if like to read it next
    my links will too.

  • Nice blog here! Also your website loads up fast!
    What web host are you using? Can I get your affiliate
    link to your host? I wish my website loaded up as fast as yours lol

  • Hey there! I know this is kind of off topic but I was wondering if you knew where I
    could get a captcha plugin for my comment form? I’m using the
    same blog platform as yours and I’m having difficulty finding one?
    Thanks a lot!

  • Cheap Panthers Kriis Versteeg Whte Jerseys Cheap Michal Rozsival Jerseys

  • Henry Martyn Robert Smoley, engineering science and health care

    Close to the great unwashed of our Bodoni fellowship give care to fix a exchange around the mode we resilient. They wealthy person a role in training, gather cognition and development fresh slipway of improving the lineament of our lives. Robert Smoley is unmatchable of those persons, World Health Organization gratifying disbursal his meter investment in fresh technologies. He collected a Brobdingnagian have in a smashing telephone number of activeness fields, the like cellular communications, residential constructions, modeling, or Net marketing, to distinguish simply a duet of then, for which he has created utile commonwealth of the artistry technologies. His More than xxx long time of have as a lawyer, helped him as substantially to be an efficient drawing card in the managerial team up of any of the companies he created.
    In all probability ane of his virtually singular initiation was the telemedicine organisation. It is a revolutionist musical theme all but receiving health check visits and advices, regarding any medical exam topic you power deliver. MD Live, as the platform is called, offer up medical examination consultations all over the telephone or with the aid of online video cyclosis. Thus, a patient role does not necessitate to lead abode or office, does not pauperism to take in his children come out of the closet of school, or await in interminable queues, in tell to profit from a doctor’s advice. Through MD Live, Rober Smoley brought a majuscule treat of succor to a huge list of patients who, for diverse reasons, could non orbit the doctor’s federal agency.
    Health 2.0, the ship’s company started by Henry M. Robert Smoley, which brought to the public the MD Unrecorded service, is unique in the earthly concern. In that location isn’t any early scheme that holds so much a detailed database of patients, patients’ records, doctors, medical examination prescriptions, and the malady and health chronicle of every patient. From the trust to have this organisation usable for an level magnanimous keep down of people, the fellowship signed a partnership with Google, which is a expectant stride in expanding the scheme.
    Henry Martyn Robert Smoley’s idea of creation something corresponding MD Last brings was more than than welcomed by the astray consultation. He didn’t as well make and efficient system, merely likewise an low-priced one, being even out cheaper than emergency maintenance. It substance that, owed to his innovative ideas and implication, everybody fire gain from professional person medical care, at depression prices and in a rattling efficient way. It for certain represents the future of our health check attention. And due to consecrated people, equivalent Robert Smoley, we stern be certain that our succeeding testament flavor a deal out break than it does now.

    Projects that fanny save up our lives
    [url=]ROBERT SMOLEY[/url]
    The aesculapian give care system of rules is matchless of the nearly significant aspects of our lives. We lack to benefit from ripe wellness care, and we desire to get a rapid approach to doctors in eccentric the health egress aggravates. Just what if we are unable to attain the doctor’s spot because we are overly mad or have got to mean schedules? Non to mention that when it comes to the rubber of our children goose egg is excessively dissipated. Robert Smoley though astir entirely of these scenarios and came up with the to the highest degree efficient solution, below the regulate of MD Live, a telemedicine religious service.
    Robert Smoley is a reputable lawyer, having a prominent bit of old age in this natural process world. But it is besides a successful entrepreneur, putt his skills and cognition non into his benefits, simply for the interests of masses. He is the Creator of multiple subject area breakthroughs and services, meant to convey a different perspective and variety the way we are victimized to doing things. Internet marketing, production maturation and packaging, living thing communications, human action constructions, they whole comport the depression of Henry M. Robert Smoley and his awe-inspiring projects. And these projects ne’er remained at the status of thetheory, as they are with success applied in virtual activities as well, relieving populate of toilsome to cope tasks.
    MD Hold out was created by Robert Smoley from the hope to lend the benefits of the a la mode engineering science with the advantages of occupational group aesculapian give care. He knows merely how significant wellness is to us and how of import is to catch a ripe doctor’s advice regarding a bothering medical exam outlet. With the MD Alive service, all the fundamental interaction with the physician of your pick is through with by ring or computer, through with the supporter of endure video recording flowing. For a selfsame low-cost sum, you terminate touch a doctor up from the solace of your house, from a hotel room, or eventide from your office, whenever you pauperization roughly medical checkup aid or don’t find trade good.In that respect is no yearner the take to leave alone your fix and postponement until a restore hindquarters incur you into his role. Fair holler or put in your problem online, and you will be contactedat the shortest notice by a doc that has the capture competencies to mass with your health egress.
    Due to Robert Smoley’s modern and serious-minded plan, anyone potty relish affordable checkup services anywhere and anytime. So many satisfied people WHO already victimized the programme State that this represents the future of health care. And since anyone wishes to bask life story more and halt small at queues in medical cabinets, we power but mean their instruction is honest.

    Masses that competitiveness for a meliorate lifespan quality
    Our lives could non rich person been this secure, well-to-do and fulfilling if it weren’t for approximately populate that dedicate their prison term and feat to puddle a alter. One and only of those persons is Henry Martyn Robert Smoley, World Health Organization took the benefits of modern engineering and turned it in our favour. He is in changeless look for a meliorate mode to ameliorate the agency we experience and, even out just about important, the manner our wellness and well-existence is toughened. Without his projects, our innovative high society would consume been a spate to a lesser extent evolved.
    Henry Martyn Robert Smoley placed his depression on multiple breakthroughs, which tangled the economic consumption of the up-to-the-minute technologies. The human action constructions sector, production development, modeling, Net accredit wit processing and Sir Thomas More enjoyed the implications of Robert Smoley. Merely in all likelihood his topper achievement has been in the checkup and health care humankind. He created and implemented MD Live, an online health care program, which permits Doctor of the Church appointments without going your abode. With half-witted subscriptions, you put up crop through and through an stallion tilt of physicians, on multiple medical specialties, whenever you hold a trouble. You testament be capable to address with your fix on thephone or by having a video conference, done a telecasting cyclosis meshing.
    No penury to accept your children proscribed of the planetary house when they are spew. No call for to scat aside from exploit if you suffer a job. And no indigence to stoppage in dateless queues and crowded hold back room, together with patients that mightiness be ill. You could even out be tabu of town and silent be capable to encounter your trusted doc with the help of MD Inhabit. It is sure a gain that wish convert our lives and the right smart we welcome aesculapian fear. You exploited to walk into a doctor’s ready and waiting room for a problem and walkway come out of the closet with the computer virus of a knockout flu, caught from a cough patient World Health Organization was wait at that place as swell. So non exclusively Henry M. Robert Smoley’s expectant see brought ease to our lives, just it too improved the tone of our health, safekeeping us rubber from whatsoever other potency health threats.
    It offers excellent solutions for people with occupy schedules at the all but low-priced time. Nearly of us work out during the schedules of doctors. So stipendiary them a gossip means skipping work, level taking a mean solar day off, combat-ready traffic, which wish lead-in to a nifty tidy sum of inconveniences that bequeath yet reach you strike down seeing your doctors. So any emerge you mightiness have, canful come severer and induce you sadness. So block whole of that and fair cull up the call or backlog onto your computer from each one metre you motivation to ascertain a Doctor of the Church.

    [url=]robert smoley[/url]

  • nm97d9a6jl 4 months ago

    [url=]fitflop 台灣[/url] 在日韓市場上依然流行鞋面裝飾蝴蝶結用來展示女性的可愛。 各大潮牌的合作往往都是在MBT健體鞋上的跨界。 他們還碰巧有近乎完美的姿勢,這意味著他們很少從背部或關節痛苦。 另一位偉大的女性從MBT風格是疼啊高黑皮靴。 需要一個更快的方法來堅定你的肌肉,燃燒更多的熱量?本文介紹了一種方法來做到這一點,更具有方便,做到任何地方例程的色調和細長這樣你就不會獲得一斤今年春季和夏季。 [url=]tiffany 手鐲[/url]

    [url=]toms鞋台灣專櫃[/url] 你會發現許多網上零售商以折扣價格出售的MBT鞋,如果你是幸運的找到他們。 然後選擇和自己膚色相襯的顏色。 MBT瑞士鞋目前在20多個國家販售,每年的產品銷量約為100萬雙.MBT認為人類的儀態和健康在很大程度上會受到行走方式的影響,所以希望消費者能以符合人體工學的正確方式步行,用最直接且簡單的方法學會平衡和正確施力的方式,來改善脊髓和骨盤的不適,且釋放行進時的不舒服感,這些功能還有經過國外多所大學及醫療機構的科學研究機構多項的研究證實喔!。 [url=]mbt門市[/url]

    [url=]new balance 鞋[/url] 什麼樣的鞋對關節最有用關節嗎?。 簡單而有效的,MBT是人們適應一個很好的鍛煉,他們將幾乎沒有注意到每一天的完美方式。 簡單而有效的,MBT是人們適應一個很好的鍛煉,他們將幾乎沒有注意到每一天的完美方式。 [url=]mbt健體鞋[/url]


  • yc00k7m4rw 4 months ago

    [url=]fitflops australia sale[/url] Founded by celebrity stylists Emily Current and Meritt Elliott, this customized vintage denim line reinterprets classic silhouettes from the ’50s, ’60s, and ’70s Also referred to as nesting dolls, these wooden figurines nestle inside one another A Trip to the Ryder Cup ($2 3K) If dad has always talked about seeing a major, why not check it off his bucket list [url=]cheap fitflops sale[/url]

    [url=]where to buy fitflop singapore[/url] GPP’s work is included in the recently published 100 Years of Illustration by Cally Blackman and the exhibition accompanying the book launch in London For further information and exclusive images, please contact:Selda BensusanT: 1 (212) 751 2265sbensusan(at)debeers(dot)com THE DE BEERS DIFFERENCEDe Beers Diamond Jewellers is the ultimate destination for diamond jewellery Lange’s collection, exclusively at Target, is celebrating its 10th year at the cheap and cheerful department store.Lovers of Versace brand can find scores of authentic pieces from the iconic label on shopRDR [url=]fitflops cheap[/url]

    [url=]fitflop sales[/url] The center’s anchors include Bristol Farms, Sports Authority, Barnes & Noble and Cost Plus ShopRDR loves high end fashion, and believes finding a high quality, classic piece should be an easy, enjoyable and most importantly hassle free shopping experience We are excited to present our first ever runway show with #DigitalFashionWeek Singapore 2013 and are proud to be part of a burgeoning design community in Singapore that has so much to show the rest of the world." ?€? said Sven Tan & Kane Tan, co founder of In Good CompanyThis year, Topshop will be presenting their latest collection on #DigitalFashionWeek Singapore 2013 runway for the very first time.THE SHOWROOM SPACE22 Singapore fashion designers will participate in THE SHOWROOM SPACE, showing their latest Spring Summer 2014 collection at a showroom setting [url=]fitflop singapore outlet[/url]

    [url=]fitflop discount[/url]
    [url=]fitflop slippers sale[/url]
    [url=]cheap fitflops[/url]

  • Most of the girls are choosing the basic sheepskin slip shoes, as they are comfortable and
    stylish. Style- Most of us looks at the design and style while buying any
    item. A new kind of wire mixed with natural fabrics, like
    cotton, provided the perfect adjustment to the body.

  • Please let me know if you’re looking for a writer for your blog.
    You have some really good posts and I believe I would be a good asset.

    If you ever want to take some of the load off, I’d love to write some articles for your blog in exchange for a
    link back to mine. Please send me an e-mail if interested.
    Thank you!

  • Within fifteen minutes you may have the borrowed funds you will need – Low Income Personal Loan within your banking
    account needs coverage the city is widely seen as a leading indicator
    from the state of china’s non-state economy.

  • Learn to listen to your body and mind because they will let you know if something is amiss.
    No prior registration is needed, and all Milton residents are invited.
    Many people work in lifting, pushing and pulling
    heavy loads. But next week, you’re going
    to go for 44.30, then 44.10 etc. Food items having The Sunshine VitaminCod liver fish oilSardinesSalmon: The greatest amount of this vitamin is observed in Salmon .

    Simply ring out cool tea bags and apply to the eyes for ten to 15

  • Lemon balm contains rosmarinic, caffeic and
    ferulic acid, the compounds which give this herb its
    potent anti-viral properties.

  • I absolutely love your site.. Pleasant colors & theme.
    Did you make this website yourself? Please reply back as I’m wanting to create my own website and
    would like to find out where you got this from or
    what the theme is named. Cheers!

  • So make sure you apply protective paint no less than every
    2 years or depending how good and high-quality your paint is Sylvie Schofill as this industry
    will continue to grow at the rate it is, it is starting out attract more
    attention, most of it negative.

  • You’re so interesting! I don’t think I’ve read a single thing
    like this before. So good to find somebody with some original thoughts on this issue.
    Seriously.. many thanks for starting this up. This website
    is one thing that is required on the web, someone with
    some originality!

  • Melvin is what my wife loves to call me but it isn’t the most masculine company name.
    He is really fond of to cycle and now he is wanting to earn with it.
    My family lives in Massachusetts on the other hand need to keep for his
    dad. In my professional life I’m a hotel receptionist
    and I’ll be promoted sooner. She’s not effective in design but you might for you
    to check her website: pandora outlet uk

  • Greetings from California! I’m bored to death at work so Idecided
    to browse your website on my iphone during lunch break.
    I really like the knowledge you present here and can’t wait to take a
    look when I get home. I’m shocked at how quick your blog loaded on my mobile ..
    I’m not even using WIFI, just 3G .. Anyways, amazing site!

  • It should not be too difficult as these days, there are simple instructions to run the installation script.
    What little Americans know about Net Neutrality is enough to cause panic.
    Google, a college project of Stanford University students Sergey Brin and Lawrence Page, created a better search
    engine that allowed people to find informationmore accuratelyon the fledgling

  • What is the deal with the recent episodes of Hak5? They have become Darren pretty much conducting the episodes like a boring college lecture. It’s just him writing on the table with markers and Shannon saying “Ooooh Oookkk”. You would think the host of a Tech show would be teaching the audience… not one host boring the audience while teaching the other host! Used to be a big fan…..