
This video will introduce you to the course
This video explains the industry background, showing that cryptography appears in almost systems.
• Understand what cryptography is used for
• Discuss where is cryptography already used
• Look at the legal implications of using cryptography
This video shows some evolution of cryptography and how it’s changed. It also shows the standards bodies who decide on algorithms.
• Show that cryptography is not new
• Identify standards in cryptography
• Discuss the importance of audit and appearances
This video helps us to relate cryptography to the broader industry, demonstrating some of the problems solved. It focuses on inter-system communication and public key infrastructure.
• Discuss system communication
• Identify role of prior knowledge
• Show how browsers chain trust
The aim of this video is to explain background of concepts like CAs, algorithms, to explain the rest of the upcoming course.
• Walk through the public key crypto system (PKCS)
• Compare strength between algorithms
• Learn the pronunciation of ciphers
The aim of this video is to teach us the role of symmetric ciphers and when to choose them.
• Understand which symmetric ciphers are effective and compatible
• Discuss what it means to have a shared key
• Understand the role of an initialization vector and key
The aim of this video is to discuss how to use symmetric cipher AES to encrypt and decrypt data.
• Encrypt/decrypt an AES message
• Initiate a cipher with the vector and key
• Wrap Java streams with ciphers
This video explains the role of hashing to validate files and check sensitive data without storing that data.
• Discuss how hashing protects and validates data
• Learn when to salt and when not to
• Look at an example code to hash known and private data
This video will discuss what are common problems when implementing code that uses basic ciphers.
• Discuss the risk of shared secrets
• Learn about the common ways in which the keys are lost
• Avoid pre-compute attacks
The aim of this video is to teach us the role of asymmetric ciphers and when to choose them.
• Understand which asymmetric ciphers are effective and compatible
• Discuss what it means to have a public and private key
• Learn about the role of asymmetric in HTTPS
This video shows you how to make a public/private KeyPair.
• Make a KeyPair to encrypt/decrypt
• Explain how the key starts encryption
• Create keys
The aim of this video is to demonstrate how to store keys securely, alongside certificates.
• Discuss the role of KeyStores to hold keys
• List the different Java cryptographic providers
• Demonstrate how to store keys and certificates
The aim of this video is to discuss the role of keytool, an easy tool for working with keys and certificates.
• Learn about what KeyTool does and when/why to use it
• Generate a certificate and keypair
• Interact with keys in a KeyStore
This video compares a KeyGenerator against a KeyPairGenerator, showing how to use each.
• Learn when to use a KeyGenerator
• Discuss why a KeyGenerator sometimes may not be used
• Generate keys with a KeyGenerator
This video teaches us how to perform encryption and decryption using asymmetric KeyPairs.
• Show which key is used to encrypt and decrypt
• Demonstrate how to encrypt and decrypt
• Demonstrate how to share encrypted messages between people
PKIX is a common error that will be seen by developers, where a few solutions will fix its obscurity. We will learn about it in this video.
• Discuss what PKIX means
• Discuss Unlimited Encryption and learn when to use it
• Import certificates into your KeyStore
This video covers navigating SSL certificates to track a chain of trust.
• Learn what a certificate chain looks like
• Discuss why you would want to look at a certificate chain
• Demonstrate how to access certificates of an HTTPSUrlConnection
One of the biggest difficulties in public key cryptography is sharing public keys and knowing who owns it. We will learn about it in this video.
• Explain what escrow means
• Explain escrow of public versus private certificates
• Discuss the difficulty of key management in cloud environments
Key re-use is easy but also simplifies role for attackers to brute force implementations. We will about these keys in this video.
• Discuss acceptable re-use versus too much re-use
• Talk about one-time pads
• Compare certificate re-use against password re-use
This video talks about Certificate pinning, which defends against man in the middle attacks by verifying certificates concretely.
• Explain certificate pinning
• Discuss who should worry about pinning and when
• Demonstrate how to pin a certificate
This video discussed about JAR files that defend against code tampering, either during transit or after code has been on a system.
• Explain the problem that signed JARs solve
• Demonstrate how to sign and verify a JAR file
• Explain the role of a timestamp authority when signing
One way of bypassing cryptography is simply discovering someone’s secret keys or tokens, either in files or code. We will learn more about it in this video.
• Discuss the problem of locating secret keys
• Demonstrate an example of data loss from harvested tokens
• Show the impact on AWS bills from hijacked tokens
You can’t use the same algorithm forever, so design systems in a way that the encryption can evolve with standards. This video talks about upgrading the algorithms.
• Explain why we upgrade algorithms
• Show times when industry mass-migrated algorithms
• Architect a mechanism for tracking algorithms
Coding secrets into applications does not hide them. In this video, we will analyze Java bytecode to extract not-secret information such as passwords.
• Explain the role of bytecode and decompilation / debugging tools
• Decompile code to reveal stored passwords
• Identify ways to avoid secrets placed in code
The aim of this video is to enhance the previous lessons to a more complete version that encrypts/decrypts files.
• Explain the role of Cipher Streams
• Demonstrate full encryption/decryption using these streams
• Discuss the role of try-with-resources on stream
Certificates enable encrypted HTTPS communication, and these certificate authorities simply it as low or no cost. We will learn about it in this video.
• Explain the role of Certificate Authorities
• Discuss when and how to use LetsEncrypt
• Learn when and how to use AWS Trust
Secure systems require more than cryptography. SSL Labs helps identify flaws in full cryptographic web servers, by analyzing their data, which is covered in this video.
• Explain the role of underlying SSL issues
• Demonstrate using SSL labs on any site
• Discuss how to interpret and act on results
DeepViolet is a library to simplify analysis of SSL connections and diagnose any issues. This video discusses about the same.
• Explain DeepViolet as an easy way to analyze SSL
• How to use DeepViolet as a dependency
• Demonstrate analyzing traffic and comparing to SSL Labs
Security is paramount for any application. Cryptography occurs all across software fields: it protects all HTTPS traffic between browsers, encrypts phone storage against prying eyes, and can even hide files inside other files through a technique called steganography. This course is for developers looking to design a system that uses cryptography, rather than designing new algorithms. Most developers simply need to put the right pieces together to make their own system work.
In this course, you will break down the concepts behind cryptography into simple lessons, covering terminology, algorithms, standards, and encryption/decryption techniques. We will also walk through how cryptographic systems are hacked to bypass (rather than break) their cryptographic capabilities.
The course answers questions such as:
What is cryptography used for?
What are keys and where do they go?
Why do networked systems sometimes give certificate validation errors?
If I need to encrypt something, how should I do that?
By the end of this course, you will recognize cryptographic problems and understand the right knowledge to apply a verifiable solution.
About the Author
Erik Costlow ran Oracle’s Java Root Certificate program, coordinating efforts with many cryptographic organizations. He is an experienced software security expert focused on program analysis and runtime instrumentation to detect security issues and provide useful guidance on fixing any security issues.