- 19
- 690 558
Paul Turner
Registrace 21. 10. 2014
My goal is to pass on some of the things I've learned during my time in the PKI, SSH, and cryptographic key management market. Most of this has been learned working with large enterprise customers so it may focus a bit more on those environments. I hope the information is helpful to you. You can also visit my Venafi blog at www.venafi.com/blog#Paul Turner.
Intro to Digital Signatures & HMACs (and a little about TLS :)
Integrity and authentication are important to security. Digital signatures and HMACs serve as two of the primary means of providing that security. In this video, I cover the mechanics of each. I also explain how TLS 1.3 leverages digital signatures and HMACs.
If you haven't already, you may want to watch my videos on certificates and hashes to help in understanding some of the topics in this video. Here are some of those videos:
Intro to Hashing: czcams.com/video/M6ZZa-9h80Q/video.html
What is a PKI: czcams.com/video/5OqgYSXWYQM/video.html
Certificate Issuance: czcams.com/video/L1GkEnftoRQ/video.html
Certificate Validation: czcams.com/video/lLw0dICMA_Y/video.html
If you haven't already, you may want to watch my videos on certificates and hashes to help in understanding some of the topics in this video. Here are some of those videos:
Intro to Hashing: czcams.com/video/M6ZZa-9h80Q/video.html
What is a PKI: czcams.com/video/5OqgYSXWYQM/video.html
Certificate Issuance: czcams.com/video/L1GkEnftoRQ/video.html
Certificate Validation: czcams.com/video/lLw0dICMA_Y/video.html
zhlédnutí: 3 237
Video
Understanding Lower Back Pain
zhlédnutí 536Před 2 lety
This video is the first in a two part series on lower back pain and sciatica. I struggled with back pain from the time I was a teenager until my forties, when I started to better understand the cause of that pain and how to manage it. Pain in the back is related to how we stretch and the position of the pelvis. Based on understanding these concepts, I'm now able to manage my back to I can do al...
Intro to Hashes
zhlédnutí 7KPřed 3 lety
In this video, I provide a basic introduction to hashing and hashes, one of the fundamental tools in cryptography. Cryptography is typically associated with encryption. However, hashing is an powerful cryptographic tool and essential to the security of protocols such as TLS.
TLS Certificate Risks
zhlédnutí 2,9KPřed 4 lety
While providing essential security, TLS has risks. If TLS certificates are not properly managed, you can encounter outages, undetected pivoting, and a lack of crypto-agility. This video provides an overview of these risks.
An Introduction to TLS (SSL)
zhlédnutí 4,3KPřed 4 lety
Transport Layer Security (TLS) has enabled secure commerce across the globe by ensuring secure connections on the internet and within organizations. (Sorry, for those of you who've watched my other videos, this contains some duplicate content.)
TLS Certificates: Enterprise Risks and Recent NIST Guidance
zhlédnutí 3,9KPřed 5 lety
NIST recently released guidance for the management of TLS certificates in enterprise environments. This video explains to executives why this guidance is critical to their organizations. Volume A of the guidance is available at: www.nccoe.nist.gov/sites/default/files/library/sp1800/tls-serv-cert-mgt-nist-sp1800-16a-draft.pdf Volume B is available at: www.nccoe.nist.gov/sites/default/files/libra...
SSH 101 - Mapping SSH Risks and Best Practices
zhlédnutí 4,5KPřed 6 lety
This video provides a strategy for mapping risks related to SSH and best practices for addressing those risks. The goal is to help you in prioritizing the risks you want to address and the best practices to address them.
SSH 101 - Major Components of SSH
zhlédnutí 14KPřed 6 lety
This video provides a visual overview of the major components of SSH (sshd, ssh client, authorized_keys files, etc.).
PKI Bootcamp - Certificate Governance for Better Security
zhlédnutí 10KPřed 7 lety
This video provides an overview of how organizations with larger deployments of certificates can leverage governance (roles & responsibilities and policies) to lower certificate operational and security risks.
PKI Bootcamp Basics of Certificate Chain Validation
zhlédnutí 35KPřed 7 lety
This video explains the basics of how a browser validates a web server certificate and the CA certificate chain.
SSH 101 - SSH Port Forwarding
zhlédnutí 41KPřed 7 lety
This session of SSH 101 provides an overview of SSH Port Forwarding, some of the risks it creates, and how to enable or restrict it.
PKI Bootcamp - Basics of Certificate Issuance
zhlédnutí 41KPřed 7 lety
This video provides a high level look at how certificates are signed and a certificate chain is created.
SSH 101 - Intro to SSH Keys
zhlédnutí 5KPřed 7 lety
This video provides an understanding of how SSH keys are used to identify SSH servers and enable users to login without requiring a password.
PKI Bootcamp - Anatomy of a Certificate Attack
zhlédnutí 10KPřed 7 lety
Public key infrastructure (PKI) and certificates play a critical role in any security architecture. However, PKI can be exploited for attacks. This session of PKI Bootcamp discusses the PKI kill chain and methods that attackers can leverage PKI in their attacks.
SSH 101 - What is SSH?
zhlédnutí 13KPřed 7 lety
Though SSH is broadly used for privileged access, administration, and automation, it is not well understood. The is the first in a series of videos aimed at explaining SSH, the risks related to using it, and best practices for managing and using it properly in an enterprise environment. This video explains the role SSH plays.
Introduction to Cryptographic Keys and Certificates
zhlédnutí 167KPřed 8 lety
Introduction to Cryptographic Keys and Certificates
Risks to Certificate Private Keys in Enterprises
zhlédnutí 2,1KPřed 8 lety
Risks to Certificate Private Keys in Enterprises
Spending time this morning tuning up on cryptography concepts, and loving that I can get the refresher from the guy who taught me everything I know about this. You are so good at this stuff. Miss our interactions. Hope you are well, my friend.
Learning PKI with this playlist in 2024 😁😁😁😁 Thank you Paul
@paul many thanks for making it so easy to understand ! Did you many any explaining private CA and how they work? I have already found one of your video on x.509
Wonderful series of videos, best explanation about PKI and cert validation I've found so far. Congrats!
This PKI Bootcamp series is impressive!
Why is this video so well put together?
Hey, I've always struggled with the differences between MAC and HMAC. From this video, you make it sound like MACs are not secure anymore and that HMACs are the new solution. Do I have this wrong or have MACs changed to adapt to the exploit you discussed?
I love this series. It is very nice to finally understand how the processes work.
Excellent explanation in such small time.
After an hour of reading about PKI, trying to understand it and failing, I finally have a grasp on this now. Thank you, Paul!
This was a great video, thank you!
3:42 straight and concise to the point. very informative and clear. Thanks a lot for this content
Thank you so much. Great explanation.
Great video Mr. Paul. God bless you
Excellent master for PKI
Glad you liked it, Jesus. Thanks for the feedback.
Hello. Can you recommend any ressource for understanding and implementing the underlying architecture and (as well as file organization) of every component in the PKI ecosystem such as CA, Root CA, ..., If were to be established and deployed in a real life insecure infrastructure?
Hi, Mike. Sorry for the slow response. There are a variety of good PKI consulting organizations out there. You might talk with Encryption Consulting (www.encryptionconsulting.com) or Komar Consulting (www.komarconsulting.com). Brian Komar also has written several papers and books. I hope that helps.
@@PaulTurnerChannel Never mind. I am glad, that you took your time to respond. Would you mind, if I message you on youtube? I need a couple of tipps for my current project if you do not mind
No problem, Mike. My primary expertise is in the cert and key mgmt of PKI. There many others better than me at CA deployment and mgmt.
@@PaulTurnerChannel can I have your E-Mail Address? I cannot find any way to communicate with you. I posted my E-Mail here in a comment but it got deleted somehow
@@Mike-kq5yc Sorry for the slow response. Please connect with me on Linkedin at www.linkedin.com/in/equio/.
@4:50 - what's the max & min timeframe (using pki best practice as a guide) for a Root-CA and an Issuing-CA?
These videos are incredible thank you Paul
are these keys persistent ? What should we do make sure keys are persistent?
Excellent content. Poor voice volume.
I want to verify the certificate. Iam using mbedtls . But i am getting error -0x2700 - X509 - Certificate verification failed, e.g. CRL, CA or signature check failed How to solve this or are reason to fail the verification
Hmmm. That’s not a lot to go on, K K. The first thing I would do would be to try to connect to the server with a different client that might give you more information about what is causing the failure. You might try OpenSSL (www.openssl.org/docs/man3.0/man1/openssl-verification-options.html). Is this a public or private server? If public, can you provide a URL?
@@PaulTurnerChannel i am using ip address for URL ..yeahh it's private The provided openssl link is not opening.
That is likely your problem. You need to use a DNS address that matches the CN and/or SAN in the certificate of the server. That is what the TLS library is attempting to match.
What a good explanation! thank you very much!
Thank you, RG!
Hello. Thanks for detailed explanation.
I’m glad it was helpful, BitVibe!
Plz speak little loud 🔊 or Inc volume of mike
Sorry, Swagata. That was one of my early videos when I didn’t have a good microphone.
Awesome video, Thank you!
Thankyou for concise and clear explanation Great work
Thanks Paul!
Great video you explained it so well.
Amazing, thanks a lot, please add another video for practice and testing for all scenarios...
Thanks.
Strange, but a software engineer who always has to sit for prolonged periods of time I struggle with upper back pain and constant clicking between shoulder blades, I do have hernia between most of my lower vertebrates, but it doesn’t give me as much trouble as the upper back
I just want to hug you and say thank you. Awesome. Bravo
When is your next back pain video coming out??
Hi, Les. I’ve been remiss in getting that done. Your message is helpful on telling that the second video would be helpful and serves as a good reminder to me to get it done. I will get to work on it and try to get it done by early February. Thank you for your kind nudge.
Hello Paul, thank you for taking time to put this great content! I have a question about a "certain area" I'm trying to understand in PKI, what is the exact operation that our browsers do in the backend to verify that server certificate X is signed by root CA certificate Y? what i understand is that the browser will take the public key of the root CA certificate Y and try to decrypt the server certificate X using that public key and if its able to decrypt it then this means that certificate X must have been encrypted with the private key of root CA, but the problem with this "theory" is that the server certificate X is actually sent to the browser un-encrypted (clear text) as we can see it in a wireshark capture for TLS 1.2 session
Hi, Nader. You are actually correct but with a slight difference. The certificate is passed in the clear. I’m order to prove it is coming from them, when issuing the certificate, the root CA hashes the clear text certificate and then encrypts that hash with its private key. Once it receives the cert, the browser 1) decrypts the signature with the root CA’s public key to get the hash, 2) hashes the clear text certificate, and 3) compares the two hashes. If they match, it knows that the signature is valid. And, since they trust the root CA cert (public key), they trust the certificate. FWIW, the certificate is now encrypted in TLS 1.3 while in transit to the browser from the server. It is encrypted within the encrypted TLS stream facilitated by Diffie-Hellman key agreement. This was added by the IETF (standards group) for additional privacy. They did not want ISPs or others listening on the internet to know the domain name (the subject DN in the cert) that the browser/user is visiting. This works along with DNS over HTTPS (DoH) to prevent detection. The intermediary can a obviously see the destination IP address of the packets but that IP address could be the destination for many domain names. A VPN connection is obviously an alternative but that is not always convenient and the user may not want the VPN provider to have a clear picture of all their communications (since TLS is still used within the VPN connection). I hope this is helpful.
Speak up! Max volume and I can still barely hear you.
Sorry, Generic Rocker. This was one of my early videos before I understood the importance of a good microphone. Hopefully, some of my later videos have better sound quality. Thanks for pointing it out. All the best.
I was wondering about the significance of certificates, you nailed it. Great video and I enjoyed watching it. Wondering what if the man in the middle spoofs the certificate that its been issued by the legit party. which body issues the certificate?
Hi, Vishnu. I may need you to clarify your question but I’ll try to provide an answer. An MITM can only succeed if the relying party (typically the party who initiated the connection) trusts the issuer of the certificate that the MITM presents. This means that the MITM can’t use a self-signed cert. Instead, they have to convince a CA trusted by the relying party to issue them a certificate with the identity of the subject of the cert (the party that the relying party is communicating with). This should be very difficult if the CA does sufficient due diligence. There have been cases where an MITM compromised the DNS account of the subject and was then able to get Let’s Encrypt to issue them a cert (since LE will issue a cert based on a DNS verification). I hope this helps. Please tell me if it doesn’t answer your question.
@@PaulTurnerChannel thanks Paul, this helps. I was able to listen to some of your videos which explains certificate issuance process as well
The analogy with a safe that is being shipped around the world is great. Gave me a way better understanding of the topic!
I’m glad the analogy was helpful, K-San. I wish I could take credit for it but heard it somewhere else (can’t remember where) and found it very helpful as well. All the best.
Thank you. Simply explained
Glad you liked it, Niranjan. Thanks for the feedback!
👍👍- Awesome! Thanks!
Glad you liked it, Athikora. Thank you.
Amazing.
Thanks for taking the time to provide your thoughts, Diwakar.
the audio volume is very low even though I have set it to max on my laptop.
Sorry, Anil. That is one of my first videos, when I was still learning the importance of a good mic. I hope the other videos are easier to hear (and understandable.
@@PaulTurnerChannel I just now happened to be at my desktop which has external speakers - now you can be heard clearly at max volume. Perhaps headphones work too. You may want to put it in the description.
Nice explanation. Thanks.
Thanks, Sparsh. I’m glad you liked it.
this is an outstanding summary of things ive learned in security but didn't relate to each other conceptually - thank you!
I’m really glad it was helpful for you, Chris. Thanks a bunch for your feedback!
Well its not so clear as it used to be in the previous video
Sorry that this video caused confusion, Profiler. Thanks for the feedback.
@@PaulTurnerChannel thank you anyway Paul!
what is the difference between sha 256 and hmac?
Hi, k. SHA256 is a hashing algorithm. An HMAC uses an algorithm, like SHA256, in a particular way. Instead of just taking a message and hashing it with SHA256 to get a hash (fingerprint) of the message, you hash the message with a secret key (twice, as shown in the video) to create an HMAC that serves as an authenticated fingerprint or signature of the message. A recipient who has the secret key can verify that the message came from the sender and that it wasn’t changed. On the other hand, if I was to simply hash this message with SHA256, you couldn’t verify that it came from me when you received it because anyone could create a message, hash it, and send it to you. However, if only you and I know the secret key, you know that the message you receive )with an HMAC attached) came from me because you can verify that it was hashed with the secret key. I hope that helps, and sorry it wasn’t clear in the video.
@@PaulTurnerChannel Thank you for quick reply.This is perfect explanation.That means SHA doesn’t provide authenticity right?
yes, that is a really good explaination
I’m glad you liked it, LOL (love the screen name). Thanks for taking the time to comment.