Have you ever downloaded a file from the internet.
Maybe it was a file for a router update,
or a file for your computer or an application.
And wondered is this file really from the vendor
or is this a file that an attacker or a hacker got,
manipulated, included some malware,
and now I have it on my computer?
That's actually a very good question to ask.
That's why we should download from reputable sources,
but beyond just hoping the files are OK.
Another method we can use for verifying data integrity
in the world of cryptography is the concept of using a hash. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the world of cryptography is the concept of using a hash.
And here's how a hash works.
So we're sitting here at our computer
and we download the file.
And what we can do is we can have that file.
It's on our hard disk.
And instead of just trusting, Oh, yeah.
That's the official file.
We can go ahead and verify the hash.
And then we can go up to-- if it's a Cisco file, for example,
we Cisco.com.
And on their website, they would publish the hash.
So a hash is like a little string of data source.
If the file is 200 megabytes, or 50 megabytes, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the file is 200 megabytes, or 50 megabytes,
or 1 megabyte based on the hash that they're using,
it'll create this little, teeny string of text
that is created as a result of creating a hash.
And so what we can do is we can download the file.
We can take a look on Cisco's official site
and see what the hash is.
We can run that same hashing algorithm again.
And if the hash we generate matches the hash
they published, guess what?
We have data integrity.
And that way we can validate that it is indeed
the file that we think it is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the file that we think it is.
Or if it's on a Cisco iOS image, you can--
let's go on the top here.
You can write this command right here, verify slash MD5.
That's verifying the MD5 hash.
It'll generate the hash, and then we'd
compare that hash generated to the hash
that Cisco publishes for.
So this is an example of using a hash
to verify the data integrity of a file,
but the same concept can be used to verify
the data integrity of packets as they're
being sent over a network.
So in the event of sending a packet,
if R1 is sending a packet over to R2, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if R1 is sending a packet over to R2,
if we're using some kind of a hashing function.
R1 and R2 can validate, based on the hash, each and every packet
that's being sent to make sure the hashes match up,
which is going to help verify the data
integrity of those packets-- that they haven't
been manipulated or changed in transit by some third party
device.
So let me give you a very vivid example of how a hash can
help us verify data integrity.
This is a Passwordgenerator.net.
I just found it online.
And I'm going to paste in-- right click
and paste the Declaration of Independence. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and paste the Declaration of Independence.
And I'm also including the unanimous declaration,
the first few words there.
So if we have this document with all these words,
all the syntax.
If we want to generate a hash based on that,
we'd paste that text in, click on Generate.
This little string right here is the hash
that's now being generated based on all that text.
Now check this out.
If we change one character or anything else in that document,
it's going to modify the hash.
So you can take a look at the first,
like 1C5F, or at the end, 5850. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like 1C5F, or at the end, 5850.
Either way is fine because the entire hash
is going to change if we change one character.
So going to change instead of a capital T,
I'm going to go ahead and put a lowercase t.
And you'll notice the entire hash changes.
And so if I generate a hash on the original document,
you're on the same hashing algorithm.
When you receive the document, you
can know if the hashes match, that the data has integrity.
It hasn't been manipulated or modified since I sent it.
So hashing is pretty cool.
Now one of the challenges with hashing though, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now one of the challenges with hashing though,
is that what if an attacker takes packets
and they modify the data, and then they generate a new hash?
Because the hashing algorithms like SHA512, SHA256, SHA1,
those are not secret algorithms.
So a hacker could theoretically take a packet,
modify the contents, create a new hash, send it on it's way.
And the receivers say, Oh, yeah.
The hash matches.
That's the problem.
So another aspect regarding hashing
is instead of just using the hashing algorithm by itself,
why not also include in the formula, in the equation,
include some secret key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
include some secret key.
Some secret that's only known by the sender and the receiver.
So if we're on a hashing algorithm
and we include a secret as part of the calculation,
that way only the sender and receiver
can correctly create new hashes and verify the hashes
on that data.
So when we do that in IP networking
to protect the traffic, that's referred
to as hashed message authentication
code, or HMAC for short.
And let me give you an example of how
adding that additional component of some secret
that both party knows, how that changes the equation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that both party knows, how that changes the equation.
So here is yet another site.
It's called Freeformatter.com.
And I will go ahead and paste the Declaration
of Independence in there again.
And we can choose our algorithm.
So bigger is better.
MD5, we're not using too much anymore because it's not too
secure, but let's do SHA512.
That's pretty hefty.
Now it's also asking us for a secret key.
So the secret is the element that's
going to make this hash only calculatable by the devices who
both have that key.
So let's use our secret here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's use our secret here.
And we'll click on Compute HMAC, which is the hashed message
authentication code.
And there it is.
There is the SHA512 HMAC for the entire document.
If we change one character of the text,
or we change any aspect of our key, which I will go and just
call it our SEC and click on Compute HMAC
is going to modify that entire string.
Again, a different secret is going
to affect the outcome of the calculation.
So in this video, we've taken a look
at the concept of hashing to validate data integrity, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at the concept of hashing to validate data integrity,
whether it's on a file or whether it's on a packet that's
being sent over a network.
Hashing and its bigger brother, HMAC,
are important tools to have in our cryptography tool belt.
Now hashing and data integrity are pretty darn important,
but also in the world of cryptography,
we have tools to help keep the data private
and hidden from unauthorized eyes.
And we'll take a look at that in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.