SlideShare a Scribd company logo
1 of 149
Download to read offline
hi y’all, i’m jesse
hi y’all, i’m jesse
co-founder at clef
hi y’all, i’m jesse
@jessepollak
co-founder at clef
cryptography
cRyPtOgRaPhY
cryptography
goals
goals
give you a basic knowledge of
what crypto is and how it works.
goals
give you a basic knowledge of
what crypto is and how it
use examples you can understand
goals
give you a basic knowledge of
what crypto is and how it
use examples you can understand
help you realize that crypto isn’t
scary.
goals
give you a basic knowledge of
what crypto is and how it works.
use examples you can understand
help you realize that crypto isn’t
scary.
again, i’m jesse
@jessepollak
co-founder at clef
crypto 101
crypto 101
getclef.com/crypto101
cryptography
the art of writing or solving codes
cryptography
the art of writing or solving codes
the practice and study of techniques
to communicate securely in the
presence of third-parties.
cryptography
the art of writing or solving codes
the practice and study of techniques
to communicate securely in the
presence of third-parties.
how we use the web without hackers
stealing our identities and information
so, what?
so, what?
where is cryptography actually used?
1 passwords
1 passwords
2 clef
1 passwords
2 clef
3 SSL
1 passwords
2 clef
3 SSL
what is SSL?
what is TLS?
what is HTTPS?
ssl
the way we browse the web without
anyone else listening in.
core problem
how can two people communicate
securely?
alicebob
two subproblems
“your message”
1
“fd64$%533#$$1”
“your message”
1
“your message”
“fd64$%533#$$1”
“your message”
1
encryption
1
alicebob
2
bob
2
“your message”
“fd64$%533#$$1”
“your message”
bob
2
alicebob
2
“your message”
bob alice
2
“your message”
“fd64$%533#$$1”
bob alice
2
“your message”
“fd64$%533#$$1”
bob
“fd64$%533#$$1”
alice
2
“your message”
“fd64$%533#$$1”
“your message”
bob
“fd64$%533#$$1”
?
alice
2
“your message”
“fd64$%533#$$1”
“your message”
bob
“fd64$%533#$$1”
?
alice
2
alicebob
key exchange
what is ssl?
how we communicate securely on
the internet.
the combination of encryption and
key exchange.
got it?
got it?
(just kidding)
let’s build ssl
encryption
I have a message that
I want to keep secret
I have an encryption key
that only I know
I have an encryption key
that only I know
I have an encryption key
that only I know
I have an encryption key
that only I knowwhat is this thing?
I have an encryption key
that only I knowwhat is this thing?
I have an encryption key
that only I knowwhat is this thing?
I have an encryption key
that only I knowwhat is this thing?
“secret message”
I have an encryption key
that only I knowwhat is this thing?
“secret message”
“secret key”
I have an encryption key
that only I knowwhat is this thing?
“secret message”
“secret key”
“the message I want to keep secret”
“the message I want to keep secret”
“my secret key”+
“the message I want to keep secret”
“my secret key”+
“the message I want to keep secret”
“my secret key”+
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”=
“the message I want to keep secret”
“my secret key”+
“the message I want to keep secret”=
encrypted
“the message I want to keep secret”
“my secret key”+
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”=
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“my secret key”+
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“my secret key”+
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“my secret key”+
“the message I want to keep secret”=
“the message I want to keep secret”
“my secret key”+
decrypted
“the message I want to keep secret”=
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“my secret key”+
“the message I want to keep secret”=
“the message I want to keep secret”
“my secret key”+
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“my secret key”+
“the message I want to keep secret”=
“the message I want to keep secret”
“my secret key”+
encryption
decryption
encryption(message, encryption_key)
returns encrypted_message
decryption(encrypted_message, encryption_key)
returns message
encryption
key exchange
alicebob
how we get the same encryption key
alicebob
how we get the same encryption key
without me finding out
alicebob
how we get the same encryption key
without me finding out
or me
alicebob
how we get the same encryption key
without me finding out
or meor me
alicebob
how we get the same encryption key
without me finding out
or meor me
alicebob
how we get the same encryption key
without me finding out
or meor me
all communication is public
problem
how do two people share an
encryption key when they can’t
communicate privately.
solution
diffie-hellman!
solution
diffie-hellman…?
solution
math!
solution
math…?
solution
colors
solution
colors!
diffie-hellman key exchange
diffie-hellman key exchange
with no math and lots of colors!
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
imagine that we have an
infinite number of colors
some rules
some rules
easy to mix two colors to get a third
some rules
+
easy to mix two colors to get a third
some rules
+
easy to mix two colors to get a third
=
some rules
+
easy to mix two colors to get a third
=
impossible to figure out mixed colors
some rules
+
easy to mix two colors to get a third
=
impossible to figure out mixed colors
=
some rules
+
easy to mix two colors to get a third
=
impossible to figure out mixed colors
= +
some rules
+
easy to mix two colors to get a third
=
impossible to figure out mixed colors
= + ?
some rules
+
easy to mix two colors to get a third
=
impossible to figure out mixed colors
= + ?
bob
hi
alicebob
hi hey
alicebob
alicebob
alicebob
alicebob
alicebob
alicebob
alicebob
alicebob
alicebob
“I NEED TO TELL YOU A SECRET!”
alicebob
“I NEED TO TELL YOU A SECRET!” “LET’S DO A KEY EXCHANGE!”
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
bob and alice agree on a random color publicly
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
bob chooses a color and tells no one
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alice chooses a color and tells no one
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
bob mixes his secret color with the public color and
send the combination to alice
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alice mixes her secret color with the public color and
send the combination to bob
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
bob and alice mix their secret colors with their
partner’s blend to get a new secret color
everyone else
secret
+ =
secret
everyone else
wrong
+ =
secret
wrong
+ = wrong
everyone else
+ =
secret
wrong
+ = wrong
+ = wrong
everyone else
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
ssl
key exchange + encryption
“the message I want to keep secret”
bob
“the message I want to keep secret”
+
bob
encrypt
“the message I want to keep secret”
+
bob
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
“the message I want to keep secret”
+
alicebob
bob’s knowledge alice’s knowledge
everyone’s knowledge
secret message
alice
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
alice
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
+
alice
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
+
decrypt
alice
“dkjf8#654&(@)(5335jJkdfd8(%&jfdc”
+
“the message I want to keep secret”=
alicebob
we did it!
what is ssl?
how we communicate securely on
the internet.
the combination of encryption and
key exchange.
questions?
@jessepollak

More Related Content

More from jessepollak

Building Trust on the Blockchain: The Importance of Mental Models
Building Trust on the Blockchain: The Importance of Mental ModelsBuilding Trust on the Blockchain: The Importance of Mental Models
Building Trust on the Blockchain: The Importance of Mental Modelsjessepollak
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityjessepollak
 
Passwords the weakest link in word press security
Passwords  the weakest link in word press securityPasswords  the weakest link in word press security
Passwords the weakest link in word press securityjessepollak
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityjessepollak
 
WordPress Security Update: How we're building the web's most secure platform ...
WordPress Security Update: How we're building the web's most secure platform ...WordPress Security Update: How we're building the web's most secure platform ...
WordPress Security Update: How we're building the web's most secure platform ...jessepollak
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityjessepollak
 
Clef security architecture
Clef security architectureClef security architecture
Clef security architecturejessepollak
 
Passwords and Botnets and Zombies (oh my!)
Passwords and Botnets and Zombies (oh my!)Passwords and Botnets and Zombies (oh my!)
Passwords and Botnets and Zombies (oh my!)jessepollak
 
Anatomy of a WordPress Hack
Anatomy of a WordPress HackAnatomy of a WordPress Hack
Anatomy of a WordPress Hackjessepollak
 

More from jessepollak (9)

Building Trust on the Blockchain: The Importance of Mental Models
Building Trust on the Blockchain: The Importance of Mental ModelsBuilding Trust on the Blockchain: The Importance of Mental Models
Building Trust on the Blockchain: The Importance of Mental Models
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress security
 
Passwords the weakest link in word press security
Passwords  the weakest link in word press securityPasswords  the weakest link in word press security
Passwords the weakest link in word press security
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress security
 
WordPress Security Update: How we're building the web's most secure platform ...
WordPress Security Update: How we're building the web's most secure platform ...WordPress Security Update: How we're building the web's most secure platform ...
WordPress Security Update: How we're building the web's most secure platform ...
 
Passwords: the weakest link in WordPress security
Passwords: the weakest link in WordPress securityPasswords: the weakest link in WordPress security
Passwords: the weakest link in WordPress security
 
Clef security architecture
Clef security architectureClef security architecture
Clef security architecture
 
Passwords and Botnets and Zombies (oh my!)
Passwords and Botnets and Zombies (oh my!)Passwords and Botnets and Zombies (oh my!)
Passwords and Botnets and Zombies (oh my!)
 
Anatomy of a WordPress Hack
Anatomy of a WordPress HackAnatomy of a WordPress Hack
Anatomy of a WordPress Hack
 

Recently uploaded

GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdflior mazor
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MIND CTI
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024The Digital Insurer
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FMESafe Software
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024The Digital Insurer
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century educationjfdjdjcjdnsjd
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsJoaquim Jorge
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 

Recently uploaded (20)

GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 

Cryptography 101