From b47dac3dadb9c73e57c0f4ea6d0e977ae93ed26c Mon Sep 17 00:00:00 2001 From: Karenzz Date: Wed, 31 May 2023 22:59:16 +0200 Subject: [PATCH] Update page 'RSA key - Karen' --- RSA key - Karen.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/RSA key - Karen.md b/RSA key - Karen.md index ec0ad53..26b9537 100644 --- a/RSA key - Karen.md +++ b/RSA key - Karen.md @@ -1,13 +1,11 @@ -1. determine what RSA key strength you want to use, based on your research on the state of the art in RSA key cracking. - +**1. determine what RSA key strength you want to use, based on your research on the state of the art in RSA key cracking. +** > I will use 2048 bit RSA keys, whice are considered secure against current known attacks and can provide a sufficient level of security. > The first reason for me to choose 2048 bit RSA keys is that I have heard that 1024 bit RSA keys have been cracked and are not used any more for web sites, and RSA-2048 is the one being recommended by NIST as it gives roughly 112 bits of security. > The other reason why I will use RSA-2048 instead of RSA-4096 is that some clear benefits of using 2048 bit keys appear in certain situations nowadays, including using less CPU than a longer key during encryption, and using less battery drain and storage space. > Also, I made a research of the case for using 4096 bits, and there is a law of diminishing returns with RSA key length, which states that an imporvement by using RSA-4096 will be so marginal that it is really not worth mentioning. -2. generate a - 2a. openssh public key ("rsa xxxx AAAA.....") - 2b. private key +**2. generate a 2a. openssh public key ("rsa xxxx AAAA.....") 2b. private key** > ---- BEGIN SSH2 PUBLIC KEY ---- Comment: "rsa-key-20230531" @@ -20,18 +18,18 @@ RtLQUUs8mSTfbnL2LuE+T2d8sBtj9wi+gODFl5dDAVZkmuKrRgLF ---- END SSH2 PUBLIC KEY ---- -3. check the public key into your branch of python-bootcamp. +**3. check the public key into your branch of python-bootcamp.** -4. find where google chrome stores your cookies, and extract the cookies it knows for google.com. +**4. find where google chrome stores your cookies, and extract the cookies it knows for google.com.** > "C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" -5. are the cookies that google chrome stores encrypted on disk? +**5. are the cookies that google chrome stores encrypted on disk?** > Yes. Not only cookies, but also other files it stored in my local system are encrypted. > It uses the Windows Data Protection API to encrypt the cookies stored on disk. This API leverages the user's login credentials as a factor for encrypting and decrypting the data. -6. assuming you could commit crimes and get away with them, how would you try to get a copy of my private SSH keys? +**6. assuming you could commit crimes and get away with them, how would you try to get a copy of my private SSH keys?** > Maybe we can crack SSH private key by first creating a new usser and generating a public/private key pair on the target, and then get the private key on the local machine. With installing SSH2John on the local machine, all we have to do is run it against the private key and direct the results to a new hash file using the ssh2john python tool. Next, we can use John to crack the password and connect to the target.