Lesson 4.1: Encrypting files with AES
Symmetric encryption uses one key to lock and unlock. AES is the worldwide standard. How a password becomes a key (key derivation with PBKDF2 and many iterations), why a random key file is better than a typed password, what the 'Salted__' header is, and what happens with a wrong key. In the lab you protect a customer backup before it's copied off-site: generate a random key, lock its permissions, encrypt with AES-256, check the result is unreadable, test the restore, and see a wrong key fail.
18 min
You will learn to
- Explain symmetric encryption and AES
- Explain key derivation (PBKDF2) and iterations
- Generate and protect a key file
- Encrypt and decrypt a file with openssl enc
- Test a restore before you need it
Key terms
- Symmetric encryption
- Encryption where the same key encrypts and decrypts.
- AES
- The Advanced Encryption Standard: a block cipher with 128-bit blocks and keys of 128, 192 or 256 bits.
- Key derivation function (KDF)
- A function that turns a password or other secret into a cryptographic key, usually slowly and with a salt.
- Plaintext and ciphertext
- The readable input and the encrypted output.
- Encryption at rest
- Encrypting stored data: files, backups, disks, databases.
← Broken access control and IDOR · All lessons · MITRE ATT&CK: a shared language for attacker behaviour →