> For the complete documentation index, see [llms.txt](https://justin-se.gitbook.io/justin-se-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://justin-se.gitbook.io/justin-se-docs/security-and-privacy/security.md).
# Security
security is important, and it is easy enough to implement,\
but if you dont, then you are basically running naked on internet.
## Security
authentication = check your authenticity
authorization = give access rights
### Authentication & Authorization
#### **Password Based**
#### **One-Time Pass (OTP)**
as it’s name, it generate a passcode and it can only use one time.
it could send from SMS, Email, or a confirm on another authorized device.
**Use Case**
* Online Payment Transaction
* Abnormal login detected
* Highly secured feature
* Password Changing / Security Info Editing
#### **Time Based One-Time Passcode (TOTP)**
TOTP are achive by a password generate algorithm.
#### **How It Work**
client side have a password generator with provided secret key.\
every 60s client side generator regenerate passcode based on secret key.\
while authentication provider receive the request, it will also generate the password as client do, \
if two password are match, it result in valid access.
**Implement**
* [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2\&hl=en) / client side generator
**Resources**
* [Wiki](https://en.wikipedia.org/wiki/Time-based_one-time_password)
* [RFC](https://datatracker.ietf.org/doc/html/rfc6238)
#### **Digital Signature**
An authentication method with visible payload & cryptography \
to ensure payload not being changed.
**Use Case**
* Financial transaction
* Legal Agreement
* Software Distribution
**Implement**
1. Key Generation :\
generate mathematically related keys (RSA),\
\- private key keep safely on sender,\
\- public key share with receiver.
2. Sign Hash :\
use data/message to generate a hash value .
3. Encrypt :\
use private key to encrypt the data and hash value.
4. Receive & Verify :\
use public key to decrypt the data and re-generate hash as step 2,\
if generated hash is the same as received hash\
that means data has not being changed.
**Common Practice :**
* use SHA (Secured Hash Algorithm), it is a group of hashing algo, at 2022 most financial software using SHA256 / SHA512 to secured their data.
* add Unix Timestamp in data, it can make the data more complex, by adding the timestamp it can process with [\*\*Receive Window,](https://cabulous.medium.com/tcp-send-window-receive-window-and-how-it-works-8629a4fad9ec)\*\* limit the latency of sender to have better efficiency.
**Receive Window**
[TCP Send Window, Receive Window, and How it Works](https://cabulous.medium.com/tcp-send-window-receive-window-and-how-it-works-8629a4fad9ec)
### Open Authorization **(OAuth)**
OAuth is an protocol for **Secured Access & Authorize**. \
It allows third-party applications to access a user's data without expose credentials like username and password. \
Instead, it provide tokens that define the permissions granted.
#### Token Based Authentication
Token base auth can reduce use of username & password, it represent an authorise.\
Since it do not transfer root authentication materials like password, it reduce damage of data leaks.
#### Use Cases
* **User Authentication & Authorization**\
Most SSO provider like Google, Apple, Github implement OAuth to let 3rd party app gain access of their services.
* **Secure API Access**\
Apps can verify token to ensure the authenticity of the request.
* **Detailed Permission Control**\
User can allow or deny specific permission for different apps.
### Single Sign On (SSO)
SSO is a concept of shared credentials, \
user only authorise once to access multiple app, \
those "Login with Google", "Login with Github" is based on SSO concept.
it eliminate needs of register account on every platform, unified the account management,\
make huge improvement in user experience.
## **Cryptography**
#### Encryption
Encryption is to protect info from leak, and mantain reusabilty.
a simple example of "encrypt" & "decrypt", algorithm is simply reverse the string.\
we can encrypt from "password" to "drowssap",\
we can also reverse it back from "drowssap" to 'password",\
but for who dont know the algorithm they cant understand what "drowssap" means, that is what encryption want to do.
#### **Symmetric vs Asymmetric Encryption**
* **Symmetric**\
encrypt and decrypt with same Secret Key
* Encrypt : Message + Secret Key = Cipher
* Decrypt : Cipher + Secret Key = Message
Symmetric Encryption Algorithm:
* [Advanced Encryption Standard(AES)](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard)
* **Asymmetric**\
encrypt and decrypt with different Key.\
SecretKey(SK) + PublicKey(PK) combination.
* Encrypt : Message + Public Key = Cipher
* Decrypt : Cipher + Secret Key = Message
Asymmetric Encryption Algorithm:
* [RSA](https://en.wikipedia.org/wiki/RSA_\(cryptosystem\))
#### **Hashing**
refer to algorithm that make irreversible encryption,
* the same “message” will always output the same hash value.
* using “salt” can add complexity to another dimension.
unlike encrypt, hash is mostly used to ensure data are not beign change,
**What is "Salt" ?**\
a simple way to explain salt,\
message is number with 1 length, so there is 10 possible (0-9) to be message,\
adding salt make message to number with 2 length, so there is 99 possible (0-99).
* more complexity = more secure,\
it make hash significantly harder for attackers to perform **Dictionary Attack** or **Rainbow Table Attack.**
Common Hashing Alogrithm:
* SHA1, SHA256, SHA512
#### **Digital Signature**
An authentication method, Asymmetric cryptography,\
Use hashing to ensure the data is not been changed in process of transfer.
* **Use Case**
* Financial transaction
* Legal Agreement
* Software Distribution
* **Verify a Hash**
share the key of hashing and let receiver hash it and compare two output,\
it is same then it is not being changed
* **Implement**
1. Key Generation :\
generate mathematically related keys (RSA),\
\- private key keep safely on sender,\
\- public key share with receiver.
2. Signing Hash :\
generate hash with (SK + data/message).
3. Receive & Verify :\
to verify the data, use public key to re-generate hash as signing,\
if generated hash is the same as received hash\
that means data has not being changed.
Common Practice :
* use SHA (Secured Hash Algorithm), it is a group of hashing algo, in 2022 most financial software using SHA256 / SHA512 to secured their documents.
* add Unix Timestamp in data, it can make the data more complex, by adding the timestamp it can process with [Receive Window,](https://cabulous.medium.com/tcp-send-window-receive-window-and-how-it-works-8629a4fad9ec) to check the sender latency.
### Authentication
* **Password Based**
* **Single Sign On (SSO)**
one time authentication, multiple application authorised, credential sharing.
it improve user experience by reduce time of log in,\
for example a company that have multiple service like microsoft,\
when we log in window account on window11 system,\
it can share the credential between microsoft store, one drive, micosoft 365 etc,\
so user don’t have to login every time they use these serivces from same provider.
* **One-Time Password (OTP)**
as it’s name, it generate a password and it can only use one time.
it could send from SMS, Email, or another authorized device.
**Use Case**
* Online Banking Transaction
* Abnormal Login ( IP, time, attempt etc)
* System with Personal Privacy / Finance related
* Password Changing / Security Info Changing
* **Time Based One-Time Password (TOTP)**
TOTP are achive by a password generate algorithm.
**How It Work**
it to required client side to setup a password generator with service provider given secret key.\
every time interval (usually 30-60s) client side need to regenerate the password based on given secret key.\
while provider will receive the authentication request, it will also generate the password as client do, if two password are match, it result in authentication success.
**Implement**
* (TOTP)
* **Digital Signature**
An authentication method, Asymmetric cryptography,\
Use hashing to ensure the data is not been changed in process of transfer.
**Use Case**
* Financial transaction
* Legal Agreement
* Software Distribution
**Implement**
1. Key Generation :\
generate mathematically related keys (RSA),\
\- private key keep safely on sender,\
\- public key share with receiver.
2. Signing Hash :\
use data/message to generate a hash value .
3. Encrypt :\
use private key to encrypt the data and hash value.
4. Receive & Verify :\
use public key to decrypt the data and re-generate hash as step 2,\
if generated hash is the same as received hash\
that means data has not being changed.
**Common Practice :**
* use SHA (Secured Hash Algorithm), it is a group of hashing algo, at 2022 most financial software using SHA256 / SHA512 to secured their data.
* add Unix Timestamp in data, it can make the data more complex, by adding the timestamp it can process with [\*\*Receive Window,](https://cabulous.medium.com/tcp-send-window-receive-window-and-how-it-works-8629a4fad9ec)\*\* limit the latency of sender to have better efficiency.
**Receive Window**
[TCP Send Window, Receive Window, and How it Works](https://cabulous.medium.com/tcp-send-window-receive-window-and-how-it-works-8629a4fad9ec)