Cryptography and PKI

Last edited

Note

This isn’t really linux specific.

Cryptography Definitions

TODO:

  • Cryptography applying math to secure communications
  • A cryptographic algorithm, called a cipher, is the set of mathematical steps taken to secure a message
  • Encryption is the process of using a cipher to convert plain text messages to unreadable ciphertext
  • Decryption is the reverse of that process

Random numbers

Kernel developers have put in lots work into recording subtle variations in system behavior and using these as sources of randomness.
Sources include timing of packets, timing of hardware interrupts to communication with hardware devices such as disk drives.

/dev/random
/dev/urandom # use this one

Nothing that runs in user space can compete with the quality of the kernel’s random number generator. Always use these.

Openssl

openssl s_client -connect google.com:443 # Get server cert

# Generate a x509 cert
openssl req -new -newkey rsa:2048 -nodes \
    -keyout stag.key -out stag.csr \
    -subj "/CN=server.com" \
    -addext "subjectAltName=DNS:server.com,DNS:hello.server.com"

PGP

PGP’s file formats and protocols are standardized as OpenPGP. The main unix implementation is GNU Privacy Guard (GPG).

PGP is really just glue over existing primatives:

  • condfidentiality: symmetric cipher, which use public key to wrap the session key
  • integrity/authencation: digita signatures over hash
  • compression before encrypt
  • key management: keyrings
  • base64 encoding for email

Let’s Encrypt and Cloudflare

# 1) Store cloudflare api key so it can create the dns records that confirms you own the domain
# /etc/letsencrypt/cloudflare.ini
dns-cloudflare_api_token = API_TOKEN_HERE

# 2 use cert bot to call letsencrypt and pass in your dns key
certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  --domains '*.pawney.net,pawney.net'

certbot sets up the results in folders nicely for you

live/pawney.net
├── fullchain.pem -> ../../archive/pawney.net/fullchain2.pem  # public key (+ leaf and intermediates) what you serve
└── privkey.pem -> ../../archive/pawney.net/privkey2.pem      # private key

# Likely you won't use these:
- cert.pem # leaf only
- chain.pem # intermediates only
Edit this page
© 2026 Monjiapawne