Difference between revisions of "KI: PRAKTEK 3: Kriptografi Praktis"
Onnowpurbo (talk | contribs) |
Onnowpurbo (talk | contribs) |
||
| (3 intermediate revisions by the same user not shown) | |||
| Line 35: | Line 35: | ||
==Golden Rule Password Security== | ==Golden Rule Password Security== | ||
Password: | Password: | ||
| − | ❌ tidak pernah disimpan plaintext | + | * ❌ tidak pernah disimpan plaintext |
| − | ❌ tidak pernah dienkripsi | + | * ❌ tidak pernah dienkripsi |
| − | ✅ selalu di-hash | + | * ✅ selalu di-hash |
| − | ✅ selalu pakai salt | + | * ✅ selalu pakai salt |
| − | ✅ selalu pakai algoritma khusus password | + | * ✅ selalu pakai algoritma khusus password |
| − | Kenapa tidak dienkripsi? | + | Kenapa tidak dienkripsi? |
| − | Karena password tidak perlu dibaca kembali, cukup dibandingkan hash-nya. | + | Karena password tidak perlu dibaca kembali, cukup dibandingkan hash-nya. |
| − | Tools & Environment | + | |
| + | ==Tools & Environment== | ||
Sistem | Sistem | ||
| − | OS: Ubuntu 24.04 LTS | + | * OS: Ubuntu 24.04 LTS |
| − | Python: ≥ 3.10 | + | * Python: ≥ 3.10 |
| − | Semua library: Open Source | + | * Semua library: Open Source |
Install Dependency | Install Dependency | ||
| − | sudo apt update | + | sudo apt update |
| − | sudo apt install -y python3 python3-pip gnupg | + | sudo apt install -y python3 python3-pip gnupg |
| − | pip install bcrypt cryptography | + | pip install bcrypt cryptography |
| − | |||
| − | |||
| − | |||
| − | password = "rahasia123" | + | ==Praktek 1 — Hash Password dengan Benar== |
| − | hash = hashlib.sha256(password.encode()).hexdigest() | + | ===Contoh SALAH (Sering Terjadi di Sistem Nyata)=== |
| − | print(hash) | + | import hashlib |
| + | |||
| + | password = "rahasia123" | ||
| + | hash = hashlib.sha256(password.encode()).hexdigest() | ||
| + | print(hash) | ||
Masalah besar: | Masalah besar: | ||
| − | ❌ Tidak ada salt | + | * ❌ Tidak ada salt |
| − | ❌ Rentan rainbow table | + | * ❌ Rentan rainbow table |
| − | ❌ SHA-256 bukan algoritma password | + | * ❌ SHA-256 bukan algoritma password |
| − | Cara BENAR — Password Hashing dengan bcrypt | + | |
| + | ===Cara BENAR — Password Hashing dengan bcrypt=== | ||
Prinsip bcrypt | Prinsip bcrypt | ||
| − | Built-in salt | + | * Built-in salt |
| − | Slow by design (anti brute force) | + | * Slow by design (anti brute force) |
| − | Standar industri (Linux, Django, Flask, dll) | + | * Standar industri (Linux, Django, Flask, dll) |
| + | |||
Script Aman (Production-Ready) | Script Aman (Production-Ready) | ||
| − | import bcrypt | + | import bcrypt |
| + | |||
| + | # Simulasi input user | ||
| + | password = b"PasswordKuat123!" | ||
| + | |||
| + | # Hash password | ||
| + | hashed = bcrypt.hashpw(password, bcrypt.gensalt()) | ||
| + | |||
| + | print("Hash tersimpan di database:") | ||
| + | print(hashed) | ||
| + | |||
| + | # ========================== | ||
| + | # Verifikasi saat login | ||
| + | # ========================== | ||
| + | input_password = b"PasswordKuat123!" | ||
| + | |||
| + | if bcrypt.checkpw(input_password, hashed): | ||
| + | print("Login berhasil") | ||
| + | else: | ||
| + | print("Password salah") | ||
| + | |||
| + | Penjelasan | ||
| + | * bcrypt.gensalt() → otomatis generate salt | ||
| + | * hashpw() → hash + salt | ||
| + | * checkpw() → bandingkan tanpa tahu password asli | ||
| − | + | Real Case | |
| − | |||
| − | + | Jika database bocor: | |
| − | |||
| − | + | user | password_hash | |
| − | + | --------------------- | |
| + | andi | $2b$12$K9x... | ||
| − | + | Attacker tidak bisa login, tidak bisa decrypt, tidak tahu password. | |
| − | + | Inilah definisi sistem yang benar-benar aman. | |
| − | |||
| − | |||
| − | + | ==Praktek 2 — Enkripsi Data Pribadi (AES)== | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | Praktek 2 — Enkripsi Data Pribadi (AES) | ||
Sekarang kita butuh enkripsi, bukan hashing. | Sekarang kita butuh enkripsi, bukan hashing. | ||
Data yang WAJIB dienkripsi: | Data yang WAJIB dienkripsi: | ||
| − | Email | + | * Email |
| − | NIK | + | * NIK |
| − | Nomor HP | + | * Nomor HP |
| − | Token API | + | * Token API |
| − | Data medis | + | * Data medis |
| − | Data akademik | + | * Data akademik |
| + | |||
| + | ===Konsep AES (Symmetric Encryption)=== | ||
| + | * Data bisa dikembalikan | ||
| + | * Pakai secret key | ||
| + | * Key HARUS dijaga | ||
| − | + | ===Enkripsi AES dengan Python (cryptography)=== | |
| − | |||
| − | |||
| − | |||
| − | Enkripsi AES dengan Python (cryptography) | ||
| − | |||
| − | |||
| − | + | ====Step 1 — Generate Key==== | |
| − | with open("secret.key", "wb") as f: | + | from cryptography.fernet import Fernet |
| − | + | ||
| + | key = Fernet.generate_key() | ||
| + | |||
| + | with open("secret.key", "wb") as f: | ||
| + | f.write(key) | ||
| + | |||
| + | print("Key disimpan ke secret.key") | ||
| − | |||
JANGAN commit key ke Git | JANGAN commit key ke Git | ||
| − | |||
| − | |||
| − | + | ====Step 2 — Enkripsi Data==== | |
| − | |||
| − | |||
| − | data = "nik=3201010101010001;email=andi@email.com" | + | from cryptography.fernet import Fernet |
| − | encrypted = cipher.encrypt(data.encode()) | + | |
| + | # Load key | ||
| + | key = open("secret.key", "rb").read() | ||
| + | cipher = Fernet(key) | ||
| + | |||
| + | data = "nik=3201010101010001;email=andi@email.com" | ||
| + | encrypted = cipher.encrypt(data.encode()) | ||
| + | |||
| + | print("Encrypted data:") | ||
| + | print(encrypted) | ||
| + | |||
| + | ====Step 3 — Dekripsi Data==== | ||
| + | |||
| + | decrypted = cipher.decrypt(encrypted) | ||
| + | print("Data asli:") | ||
| + | print(decrypted.decode()) | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Perbedaan Hash vs Enkripsi (Nyata) | Perbedaan Hash vs Enkripsi (Nyata) | ||
Operasi | Operasi | ||
| Line 155: | Line 174: | ||
Praktek 3 — Simulasi Kesalahan Fatal (Plaintext Storage) | Praktek 3 — Simulasi Kesalahan Fatal (Plaintext Storage) | ||
Sistem Salah (TAPI SERING ADA) | Sistem Salah (TAPI SERING ADA) | ||
| − | user = { | + | user = { |
| − | + | "username": "andi", | |
| − | + | "password": "Password123", | |
| − | + | "nik": "3201010101010001" | |
| − | } | + | } |
Jika bocor: | Jika bocor: | ||
Password bocor | Password bocor | ||
| Line 165: | Line 184: | ||
Melanggar UU PDP | Melanggar UU PDP | ||
Sistem Benar | Sistem Benar | ||
| − | user = { | + | user = { |
| − | + | "username": "andi", | |
| − | + | "password_hash": "<bcrypt hash>", | |
| − | + | "nik_encrypted": "<AES ciphertext>" | |
| − | } | + | } |
| − | Praktek 4 — GnuPG (GNU Privacy Guard) | + | |
| + | ==Praktek 4 — GnuPG (GNU Privacy Guard)== | ||
Tujuan Pembelajaran | Tujuan Pembelajaran | ||
Mahasiswa mampu: | Mahasiswa mampu: | ||
| Line 209: | Line 229: | ||
Setup Awal (Ubuntu 24.04) | Setup Awal (Ubuntu 24.04) | ||
Install GnuPG | Install GnuPG | ||
| − | sudo apt update | + | sudo apt update |
| − | sudo apt install -y gnupg | + | sudo apt install -y gnupg |
Cek versi: | Cek versi: | ||
| − | gpg --version | + | gpg --version |
BAGIAN 1 — Membuat Key Pair GnuPG | BAGIAN 1 — Membuat Key Pair GnuPG | ||
Step 1 — Generate Key | Step 1 — Generate Key | ||
| − | gpg --full-generate-key | + | gpg --full-generate-key |
Pilihan yang Direkomendasikan | Pilihan yang Direkomendasikan | ||
Please select what kind of key you want: | Please select what kind of key you want: | ||
| Line 231: | Line 251: | ||
Masukkan passphrase kuat. | Masukkan passphrase kuat. | ||
Step 2 — Lihat Key yang Dibuat | Step 2 — Lihat Key yang Dibuat | ||
| − | gpg --list-keys | + | gpg --list-keys |
| − | gpg --list-secret-keys | + | gpg --list-secret-keys |
Contoh output: | Contoh output: | ||
| − | pub rsa4096 2026-01-20 [SC] | + | pub rsa4096 2026-01-20 [SC] |
| − | uid Admin Kampus <admin@kampus.ac.id> | + | uid Admin Kampus <admin@kampus.ac.id> |
| − | sub rsa4096 2026-01-20 [E] | + | sub rsa4096 2026-01-20 [E] |
BAGIAN 2 — Enkripsi File (Public Key) | BAGIAN 2 — Enkripsi File (Public Key) | ||
Contoh File Sensitif | Contoh File Sensitif | ||
| − | echo "INI DATA SANGAT RAHASIA" > data_rahasia.txt | + | echo "INI DATA SANGAT RAHASIA" > data_rahasia.txt |
Enkripsi File | Enkripsi File | ||
| − | gpg --encrypt \ | + | gpg --encrypt \ |
| − | + | --recipient admin@kampus.ac.id \ | |
| − | + | data_rahasia.txt | |
Hasil: | Hasil: | ||
data_rahasia.txt.gpg | data_rahasia.txt.gpg | ||
| Line 249: | Line 269: | ||
shred -u data_rahasia.txt | shred -u data_rahasia.txt | ||
BAGIAN 3 — Dekripsi File (Private Key) | BAGIAN 3 — Dekripsi File (Private Key) | ||
| − | gpg --decrypt data_rahasia.txt.gpg | + | gpg --decrypt data_rahasia.txt.gpg |
Atau simpan ke file: | Atau simpan ke file: | ||
| − | gpg --decrypt data_rahasia.txt.gpg > data_buka.txt | + | gpg --decrypt data_rahasia.txt.gpg > data_buka.txt |
Akan diminta passphrase private key. | Akan diminta passphrase private key. | ||
BAGIAN 4 — Enkripsi & Dekripsi Message (Text) | BAGIAN 4 — Enkripsi & Dekripsi Message (Text) | ||
Enkripsi Pesan | Enkripsi Pesan | ||
| − | echo "Password database: RAHASIA" | \ | + | echo "Password database: RAHASIA" | \ |
| − | gpg --encrypt --armor -r admin@kampus.ac.id | + | gpg --encrypt --armor -r admin@kampus.ac.id |
Output: | Output: | ||
| − | -----BEGIN PGP MESSAGE----- | + | -----BEGIN PGP MESSAGE----- |
| − | hQIMAz... | + | hQIMAz... |
| − | -----END PGP MESSAGE----- | + | -----END PGP MESSAGE----- |
--armor → format teks (ASCII), cocok email/chat. | --armor → format teks (ASCII), cocok email/chat. | ||
Dekripsi Pesan | Dekripsi Pesan | ||
| − | gpg --decrypt message.asc | + | gpg --decrypt message.asc |
Atau langsung: | Atau langsung: | ||
| − | echo "-----BEGIN PGP MESSAGE-----..." | gpg --decrypt | + | echo "-----BEGIN PGP MESSAGE-----..." | gpg --decrypt |
BAGIAN 5 — Enkripsi Simetris (Tanpa Public Key) | BAGIAN 5 — Enkripsi Simetris (Tanpa Public Key) | ||
Digunakan jika: | Digunakan jika: | ||
| Line 272: | Line 292: | ||
Sistem lokal / offline | Sistem lokal / offline | ||
Enkripsi File | Enkripsi File | ||
| − | gpg --symmetric rahasia.txt | + | gpg --symmetric rahasia.txt |
Masukkan passphrase. | Masukkan passphrase. | ||
Dekripsi | Dekripsi | ||
| − | gpg --decrypt rahasia.txt.gpg | + | gpg --decrypt rahasia.txt.gpg |
Kurang ideal untuk tim besar. | Kurang ideal untuk tim besar. | ||
BAGIAN 6 — Proteksi AES Key (Best Practice) | BAGIAN 6 — Proteksi AES Key (Best Practice) | ||
| Line 302: | Line 322: | ||
❌ Tidak backup key | ❌ Tidak backup key | ||
BAGIAN 9 — Backup & Recovery Key | BAGIAN 9 — Backup & Recovery Key | ||
| − | gpg --export-secret-keys admin@kampus.ac.id > private_backup.gpg | + | gpg --export-secret-keys admin@kampus.ac.id > private_backup.gpg |
Simpan di: | Simpan di: | ||
Flashdisk offline | Flashdisk offline | ||
Latest revision as of 19:36, 22 January 2026
PRAKTEK 3: Kriptografi Praktis
Tujuan
Setelah praktek, mahasiswa benar-benar bisa mengamankan data, bukan sekadar tahu istilah. Mahasiswa mampu:
- Menyimpan password dengan benar
- Mengenkripsi data pribadi sensitif
- Membedakan hashing vs encryption secara nyata
- Memahami kesalahan fatal yang sering terjadi di sistem nyata
- Menghasilkan script Python siap pakai (production-ready)
Konsep Kunci (Wajib Dipahami Sebelum Koding)
Hash ≠ Enkripsi
| Aspek | Hashing | Enkripsi |
|---|---|---|
| Bisa dibalik? | ❌ Tidak | ✅ Bisa (pakai key) |
| Tujuan | Verifikasi | Perlindungan data |
| Contoh | Password | Email, NIK, Token |
| Jika DB bocor | Relatif aman | Aman jika key aman |
Kesalahan paling umum di dunia nyata:
- ❌ Password dienkripsi
- ❌ Password disimpan plaintext
- ❌ Password pakai MD5/SHA1
- ❌ Tidak pakai salt
Golden Rule Password Security
Password:
- ❌ tidak pernah disimpan plaintext
- ❌ tidak pernah dienkripsi
- ✅ selalu di-hash
- ✅ selalu pakai salt
- ✅ selalu pakai algoritma khusus password
Kenapa tidak dienkripsi? Karena password tidak perlu dibaca kembali, cukup dibandingkan hash-nya.
Tools & Environment
Sistem
- OS: Ubuntu 24.04 LTS
- Python: ≥ 3.10
- Semua library: Open Source
Install Dependency
sudo apt update sudo apt install -y python3 python3-pip gnupg pip install bcrypt cryptography
Praktek 1 — Hash Password dengan Benar
Contoh SALAH (Sering Terjadi di Sistem Nyata)
import hashlib password = "rahasia123" hash = hashlib.sha256(password.encode()).hexdigest() print(hash)
Masalah besar:
- ❌ Tidak ada salt
- ❌ Rentan rainbow table
- ❌ SHA-256 bukan algoritma password
Cara BENAR — Password Hashing dengan bcrypt
Prinsip bcrypt
- Built-in salt
- Slow by design (anti brute force)
- Standar industri (Linux, Django, Flask, dll)
Script Aman (Production-Ready)
import bcrypt
# Simulasi input user
password = b"PasswordKuat123!"
# Hash password
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
print("Hash tersimpan di database:")
print(hashed)
# ==========================
# Verifikasi saat login
# ==========================
input_password = b"PasswordKuat123!"
if bcrypt.checkpw(input_password, hashed):
print("Login berhasil")
else:
print("Password salah")
Penjelasan
- bcrypt.gensalt() → otomatis generate salt
- hashpw() → hash + salt
- checkpw() → bandingkan tanpa tahu password asli
Real Case
Jika database bocor:
user | password_hash --------------------- andi | $2b$12$K9x...
Attacker tidak bisa login, tidak bisa decrypt, tidak tahu password. Inilah definisi sistem yang benar-benar aman.
Praktek 2 — Enkripsi Data Pribadi (AES)
Sekarang kita butuh enkripsi, bukan hashing. Data yang WAJIB dienkripsi:
- NIK
- Nomor HP
- Token API
- Data medis
- Data akademik
Konsep AES (Symmetric Encryption)
- Data bisa dikembalikan
- Pakai secret key
- Key HARUS dijaga
Enkripsi AES dengan Python (cryptography)
Step 1 — Generate Key
from cryptography.fernet import Fernet
key = Fernet.generate_key()
with open("secret.key", "wb") as f:
f.write(key)
print("Key disimpan ke secret.key")
JANGAN commit key ke Git
Step 2 — Enkripsi Data
from cryptography.fernet import Fernet
# Load key
key = open("secret.key", "rb").read()
cipher = Fernet(key)
data = "nik=3201010101010001;email=andi@email.com"
encrypted = cipher.encrypt(data.encode())
print("Encrypted data:")
print(encrypted)
Step 3 — Dekripsi Data
decrypted = cipher.decrypt(encrypted)
print("Data asli:")
print(decrypted.decode())
Perbedaan Hash vs Enkripsi (Nyata) Operasi Output Hash password Tidak bisa dibalik Enkripsi NIK Bisa dibaca kembali Login Compare hash Kirim data Decrypt
Praktek 3 — Simulasi Kesalahan Fatal (Plaintext Storage)
Sistem Salah (TAPI SERING ADA)
user = {
"username": "andi",
"password": "Password123",
"nik": "3201010101010001"
}
Jika bocor: Password bocor Identitas bocor Melanggar UU PDP Sistem Benar
user = {
"username": "andi",
"password_hash": "<bcrypt hash>",
"nik_encrypted": "<AES ciphertext>"
}
Praktek 4 — GnuPG (GNU Privacy Guard)
Tujuan Pembelajaran Mahasiswa mampu: Memahami konsep kriptografi asimetris Membuat dan mengelola key GnuPG Mengenkripsi & mendekripsi file Mengenkripsi & mendekripsi pesan (text/message) Menggunakan GnuPG untuk key management system nyata Menghindari kesalahan fatal pengelolaan key Konsep Dasar GnuPG Kriptografi Asimetris Komponen Fungsi Public Key Untuk enkripsi Private Key Untuk dekripsi Passphrase Melindungi private key
Analogi sederhana: Public key = alamat rumah Private key = kunci rumah Semua orang boleh punya alamat rumah, hanya pemilik kunci yang bisa membuka pintu. Kapan GnuPG Dipakai? GnuPG cocok untuk: Enkripsi file backup Enkripsi key AES / API token Distribusi data antar admin Proteksi dokumen sensitif Sistem tanpa cloud / offline Bukan untuk hashing password. Setup Awal (Ubuntu 24.04) Install GnuPG
sudo apt update sudo apt install -y gnupg
Cek versi:
gpg --version
BAGIAN 1 — Membuat Key Pair GnuPG Step 1 — Generate Key
gpg --full-generate-key
Pilihan yang Direkomendasikan Please select what kind of key you want: (1) RSA and RSA ← PILIH INI
RSA keys may be between 1024 and 4096 bits. 4096
Key is valid for? (0) ← no expiry (atau 1y untuk produksi)
Name: Admin Kampus Email: admin@kampus.ac.id
Masukkan passphrase kuat. Step 2 — Lihat Key yang Dibuat
gpg --list-keys gpg --list-secret-keys
Contoh output:
pub rsa4096 2026-01-20 [SC] uid Admin Kampus <admin@kampus.ac.id> sub rsa4096 2026-01-20 [E]
BAGIAN 2 — Enkripsi File (Public Key) Contoh File Sensitif
echo "INI DATA SANGAT RAHASIA" > data_rahasia.txt
Enkripsi File
gpg --encrypt \
--recipient admin@kampus.ac.id \
data_rahasia.txt
Hasil: data_rahasia.txt.gpg File asli masih ada → sebaiknya dihapus manual. shred -u data_rahasia.txt BAGIAN 3 — Dekripsi File (Private Key)
gpg --decrypt data_rahasia.txt.gpg
Atau simpan ke file:
gpg --decrypt data_rahasia.txt.gpg > data_buka.txt
Akan diminta passphrase private key. BAGIAN 4 — Enkripsi & Dekripsi Message (Text) Enkripsi Pesan
echo "Password database: RAHASIA" | \ gpg --encrypt --armor -r admin@kampus.ac.id
Output:
-----BEGIN PGP MESSAGE----- hQIMAz... -----END PGP MESSAGE-----
--armor → format teks (ASCII), cocok email/chat. Dekripsi Pesan
gpg --decrypt message.asc
Atau langsung:
echo "-----BEGIN PGP MESSAGE-----..." | gpg --decrypt
BAGIAN 5 — Enkripsi Simetris (Tanpa Public Key) Digunakan jika: Tidak perlu distribusi key publik Sistem lokal / offline Enkripsi File
gpg --symmetric rahasia.txt
Masukkan passphrase. Dekripsi
gpg --decrypt rahasia.txt.gpg
Kurang ideal untuk tim besar. BAGIAN 6 — Proteksi AES Key (Best Practice) Contoh Kasus Nyata Python AES key → jangan disimpan plaintext gpg --encrypt -r admin@kampus.ac.id secret.key rm secret.key Saat Dibutuhkan: gpg --decrypt secret.key.gpg > secret.key Dipakai di: Server kampus Sistem pemerintah Pipeline AI offline
BAGIAN 7 — Export & Import Public Key (Distribusi Aman) Export Public Key gpg --export --armor admin@kampus.ac.id > publickey.asc Import Public Key gpg --import publickey.asc Public key boleh dibagikan bebas. BAGIAN 8 — Kesalahan Fatal (WAJIB DIHINDARI) ❌ Private key di-share ❌ Passphrase kosong ❌ Key disimpan di GitHub ❌ Enkripsi tapi key bocor ❌ Tidak backup key BAGIAN 9 — Backup & Recovery Key
gpg --export-secret-keys admin@kampus.ac.id > private_backup.gpg
Simpan di: Flashdisk offline Brankas fisik Air-gapped storage Integrasi dengan Sistem Nyata Digunakan untuk: Enkripsi backup database Proteksi token API Enkripsi dataset riset Secure DevOps pipeline Sistem offline-first Output Skill Mahasiswa Mahasiswa bukan hanya paham, tapi bisa melakukan: ✅ Generate & manage key ✅ Enkripsi file & message ✅ Proteksi key AES ✅ Key distribution ✅ Backup & recovery key Analisis Kesalahan Umum (Wajib Masuk Laporan) Menyimpan password plaintext Enkripsi password (salah konsep) Tidak pakai salt Menyimpan key di source code Commit key ke GitHub Penutup Sistem aman bukan sistem yang tidak bisa dibobol, tetapi sistem yang tetap aman meskipun database bocor. Praktikum ini bukan latihan akademik, melainkan fondasi keamanan nyata untuk: Sistem kampus Startup AI pipeline Sistem pemerintah Infrastruktur data nasional