Domain 3 - Encryption

65 flashcards · Computer Science · by Jaysen Lewis

1. What are the 2 main categories of Encryption?

   Symmetric (Same Key) 1 Shared key Encrypt & Decrypt operations use the same shared secret key. Unmanageable amounts of keys in large organizations. Asymmetric 2 Keys (Recipient's Public and Private Key) Your Public Key is publicly available. Used by others to encrypt messages sent to you. Since the key is asymmetric, the cipher text can't be decrypted with your public Key. Your Private Key - You keep this safe. You use it to decrypt messages sent with your public key. Also used for digital sign…

2. What's one of the down-sides to Symmetric Encryption?

   Requires a lot of keys if you have a large group of users who need to share secrets; as your group grows, can result in an unmanageable amount of keys (Asymmetric Encryption solves this problem). There is a formula to compute the number of symmetric keys required for an entire group to communicate: Example of keys required per group size:

3. How many keys are required per user with Asymmetric Encryption?

   2 keys per user.

4. Know the difference between Codes & Ciphers:

   Code: A system that substitutes one word/ phrase for another; intended to provide secrecy and/or efficiency. Think of Radio codes (like 10-4) Cipher: Systems that use mathematical algorithms to encrypt and decrypt messages.

5. What are the different types of Ciphers?

   Stream Cipher 1 bit at a time Block Cipher Blocks/ chunks at a time Substitution Ciphers Changes/ shifts the characters of a message Rotation Ciphers are a type of substitution cipher that shifts each letter by a certain increment Named like "ROT13" indicating the increment to shift (13). Transposition Ciphers: Scrambles/ Rearranges the characters in a message.

6. Understand the "Exclusive Or" (XOR) Operation:

   A logical operation that is true when 1 and only 1 of the inputs is true. Truth Table: So, if 2 inputs are true (like the bottom example).. then the XOR is False. The XOR is only True when a single input is True.

7. Understand One-Time Pad Encryption and why it's difficult to implement:

   The strongest algorithm invented 100 years ago Unbreakable due to it being totally random and as long as the sender uses the one-time pad only once. However, difficult to implement because of distribution: the sender & receiver have to be in the same room physically to transfer the 1-time pad and need to meet again once they run out of pages. Encryption: Decryption:

8. What are the goals of Cryptography?

   CAIN (CIA Triad + Non-Repudiation): C - Confidentiality (or Privacy) A - Authentication I - Integrity N - Non-Repudiation

9. If Alice wants to send a message to Bob using Symmetric cryptography, what key does she use to encrypt the message?

   Shared Secret Key

10. Describe the DES encryption algorithm:

    Data Encryption Standard (DES) a Symmetric encryption algorithm 64 bit Block Cipher Key length = 56 bits Not Secure

11. What is 3DES (or Triple DES)?

    An old workaround when DES was originally being phased out. Symmetric encryption algorithm 64 bit Block Cipher Applies DES encryption 3 times = 112 bit key length Not Secure. Now being phased out for Govt applications. 3 different keying options

12. What is AES?

    Advanced Encryption Standard (AES) aka Rijndael (won the competition led by NIST to replace DES). Combines substitution and transposition Symmetric encryption algorithm 128 bit Block Cipher Key length of either 128, 192 or 256 bits Secure

13. What is the Blowfish algorithm?

    A public domain algorithm developed by Bruce Schneier as a potential replacement for DES. Combines substitution and transposition Symmetric encryption algorithm 64 bit Block Cipher Key Length between 32-448 bits. Not Secure - Bruce doesn't even recommend it anymore

14. What is the Twofish Algorithm?

    Twofish was a competitor of Rijndael in the same NIST competition that almost won for AES. Symmetric encryption algorithm 128 bit Block Cipher Key Length of 128, 192 or 256 bits Secure Same stats as AES

15. What is RC4?

    Invented in 1987 by Ron Rivest (of RSA Security) as a proprietary trade secret algorithm (not protected by a patent) until someone leaked it in 1994. Used a lot in network based encryption schemes WEP & WPA, SSL, TLS all allowed RC4 as their underlying algorithm Symmetric encryption algorithm Stream cipher Variable length key between 40-2048 bits Uses a psuedorandom keystream Not Secure

16. What does the Counter Mode functionality do in cryptography?

    Allows a Block Cipher to act more like a Stream Cipher.

17. What is Steganography?

    Hiding something within something else, or data hidden within other data. Hiding text within text Hiding text in the pixels of seemingly innocuous image files. Hiding data in harmless-looking, larger files Can also be used in audio & video files.

18. Know the quick-facts about RSA Encryption:

    An early Asymmetric algorithm (named after Rivest, Shamir and Adleman). The patent expired in 2000. When users create RSA key pairs, 2 very large prime numbers are used (Public and Private key) Variable key length 1024-4096 bits. RSA is more-commonly used to exchange symmetric keys. Slow Considered secure as long as you use a key length of at least 1024 bits.

19. What is the PGP encryption framework?

    Pretty Good Privacy (PGP) Uses public & private key pairs Remember, it's a framework -not an algorithm. It relies upon other encryption algorithms to perform the encrypt/ decrypt operations. combines both symmetric and asymmetric cryptography used for signing, encrypting/decrypting texts, e-mails, files, directories, and whole disk partitions Uses a "Web of Trust" model to authenticate digital certificates, if you trust me, you trust everyone I trust. PGP Encryption: PGP Decryption:

20. What is Elliptic Curve cryptography (ECC)?

    ECC does not depend upon the prime factorization problem. Instead it uses the EC discrete log problem. Most susceptible to quantum computing attacks.

21. What are some examples of Out-of-Band key exchanges?

    Physical Key Exchange Mailed Key Exchange

22. What is In-Band Key Exchange and what is an example:

    A way of securely exchanging keys digitally. Diffie-Hellman key exchange algorithm

23. What are the key points about the Diffie-Hellman key exchange algorithm?

    An In-Band approach to key exchange. Since asymmetric cryptography is based upon the difficulty of the "prime factorization problem" (solving complex math problems), this provides the security for this algorithm. Provides secure symmetric key exchange capability.

24. What is Key Stretching?

    Salting & Hashing keys to make them stronger. Using mathematical techniques to strengthen an insecure value, making it harder to crack. Slows things down when trying to make millions of guesses. Utilizes Salts & Hashes: Salting: Adds a value to the encryption key to make it more complex. Hashing: Adds time to the key-checking verification process by requiring more math.

25. What is Key Escrow?

    Allows govt access to keys if certain conditions (Court Order) are met. Secret key is divided into two parts and handed over to a third party (like the govt/ police) Not really a secure way of implementing this without compromising the privacy of innocent citizens. "The Clipper Chip" is an example of Key Escrow and caused tremendous public controversy and never became widely adopted and contained fundamental flaws that made it a bad option anyways.

26. What algorithm uses the Blowfish cipher along with a salt to strengthen cryptographic keys?

    Bcrypt

27. In the early 1990s, the National Security Agency attempted to introduce key escrow using what failed technology?

    Clipper Chips

28. Which form of encryption is used only to encrypt data in transit over a network and cannot be used to encrypt data at rest?

    TKIP TKIP is only used as a means to encrypt transmissions and is not used for data at rest. RSA, AES, and 3DES are all used on data at rest as well as data in transit.

29. What is the name of the cryptographic principle that states that cryptographic algorithms should be open to public inspection and should be secure even if everything about the system, except the key, is public knowledge.

    Kerckhoff's principle.

30. What are 3 ways we can establish certainty of the identity of the people we're exchanging keys with?

    1) In-person, physical exchange (cumbersome) 2) Web of Trust (WoT) 3) Use PKI

31. PKI depends highly upon ______________ for defining trust?

    Certificate Authorities (CA's) * Highly trusted centralized service providers/ CAs

32. What are the 2 common ways Hash functions might fail?

    1) If it can be reversed (If they go public, they aren't secure). 2) If 2 inputs produce the same hashed output. (aka Hash Collisions)

33. Describe Hash functions:

    --> One-way functions that transform variable length input into a unique, fixed-length output that can be checked. can't be reversed Uses: Compare hashes to validate the integrity of data. If no changes were detected, the data is good. used with assymetric cryptography for digital signatures and certificates. Prove authenticity Hashes are used for integrity checking *not confidentiality protection

34. What is Message Digest 5?

    MD5 Hash algorithm that produces a 128-bit hashes no longer secure and should not be used. Many systems still use it though.

35. Know that basics of SHA:

    SHA Secure Hash Algorithm Govt standard created by NIST NSA helped with it (kind of scary). SHA-1 160-bit hash value SHA-2 a family of 6 functions: Mathematically similar to SHA-1 and MD5 128 bits is not allowed (insecure) SHA-3 2006 via NIST competition to replace SHA-2 Uses Keccak for Hash gen. Produces hashes of a user-selected length.

36. What is RIPEMD?

    RIPEMD: RACE Integrity Primitives Evaluation Message Digest A Hash algorithm that was developed outside of government-sponsored hash functions. 4 Variants that produce hashes of 128, 160,256 and 320 bit hashes. 160 bit version is used widely in BitCoin transactions.

37. What is HMAC?

    Hash-based Message Authentication Code One of the uses of hash functions Combines symmmetric cryptography and hashing to provide authentication and integrity of messages.

38. Know the key points about Digital Certificates:

    Electronic alternative to physical signatures They use the X.509 standard and contain a copy of an entity's public key. They provide integrity, authentication and non-repudiation. Proves that the owner of the public key is the person who signed the message the message was not altered after being signed recipient can prove this to a 3rd party if required. • Users register public keys with a certification authority (CA). • Digital signature is generated by the user’s public key and validity perio…

39. What do digital signatures depend upon?

    No collisions with hash functions/ Unique output Asymmetric Cryptography

40. Know the Approved Digital Signature Standard (DSS) Algorithms:

    DSA (Digital Signature Algorithm) RSA (Rivest-Shamir-Adelman) Elliptic Curve Digital Signature Algorithm (ECDSA)

41. Which standard governs the structure and content of digital certificates?

    X.509

42. What are the 3 steps for digital certificates?

    1) Enrollment 2) Verification 3) Revocation

43. What is the most effective method of revoking digital certificates?

    Online Certificate Status Protocol (Cert Revocation Lists are not the most effective)

44. What type of digital certificate offers the highest possible level of trust?

    EV

45. What type of certificate do Load Balancers commonly use?

    Wildcard Certificates

46. What are the different types of certs?

    Root Certificates core cert at the heart of a CA protects CA Private Keys used as the "root" of trust in cert chains DV - Domain Validation verifies domain ownership OV - Organizational Validation verifies Business Name EV - Extended Validation provides highest level of trust requires extensive investigation CA Issuing Certificates vouch for the certificate subject's identity Wildcard Certificates cover an entire domain but only matches 1 level deep example: *.jalewismusic.com

47. Know the basics of PKI *** This is a great card to memorize ***

48. Are CRT files binary or text?

    Trick question: It depends. They can either be DER Binary or PEM text. You cannot tell whether a CRT file is binary or text without examining the contents of the file.

49. Know the different cert formats:

50. Who provides the digital signature on a digital certificate?

    The CA.

51. What technology can you use to tell clients that a certificate is unlikely to change over time?

    Certificate Pinning Ties a certificate to a subject for a period of time Allows for a trusted copy of a certificate or public key to be associated with a server and thus reducing the likelihood of frequently visited sites being subjected to MiM attacks. Certificates or public keys can be pinned after a trusted connection has been established or the pinning can be preloaded in an application, which is the preferred method for mobile applications. Pinning can take the form of certificate pinning…

52. Which type of CA is typically offline?

    Root CA

53. What technology allows web servers to attach an OCSP validation to the certificate they send to users?

    Certificate Stapling

54. What type of attack is happening when an attacker tries all possible patterns and combinations to find correct key.

    Brute-Force Attack aka "Known Ciphertext" attacks

55. What type of knowledge-based attack studies patterns of letters and ciphertext?

    Frequency Analysis attacks Think - "Patterns of letters" is essentially how-often, how-frequent they occur

56. What type of attack is occurring when an attacker has access to the encrypted and unencrypted versions of a message?

    Known Plaintext Attack The key here is that the attacker has the "unencrypted" aka plaintext data.

57. What is a Chosen Plaintext Attack?

    When an attacker studies an algorithm's workings to learn the key being used and then creates an encrypted message of their choice, sends that message to another user expecting the user will forward that message as cipher text.

58. What type of attack searches for hash collisions and exploits that?

    Birthday Attack

59. What type of attack relies on a compromised communications path?

    Eavesdropping Attack

60. Know the difference between Active and Passive attacks

    Active Attacks - use different methods such as message or file modification attempting to break encryption keys, algorithm. Passive Attacks - Use eavesdropping or packet sniffing to find or gain access to information.

61. Which 3 encryption algorithms are approved as part of the federal Digital Signature Standard under FIPS 186-4?

    DSA, ECDSA & RSA Digital Signature Algorithm (DSA) Elliptic Curve DSA (ECDSA) Rivest, Shamir, Adleman (RSA)

62. Know the difference between Cryptography, Cryptanalysis, Cryptology and Cryptosystems

    Cryptography --> Art of converting plain text to cipher text Cryptanalysis --> Art of breaking the cipher Cryptology --> Science of Cryptography and Cryptanalysis Cryptosystem --> Implementation of code/cipher in Hardware or Software

63. Know Symmetric vs. Asymmetric Cryptography Workflow:

64. What is a TOCTOU attack?

    In a Time of Check/Time of Use (TOCTOU) attack, the attacker exploits the difference in time between when a security control is verified and the data protected by the control is actually used. Example: A hacker recently violated the integrity of data in James’s company by modifying a file using a precise timing attack. The attacker waited until James verified the integrity of a file’s contents using a hash value and then modified the file between the time that James verified the integrity and r…

65. What element of a certificate goes on a certificate revocation list?

    Serial Number (issued by the CA)