2.8 - Summarize the basics of cryptographic concepts.

Question 1

Digital signatures

Answer 1

-uses encrpyed hash of a msg
->hash encrypted wth sender’s PRIVATE key

-digital signature alg relies on public key cryptography + hashing functions

-if recipient can decrypt the hash it provides 3 benefits;

Authentication
->Prove the source of the message/identifies sender of the email
->email came from who it appears to be coming from

Non-repudiation
->Make sure the signature isn’t fake
->sender can’t later deny sending the msg
->sometimes req 4 online transactions

Integrity
->Prove the message was not changed
->provides assurances msg not modified/corrupted
->recipients know the msg is the same as the sent msg

-Sign with the private key
->msg doesn’t need to be encrypted
->Nobody else can sign this (obviously)

Verify with the public key
->Any change in the msg will invalidate the signature

EX:
-Alice encrypts using her private key (encrypted msg = digital signature)
->Bob decrypts digital signature using Alice’s public key

Gibson 370
Chapple 207

Question 2

• Key length

Question 3

• Key stretching

Answer 3

*
Already built for your application
– No additional programming involved
*
bcrypt
– Generates hashes from passwords
– An extension to the UNIX crypt library
– Uses Blowfish cipher to perform multiple
rounds of hashing
*
Password-Based Key Derivation Function 2 (PBKDF2)
– Part of RSA public key cryptography standards
(PKCS #5, RFC 2898)

Question 4

• Salting

Answer 4

Adding some salt
*
Salt
– Random data added to a password when hashing
*
Every user gets their own random salt
– The salt is commonly stored with the password
*
Rainbow tables won’t work with salted hashes
– Additional random value added to the
original password
*
This slows things down the brute force process
– It doesn’t completely stop the reverse engineering
*
Each user gets a different random hash
– The same password creates a different hash

Question 5

• Hashing

Answer 5

Hashes
-Represent data as a short string of text - A message digest
-One-way trip
–> Impossible to recover the original message from the digest
–> Used to store passwords / confidentiality
-Verify a downloaded document is the same as the original
–> Integrity
-Can be a digital signature
–> Authentication, non-repudiation, and integrity
-Will not have a collision (hopefully)
–> Different messages will not have the same hash

Practical hashing
-Verify a downloaded file
–> Hashes may be provided on the download site
–> Compare the downloaded file hash with the
posted hash value
-Password storage
–> Instead of storing the password, store a salted hash
–> Compare hashes during the authentication process
–> Nobody ever knows your actual password

Question 6

• Key exchange

Answer 6

*
A logistical challenge
– How do you transfer an encryption key across an
insecure medium without having an encryption key?
*
Out-of-band key exchange
– Don’t send the symmetric key over the ‘net
– Telephone, courier, in-person, etc.

Question 7

ECC

Answer 7

Elliptic-curve cryptography (gibson 365, chapple 204)

-graphs points on curve to create keys

Instead of numbers, use curves!
– Smaller storage and transmission requirements
– Perfect for mobile devices
-doesn’t take as much processing power as other cryptographic methods
-keys can be much smaller compared to non ECC keys

-common use cases of low power devices
-sometimes used wth smaller wireless devices b/c doesn’t take much processing power to achieve desired security
-use 4 asymmetric encryption

Asymmetric encryption
– Need large integers composed of two or more large prime factors

-256 bit elliptic curve public key = provide same sec benefit of a 3072 key used wth DSA

defined by equation: ysquared = xtothethird + ax + b

Question 8

PFS

Answer 8

Perfect Forward Secrecy

Change the method of key exchange
– Don’t use the server’s private RSA key
*
Elliptic curve or Diffie-Hellman ephemeral
– The session keys aren’t kept around
*
Can’t decrypt with the private server key
– Every session uses a different private key for the
exchange
*
PFS requires more computing power
– Not all servers choose to use PFS
*
The browser must support PFS
– Check your SSL/TLS information for details

Question 9

• Communications (Quantum)

Question 10

• Computing (Quantum)

Question 11

Post-quantum

Question 12

Ephemeral

Question 13

• Authenticated (Modes of operation)

Question 14

• Unauthenticated (Modes of operation)

Question 15

• Counter (Modes of operation)

Question 16

Public ledgers (Blockchain)

Question 17

Stream (Cipher suites)

Question 18

Block (Cipher suites)

Question 19

Symmetric vs. asymmetric

Answer 19

Symmetric encryption
A single, shared key
– Encrypt with the key
– Decrypt with the same key
– If it gets out, you’ll need another key
Secret key algorithm
– A shared secret
Doesn’t scale very well
– Can be challenging to distribute
Very fast to use
– Less overhead than asymmetric encryption
– Often combined with asymmetric encryption

Asymmetric encryption
Public key cryptography
– Two (or more) mathematically related keys
Private key - Keep this private
Public key - Anyone can see this key - Give it away
The private key is the only key that can decrypt data
encrypted with the public key
– You can’t derive the private key from the public key

Question 20

Lightweight cryptography

Answer 20

*Powerful cryptography has traditionally
required strength
– A powerful CPU and lots of time
*Internet of Things (IoT) devices have limited power
– Both watts and CPU
*New standards are being created
– National Institute of Standards and Technology (NIST)
leading the effort
– Provide powerful encryption
– Include integrity features
– Keep costs low

Question 21

• Audio (Steganography)

Question 22

• Video (Steganography)

Question 23

• Image (Steganography)

Question 24

HE

Answer 24

Homomorphic encryption

Encrypted data is difficult to work with
– Decrypt the data
– Perform a function
– Encrypt the answer

Homomorphic encryption
– Perform calculations of data while it’s encrypted
– Perform the work directly on the encrypted data
– The decrypted data can only be viewed with
the private key

Advantages
– Securely store data in the cloud
– Perform research on data without viewing the data

Question 25

-Low power devices (Common use cases)

Question 26

• Low latency (Common use cases)

Question 27

• High resiliency (Common use cases)

Question 28

• Supporting confidentiality (Common use cases)

Question 29

• Supporting integrity (Common use cases)

Question 30

• Supporting obfuscation (Common use cases)

Question 31

• Supporting authentication (Common use cases)

Question 32

• Supporting non-repudiation (Common use cases)

Question 33

• Speed (Limitations)

Question 34

• Size (Limitations)

Question 35

• Weak keys (Limitations)

Question 36

• Time (Limitations)

Question 37

• Longevity (Limitations)

Question 38

• Predictability (Limitations)

Question 39

Reuse (Limitations)

Question 40

Entropy (Limitations)

Question 41

Computational overheads (Limitations)

Question 42

Resource vs. security constraints (Limitations)