Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

WGU > Applications of Cryptography > Flashcards

Applications of Cryptography Flashcards

1
Q

FIPS Standards

A

FIPS 140: Cryptographic Modules
FIPS 186: Digital Signatures
FIPS 197: AES
FIPS 201: Identity Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Digital Signatures

A

Encryption of a message digest with the sender’s private key. Provides:

  • Authentication
  • Integrity
  • Non-repudation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Digital Certificate

A

A digital document that contains a public key and some information to allow your system to verify where that key came from.
Uesd for web servers, Cisco Secure phones, E-Commerce.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

PKI (Public Key Infrastructure)

A

Uses asymmetric key pairs and combines software, encryption and services to provide a means of protecting the security of business communication and transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

PKCS (Public Key Cryptography Standards)

A

Put in place by RSA to ensure uniform certificate management throughout the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Trusted Third Party (TTP)

A

Certificate, a digital representation of the information that identifies you as a relevant entity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CA (Certification Authority)

A

An entity trusted by one or more users to manage certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

RA (Registration Authority)

A

Used to take the burden off of a CA by handling verification prior to certificates being issued. Acts as a proxy between user and CA. Receives request, authenticates it and forwards it to the CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

CP (Certificate Policy)

A

A set of rules that defines how a certificate may be used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

X.509

A

The most widely used digital certificate standard. First issued July 3, 1988. It is a digital document that contains a public key signed by the trusted third party, which is known as a Certificate Authority, or CA. Relied on by S/MIME. Contains your name, info about you, and a signature of a person who issued the certificate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

X.509 Certificate Content

A 
Version
Certificate holder's public key
Serial number
Certificate's validity period
Unique name of certificate issuer
Digital signature of issuer
Signature algorithm identifier
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

X.509 Certificate File Extensions

A 
.pem
.cer, .crt., .der
.p7b, .p7c
.p12
.pfx
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

.pem

A

Privacy Enhanced Mail, a Base64 encoded DER certificate, enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

.cer, .crt, .der

A

Usually in binary DER form, but Base64-encoded certificates are common also (see .pem).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

.p7b, .p7c

A

PKCS#7 SignedData structure without data, just certificate(s) or CRL(s).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

.p12

A

PKCS#12, may contain certificate(s) (public) and private keys (password protected).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

.pfx

A

Predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., w/ PFX files generated in IIS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Certificate Authority (CA)

A

The primary role of this is to digitally sign and publish the public key bound to a given user. It is an entity trusted by one or more users to manage certificates. Verisign is an example.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Certificate Authority - Verisign - Class 1

A

For individuals, intended for email

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Certificate Authority - Verisign - Class 2

A

For organizations for which proof of identity is required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Certificate Authority - Verisign - Class 3

A

For servers and software signing, for which independent verification and checking of identity and authority is done by the issuing CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Certificate Authority - Verisign - Class 4

A

For online business transactions between companies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Certificate Authority - Verisign - Class 5

A

For private organizations or governmental security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Registration Authority (RA)

A

Used to take the burden off of a CA by handling verification prior to certificates being issued. Acts as a proxy between the user and the CA. Receives request, authenticates it, and forwards it to the CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Public Key Infrastructure (PKI)

A

)
Distributes digital certificates that contain public keys. A network of trusted certificate authority servers. An arrangement that binds public keys with user identities by means of a CA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Certificate Revocation List (CRL)

A

A list of certificates that have been revoked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Online Certificate Status Protocol (OCSP)

A

A real time protocol for verifying certificates (and a newer method than CRL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Server-based Certificate Validation Protocol (SCVP)

A

An Internet protocol for determining the path between a X.509 digital certificate and a trusted root (Delegated Path Discovery) and the validation of that path (Delegated Path Validation) according to a particular validation policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Digital Certificate Management

A

Two types of systems:
Centralized key-management systems
Decentralized key-management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Three phases of key life cycle (Digital Certificate Management)

A

Setup and initialization
Administration
Cancellation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Setup and Initialization Phase (Digital Certificate Management, 3 phases)

A

Process components:
Registration
Key pair generation
Certificate Generation Certificate Dissemination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cancellation and History Phase (Digital Certificate Management, 3 phases)

A 
Expiration
Renewal
Revocation
Suspension
Destruction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Administration Phase (Digital Certificate Management, 3 phases)

A

Key Storage
Certificate retrieval and validation
Backup or escrow
Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Update and Patch Vulnerabilities (Digital Certificate Management)

A
  • Person who can recover keys from the keystore on behalf of a user
  • Highly trusted person
  • Issue recovery agent
    ·EFS recovery agent certificate
    ·Key recovery agent cert
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Hierarchical Trust Model

A

Certificate Authority is at the top
Intermediate CAs are the next level
Users are the bottom level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Single Authority Trust Model

A

Certificate Authority is at the top

Users are directly below the CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Web of Trust - Trust Model

A

Users all trust each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Password Authentication Protocol (PAP)

A

One of the most basic authentication protocols. Passwords are sent over the network in clear text. The basic authentication feature built into HTTP uses this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Shiva Password Authentication Protocol (S-PAP)

A

This is a proprietary version of PAP. Encrypts username and password as it is sent across network.

40
Q

Challenge-Handshake Authentication Protocol (CHAP)

A

Authenticator sends a “challenge” message to the peer after link establishment. Peer responds with a value using a “one-way hash” function. Authenticator checks the response against its own calculation of the hash value. Authenticator sends new challenges to the peer at random intervals.

41
Q

Kerberos

A

Widely used, particularly with Microsoft operating systems.
Created by MIT and derives its name from the mythical three headed dog. The is a great deal of verification for the tickets and the tickets expire quickly. Client authenticates to the Authentication Server once using a long term shared secret and receives back a Ticket-Granting Server. Client can reuse this ticket to get additional tickets without reusing the shared secret. These tickets are used to prove authentication to the Service Server.

42
Q

Principal (Components of Kerberos System)

A

A server or client that Kerberos can assign tickets to.

43
Q

Authentication Server (AS) - (Components of Kerberos System)

A

Server that authorizes the principal and connects them to the Ticket Granting Server.

44
Q

Ticket Granting Server (TGS) - (Components of Kerberos System)

A

Provides tickets.

45
Q

Key Distribution Center (KDC) - (Components of Kerberos System)

A

A server that provides the initial ticket and handles TGS requests. Often runs as TGS services.

46
Q

Realm (Components of Kerberos System)

A

A boundary within an organization. Each realm has its own AS and TGS.

47
Q

Remote Ticket Granting Server (RTGS) - (Components of Kerberos System)

A

A TGS (Ticket Granting Server) in a remote realm.

48
Q

Ticket Granting Ticket (TGT) - (Components of Kerberos System)

A

The ticket that is granted during the authentication process.

49
Q

Ticket (Components of Kerberos System)

A

Used to authenticate to the server. Contains identity of client, session key, timestamp, and checksum. Encrypted with servers key.

50
Q

Session key (Components of Kerberos System)

A

Temporary encryption key.

51
Q

Authenticator (Components of Kerberos System)

A

Proves session key was recently created. Often expires within 5 minutes.

52
Q

Type cryptography Kerberos uses and the port number

A

Uses symmetric cryptography and UDP port 88.

53
Q

Pretty Good Privacy (PGP)

A

Created by Phillip Zimmerman in early 1990’s. Not itself an algorithm but uses other symmetric and asymmetric algorithms. Open source software for making encryption and decryption readily usable by end users. Most often associated with email encryption. Uses certificates that contain multiple signatures but they are self-signed so they can’t be validated with a CA.

54
Q

PGP Certificates

A

Defines it own format. A single certificate can contain multiple signatures. Includes:
Version Number
Certificate holder’s public key
Certificate holder’s information
Digital signature of certificate owner
Certificates validity period
Preferred symmetric encryption algorithm for the key

55
Q

Wired Equivalent Privacy (WEP)

A

Uses the RC4 stream cipher to secure the data and a CRC-32 checksum for error checking. Standard version uses a 40bit key with a 24bit initialization vector to form 64bit encryption. 128bit version uses 104bit key with 24bit IV. Because RC4 is a stream cipher, the same traffic key must never be used twice. 24bit IV is not enough prevent repetition on a busy network. Vulnerable to related key attack.

56
Q

WPA - WiFi Protected Access

A

Uses Temporal Key Integrity Protocol (TKIP). Dynamically generates a new key for each packet.

57
Q

WPA-Personal (can be known as WPA-PSK mode)

A

Uses pre-shared key mode. Designed for home and small networks. Doesn’t require authentication server. Each wireless device authenticates using the same 256bit key.

58
Q

WPA-Enterprise (can be called WPA-802.1x mode)

A

Designed for enterprise networks. Requires a RADIUS server for authentication. Extensible Authentication Protocol (EAP) is used for authentication. (EAP-TLS and EAP-TTLS)

59
Q

WPA2

A

Based on IEEE 802.11i and provides:

  • Advanced Encryption Standard (AES) using the Counter Mode-Cipher Block Chaining (CBC)-Message Authentication Code (MAC) Protocol (CCMP) that provides data confidentiality, data origin authentication, and data integrity for wireless frames.
  • Optional use of Pairwise Master Key (PMK) caching and opportunistic PMK caching. (caches results of 802.1x authentications to improve access time)
  • Optional use of pre-authentication that allows WPA2 wireless client to authenticate with other wireless access points in range.
60
Q

SSL

A

Developed by Netscape and has been replaced by TLS. It was the preferred method used with secure websites (i.e. https)

61
Q

How SSL Works

A
  1. The browser asks the web server to prove its identity.
  2. The server sends back a copy of its SSL certificate.
  3. The browser checks to see if the certificate is from a CA it trusts.
  4. The server sends back a digitally signed acknowledgement and a session is started.
62
Q

TLS (Transport Layer Security)

A

A protocol for encrypting transmissions. A client and server negotiate a connection by using a handshaking procedure. The server sends back its identification as a X.509 certificate. The client contacts the CA to confirm the validity of the certificate before proceeding. This protocol also supports secure bilateral connection mode.

63
Q

VPN

A

A way to use the internet to create a virtual connection between a remote user or site and a central location. Packets are encrypted making the network private. Emulates a direct network connection.

64
Q

Point-to-Point Tunneling Protocol (PPTP) - (often used for VPNs)

A

Oldest of the three protocols used in VPNs. Designed as a secure extension to the Point-to-Point Protocol (PPP). Adds the feature of encrypting packets and authenticating users to PPP. Works at the data link layer of the OSI model.

65
Q

PPTP VPN

A

Can use two different methods of authenticating the user:

EAP and CHAP

66
Q

Layer 2 Tunneling Protocol (L2TP) VPN

A 
Designed as an enhancement to PPTP
Like PPTP, works at the data link layer
Offers many modes of authentication: CHAP, EAP, PAP, SPAP, and MS-CHAP
Can work on X.25 networks (phone)
Uses IPSec for its encryption
67
Q

Internet Protocol Security (IPSec) VPN

A

Latest of the three VPN protocols
Encrypts not only the packet data, but also the header information
Has protection against unauthorized re-transmission of packets

68
Q

SSL/TLS VPN

A

VPN setup through a web browser, portal that uses SSL/TLS to secure traffic. Gives user access to the target network.

69
Q

Encrypting File System (EFS)

A

Since Windows 2000, this has been used along with NTFS. Allows a simple way to encrypt and decrypt files/folders. Simply right-click, choose properties, then advanced. Encrypted files will appear in green and are tied to the user who encrypted them.

70
Q

BitLocker

A

Introduced with Windows 7. Can encrypt partitions or entire drives. Startup key only. Key information is stored on a flash drive or TPM. Uses AES with 128bit key.

71
Q

VeraCrypt

A

Software for maintaining an on-the-fly-encrypted volume. Data is automatically encrypted right before it is saved, then decrypted right after it is loaded, all w/o user intervention.

72
Q

Common Cryptography Mistakes

A
  • Using a standard modulus in RSA (modulus e=216+1=65537)
  • Using seeds for symmetric algorithms that are not random enough
  • Hard coded cryptographic secrets/elements
  • Using too short of a key
  • Re-using keys
  • Unsecure Key Escrow
  • Unsecure cryptographic mode (ECB mode)
  • Proprietary cryptographic algorithms
73
Q

Steganography

A

The art and science of writing hidden messages so that no one suspects the existence of the message, a type of security through obscurity. Message can be hidden in picture or audio file for example. Uses least significant bits in a file to store data.

74
Q

Payload (Steganography Terms)

A

The data to be covertly communicated, the message you wish to hide.

75
Q

Carrier (Steganography Terms)

A

The signal, stream, or data file into which the payload is hidden.

76
Q

Channel (Steganography Terms)

A

The type of medium used. This may be still photos, video, or sound files.

77
Q

Steganography Details

A

In every file, there are a certain number of bits per unit of the file. For example, an image file in Windows is 24bits per pixel. With Least Certificate Bit (LSB) replacement, some bits can be replaced without altering the file much.

78
Q

Steganophony

A

Hiding messages in sound files. Can be done via LSB and Echo Hiding

79
Q

Video Steganography

A

Hiding messages in video files. Can be done via Discrete Cosine Transform

80
Q

Steganographic File Systems

A

Stores data in seemingly random files. Proposed by Ross Anderson, Roger Needham, and Adi Shamir. Also something about ‘vectors’ and ‘decrypt all lower levels’. Sorry. I was tired when making this card.

81
Q

Steganography Implementations

A

QuickStego - easy to use but limited
Invisible Secrets - robust, has free and commercial versions
MP3Stego - MP3 files
Stealth File 4 - Sound files, video files, and image files
Snow - Hides data in whitespace
StegVideo - Hides data in a video sequence

82
Q

Steganalysis

A

Detecting steganography and extracting the hidden information. Done with software. By analyzing changes in an images close color pairs, the steganalyst can determine if LSB was used. Close color pairs consist of two colors whose binary values differ only in the LSB.

83
Q

Steganalysis - Raw Quick Pair

A

A method to analyze an image to detect hidden messages. Based on statistics of the number of unique colors and close-color pairs in a 24bit image. Analyzes the pairs of colors created by LSB embedding. Countermeasure- Maintaining the color palette w/o creating new colors.

84
Q

Steganalysis - Chi-Square Analysis

A

Calculates the average LSB and builds a table of frequencies and Pair of Values. Performs a test on the two tables. It measures the theoretical vs. calculated population difference.

85
Q

Steganalysis - Audio Steganalysis

A

Examines noise distortion in the carrier file. Noise distortion could indicate the presence of a hidden signal.

86
Q

Steganography Detection Tools

A

StegSpy
Stegdetect
StegSecret

87
Q

Suite A (How the NSA classifies cryptography)

A

This classification of algorithms are not published. Algorithms are classified.

88
Q

Suite B (How the NSA classifies cryptography)

A

This classification of algorithms are published.

89
Q

How the NSA classifies cryptography

A

Also classified as Type 1, 2, 3, or 4, with 1 being the highest ranking.

90
Q

NSA Suite A Cryptography Algorithms

A

That’s CLASSIFIED!

91
Q

NSA Suite B Cryptography Algorithms

A
  • AES w/ key sizes of 128 and 256bits
  • For traffic, AES should be used w/ the Galois/Counter Mode (GCM) mode of operation - symmetric encryption
  • Elliptic-Curve Digital Signature Algorithm (ECDSA) - digital signatures
  • Elliptic-Curve Diffie-Hellman (ECDH) - key agreement
  • Secure Hash Algorithm 2 (SHA-256 and SHA-384) - message digest
92
Q

NSA Type 1 Algorithms

A 
Highest level of encryption algorithms. Used for classified or sensitive U.S. government information. Includes:
JUNIPER - Block Cipher
MAYFLY - Asymmetric
FASTHASH - Hashing
WALBURN - High bandwidth link encryption
PEGASUS - Satellite telemetry
93
Q

NSA Type 2 Algorithms

A

Used for unclassified cryptographic equipment, assemblies, or components. Endorsed by the NSA for use in telecommunications and automated information systems for the protection of national security information. These include:
Skipjack (a block cipher)
KEA (Key Exchange Algorithm - Asymmetric)

94
Q

NSA Type 3 Algorithms

A

Type 3 product is a device for use with Sensitive But Unclassified (SBU) information on non-national security systems. Algorithms include:
DES
3DES
SHA
AES (some implementations of AES are type 1)

95
Q

NSA Type 4 Algorithms

A

Algorithms that are registered by NIST but not FIPS published. Also, unevaluated commercial cryptographic equipment, assemblies, or components that neither NSA nor NIST certify for any government usage.

96
Q

One Time Pad (OTP)

A

The only unbreakable encryption. Has a separate substitution for each character making the key as long as the text. No substitution is used more than once. Key is used one time then destroyed. Impractical for most situations.

WGU (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions