Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 10: PKI and Cryptographic Applications > Flashcards

Chapter 10: PKI and Cryptographic Applications Flashcards

1
Q

Describe public key cryptosystems.

A

Every user has a public and private key. Public keys are freely shared, and disclosing one does not introduce any weaknesses into the cryptosystem. The private key must remain confidential.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Does setting up communications between users of public key cryptography require sharing private keys?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How does a public key user create a ciphertext to send securely?

A

Encrypt it using the recipient’s public key. Only the holder of the corresponding private key can decrypt it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is RSA?

A

A public key cryptosystem invented to Ron Rivest, Adi Shamir, and Leonard ADleman. Patented. It depends on the computational difficulty inherent in factoring large prime numbers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How should you select key length?

A

Based on the sensitivity of the data. More sensitive data requires longer keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the disadvantage of El Gamal?

A

It doubles the size of any message it encrypts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Elliptic curve?

A

No notes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a hash function?

A

A hash function is a one way function that takes a message of arbitrary length and generates a unique, generally shorter, value called a message digest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a message digest?

A

The output of a hash function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the five requirements of a hash function according to RSA Security?

A
  1. The input can be any length
  2. The output has a fixed length
  3. The hash function is relatively easy to compute for any input
  4. The hash function is one-way
  5. The hash function is collision-free
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the collision-free property?

A

It’s extremely hard to find two messages that produce the same hash value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is SHA?

A

The Secure Hash Algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is FIPS-180?

A

It defines the Secure Hash Algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What defines SHA?

A

FIPS-180

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the input range for SHA?

A

0-2,097,152 terabytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the output size for SHA?

A

160 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How does SHA process input?

A

In 512-bit blocks. Blocks are padded if the message is too short to fill the block.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe SHA-2?

A

It has four variants of SHA:

SHA-256 produces a 256-bit output from 512-bit blocks
SHA-224 produces a 224-bit output from 512-bit blocks
SHA-512 produces a 512-bit output from 1,024-bit blocks
SHA-384 uses a truncated output from SHA-512 using 1,024 bit blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why should MD2 not be used?

A

It was proven not to be a one-way function, and collisions can occur.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Why should MD4 not be used?

A

Collisions can be found in under a minute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Add the hash value memorization chart

A

.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the goals of a digital signature infrastruture system?

A

Assure the recipient that the message truly came from the claimed sender
Assure the recipient that the message was not altered

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is HMAC and what does it do?

A

Hashed Message Authentication Code. It guarantees message integrity, but does not provide nonrepudiation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Why doesn’t HMAC provide nonrepudiation?

A

It uses a shared secret key, so either user could create a ciphertext and claim it came from the other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the Digital Signature Standard?

A

A NIST standard in FIPS 186-3 that specifies that federally approved digital signature algorithms must use SHA-1 or SHA-2. Also, the encryption algorithms that may be used are DSA (from FIPS 186-3), RSA, or the Elliptic Curve DSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the major strength of Public Key Infrastructure?

A

Facilitating encrypted communcations between parties previously unknown to each other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a digital certificate?

A

An endorsed copy of a public key, providing assurance that the owner is who they are claiming to be.

28
Q

What is a certificate authority?

A

Also called a CA. A neutral organization that offers notarization services for digital certificates. You prove who you are and they sign your certificate.

29
Q

What are the requirements to determine that a certificate is valid?

A

The digital signature of the CA is authentic
You trust the CA
The certificate is not listed on a certificate revocation list
The certificate actually contains the data you are trusting

30
Q

What is certificate revocation?

A

The process of asserting that a certificate is no longer valid.

31
Q

Why might a certificate be revoked?

A

It’s compromised (private key disclosed)
It was issued in error
The certificate details (names, etc) changed
The security association changed (employees leave, etc)

32
Q

What is the major disadvantage of CRLs?

A

They have to be periodically downloaded and checked, introducing latency.

33
Q

What is OCSP

A

Online Certificate Status Protocol

34
Q

What does OCSP do?

A

It provides for realtime certificate revocation checking.

35
Q

What are the rules for asymmetric key management?

A

Choose key lengths appropriately for security requirements
Keep private keys private
Retire keys appropriately
Back up your keys

36
Q

What are the rules about encrypting mail?

A

If you need confidentiality, encrypt.
If you need integrity, hash
If you need authentication, integrity, and/or non-repudiation, digitally sign.
If your message requires confidentiality, integrity, authentication, and nonrepudiation, encrypt and digitally sign.

37
Q

What is PGP?

A

A secure email system developed in 1991 that combines a CA hierarchy with a web-of-trust concept.

38
Q

What is S/MIME?

A

Secure Multipurpose Internet Mail Extensions protocol. De facto standard for encrypted email. Uses RSA, relies on X.509 certificates.

39
Q

What port should secure web applications be found on?

A

443/tcp

40
Q

What are the merits of SSL/TLS?

A

You can tunnel anything, and it secures the entire path.

41
Q

What is steganography?

A

Using cryptographic techniques to embed secret messages within another message.

42
Q

What is a steganography tool worth knowing about?

A

The X1A0 Stego tool

43
Q

What is steganography generally used for?

A

Hiding text in images.

44
Q

What are the two types of encryption techniques used to protect data traveling over a network?

A

Link encryption and end-to-end encryption

45
Q

Describe link encryption

A

Protects entire communcation circuits by creating a secure tunnel between two points using a hardware or software solution.

46
Q

Describe end-to-end encryption

A

Protects communication between two parties and is performed independently of link encryption. TLS, for example.

47
Q

What is IPsec?

A

A protocol that uses public key crypto to provide encryption, access control, nonrepudiation, and message authentication using IP protocols.

48
Q

What is the primary use of IPsec?

A

VPNs.

49
Q

What protocol is IPsec commonly paired with?

A

L2TP (Layer 2 Tunnelling Protocol)

50
Q

What is WEP?

A

Wired Equivalency Protocol, 64 and 128 bit encryption for wiresless LANs. IEEE 802.11. Significantly flawed and insecure.

51
Q

What is WPA?

A

WiFi Protected Access. Implements the Temporal Key Integrity Protocol (TKIP) to eliminate the insecurities of WEP.

52
Q

What is WPA2?

A

Improved version of WPA. Commonly considered the best option today.

53
Q

What is IEEE 802.1X?

A

A wireless security standard that provides a flexible framework for authentication and key management in wired and wireless networks.

54
Q

What is an analytic attack?

A

Algebraic manipulation that attempts to reduce the complexity of an algorithm. Focuses on the logic of the algorithm itself.

55
Q

What is an implementation attack?

A

An attack that exploits weaknesses in the implementation of a cryptography system. Focuses on exploiting the software code, not the methodology.

56
Q

What is a statistical attack?

A

Exploits statistical weaknesses like floating point errors and inability to produce truly random numbers. Looks for vulnerabilities in the hardware or OS hosting the application.

57
Q

What is a brute force attack?

A

One that attempts every possible valid combination for a key or password.

58
Q

What is frequency analysis or ciphertext-only attacks?

A

.

59
Q

What is a known plaintext attack?

A

Having a copy of a plaintext and the corresponding ciphertext greatly assists in breaking weaker codes.

60
Q

What is a chosen ciphertext attack?

A

The attacker has the ability to decrypt chosen portions of the ciphertext and used the decrypted portion to discover the key.

61
Q

What is a chosen plaintext attack?

A

The attacker has the ability to encrypt plaintext messages of their choosing and can analyze the resulting ciphertext.

62
Q

What is a meet in the middle attack?

A

Used to defeat encryptions that use two rounds of encryption. This is why 2DES isn’t used. Only generally twice as hard as one round, not n**2 as hard.

63
Q

What is a man in the middle attack?

A

A malicous individual between two communicating parties intercepts all communications and masquerades as each party to the other.

64
Q

What is a birthday attack?

A

Also called a collision attack or reverse hash matching, seeks to find flaws in the one-to-one nature of hash functions.

65
Q

What is a reply attack?

A

Useful against cryptosystems that don’t use temporal protection. Intercept encrypted message and send it later to open a new session.

CISSP (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions