Chapter 14 - Cryptography

Question 1

Define an encryption algorithm?

Answer 1

A mathematical process that converts plaintext data into ciphertext data - often published to peer review their strength and validity.

Question 2

What is Symmetric Encryption?

Answer 2

Data is encrypted and decrypted with the same key value.

Question 3

What is Asymmetric Encryption?

Answer 3

Data is encrypted and decrypted using two different keys, typically a public key and a private key.

Question 4

What is a Cryptographic System?

Answer 4

A system that includes all the necessary resources to support a particular method of encryption/decryption.

Question 5

What is Cryptanalysis?

Answer 5

The study of cryptography in attempt to discover their strengths and weaknesses.

Question 6

What is hashing?

Answer 6

A one-way mathematical encryption method that converts a file into a hash to check for its integrity.

A hash of the same file will always be the same.

Question 7

What are examples of broken hashing algorithms that should not be used due to vulnerabilities?

Answer 7

MD5 (128-bit)

SHA-1 (160-bit)

Question 8

What are the different bits that SHA-2 can produce?

Answer 8

224
256
384
512

Question 9

What algorithms does SHA-3 use?

Answer 9

Keccak algorithms

producing 224, 256, 384, 512 bit hashes

Question 10

What is a commonly used symmetric encryption algorithm?

Answer 10

AES

Question 11

What is a Block Stream Cipher?

Answer 11

Data is encrypted in defined fixed-length blocks.

Question 12

What is a Stream Cipher?

Answer 12

Data is encrypted in a stream rather than encrypting blocks of data.

Question 13

What is a PKI?

Answer 13

Public Key Infrastructure is used to create, manage, distribute, use, store and revoke digital certificates used in public key encryption.

Question 14

What is RSA?

Answer 14

Rivest, Shamir and Adleman

RSA is a very popular type of asymmetric encryption using large prime numbers to create secure matching public and private keys.

Question 15

What is used to secure HTTPS and VPN traffic?

Answer 15

TLS

Question 16

How does TLS use both symmetric and asymmetric encryption?

Answer 16

Asymmetric to share the session key.

Symmetric data to encrypt the session data.

Question 17

What are TLS/SSL decryptors?

Answer 17

TLS/SSL decryptors are placed between client and server to detect any malicious activity.

Client — TLS session —> TLS decryptor — TLS session —> Server
Client <— TLS session — TLS decryptor <— TLS session — Server

The TLS decryptor will receive unencrypted data that can then be analysed by various detective methods such as AV, DLP etc.

Question 18

What function does Diffie Helman serve?

Answer 18

Diffie Helman is a key exchange protocol that allows the sharing of keys over a public network.

Question 19

What is Elliptic Curve Cryptography (ECC)?

Answer 19

ECC uses mathematically defined curves to create public and private keys.

Less resource and computation intensive as it can use smaller-bit size keys.

Employed in smaller mobile devices.

Question 20

What is the standard used when encrypting and digitally signing e-mails?

Answer 20

S/MIME

Secure Multipurpose Internet Mail Extensions

Question 21

What is a digital signature?

Answer 21

A digital signature is an encrypted hash of a message.

message > hashed > encrypted

A Digital Signature Algorithm (DSA) creates digital signatures.

Question 22

How do digital signatures work in emails?

Answer 22

1. Sender hashes their message and encrypts this with their private key.
2. The encrypted has is then sent to the recipient along with the message.
3. Recipient retrieves the sender’s public key via their certificate.
4. The encrypted hash is then decrypted using the sender’s public key
5. Hash comparison can now be compared.

Authentication - proof that the sender sent the email as the encrypted hash was decrypted by the sender’s public key.

Integrity - Hashes can be compared to test for integrity

Non-Repudiation - only the sender has the private key

Question 23

How does DKIM prevent email spoofing?

Answer 23

Organizations publish DKIM DNS records.

Each email sent out by the organization includes their DKIM signature.

Recipient can look up the published DKIM DNS record to see if attached DKIM signature matches.

If they match, the email is confirmed to have originated from that organization.

Question 24

What is DMARC?

Answer 24

DMARC is used in addition to DKIM or SPF.

DMARC contains instructions as to what to do when a spoofed email is received.

Question 25

What is SPF?

Answer 25

Sender Policy Framework allows organizations to define which IP addresses (Email servers) are allowed to send emails for their organizational domain.

SPF is published and can be looked up to check the validity of an email.

Google will publish a list of IP addresses (email servers) that can send gmail emails.