Chapter 2 Flashcards
Identification
Asserting who a person is
Authentication
Proving the asserted identity
3 qualities of authentication
Something the user knows: password, pin etc
Something the user is: Biometrics like voice & fingerprints
Something the user has: ID badges, keys, drivers licence
Password drawbacks
Use - for every object
Disclosure
Revocation
Loss
Rainbow table
Precomputed lists of values such as passwords
Salt
User specific component joined to a password to distinguish identical passwords
Tokens
Something you have
Active token
Changes on the token with computing power
Passive token
Don’t change. ID book
Federated identity management
Union of identification and authentication process for a group of systems
Single sign-on
Takes over sign-on and authentication to/for several independent systems for a user
Multi-factor authentication
Use more than one authentication mechanism at a time, e.g. password and biometrics
Access control
Limiting who can access what in what ways
Least privilege
Access to the fewest resources necessary to complete a task
Reference monitor
Access control that is always invoked, tamperproof and verifiable
Capability
Unforgeable token that gives the possessor certain rights to an object
Procedures
Can perform actions specific to a particular object in implementing access control. For example a reduced API like add, delete, check.
Encryption
Encoding a message so its meaning is not obvious
Plaintext
Original message
Cyphertext
Encrypted message
Cryptographer
Works for sender/receiver
Cryptoanalyst
Works for unauthorised party
Work factor
Amount of effort needed to break encryption
Stream cypher
Encrypt one bit or byte at a time
Block cypher
Encrypt a fixed number of bits as a single chunk
Nonce
A value that’s meaningless and shows liveness and originality
Digital signature conditions
Unforgeable and authentic
Not reusable and not alterable
Access control by role
Recognises the common needs of all members by a set of subjects
Cryptography
Conceals data from unauthorised access
Problems addressed by encryption
Blocking
Interception
Fabrication
Modification
Certificate
A public key and a user’s identity are bound together in a certificate and signed by a certificate authority
What does a digital signature consist of
A file
A demonstration that the file is unaltered
An indication of who applied the signature
Validation that the signature is authentic
Connection of the signature to the file
