Chapter 2 - Cryptography Flashcards
What does Cryptography help ensure? (4)
Ensures
1. Confidentiality: only authorized people can read information
2. Authentication: Verifies sender’s identity
3. Integrity: Protect data from unauthorized modification
4. Anonymity: Hides user identities during communication
What are the two basic operations in cryptography?
- Encryption: Convert plaintext into ciphertext
- Decryption: Convert ciphertext back to plaintext
What is a cipher?
Algorithm used to encrypt and decrypt data.
What is a key in cryptography?
A piece of information that works with the cipher to encrypt and decrypt messages
What is the Caesar Cipher?
Substitution cipher where each letter is shifted by a fixed number of positions
Ex: A becomes D (shift of 3)
How can the Caesar Cipher be attacked?
- Brute Force: Trying all possible keys until intelligible plaintext is obtained
- Cryptoanalysis: Using letter frequency analysis
What is symmetric key encryption?
Encryption where the same key is used for both encrypting and decrypting data
What is the key distribution problem?
If both sender and reciever use the same key then how do you share the key without someone intercepting it?
What are the requirements for secure symmetric encryption?
- A strong encryption algorithm
- Secure key exchange and storage
Can’t deciper ciphertext even if opponent knows it and has access to one or more ciphertexts
What are common attacks on symmetric encryption?
Brute Force and Cryptoanalysis (exploit algorithm weaknesses)
Examples of symmetric encryption algorithms
- DES: Weak and outdated (56-bit key)
- 3DES: Encrypt 3 times with DES (stronger but slower)
- AES: Fast and secure (128, 192 or 256 bit keys)
What is the difference between block and stream ciphers?
Block: Encrypt data in fixed-size blocks (AES) (can resuse keys)
Stream: Encrypt byte by byte, faster and lightweight (use less code)
When to use block vs stream ciphers
stream for data communications channel
block for file transfer, email and database
Why is encryption alone not good enough for authentication? Give an example
An attacker can reorder blocks
Time
When might we authenticate messages but not encrypt them?
- Broadcast messages (alarm)
- One side is overloaded and can’t afford to decrypt all incoming messages
- Computer programs that don’t want to decrypt evey time they need to execute
What is a Message Authentication Code (MAC)?
Short piece of data that verifies the authenticity (who) and integrity (unchanged) of a message
Uses a key and a MAC algorithm
message + key as inputs, MAC as ouput that gets added to end of message
both message and MAC transmitted in clear on network, recipient verifies with key that they also have and message as inputs
HMAC
Standard approach for a keyed hash mac
One-Way Hash Function Role
Alternative to the message authentication code that does not take a secret key as input for the function
Disclaimer: You can encrypt/decrypt the hashed message for authentication, as we see in diagrams a and b (as authentication method that benefits from using much smaller value than entire message), but the actual hash function just recieves message as input
3 ways a message can be authenticated using a hash function
a) symmetric encryption
b) public key encryption
c) secret value (keyed hash mac)
Steps in keyed hashed MAC
- Concatenate key before and after message
- Hash this and add to end of message
- Send both in clear
- Recipient who knows key concatenates (prefix and suffix), hashes it, and compares
Example of MAC use
When you make a payment online, the bank can use HMAC to verify that the payment details weren’t altered during transmission.
One-way hash vs MAC
An alternative to message authentication code (MAC) that DOES NOT take a secret key as input
Why are hash values efficient?
Instead of comparing large amounts of data for verification, systems compare smaller fixed size hash values
What are the 6 properties of secure hash functions?
- Any size input
- Fixed-size output
- Easy to compute
- One-way (preimage resistant) Starting with hash, can’t find it’s input
- Second preimage resistant Starting with known input and hash, can’t find another input with the same hash
- Collision resistant can’t find two inputs with same hash
second preimage like collision with headstart-at u least know one input
What is public-key encryption?
Encryption method using two keys:
1. Public Key: Available to everyone
2. Private Key: Kept secret
Encryption with one key can only be decrypted with the other
Why is public-key available to everyone?
So anyone can send an encrypted message for the key owner. (secure communication for parties who have never met)
Let others know how to encrypt a message for YOU specifically… the public key is the customization of an already used algorithm (RSA, ECC)
The cipher is the algorithm, and the** key** is the specific variable used to customize it. (Should be random and long enough). We can know how a combination lock works, but we will keep the numbers secret. We can understand the concept of shifting letters, but not tell how many to shift by. It allows the public to determine how robust the algorithm is and think hmmm maybe I won’t use this
What are digital signatures used for?
To authenticate the sender and ensure data integrity
What is a public-key certificate?
Verifies ownership of public key, issued by a trusted Certificate Authority (CA).
What is a digital envelope?
A hybrid method combining symmetric encryption for data and public-key encryption for the symmetric key
Why are random numbers important in cryptography?
Used for generating keys, session keys, and preventing replay attacks.
Replay Attack
Attacker intercepts a legitimate message and resends it to trick the recipient into believing it’s valid.
What is the difference between true random and pseudo-random numbers?
True Random (TRNG): Produce randomness by measuring unpredictable natural processes (nondeterministic source)
Pseudo-random: Deterministic but passes statistical randomness tests
EX: radiation, gas discharge, leaky capacitors
TRNG increasingly provided with modern processors
Where are random numbers used?
- generationg of keys (public-key algorithms)
- Stream key (symmetric stream cipher)
- Symmetric key (temporary session key or for digital envelope)
- Handshaking to prevent replay attacks
2 criteria for randomness
- Uniform distribution (frequency occurence of each number almost the same)
- Independence (can’t infer one value from others)
Unpredictability
What Happens When You Visit an HTTPS Website:
You request https://example.com.
The website sends you its digital certificate (which contains its public key and the CA’s signature).
Your browser:
Checks the CA’s digital signature (by using the CA’s public key, which your browser already trusts).
If the signature is valid, the website’s public key is trusted.
Now, your browser generates a random session key, encrypts it with the website’s public key, and sends it to the site.
Only the website (with its private key) can decrypt the session key, enabling secure communication.
