Chapter 3: Cryptography Flashcards
1
Q
What is the synonymous term for Cipher
A
Algorithm
2
Q
what are the two major types of ciphers?
A
A substitution cipher (uses a key to determine how the substitution should be carried out (eg key is the instruction to shift up 3 places)
Transposition Cipher r(Message is scrambled or put in different order)
3
Q
What are the components of a cryptosystem
A
- Encryption algorithm (which determines how simple or complex the process will be)
- Keys (known as cryptovariable, key is a large sequence of random bits)
- Software components
- Protocols
4
Q
What is a keyspace?
A
A keyspace is the total number of values of keys possible e.g a 256 bit key has a keyspace of 2^256
It is a range of values that can be used to construct keys (2^512 is higher than 2^128 and so on)
The larger the keyspace, the more difficult for the attacker to back calculate it
5
Q
algorithms vs keys
A
Most algorithms are complex mathematical formulas that are applied in a specific sequence to the plain text. The key indicates the sequence in which these functions take place
6
Q
What is Kerchoffs principle
A
algorithms should be publicly known. Only key should be private
7
Q
what is menat by strength of a cryptosystem
A
strength refers to how hard it is to figure out the algorightm or the key whichever is not made public
another name for cryptography strength is work factor
8
Q
What does the Strength of a cryptosystem depends on
A
- Algorithm used
- Length of keys
- Secrecy of keys
- Initialisation vectors
9
Q
what is work factor in asymmetric cryptography
A
the difference in time and effort required to carry out the one way function in the easy direction compared to one way function in the hard direction
10
Q
What services are offered by cryptosystems
A
- Confidentiality
- Integrity
- Authentication
- Authorisation
- Non repudiation
11
Q
What are the features of one time pad
A
generally considered unbreakable if implemented correctly
- XORs the value of text with the one time pad
- Should be of same or greater length than plain text
- Should not be used more than once
- Pad must be securely distributed and protected at its destination
- Pad must be made up of truly random values
- Pad must be secured at senders and receivers sites
12
Q
Why are random numbers generated by computers called pseudo random
A
they Use Initialisation vectors which could be aligned to some state of the system
Computer system states are not fully random and hence can be possibly calculated. Consequently number is pseudorandom
13
Q
What are running Ciphers
A
refer to external stuff (such as books) to get real message
no mathematical computation on plain text
14
Q
Concealment Ciphers (Null Ciphers)
A
message within a message.
The key determines how to extract the message from the message (e.g every third word from punctuation
Concealment cipher is a type of steganography method
15
Q
how do symmetric algorithms work
A
use long sequences of substitution and transposition
The algorithm provides the many possible ways the substitution and transposition can happen (represented in mathematical formulas)
Key is used as the instructions for the algorithm, dictating exactly how these processes will happen and in what order
16
Q
how many number of keys are required for symmetric encryption
A
N*(N-1)/2
17
Q
What is secure message format
A
sender encrypts message with receivers public key
ensures confidentiality
18
Q
what is open message format
A
sender encrypts message with his own private key
Ensures authenticity
19
Q
What are the strengths of symmetric key cryptography
A
Faster
harder to break
provide confidentiality
used in bulk encryption eg files and communication paths
20
Q
What are the weaknesses of symmetric key cryptography
A
secure mechanism required for key delivery
unmanageable keys with more participants
no authenticity and non repudiation
21
Q
What are the examples of symmetric key cryptography
A
DES, 3DES, AES, RC4, RC5, RC6
International Data Encryption Algorithm (IDEA), Blowfish
22
Q
What are the strengths of asymmetric cryptography
A
Better key distribution
Better scalability
Authenticity, non-repudiation, confidentiality
used in key distribution and digital signatures
23
Q
what are the disadvantages or weaknesses of asymmetric cryptography
A
Works slowly
mathematically intensive
24
Q
what are some of the examples of asymmetric key cryptography
A
Rivest –Shamir-Aldeman (RSA)
Elliptic curve cryptosystem (ECC)
Diffie-Hellman,
El Gamal,
Digital Signature algorithm (DSA)
25
what is the other name for asymmetric algorithms?
Public Key Cryptography
26
What are block ciphers
- Message is divided into blocks of bits
- Each block is encrypted
- do not require processing power and can be implemented in software
27
what should a strong cipher contain
confusion and diffusion
28
differentiate between confusion and diffusion in cipher
Confusion is substitution
Diffusion is transposition
29
what is the key point to note about diffusion
Single plaintext bit has influence over several ciphertext bits
similar to avalance effect ((small change to the key or plaintext should cause drastic change to ciphertext))
30
What are stream ciphers
Keystream generator generates bitstream based on the key (which provides randomness)
Each bit is XORed with this bit stream generated
Better Implemented at hardware level
31
what should be the key features of stream ciphers?
- Long periods of no repeating values within keystream
- keystream is not linearly related to key (and hence cannot be deduced)
- statistically unbiased keystream (as many zeros as ones)
32
Differentiate between stream and block ciphers
STREAM :: BLOCK
More processing :: Less processing
Less secure (pseudo random) :: more secure
propagtes single error :: error affects only one or few blocks
33
What are initialisation vectors and why are they used
two identical plain text should not generate same cipher text when same key is used
create more randomness along with the key
34
Apart from confusion and diffusion what are the Other cryptographic transformation techniques
- Compression (reduce redundancy)
- Expansion (add duplicate values to meet key sizes)
- Padding
- Key mixing
35
Explain the process of hybrid encryption
- symmetric key is used to encrypt message
- Symmetric key is encrypted using receivers public key
- Symmetric key is decrypted using receivers private key
- symmetric key is then used to decrypt message
36
what are alternative names for symmetric cryptography
- **secret key cryptography**
- **session key cryptography**
(keys good for only one session but in all sense similar to secret key. This way, attacker has a small window to try and decrypt it))
- **private key cryptography** (different from private key of asymmetric encry)
**- shared key cryptography**
37
DES/AES vs DEA/Rijndael
DES/AES are standards
DEA/Rijndael are algorithms in those standards
exam can refer to algorithm by either of DES / DEA
38
What type of data is encrypted by DES
Sensitive but unclassified
39
What was the replacement of DES
DES was later replaced by Rijndael algorithm as the Adavanced Encryption Standard (AES) for sensitive but unclassified documents
40
What are the key points of DES
* Symmetric Block encryption
* **64** bit key – 54 is key 8 are parity
* Blocks are put through **16 round**s of substitution and transposition
* **Order** of substitution and transposition depends on key used
* Output is **64bit**
41
What are the different modes of DES
* Electronic Code Book (ECB)
* Cipher block chaining
* Cipher Feedback mode
* Output Feedback mode
* Counter mode (CTR)
42
Explain the electronic code book (ECB) mode of DES
Key = instructions to use code book
Code book dictates how text will be encrypted and decrypted
used for short messages such as pins, keys, challenge-response values etc
not dependent on previous block for encryption– good for databases , not for files
43
What are the shortcomings of ECB
Same key and code book are used – hence not enough randomness
not suitable for large amount of data where pattern could emerge
Cannot carry out preprocessing before receiving plaintext
44
Explain Cipher Block Chaining
* Each block of plaintext is modified using XOR before being encrypted
* Results of one block are XORed with the next block before it is encrypted
* First block is XORed using Initialisation vector
* If new IV is used every time, will result in a unique ciphertext everytime
* Chaining adds the necessary randomness that allows to encrypt large files
45
What is Cipher Feedback Mode
It is block cipher working in stream mode
46
How does Cipher Feedback Mode (CFB) work?
* Key and IV are used to create keystream
* Keystream is XORed with first block
* Ciphertext sent to destination , also key+ciphertext=keystream for next block
* IV has to be different for each message to avoid patterns
47
What is the constraint in CFB
Size of the ciphertext needs to be of the same size as the block of plaintext being encrypted. Otherwise values will get repeated which will introduce patterns
48
What is the use case for CFB of DES
Better for smaller sized blocks (such as 8 bit data from terminal to server)
49
What is difference between CBC and CFB
In CBC, encryption is carried out on block using the key (XOR is for preprocessing of block)
In CFB, block is only XORed
50
how does output feedback mode (OFB) work
* similar to CFB
* instead of last blocks ciphertext, it is last blocks keystream that is used along with key to create new keystream
* is used to avoid errors in ciphertext propagating forward (for digitised voice and video)
51
How does counter mode (CTR) work
* similar in working to CFB and OFB
* new IV for each block
* IV + Key = keystream
* since there is no chaining, the encryption can happen in parallel and hence better performance
52
What is the use case for CTR mode of DES
Used in ATM cells or IPSEC tunnels where the bits may arrive out of sequence
So CTR mode means that receiver does not have to wait for entire message before starting the decryption
53
What is the difference between Synchronous cryptosystem and Asynchronous cryptosystem
Synchronous: Keystream values are in-sync with plaintext values
Asynchronous: Uses previously generated output to encrypt the plaintext values
54
what are different options in 3DES
uses 48 rounds in computation
1. DES-EEE3 – 3 separate keys, encryption, encryption , encryption
2. DES-EDE3 – 3 separate keys, encryption, decryption, encryption
3. DES-EEE2 – 2 separate keys, encryption , encryption, encryption (same key for first and third)
4. DES-EDE2 – 2 separate keys, encryption, decryption, encryption (same key for first and third)
Here decryption refers to decrypting with a different key which results in more jumbling up rather than plaintext.
55
How many bits are supported by Rijndael
128 (10 rounds)
192 (12 rounds)
256 (14 rounds)
(both key and block size should be same for above rounds)
56
International Data Encryption Algorithm (IDEA)
- Block Cipher
- 64 bits block
- 64 bit data block is divided into 16 smaller blocks
- each has 8 rounds of mathematical functions performed on it
57
what is the key length in IDEA
128
58
who is developer of blowfish
Developed by bruce schneier and has kept it open and unpatented
59
what are the key sizes and rounds of computation in blowfish
Key from 32 bits to 448 bits
16 rounds of cryptographic functions
Block cipher working on 64 bit blocks
60
What is RC4
most commonly implmeneted **stream** ciphers
is used in ssl protocol
has a variable key size
Stolen version is referred to as ARC4 at times
61
What is RC5
Block Cipher
62
what is the cryptographic notation for RC5
W | R | B
W = word size in bits
R = number of rounds from 0 to 255
B =key size in bytes
63
what does RC5-32/12/16 mean
32 bit words , which means it encrypts 64 bit blocks
Using 12 rounds
With a 16 byte (128 bit) key
64
List the key sizes and rounds of computation for block ciphers
algorithm | key size | Rounds of computation
DES | 64 | 16
3DES | 64 | 48
Rjindael | 128/192/256 | 10/12/14
IDEA 128 / 8
Blowfish | 32 to 448 | 16
RC4 | Variable
RC 5/RC6 | upto 2048 | 255
65
what is the difference between key agreement and key exchange
Key agreement - use of DH type algorithm for generating and agreeing on public/private key pair
Key exchange - encrypting key before sending it to other party
(typically key is encrypted with senders public key)
66
What does Diffie Hellman provide for and not provide for
allows : key distribution
does not allow : encryption and digital signature
67
How can DH algorithm be attacked and what countermeasure can be taken
Man in the middle while public key exchange can create a conduit where receiver speaks to the MITM and sender speaks to the MITM
Countermeasure to this attack is to have authentication done before public key exchange.
Exchanging digital certificates can thwart man in the middle type of attacks
68
What authentication key agreement function can prevent MITM attack on DH
MQV
69
What are key features of RSA
Defacto standard for
1. Digital signatures
2. Key **_exchange_**
3. Encryption
70
What is a digital signature
Hash value encrypted with private key
71
What does one way function of RSA provide
Encryption
&
Digital Signature Verification
72
What does inverse function of RSA provide
Decryption
&
Digital Signature Creation
73
what are the symmetric algorithms with which RSA has been used
DES and AES
Used as key exchange, RSA encrypts the secret key created by the DES or AES algorithm with the receivers public key and sends across to receiver. The receiver decrypts it with his private key.
74
What is work factor in asymmetric key cryptography
mathematical equations are easy to perform in one direction and next to impossible to perform in other direction
(hard direction is based on a hard mathematical problem)
75
Which assymetric encryption can be used where computing power is limited and why
Elliptic Curve
- provides higher encryption with small key sizes and hence requires less mathematical computation
76
What is the challenge with parity bits, CRC and one way hash values
Message can be modified and revised parity, CRC and hash values can be inserted to make message genuine
77
What are Hash algorithms used for
detect intentional and unintentional unauthorized modifications to data
78
What is the secrecy in one-way hash
the hash value cannot be recompiled into message
79
what are key points of one-way hash
1. Variable string converted to a fixed length hash
2. hashing algorithm is public
3. one way hash takes place without any keys
80
how can MITM attack on Hash values be avoided
by using MAC functions
81
what benefit does MAC function offer over Hash
MAC can identify **intentional**, **accidental** and **unauthroised** changes
Hash can identify only _accidental_ changes
82
What are the different MAC functions
1. Hash MAC (HMAC)
2. CBC-MAC (Cipher block chaining MAC)
3. CMAC (Cipher based MAC)
83
How does Hash MAC (HMAC) work
1. Private Symmetric key is concatenated with the message and then the complete text is hashed
2. Works against MITM attacks since MITM will not have access to the private symmetric key
3. Symmetric key in this case does not do encryption
84
how does CBC-MAC (Cipher block chaining MAC) work
1. Message is put through CBC encryption using the symmetric key
2. Final block of output is considered as the integrity check ie MAC value
3. Receiver carries out similar encryption and verifies the final output
4. Symmetric key ensures that the only person who can verify integrity is the one who has access to the symmetric key
Note: the same key should not be used for authentication and encryption
85
What kind of authentication does MAC provide
MAC provides data origin authentication , also known as system authentication
86
how does CMAC (Cipher based MAC) work
1. Similar to CBC-MAC but with more complex mathematical functions and logic
2. Symmetric key is used to create sub-keys. Each sub-key is used individually to encrypt the blocks of message
87
How does CCM MAC work
1. Combines CBC-MAC and CTR mode
2. Provides data origin authentication and encryption using same key
88
What is difference between private key and symmetric key
A private key is bound to an individual, a symmetric key is not . Symmetric key is bound to computer or device.
Hence MAC authentication provides the weakest form of authentication
89
how many hash values are required to be checked to see if two messages hash to the same value
2^(n/2) hash values where n is the length of the hash (e.g in 160 bit hash may required around 2^80 computations to break)
90
What are the different Hashing algorithms
MD4
MD5
SHA
SHA 1 /2 /3
91
How does MD4 hashing work
its a one way hash
Produces a 128 bit message digest value
No longer considered secure
92
How does MD5 work
1. Similar to MD4 but more stronger, using more complex mathematical functions and additional fourth round of operations during hashing
2.
93
What can MD5 be use for and avoided for
It is Secure but not resistant to collisions
not used in digital signatures and ssl certificates
Mostly used for file integrity checksums
94
SHA / SHA1
Similar to MD4 but 160 bit value and extra mathematical functions
Was improved and renamed as SHA1
it is a federal government algorithm
95
Why was SHA2 and 3 developed
SHA and SHA 1 are not resistant to collision attacks hence developed SHA2 and 3
96
What are part of the SHA 2 and 3 families
2 and 3 families include SHA256, SHA384 and SHA512.
The SHA 2 and 3 families are considered secure for all uses
97
what is a birthday attack
It is more probable to find two people with same birthday than to find a person who matches a particular birthday
A hashing algorithm that has a larger bit output is less vulnerable to brute force attacks such as birthday attacks
98
which are the two algorithms widely used for digital signing
RSA and DSA
99
What is the difference between RSA and DSA
DSA can be used only for digital signatures
DSA is slower in signature verification
100
what is the standard used to create digital signatures
DSS
outlines the digitial signature algorithms that can be used with SHA: RSA, DSA, Elliptic curve DSA (ECDSA)
101
Matrix of encryption / use case
## Footnote
Message is :
Confidentiality
Integrity
Authentication
Non-repudiation
Encrypted
Yes
-
-
-
Hashed
-
Yes
-
-
Digitally Signed
-
Yes
Yes
Yes
Encrypted and Digitally signed
Yes
Yes
Yes
Yes
102
What services does PKI offer
1. Confidentiality
2. Integrity
3. Authentication
4. Non repudiation
5. Access control
103
What is a certificate authority CA
A CA is a trusted organisation (or server) that maintains and issues digital certificates
104
what does digital certificate contain
A digital certificate contains public key for that individual along with other identifying information
105
What is the relation between registration authority and certificate authority
Registration authority verifies the individuals identity and passes off the certificate request to the CA
CA constructs the certificate, signs it and send it to the receiver. Also maintains it over lifetime
106
what is CA cross certification
CA cross certification is required when two CAs do not have a root CA above them. It establishes a trust relationship in which they rely upon each others digital certificates and public keys as it they had issued it themselves
107
CRL is cumbersome. what is the alternative
CRL is cumbersome, so OCSP is used, online certificate status protocol that automatically checks with the CRL in the background
108
what is the standard for certificates
X.509v3
109
what does a certificate typically include
1. Serial number
2. Version number
3. Identity information
4. Algorithm information
5. Lifetime dates
6. Signature of issuing authority
110
what is role of registration authority
1. Acts as broker between user and CA
2. Identifies the user
3. New certificate requests are made to the RA and not to the CA
111
if CA creates public key, how is the private key created and distributed to the customer?
CA creates certificate with the users public key and identity information embedded.
The private/public key is either created by CA OR
as is the usual case , created by the user on his machine and then sends in the public key during the registration process
112
What are the Steps in communicating during PKI
1. John requests Dianes public key from a directory (also called repository)
2. The directory sends Dianes digital certificate
3. John verifies the digital certificate and extracts her public key
4. John encrypts a session key with Dianes public key
5. Along with encrypted session key, John sends his digital certificate
6. Dianes browser checks Johns digital certificate to identify the CA who issued it as well as validate rest of the pieces of the identity
7. Diane extracts the session key using her own private key
113
What are the entities and functions in PKI
1. Certification authority
2. Registration authority
3. Certificate repository
4. Certificate revocation system
5. Key backup and recovery system
6. Automatic key update
7. Management of key histories
8. Time stamping
9. Client side software
114
What is a trusted platform module?
* securely designed microcontroller with added modules to perform cryptographic functions
* These modules allow for accelerated and storage processing of cryptographic keys, hash values, and pseudonumber sequences
*
115
what are common use cases for TPM
bind a hard disk to a system
seal a systems state to a particular hardware and software configuration
116
What are components of TPM
1. Endorsement Key (persistent memory)
2. Storage Key (persistent memory)
3. Attestation Identity key (versatile memory)
4. Platform configuration registers (versatile memory)
5. Storage keys (versatile memory)
117
What is the Endorsement Key of TPM
Public/private key pair.
Private key permanently stored in the module.
Used to verify the TPM platform itself
118
What is Storage Key (persistent memory) in TPM
Master wrapping key used to secure the keys stored in the TPM
119
What is Attestation Identity key in TPM
* Used for attestation of TPM to tservice providers
* AIK linked to EK
* AIK ensures integrity of EK
120
What are Platform configuration registers in TPM
Used to store Cryptographic hashes of data used for TPMs “sealing” use case
121
What are storage key (versatile memory) in TPM
Used to encrypt the storage media of the computer system
122
What are the Attacks on Cryptography
Passive attacks – reading off the wires
Active attacks – altering messages / system files, masquerading as another user
123
What are the active attack types in cryptography
1. Cipher-text only
2. Known plain-text
3. Chosen plain-text
4. Chosen cipher-text
5. Differential crypanalysis
6. Linear crypt analysis
7. Replay attacks
8. Side channel attacks
9. Algebraic attacks
10. Analytic attacks
11. Social engineering attacks
12. Statistical attacks
13. Meet in the middle
124
What is Cipher-text only attack
multiple encrypted messages are analysed
125
What are Known plain-text and Chosen plain-text attacks
**Known plain-text**: the plain-text and its encrypted form are known to attacker
**Chosen plain-text**: attacker choses the plain text and then observes corresponding ciphertext
126
What is Chosen cipher-text attack
attacker choses cipher-text and has access to resulting plain-text
127
Differential crypanalysis
Type of chosen plain text attack
ooks at pairs of cipher-text for corresponding pairs of known and chosen plain-text with specific differences engineered in the plain-text
128
Linear crypt analysis
known plain-text attack on several different messages to identify the highest probability of specific key employed during encryption
129
Replay attacks on cyrptography
resubmitting information caught on wire while masquerading as different entity
130
Side channel attacks
identify the behavior of the system and infer the encryption process/keys
131
Algebraic attacks
exploit weakness in the mathematics of the algorithm
132
Analytic attacks
exploit weakness in the structure of the algorithm
133
Social engineering attacks on cryptography
get a user to divulge information related to keys etc
134
Statistical attacks on cryptography
identify statistical patterns e.g more 1s than 0s can indicate a biased random number generator and consequently towards a biased key set
135
Meet in the middle attacks on cryptography
encryption from one side and decryption from other side
136
What is a zero knowledge proof
interactive method for one party to prove to another that a (usually mathematical) statement is true without revealing anything sensitive
e.g marge uses her private key to create a digitial signature on a message she is sending to george but does not show or send her private key with george
137
