Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPT > Chapter 3: Encryption and Related Technologies > Flashcards

Chapter 3: Encryption and Related Technologies Flashcards

1
Q

What is homomorphic encryption?

A

Allows encrypted information to be manipulated without decrypting it first (data in use)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is multiparty computation?

A

Allows two or more computers to participate in a computation and compute a mathematical result without otherwise revealing private information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does the term encrypt mean?

A

To convert information or data into a cypher or code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a cypher?

A

Mathematical transformations of data, in which data is scrambled according to some kind of function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a code?

A

Transformations that typically involve a one-to-one replacement of a word, letter, figure or symbol with another word, letter, figure or symbol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between plaintext and cyphertext?

A

Plaintext - clear and readable text

Cyphertext - the encrypted message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the work factor?

A

The amount of effort that an adversary needs to expend to decrypt a message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is threat modeling?

A

Understanding the adversary the system has been designed to protect against, the capabilities that adversary has, and the likely forms of attack the system may experience

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a cryptographic system?

A

Collection of cryptographic algorithms, protocols, software and other items that use cryptography to achieve information security goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What factors can cause cryptographic implementation flaws?

A
  • Bugs - Implementation errors
  • Back doors - Flaws that have been deliberately placed in a product for later exploitation
  • Weaknesses - Mathematical vulnerabilities that are unknown when they are developed and deployed but are later discovered
  • Obsolescence - Erosion over time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why is entropy important?

A

Merely encrypting with an algorithm and a key is not sufficient to ensure security. It is also necessary to use randomness, also called entropy, so that an attacker observing the output of an encryption system cannot determine if the same message is encrypted a second time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where must entropy be applied in modern cryptographic systems?

A

Both in creating keys and encrypting messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

List the 2 kinds of encryption algorithms

A

Secret key algorithms (aka symmetric)

Public key algorithms (aka asymmetric)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a symmetric or secret key algorithm?

A

Uses the same key to encrypt and decrypt the plaintext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an asymmetric or public key algorithm?

A

Designed so that the plaintext can be encrypted using only public information, but decrypting the cyphertext requires the use of private information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Is RSA a symmetric or asymmetric algorithm?

A

Asymmetric

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the most common symmetric algorithm in use today?

A

AES - typically used with 128 or 256 bit keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a brute force attack?

A

Try every possible key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is another name for a brute force attack?

A

Key search attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What technology will theoretically be capable of breaking 128-bit AES with relative ease?

A

A sufficiently large quantum computer

Though it is believes that it will not have the ability to crack AES-256 in any reasonable amount of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why is it a bad idea to develop your own encryption algorithm?

A

Secret algorithms are typically weaker because they have not been as widely tested
It is also difficult to understand the risk of using such an algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the differences between a cryptographic key and a password?

A

With a cryptographic key
• Information must be mathematically transformed
• Does not decide whether or not to grant access
• Cannot be reset if the key is lost
• To change the key you have to decrypt then re-encrypt the information

With a password
• Access to the controlled information is mediated by a program
• Because the program is making decisions, it can be manipulated by other factors (ex. the system allows access without a password Thursdays at 5)
• Software accessed confidential parts of the program even when a password is not provided

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which private key algorithm was published by the US government in their Federal Information Processing Standard (FIPS) in 1977?

A

Data Encryption Standard (DES)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A public demonstration in 1998 showed that DES could be broken, what was the solution?

A

Encrypting a message with DES three time over, each time with a different key (a technique called triple DES or 3DES)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Why was cryptography not widely used until the rise of e-commerce in the 1990s?

A

Lack of workable public key cryptography
Export controls - government restricted the export of any computer technology that could perform cryptography
CPU speed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which browser first incorporated transparent cryptography in 1995?

A

Netscape Navigator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What encryption protocol do web browsers use to automatically encrypt information as it travels between browser and web server?

A

Secure Socket Layer (SSL) - later renamed to Transport Layer Security (TLS)
Often called SSL/TLS today

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is a pluggable cryptographic protocol?

A

The single protocol supports the use of multiple hash functions and ciphers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How does TLS determine which algorithm to use?

A

TLS client connects to a TLS server, the two negotiate the most secure version of each algorithm from the set of algorithms that each implement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does TLS not protect?

A

Knowing how much data is exchanged and what the endpoints are
Knowing that data is being exchanged at all
TLS provides neither anonymity or stealth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

To achieve anonymity, it is necessary to hide one’s traffic within a crowd, which systems can do this?

A

Proxies and mix networks, also called onion routing networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How do systems such as onion routing networks work?

A

Combine traffic from multiple computers into a single channel that is sent between multiple computers and then separating out the traffic again

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How does the onion router (Tor) work?

A

Uses a sophisticated system that relies on multiple layers of encryption and sends every users’ traffic to at least three different computers in sequence, so that not even the nodes of the mix network know with whom the users are communicating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

To offer stealth, it is necessary to masquerade one’s traffic so that it cannot be observed, how can this be done?

A

By hiding the traffic using a masking protocol or using steganography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

TLS works at the transport layer, some internet telephone protocols use encryption at which layer?

A

Application layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which wireless network protocols have encryption built in?

A

802.11 WPA and WPA2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which 2 approaches are commonly used to encrypt data at rest?

A

Application level encryption

Device level encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Application level encryption is also known as…

A

File-level or document-level encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Where is device-level encryption is applied?

A

It is built into the computer’s storage subsystem and performs encryption on a block-by-block basis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

List the 3 approaches for working with encrypted data

A

Secure enclaves
Homomorphic encryption
Multiparty computation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are secure enclaves?

A
  • They rely on modifications to the microprocessor to provide security
  • Some of these systems rely on curtained memory, which prevents the microprocessor from accessing the memory where the secure application is running
  • Another approach uses specialized hardware within the microprocessor to automatically encrypt memory as it is written and decrypt it as it is read
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is homomorphic encryption?

A

A collection of mathematical techniques for working with encrypted data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is multiparty computation?

A

Multiparty computation is a class of algorithms that allows programs running on different computers to participate in computations such that results can be computed without compromising each party’s private data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are digital signatures?

A

Using encryption to certify that a document has not been modified since some time in the past

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What 2 kinds of cryptographic quantum technology have already been demonstrated in the laboratory?

A

Quantum computers

Quantum key distribution (QKD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is quantum key distribution (QKD)?

A

Approach for distributing an encryption key to two endpoints so that it is physically impossible (according to our understanding of physics) for a third party to get a copy of the key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

List the 2 kinds of secret key algorithms

A

Stream ciphers

Block ciphers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are stream ciphers?

A

Encryption algorithms that transform one byte of data at a time
The RC4 algorithm was widely used in the 1990s with the Netscape SSL protocol and is still somewhat used today, although its popularity is waning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What are block ciphers?

A

Transform a small block of data at one time, typically 16, 32 or 64 bytes
Both DES and AES are block ciphers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Which 2 mathematical functions are ciphers based on?

A

Substitution

Transposition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is substitution in encryption?

A

Substitutes one pattern for another according to a code book

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is transposition in encryption?

A

Scrambling the bits within a set of bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Traditionally, do steam ciphers use substitution or transposition?

A

Substitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Traditionally, do block ciphers use substitution or transposition?

A

Both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Which is generally considered safer, stream ciphers or block ciphers? Why?

A

Because stream ciphers typically only use substitution and block ciphers use both substitution and transposition, block ciphers are somewhat more secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is the drawback of block ciphers versus stream ciphers?

A

Block ciphers are generally slower because they perform both substitution and transposition
Though today’s computer are fast enough to allow stream ciphers to be used as block ciphers and vice versa in the majority of applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Which algorithm was adopted by the US government in 2001?

A

AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What weaknesses does AES have?

A

Currently regarded as containing no significant algorithmic weaknesses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

How does AES work?

A

Consists of an inner mathematical operations that is repeated
AES-128 repeats this function 10 times and is said to have 10 rounds
AES-192 has 12 rounds
AES-256 has 14 rounds
Each round makes it harder to decrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Which encryption algorithm has the US National Security Agency (NSA) for top secret information?

A

AES-256 (but not AES-128)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Why do some organizations use triple DES over AES?

A

They believe it is more thoroughly understood than AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which algorithm was developed by the Chinese government?

A

SM4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What are lightweight encryption algorithms?

A

Algorithms designed to encrypt small amounts of data - just a few bytes - or that must run in low-powered environments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

List 2 examples of lightweight encryption algorithms

A

SIMON and SPECK, both developed by the NSA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What is cryptanalisys?

A

The process of trying to decipher an encrypted message without knowing the key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

A brute force attack is the most basic form of cryptanalysis, what do more sophisticated methods rely on?

A

Analyzing individual mathematical operations that create the encryption algorithm and correlating many applications of the algorithm over a large set of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

In what circumstances is an encryption algorithm considered broken?

A
  • Known ciphertext attack
  • Known plaintext attack
  • Chosen plaintext attack
  • Differential cryptanalysis
  • Related key attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What is a Known cyphertext attack?

A

Given a ciphertext C, the attacker can determine the plaintext P

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is a Known plaintext attack?

A

Given a plaintext P and a ciphertext C, the attacker can determine the encryption key K

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is a Chosen plaintext attack?

A

Given a plaintext P of the attacker’s choosing and the encrypted ciphertext C of that message, the attacker can determine the encryption key K

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What is Differential cryptanalysis?

A

Given a number of similar plaintext messages P1 through PN and the corresponding ciphertext messages C1 through CN, the attacker can determine encryption key K

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is a Related key attack?

A

Given a number of related keys and a collection of ciphertext encrypted with each key, it is possible to learn some or all of the keys, and therefore decrypt some or all of the ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Why was DES-128 weaker than DES-56?

A

The change to the substitution boxes that NSA had applied to the original 128-bit algorithm submitted by IBM had made the algorithm stronger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

By the mid-1990s, why was 56-bit DES no longer considered sufficiently long?

A

It could be brute-forced by Deep Crack (a million-dollar special-purpose computer created for the purpose of demonstrating the weakness of the algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is a Clipper chip?

A

A microchip with encryption embedded, developed by the US government in the mid-1990s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Why was the Clipper chip not commercially successful?

A
  • Featured a mandatory key escrow that would have let the U.S. government decode Clipper-encoded messages with a valid court order
  • Hardware vendors did not want to accept the additional costs and manufacturing complexities of adding a U.S. government chip to their products
  • Organizations that needed more than 56 bits of security but still wished to follow government standards could simply use triple DES or 3DES
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

List 4 symmetric algorithms

A

DES
3DES (triple DES)
RC4
AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Is DES a block or stream cipher?

A

Block cipher

79
Q

Is 3DES a block or stream cipher?

A

Block cipher

80
Q

Is RC4 a block or stream cipher?

A

Stream cipher

81
Q

Is AES a block or stream cipher?

A

Block cipher

82
Q

What is the key size for the DES algorithm?

A

56 bits

83
Q

What is the key size for the 3DES algorithm?

A

168 bits

84
Q

What is the key size for the RC4 algorithm?

A

40-2048 bits

85
Q

What is the key size for the AES algorithm?

A

128, 192 or 256 bits

86
Q

What is the block size for the DES algorithm?

A

64 bits

87
Q

What is the block size for the 3DES algorithm?

A

64 bits

88
Q

What is the block size for the RC4 algorithm?

A

8 bits (1 byte)

89
Q

What is the block size for the AES algorithm?

A

128 bits

90
Q

What is the status of the DES algorithm?

A

Not secure; do not use

91
Q

What is the status of the 3DES algorithm?

A

Secure but slow; not widely used

92
Q

What is the status of the RC4 algorithm?

A

Was widely used in SSL and WEP; increasingly deprecated

93
Q

What is the status of the AES algorithm?

A

Widely used; generally thought to be secure

94
Q

What are cryptographic modes of operation?

A

Techniques for combining repeated invocations of block algorithms so that they can be used on more data

95
Q

List 4 common cryptographic modes of operation

A 
Electronic codebook (ECB)
Cipher block chaining (CBC)
Counter mode (CTR)
Authenticated encryption (AE)
96
Q

Describe the Electronic codebook (ECB) cryptographic mode of operation

A
  • Simplest
  • Least secure
  • Uses the same key for each block of data
97
Q

Describe the Cipher block chaining (CBC) cryptographic mode of operation

A
  • Encrypting each block as a function of the block’s plaintext and the previous block’s cyphertext
  • Same block of plaintext will be encrypted differently each time
  • Because the first block of the message doesn’t have a previous block, it is encrypted by combining the plaintext and a randomly generated block of data called the initialization vector (IV)
  • Must begin decrypting from the first block in the sequence
98
Q

Describe the Counter mode (CTR) cryptographic mode of operation

A
  • Similar to CBC, except that the IV is replaced with a counter
  • Possible to start decrypting at any point in the encrypted data
  • Popular choice for disk encryption algorithms
  • Errors in the cipher text do not propagate, and CTR encryption and decryption can be parallelized
  • Despite these advantages, not widely used
99
Q

Describe the Authenticated encryption (AE) cryptographic mode of operation

A
  • Family of modes that provide for both confidentiality and authentication
  • Rely on additional information that is injected into the ciphertext so that the decrypting program can verify that decryption was performed using the correct key
  • Authenticated encryption modes have been patented and, as a result, they are not widely used
100
Q

What are the 2 hard and fast rules for strong encryption keys?

A

Truly random

Used as infrequently as possible (ideally just to protect a single message)

101
Q

How can microprocessors be built to provide randomness?

A

Many microprocessors have a hardware random number generator that acquire entropy from thermal noise

102
Q

List 8 uses of symmetric (secret-key) encryption

A 
Documents with passwords
Block-level disk encryption
Persistent VPNs
TLS
Wireless networks
Encrypted databases
Cryptographic erasure and retention rules
Secret sharing
103
Q

Describe symmetric encryption applied to Documents with passwords

A

One of the most common uses

Microsoft and Adobe use it

104
Q

Describe symmetric encryption applied for Block-level disk encryption

A

At the driver layer, separately encrypting each disk sector

Typically use a variant of counter mode so that any disk block can be decrypted without decrypting the adjacent block

105
Q

Describe symmetric encryption applied for Persistent VPNs

A

System administrator would create a random encryption key and program it into all systems that require access to the VPN

106
Q

Describe symmetric encryption applied for TLS

A

After a cryptographic session is established using asymmetric cryptography, symmetric encryption algorithms are used for bulk data encryption

107
Q

Describe symmetric encryption applied in Wireless networks

A

WPA2 encryption system requires that all units be programmed with the same passphrase or key
This passphrase or key is then used to derive a specific symmetric encryption key used to secure data sent over the wireless network

108
Q

Describe symmetric encryption applied to Encrypted databases

A

The entire database file can be encrypted with a single key; individual rows or columns can be encrypted; rows, columns or cells can be encrypted with keys stored in other rows, columns or cells; the database can be encrypted but the index left unencrypted to allow for rapid searching; and so on

109
Q

Describe symmetric encryption applied for Cryptographic erasure and retention rules

A

If the drive is encrypted with a key, the entire contents of the hard drive can be rendered indecipherable by erasing the key

110
Q

Describe symmetric encryption applied for Secret sharing

A

A single document can be encrypted with a single key that is then split into multiple shares using a mathematical approach called secret sharing
For example, if an organization has seven auditors, the key could be split so that any three auditors, working together, can recover the encrypted data

111
Q

What are hash algorithms?

A

Fast mathematical functions that take an input of any length and produce a small output (typically 16-64 characters) that looks random

112
Q

What makes a strong hash algorithm?

A

The output cannot be predicted from the input without running the algorithm
Changing any bit in the input will change, on average, half of the bits in the output

113
Q

Many people call hash algorithms digital fingerprints. Why is this incorrect?

A
  • Different hash functions will produce different outputs for the same document, so in addition to knowing a document’s hash, it is important to know the algorithm that was used to produce the hash. Some hash functions can also be keyed, so that the document’s cryptographic hash depends on the algorithm, the document and the key.
  • Even though no two people have been found to have the same fingerprints, it is possible for many different documents to have the same hash value
  • People’s fingerprints change over time and each set of fingerprints from the same individual is slightly different. Human fingerprints must be matched with a comparison function that allows for slight variations. Cryptographic hashes, by contrast, are precisely matched bit for bit.
  • Latent prints left at the scene of a crime are typically partial prints and can sometimes match many different people. Only an expert can determine whether or not two prints actually match. File hashes, on the other hand, are always complete and can be matched by anyone, or any program—no special training is required.
114
Q

What is a hash collision and what does it mean?

A

Multiple documents having the same hash value

They are the mark of a hash that is no longer secure

115
Q

How do digital signatures work?

A

Digital signatures combine hash functions with public key cryptography in a way that makes it possible to certify that a document has not been changed since it was digitally signed

116
Q

SHA-256, SHA-384 and SHA-512 are all variants of which hash algorithm?

A

SHA-2

117
Q

List 9 hash algorithms

A 
MD5
SHA-1
SHA-256
SHA-384
SHA-512
SHA3-224
SHA3-256
SHA3-384
SHA3-512
118
Q

What is the output size for the MD5 hash algorithm?

A

128 bits

119
Q

What is the output size for the SHA-1 hash algorithm?

A

160 bits

120
Q

What is the output size for the SHA-256 hash algorithm?

A

256 bits

121
Q

What is the output size for the SHA-384 hash algorithm?

A

384 bits

122
Q

What is the output size for the SHA-512 hash algorithm?

A

512 bits

123
Q

What is the output size for the SHA3-224 hash algorithm?

A

224 bits

124
Q

What is the output size for the SHA3-256 hash algorithm?

A

256 bits

125
Q

What is the output size for the SHA3-384 hash algorithm?

A

384 bits

126
Q

What is the output size for the SHA3-512 hash algorithm?

A

512 bits

127
Q

When was the MD5 hash algorithm first published?

A

1992

128
Q

When was the SHA-1 hash algorithm first published?

A

1995

129
Q

When were the SHA-256/384/512 hash algorithms first published?

A

2001

130
Q

When were the SHA3-224/256/384/512 hash algorithms first published?

A

2015

131
Q

As of 2019, what was the status of the MD5 hash algorithm?

A

Deprecated; should not be used in applications that require confidentiality or integrity

132
Q

As of 2019, what was the status of the SHA-1 hash algorithm?

A

Being phased out; should not be used for new applications

133
Q

As of 2019, what was the status of the SHA-256/384/512 hash algorithm?

A

Widely used

134
Q

As of 2019, what was the status of the SHA3-224/256/384/512 hash algorithms?

A

Chosen by NIST through an open competition in 2013; significantly slower than SHA-256 without hardware support

135
Q

List 3 applications for hash functions

A

Converting pass phrases to cryptographic keys
Identifying versions of documents
Digitally signing documents

136
Q

Although it’s common to derive an encryption key by simply taking a person’s passphrase and hashing it, why is this not secure?

A

Attackers have compiled lists of billions of hashes of popular passwords and passphrases

137
Q

How can you securely use a hashed passphrase as an encryption key?

A

Combine the provided passphrase and a random number, called a nonce, and to hash the two together many thousands of times

138
Q

Which algorithms are typically slower, symmetric or asymmetric?

A

Asymmetric

139
Q

Are symmetric or asymmetric keys of the same length easier to crack? Why?

A 
Asymmetric - symmetric keys are simply random collections of bits, while asymmetric keys are numbers with specific mathematical properties
Public keys (asymmetric) are public, so an attacker who is targeting a public key system can create any number of chosen plaintext/ciphertext pairs
140
Q

List 3 asymmetric (public key) systems

A

RSA
The Digital Signature Algorithm (FIPS-186)
Elliptic Curve Cryptography

141
Q

Describe the RSA public key system

A
  • Relies on the fact that it is easy to multiply two prime numbers together to create a composite, but it is relatively difficult to take a composite number and decompose it into its prime factors
  • Private and public keys are interchangeable; that is, messages encrypted with the RSA public key can be decrypted with the private key, and messages encrypted with the private key can be decrypted with the public key
  • Can be used both for message secrecy and for digital signatures
142
Q

Describe The Digital Signature Algorithm

A

Public key algorithm created by the U.S. government in the 1990s as an alternative to RSA
Was not covered by the RSA patent
Could be used for digital signature but not for encryption
Required significantly more computational effort to verify signatures than does RSA

143
Q

Describe Elliptic Curve Cryptography

A

Both the RSA and DSA algorithms make use of mathematical properties that arise from performing mathematics
It is possible to perform the same kinds of operations in a different kind of mathematical range called an elliptic curve
Has the advantage of making it dramatically harder to factor numbers and, thus, crack a public key
Public key cryptography performed in elliptic curves can achieve the same security with much smaller keys, making the resulting cryptography faster and more energy efficient

144
Q

Many other public key algorithms exist but why should we not use them?

A

Even though they work, they do not provide compelling advantages compared to existing standards, and their lack of widespread adoption means that any implementations are more likely to have significant security vulnerabilities

145
Q

Why are digital signatures more powerful than physical signatures?

A
  • Certify that a document has not been modified
  • Physical signatures can be forged
  • You can’t lift a digital signature and put it on another document
  • Digital signatures can be stores separately from the document
146
Q

What property do digital signature provide?

A

Integrity - they certify that a document has not been modified

147
Q

What is the property of nonrepudiation?

A

Non-repudiation is the assurance that someone cannot deny the validity of something

148
Q

How do digital signatures provide nonrepudiation?

A

The only way to dispute the authenticity of a digital signature is by making a claim that the private key was compromised or by asserting the digital signature scheme it itself mathematically broken

149
Q

Provide an example of how digital signatures may be used as a form of commitment

A

The document is stored separate from the signature
Commitments can be used to implement closed-bid auctions in a manner that not even the auctioneer knows the identities of the bidders

150
Q

How do digital signatures work?

A

By combining 2 mathematical techniques:
• A program first computes a hash value
• It then encrypts the hash value with an asymmetric signing key

151
Q

How are digital signatures verified?

A

The signature is decrypted with the verification key (the public key)
The document is hashed and that value is compared to the decrypted hash to confirm they are identical

152
Q

What do you call a person or program that verifies a digital signature?

A

Relying party (RP)

153
Q

Digital signatures are distributed as digital certificates that are themselves signed by organizations called…

A

Certificate authorities

154
Q

What does PKI stand for?

A

Public Key Infrastructure

155
Q

What is Public Key Infrastructure?

A

A set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption

156
Q

These days, who uses today’s public keys?

A

Today’s public keys are mostly used to certify the identity of organizations—and in particular, their web servers—not individuals

157
Q

Why is Public Key Infrastructure trusted?

A

They are digitally signed by an organization trusted to certify that the public key belongs to the organization

158
Q

Provide examples of where PKI is used today

A

PKI operates mostly behind the scenes, securing web servers, mobile phones, secure chat and even chip-based credit cards

159
Q

Why is PKI not widely used to identify people?

A

Today’s PKI implementations have proven to be too complicated for most computer users to comprehend and too technical for them to care much about it

160
Q

What is a certificate authority (CA)?

A

An entity that a particular public key belongs to

For example, Equifax Security CA

161
Q

What is a digital certificate?

A

On a web server, it’s a promise made by a third party, the certificate authority, that the public key on the certificate really does belong to the organization that operates a web server

162
Q

What is contained within a digital certificate?

A

Server’s public key
Server’s domain name system (DNS) name
Name of the company

163
Q

How does an organization get a digital certificate?

A

The organization fills in a document called a certificate signing request (CSR)

The Certificate Authority:
•	verifies the information
•	puts it on the certificate
•	signs the certificate with their private key
•	Gives it back to the organization

The organization puts the certificate on their web server

164
Q

How are digital certificates verified?

A

The browser:
• computes the cryptographic hash of all the information on the certificate other than the signature
• takes the signature that’s on the certificate and decrypts the signature with the CA’s public key
• checks that the 2 values match

165
Q

What 2 assumptions must be true for digital certificate verification to succeed?

A

The browser must have a copy of the CAs public key

The CA must have behaved in a trustworthy manner

166
Q

What is client-side PKI?

A

PKI applied to individuals rather than organizations

167
Q

What does client-side PKI require?

A

A means for the individual to securely maintain their private key and to use it to prove their identity

168
Q

List 2 ways an individual can maintain their private key

A
  • Stored inside a smart card or another kind of physical token - this is the most secure means and may be combined with a PIN to further secure it
  • Stored in an encrypted file on the user’s computer - typically requires a password
169
Q

List 2 reasons why smart cards are significantly more secure than storing a private key in an encrypted file

A
  • Key does not leave the card

* Card is normally removed when not in use

170
Q

List 4 common uses for client-side PKI

A
  • Alternative to usernames and passwords for website authentication
  • Add signed name to a document
  • Certify the contents of a digital document
  • Digitally sign software
171
Q

Why do we need a means to revoke public keys?

A
  • They are valuable and can be stolen
  • They can be destroyed
  • Allows the CA a means to identify keys that should no longer be used or trusted
172
Q

Name 3 approaches to certificate revocation

A
  • When a certificate is issued, the certificate’s owner can also obtain a revocation certificate.to be published if the private key is compromised
  • Most CAs operate a certificate revocation list (CRL)
  • Most CAs operate an online certificate revocation service
173
Q

Which protocol do most CAs use for online certificate revocation services

A

Online Certificate Status Protocol (OCSP)

174
Q

Can Certificate Authorities be revoked?

A

No - companies (such as Microsoft, Google and Apple) need to publish patches for their browser software to remove a CA

175
Q

Why is it important, when dealing with digital certificates, that the computer know the current time?

A

Because digital certificates have validity periods

176
Q

How can computers reliably learn the correct time?

A
  • Using the internet Network Time Protocol (NTP)
  • Using a global positioning system (GPS) receiver
  • Learning the time from a cellular network
  • Using the Windows Time Service
177
Q

Currently, can computers be sure they know the correct time?

A

No, none of the current protocols use cryptography to assure that the time provided is correct

178
Q

What are the issues with today’s PKI system?

A
  • Modern web browsers have more than 100 CAs built-in (some with suspicious names like AAA Certificate Services)
  • No practical way for users to distinguish between high-quality CAs and bargain basement ones
  • All CAs are equally trusted
  • Different CAs use different security standards
179
Q

What can organizations do to ensure their true digital certificates are used?

A

Publish Certification Authority Authorization (CAA) records with their DNS to inform web browsers to only trust certificates from a specific authority

180
Q

What are Extended Valuation (EV) certificates?

A
  • An attempt to create a high-quality certificate
  • CAs are supposed to demand higher levels of assurance
  • They provide more information about the provider
  • More expensive
181
Q

Why were Extended Valuation (EV) certificates not popular with security professionals?

A

They argued against the very premise of EV certificates, saying that the rigorous checking of identity and liability protection were supposed to be part of the original certificates

182
Q

What are Extended Valuation (EV) certificates primarily used for today?

A

The provide additional branding, but they do not appear to provide the additional security hoped for by their creator

183
Q

What is a hybrid cryptography system?

A

One that combined symmetric cryptography, cryptographic hash functions and asymmetric cryptography
Most systems nowadays are hybrid

184
Q

List 2 common protocols used in email

A

S/MIME

Pretty Good Privacy (PGP)

185
Q

How does S/MIME work?

A

Email messages are digitally signed to verify the sender and encrypted so that they can only be deciphered by their intended recipient

186
Q

Why is S/MIME rarely used (outside of a few select organizations)?

A

Using S/MIME requires that email correspondents first obtain digital certificates

187
Q

How have organizations that have been successful in using S/MIME implemented it?

A

They generally provide digital certificates to their users

Example, US government provides digital certificates stored on cards to their employees

188
Q

How does Pretty Good Privacy (PGP) work in email?

A

Uses an alternative model for PKI called the Web of Trust
Instead of relying on CAs to certify an individual’s public key, individuals create their own PGP pubic keys and then publish those keys either on a web page or by uploading the key to the PGP key server

189
Q

PGP deployment is generally limited to which group of users?

A

Small groups of technologists

190
Q

What is Digital rights management (DRM) generally used for?

A

Encrypting movies and other kinds of digital media

Offers a cryptographic erasure function to block access to a document after a time period has expired

191
Q

Why is there still a privacy risk when a database is encrypted?

A

Access patterns of reads and writes can still reveal privacy-sensitive information

192
Q

What is Oblivious Random-Access Memory (Oblivious RAM, or simply ORAM)?

A

A system that has the property that monitoring reads or writes between the user, and the database reveals no side channel information
ORAM systems typically perform additional read-and-write operations to different parts of memory whenever any information is read or written

193
Q

What is Private Information Retrieval (PIR)?

A

A range of protocols in which data can be retrieved from a database without revealing to the database or another observer the information that is retrieved

194
Q

How do Oblivious RAM and Private Information Retrieval (PIR) relate?

A

PIR systems are a subset of ORAM systems, in that they provide for data access but not necessarily for data modification

CIPT (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions