Chapter 6

Question 1

cryptology

Answer 1

cryptography + cryptanalysis

Question 2

Work function

Answer 2

Effort and time to complete brute force attack against encryption system

Question 3

Ciphers

Answer 3

1. Transposition - Re-arrange
2. Substitution - Replace
   - ROT3
   - Vigenere cipher table
3. One time pads (Vernam ciphers)
   - OTP must be random
   - OTP must be secure
   - OTP used only once
   - OTP (key) must be as long as the message
4. Running key ciphers (or book ciphers) - use passage in book, newspaper, or magazine
5. Block ciphers - blocks or chunks at a time
6. Stream ciphers - one character at a time

Question 4

Confusion and Diffusion

Answer 4

Used by cryptography to obscure plaintext

Confusion - complexity between plaintext and key

Diffusion - small change in plaintext results in changes spread in ciphertext

Question 5

Symmetric key cryptography

Answer 5

aka. shared Key or private Key cryptography

Sometimes used ephemeral key - temporary for one session only

Cons:
- Key distribution is a problem
- No non-repudiation
- Not scalable
- Must re-generate when one participant leaves the group

Pro:
- Fast

Question 6

Asymmetric key cryptography

Answer 6

Public key cryptography

Total keys = n(n-1) / 2

Pros:
- Only 1 pair of keys need to be generated for new user
- When 1 participant leaves, just cancel that pair of keys
- Regenerate only when private key is compromised
- Additionally provides integrity, authenticity and non-repudiation
- Key distribution is simple, just share public key
- No pre-existing comm link required

Cons:
- Slow

Question 7

Message Digest

Answer 7

Hash

Used with public key cryptography to create digital signatures

Question 8

Symmetric cryptographic modes

Answer 8

1. Electronic code book (ECB) - block encryption using 64-bit key; least secure
2. Cipher block chaining (CBC) - IV and XOR; prev encrypted block XOR with current plain block, then encrypt; transmission errors can affect decrypt
3. Cipher feedback (CFB) - similar to CBC but streaming and encrypt previous ciphertext block before XOR with current plain block; transmission errors can affect decypt
4. Output feedback (OFB) - also uses IV and XOR, but does not rely on prev ciphertext block; IV is encrypted and XOR’d, and is used as IV for next block; no longer affected by transmission errors
5. Counter Mode (CTR) - similar to CFB and OFB, but uses counter to increment IV (seed value) for each block; does not rely on prev stage
6. Galois counter mode (GCM) - CTR with authenticity
7. Counter with Cipher Block Chaining Message Authentication Code (CCM) - uses CTR for confidentiality, CBC-MAC for authenticity

Unauthenticated modes:
ECB, CBC, CFB, OFB, CTR

Authenticated modes:
GCM, CCM

Question 9

Symmetric key cryptography algorithms

Answer 9

1. DES - 64-bit blocks; 56-bit key; 16 rounds of encryption; supports all 5 unauth cipher modes (ECB, CBC, etc.); not secure
2. Triple DES (3DES) - DES EEE-3 or EDE-3; no longer used by gov’t
3. IDEA - 128 bit key (52 x 16-bit subkeys); supports all 5 unauth modes like DES; used in PGP secure email
4. Blowfish - extends IDEA with 32 - 448 bits range of keys; used in SSH
5. Skipjack - 64-bit blocks, 80-bit key; supports escrowed key and used by gov’t (NIST and D of Treasury); not embraced by crypt community
6. RC4 - stream cipher; 0 - 2048 bit keys; deprecated
7. RC5 - 32, 64, 128 bit blocks; 0 - 2040 bit keys
8. RC6 - 128 bit blocks; 128, 192, 256 bit keys; not widely used
9. AES - 128 bit block;
   - 128 bit key: 10 rounds encryption
   - 192 bit key: 12 rounds
   - 256 bit key: 14 rounds
10. Rijndael - same as AES but block size = key size
11. CAST-128
    - 64 bit block; 40 - 128 bit keys; 12 or 16 rounds encrypt
12. CAST-256
    - 128 bit block; 128, 160, 192, 224, 256 bit keys; 48 rounds
13. Twofish - 128 bit block; 256 bit keys; 16 rounds of encrypt; prewhitening and postwhitening (plaintext XOR key operation)

Question 10

Distribution of symmetric keys

Answer 10

1. Offline distribution
2. Public key encryption
3. Diffie-Hellman

Question 11

Storage of keys

Answer 11

• never store with encrypted data
• use split knowledge

Can be software based or hardware based (e.g. HSM)

Question 12

Key escrow

Answer 12

Government:
- Fair cryptosystems - multiple parts to 3rd parties
- Escrow encryption standard - gov’t or agent has access (such as Clipper chip)

General community:
Use escrow with recovery agent (RA); each RA is part of M of N control