Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Next Gig > Cryptograhy > Flashcards

Cryptograhy Flashcards

1
Q

Cryptography

A

Encrypting data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Cryptanalysis

A

Breaking encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cryptography Algorithm

A

A set of rules performing the locking/encryption and unlocking/decryption of data/information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cryptography Key

A

A value used with the algorithm to lock and unlock information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Key Space

A

The maximum number of keys possible

e.g. key space of particular character set (e.g. 0-9)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Entropy

Is high or low entropy desired for crypto key?

A

A measure of how random or unpredictable something is

e.g. using only lowercase letters a key would result in low entropy
using mix of upper, lower, numbers and special chars would result in high entropy

High entropy is desired, it would make it harder for an attacker to guess your keu

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Cryptoperiod

A

Length of time a particular crypto key may be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Work Factor

A

Estimated time or effort needed to break the encryption, usually measured by timing of brute force approach

The larger the key size, the greater the key space, the more secure your key becomes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Avalanche Effect?

What methods does it apply to? Why?

A

Minor changes to the either the key or plaintext will result in a large change to the ciphertext

Important for both encryption and hashing

Prevents reversing ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Kerckhoff’s Principle

A

The strength of your encryption should not rely on keeping your algorithm secret

It should rely instead on keeping the encryption keys a secret, as long as you can change them when needed

If keys compromised, just make a new one - cheap and easy
If algorithm is compromised - this is costly and complicated, all HW and SW that rely on encryption algorithm would need to be updated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Symmetric Encryption

Advantage/Disadvantage

AKA

A

One key is used with the algorithm to encrypt and decrypt data

Only benefits confidentiality

Advantages: very fast and cheep
Disadvantages: key management is difficult because you have to distribute the key to decrypt; usually done using asymmetric encryption or out of band

AKA - Secret key, Single Key, Shared Key, Session Key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

List types of Ciphers

A

Steam
Block
Block Mode
Stream Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Stream Ciphers

A

Generates ciphertext bit by bit or byte by byte

Used for encrypted data in transit

Popular Algorithms:
RC4 - old and not used anymore
Salsa and ChaCha commonly used in TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Block Ciphers

Examples

A

Block ciphers can work in two modes: Stream or Block Mode

Block Mode - encrypts data at rest
Stream Mode - encrypts data in transit

Examples - AES, DES, 2DES, 3DES
Twofish, Blowfish
IDEA
RC2, RC5, RC6, RC7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Asymmetric Encryption

A

Using a key pair (Public key and Private key)

The public key can be used by anyone

The private key is held by the subject that created the key pair and is kept PRIVATE. It should not be given to anyone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

List Asymmetric Algorithm

A 
RSA
ElGamal
ECC (Elliptic-Curve Cryptography)
Diffie-Hellman
Digital Sigital Algorithm
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RSA (Rivest-Shamir-Adleman)?

Use?

A

Asymmetric Algorithm

Encrypts tiny quantities of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

ElGamal

Use

A

Asymmetric Algorithm

Exchanging a symmetric key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ECC (Elliptic-Curve Cryptography)

Use

A

Asymmetric Algorithm

Creating digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Diffie-Hellman

Use

A

Asymmetric Algorithm

A key agreement algorithm

DH is ued to negotiate symmetric keys between

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Digital Signature Algorithm

Use

A

Asymmetric Encryption

Designed by NIST to create digital signatures

NOT capable of exchanging symmetric keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Hashing

A

irreversible, one way function

We utilize hashes for integrity through the ability to detect any changes in a data set through the change in a hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Salt

A

something that should be added to passwords/passphrases before being hashed

makes password resistant to rainbow table and other attacks on hashes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which OS CANNOT salt passwords/passphrases

A

Microsoft Windows

SYSKEY in prior versions could encrypt hashes in the SAM file

Microsoft recommends mitigation: use Bitlocker to encrypt drive and protect SAM file from attackers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Describe how Hash Algorithms work?

A

Take input file/data

Split the file/data into blocks, take first block and XOR with next and continue until the end block

The result is a hash or digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Common Hashing Algorithms?

A

MD2, 4, 5 - 128 bit

MD6 - 512 bit

SHA 1 - 160 bit

SHA2/3 - 224, 256, 384, 512

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Public Key Infrastructure

A

CA’s generate certificates containing the public keys of the users (or servers).

Users then distribute these certs to the people they want to communicate with.

Certificate recipients validate a certificate using the CA’s public key, which is pre-installed in their device from the operating system vendor, browser vendor or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Registration Authority (RA)

A

An authority in a network that verifies user request for a digital certificate and tells the CA to issue it.

The RA VERIFIES user credentials (verifies username/password conducts a background check, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Certificate Authority

A

Signs, issues and manages certificates.

The CA users the subject’s Certificate Signing Request (CSR) to sign the subject’s certificate.

The CA also maintains the Certificate Revocation List (CRL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Certificate Revocation List

A

Contains serial numbers of the public certificates that have been revoked and should no longer be trusted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Certificate revocation reason codes

A 
KeyCompromise
CAcomprimise
affiliationChanged
Superseded
CessationOfOperation
CertificateHold
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Online Certificate Status Protocol (OCSP)

A

Check revoked certificates online in real time

33
Q

X.509 Certificate

A

Standard format or layout of a digital certificate, which includes:

  • CA’s unique name
  • Subject’s public key
  • Subject’s X.500 name
  • Unique certificate serial number given by the CA
  • Beginning and ending dates (validity dates)
  • CRL location
  • CA’s digital signature
34
Q

Certificate Practices Statement

A

This outlines the CA’s rule of issuance of a certificate

35
Q

Certificate Signing Request

A

Used to request a digital certificate from RA

36
Q

Certificate Signing Request Process

A
  1. The subject creates their public/private key pair
  2. The subject generates a CSR and digitally signs it with their private key This contains a description of the subject as well as their public key and is sent to the RA
  3. RA verifies the subjects identity. Once verified the RA sends the subjects key to the CA
  4. The CA issues the subjects public key and a unique serial number, that validity date and the CRL/OCSP
  5. The CA creates a digital signature on the subject’s public key
  6. The subject’s public key is sent back to the subject
37
Q

Encryption Implementation - Data At Rest

A

For data lifecycle phases: store and archive (retention of data), use symmetric encryption

38
Q

Encryption Implementation - Data in Motion/Transit

A

For data lifecycle phases: share, can use IPSec, VPN and TLS

39
Q

Encryption Implementation - Data in Use

A

For data lifecycle phases: use, focuses on DRM

Typically the most difficult phase of data to protect

40
Q

Quantum Crytography

A

Use quantum physics for encryption purposes. Very new technology, with limited applications and expensive to implement.

41
Q

Homomorphic encryption

A

Homomorphic encryption is a theoretical phenomenon that would allow processing of encrypted material without needing to first decrypt it.

42
Q

What data encryption is available with possibly IaaS?

What data/access is protected and what is not?

A

basic storage level encryption - encryption is performed on the cloud storage solution with keys maintained by the CSP

only protects from media theft or loss but not CSP insider

volume storage encryption - encrypted data resides on volume storage via an encrypted container and will protect against physical loss or theft, external admins (CSP, MSP, CSB) accessing data, snapshot being taken or removed

will not protect against access attempts made through the instance

43
Q

How can volume level storage encryption be implemented

What cloud service model is it applicable to?

A
  1. Instance based encryption - encryption engine on image and keys are managed externally
  2. Proxy based image - encryption engine runs on proxy instance and handles cryptographic processing along with key management and storage
  3. Oject-storage encryption - offers server-side encryption but less effective so encrypt data before it arrives to the cloud

Applicable to IaaS

44
Q

What data encryption is available with possibly PaaS and SaaS?

A

File level encryption

Application level encryption

Database encryption which offers

  • File level encryption
  • Transparent encryption
  • Application level encryption
  • Proxy Level encryption
45
Q

Describe File level encryption?

What cloud service model is it applicable to?

A

encryption engine implemented at client level using IRM and/or DRM

PaaS and SaaS

46
Q

Describe Application level encryption?

What cloud service model is it applicable to?

A

encryption engine resides in the application that utilizes object storage and encrypts the data before the data reaches the cloud

PaaS and SaaS

47
Q

Describe Database File level encryption?

What cloud service model is it applicable to?

A

The volume or folder of the database gets encrypted and the key resides on the instance

PaaS and SaaS

48
Q

Describe Database Transparent encryption?

What cloud service model is it applicable to?

A

The DBMS can encrypt specific portions of the DB like tables, rows/tuples, columns/attributes or the entire DB

The encryption engine and Keys reside within the DB and is encryption is transparent to the application

PaaS and SaaS

49
Q

Describe Database Application level encryption?

What cloud service model is it applicable to?

A

Encryption engine and keys reside within the application that is using the DB

PaaS and SaaS

50
Q

Describe Database Proxy level encryption?

What cloud service model is it applicable to?

A

Encryption engine is separate from the application or DB or using a 3rd party vendor tor MSSP

PaaS and SaaS

51
Q

Best practices particular to cloud with Key Management

A

Keys should be separate from CSP

52
Q

What are the challenges with Encryption Management in the Cloud

A

Access to keys; should not be accessible by CSP
Key storage; It is difficult to securely store keys in the cloud
Backup and replication: data can be backed up and replicated across different formats, affects the ability of short and long term keys to maintained and managed effectively

53
Q

Key Management Options in the Cloud

A
  1. XML Key Management Specification (XKMS 2.0)
  2. Key Management Interoperability Protocol (KMIP)
  3. Trusted Platform Module (TPM)
  4. Hardware Security Module (HSM)
  5. Key Escrow
54
Q

Describe XML Key Management Specification (XKMS 2.0)

A

defines protocols for distributing and registering public keys (used for XML encryption and digital signature) and key management

55
Q

Describe Key Management Interoperability Protocol (KMIP)

A

An open source communication protocol that defines message formats for the manipulation of keys on a key management server

56
Q

Describe Trusted Platform Module (TPM)

A

A crypto chip on the main board of a device that can GENERATE and STORE encryption keys, as well as perform hardware based encryption/decryption

It can also allow cloud based applications to authenticate hardware devices

(Think Tiny Platform Module)

57
Q

How does TPM interact with the host device

A

3 Roots of Trust (which can be externally authenticated by means of a Certificate Authority)

  1. Root of Trust for Measurement - first set of instructions executed when a chain of trust is established
  2. Root of Trust for Storage - The TPM memory is shielded from access by any entity other than the TPM
  3. Root of Trust for Reporting - Typically, a digitally signed digest of the contents of selected values within a TPM
58
Q

Describe Hardware Security Module (HSM)

A

A physical device that can be added to a computer or attached to the network

can provide crypto processing, manage keys for encryption and authentication and can securely store keys

Think Humongous Security Module

59
Q

Describe Key Escrow

A

3rd party maintains a copy of keys

Key escrow implements M of N - requires some number (M) of the total number of (N) agents to perform the task, e.g. retrieve or copy key; e.g. 2 of 8 recovery agents are required to restore a user’s private key from key escrow

M of N AKA - Dual Control or TPI (Two Person Integrity)

60
Q

List cloud common key management approaches

A

Remote KMS

Client-side Key Management

61
Q

Remote Key Management System (KMS)

A

The cloud customer owns, operates and maintains the KMS on premise

A remote key management service is one that is owned, operated, and maintained on premises by the customer. This configuration gives the customer complete control over who can generate or access cryptographic keys.

62
Q

What is required to maintain CIA?

A

Remote KMS requires constant network connectivity between the cloud customer and CSP; disruptions in connectivity may prevent encryption and decryption functions from operating.

63
Q

Client-side Key Management

A

KMS is provided by CSP and is shipped to the customer to reside on premise

The keys are generated, held, and retained by the cloud customer

Assures better integration with the cloud environment.

Mainly used for SaaS

64
Q

Options for Key Storage in the Cloud

A

Internally Managed
Externally Managed
Managed by 3rd party

65
Q

Internally Managed Key Storage

A

keys are stored on the VM or application component that is acting as the encryption engine

used for storage level, internal database or backup application encryption

66
Q

Externally Managed Key Storage

A

keys are maintained SEPARATELY from the encryption engine

67
Q

3rd Party Managed Keys

A

a trusted 3rd party provides key escrow service

68
Q

Quantum Computing

A

uses PHYSICS and quantum science, and instead of bits, it uses qubits (0,1, or both), to allow quantum computers to compute multiple data states at the same time

69
Q

Neural Networks

A

computing systems inspired by how human and/or animal brains work

70
Q

Bit Spliting

Types of Bit Splitting

A

Splitting up the encrypted data into bits and storing this information across several cloud storage services

An erasure coding encryption implementation

2 Types of Bit Splitting

  1. Secret Sharing Made Short (SSMS) - better availability
  2. All-Or-Nothing-Transform-with-Reed-Solomon (AONT-RS) - more confidential
71
Q

Benefits of Bit Splitting

A

-Better confidentiality
-Harder to acquire the data for legal process as the data is distributed between different geographies or jurisdictions
Scalable and reduce the risk of vendor lock-in

72
Q

Challenges of Bit Splitting

A
  • Increase processing overhead
  • Data in transit needs to be available and uphold confidentiality
  • Availability risks
  • Cost increase
  • Storage requirements
73
Q

Bit Splitting Methods

A

Secret Sharing Made Short

All-or-Nothing-Transform with Reed-Solomon (AONT-RS)

74
Q

Secret Sharing Made Short (SSMS)

A

3 Phases:

  1. Encrypt information
  2. Use Information Disperse Algorithm (IDA) - splits the data using erasure coding into fragments
  3. Splits the crypto key using the secret sharing algorithm
75
Q

What is the advantage of using you own key management system vs a public CSP’s?

A

When using public cloud, customers often want to use their own key management system as an added layer of privacy and control over their data. In doing so, customers remove dependency on the cloud provider to manage their keys and also avoid potential vendor lock-in due to using a CSP’s proprietary key management platform.

Increase portability

76
Q

cryptographic module

A

module is simply any hardware, software, and/or firmware combination that performs encryption, decryption, or other cryptographic functions.

77
Q

Encryption Challenges?

A
  1. Data Analysis requires unencrypted data
  2. Encryption keys are cached in memory when in use - CSPs must protect keys in multi-tenant env
  3. Cloud data is often replicated making encryption and key management challenging - most CSPs mitigate by replicating encrypted data if it is encrypted at rest
  4. Throughout data lifecycle data is changing which requires encryption along the way - mitigate by designing end to end encryption solution
  5. Encryption addresses confidentiality but not integrity
  6. Encryption is only as secure as the key management - if key is compromised all data is potentially compromised
78
Q

How do you implement a secure key management strategy?

A
  1. Ensure keys are generated within a trusted secure cryptographic module (e.g. FIPS 140-2 compliant)
  2. Secure key distribution - common practice to encrypt keys with a separate key when distributing
  3. Secure key storage - both in volatile and persistent memory; keys should be stored internally on VM or other integrated app, externally and separate from data itself or managed by trusted 3rd party (key escrow service)
  4. Key destruction or deletion when key is no longer needed
79
Q

Key destruction

Key deletion

A

Key destruction is the removal of an encryption key from its operational location.

Key deletion takes it a step further and also removes any information that could be used to reconstruct that key.

Next Gig (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions