MD5 - Hashing algorithm - 128-bit hash - Cracked - Used to verify integrity of files

RIPEMP - Family of hashing functions - For integrity - RIPEMPD-128 (not secure) - RIPEMD-160: 160-bit hash - RIPEMD-256 - RIPEMD-320

Key Stretching - What is it - What can it prevent - Specific techniques

Key Stretching - Make a weak key stronger - Add salt with additional random bits - Repeatedly hashing - Can thwart brute force and rainbow table attacks - bcrypt and PBKDF2 are key-stretching techniques

bcrypt - What is it - What does it do - What does it result in - Where is it used

bcrypt - Key-stretching technique for passwords - Salts, then encrypts with Blowfish - Can repeat multiple times - Result is 60 character string - Used in linux

CTR - Counter Mode - A cypher mode - Converts block cypher into stream cypher - Combines IV with counter so every block gets different encryption key - Encrypts successive values of counter - Widely used and respected

Elliptic Curve Cryptography (ECC) - What is it - What is it used for

Elliptic Curve Cryptography (ECC) - Asymmetric encryption algorithm - Encryption, digital signatures, pseudo-random generators - Less processing power, good for wireless devices - Deprecated

Stream Cipher - Used with symmetric encryption (not asymmetric) - One bit or byte at a time - High speed, low hardware complexity - Starting state should never be the same - combine key with IV

Block Cipher - Symmetric encryption - Encrypt fixed-length groups

Digital Signature - What does it provide - Which keys are used by sender and receiver - Steps to send/receive digital signature

Digital Signature - Integrity - Authentication - Non-repudiation - Sender uses sender's private key - Recipient uses sender's public key Steps - Sender creates hash of message - Sender encrypts hash with sender's private key - Sender sends encrypted has and plaintext - Recipient decrypts hash with sender's public key - Recipient hashes plaintext and compares to decrypted hash

Cryptography Flashcards by T M

MD5

Hashing algorithm
128-bit hash
Cracked
Used to verify integrity of files

How well did you know this?

Not at all

Perfectly

SHA

-Types

SHA
Secure Hash Algorithm
-Integrity
-SHA-1: 160-bit hash
-SHA-2: 256 bit most popular, up to 512-bit hash
-SHA-3: same sizes as SHA-2 (up to 512-bit hash). Non-NSA

How well did you know this?

Not at all

Perfectly

HMAC

What is it
What does it provide
What uses it

HMAC
Hash-Based Message Authentication Code
-Integrity and authenticity
-Combine hash plus secret key (ic, HMAC-MD5,HMAC-SHA1)
-Integrity and authenticity
-IPSec and TLS use

How well did you know this?

Not at all

Perfectly

RIPEMD

RIPEMP

Family of hashing functions
For integrity
RIPEMPD-128 (not secure)
RIPEMD-160: 160-bit hash
RIPEMD-256
RIPEMD-320

How well did you know this?

Not at all

Perfectly

Key Stretching

What is it
What can it prevent
Specific techniques

Key Stretching

Make a weak key stronger
Add salt with additional random bits
Repeatedly hashing
Can thwart brute force and rainbow table attacks
bcrypt and PBKDF2 are key-stretching techniques

How well did you know this?

Not at all

Perfectly

bcrypt

What is it
What does it do
What does it result in
Where is it used

bcrypt

Key-stretching technique for passwords
Salts, then encrypts with Blowfish
Can repeat multiple times
Result is 60 character string
Used in linux

How well did you know this?

Not at all

Perfectly

PBKDF2

What is it
What does it do
What does it result in
Where is it used

PDKDF2
Password Based Key Derivation Function 2
-Key-stretching technique for passwords
-Salts of at least 64 bits
-Hash with HMAC
-May repeat a million times
-Results in 128, 256, 512 bit hash
-Used in WPA2, iOS, Cisco
-May be weaker than bcrypt

How well did you know this?

Not at all

Perfectly

ECB

ECB
Electronic Code Book
-A cypher mode
-Simplest encryption mode
-Each block encrypted with same key (same plaintext block creates same ciphertext)
-Deprecated

How well did you know this?

Not at all

Perfectly

CBC

CBC
Cipher Block Chaining
-A cypher mode
-Each plaintext block XOR'ed with previous ciphertext block
-Initialization vector for first block
-Adds randomization

How well did you know this?

Not at all

Perfectly

CTR

Counter Mode
A cypher mode
Converts block cypher into stream cypher
Combines IV with counter so every block gets different encryption key
Encrypts successive values of counter
Widely used and respected

How well did you know this?

Not at all

Perfectly

GCM

-What uses it?

GCM
Galois/Counter Mode
-A cypher mode
-Encryption with authentication
-Counter mode plus Galois authentication
-Commonly used with in packetized data (wireless, IPSec, SSH, TLS)

How well did you know this?

Not at all

Perfectly

Elliptic Curve Cryptography (ECC)

What is it
What is it used for

Elliptic Curve Cryptography (ECC)

Asymmetric encryption algorithm
Encryption, digital signatures, pseudo-random generators
Less processing power, good for wireless devices
Deprecated

How well did you know this?

Not at all

Perfectly

Stream Cipher

Used with symmetric encryption (not asymmetric)
One bit or byte at a time
High speed, low hardware complexity
Starting state should never be the same - combine key with IV

How well did you know this?

Not at all

Perfectly

Block Cipher

Symmetric encryption
Encrypt fixed-length groups

How well did you know this?

Not at all

Perfectly

Digital Signature

What does it provide
Which keys are used by sender and receiver
Steps to send/receive digital signature

Digital Signature

Integrity
Authentication
Non-repudiation
Sender uses sender’s private key
Recipient uses sender’s public key

Steps

Sender creates hash of message
Sender encrypts hash with sender’s private key
Sender sends encrypted has and plaintext
Recipient decrypts hash with sender’s public key
Recipient hashes plaintext and compares to decrypted hash

How well did you know this?

Not at all

Perfectly

PFS

PFS
Prefect Forward Secrecy
-Ephemeral keys (good for one session)
-Elliptic Curve or Diffie-Hellman ephemeral

AES

What is it
What uses it
Is it good

AES
Advanced Encryption Standard
-Symmetric encryption algorithm
-128-bit block cipher
-128, 192, 256-bit keys
-Used in WPA2
-Strong, fast, efficient

DES

What is it
What uses it
Is it good

DES
Data Encryption Standard
-Symmetric encryption algorithm
-64-bit block cypher
-56-bit key (small)
-Nothing today uses
-Not good. Easily brute forced

3DES

What is it
What uses it
Is it good

3DES
Triple DES
-Symmetric encryption algorithm
-DES encryption three times with three different keys
-Nothing today uses
-Not good anymore
-Superseded by AES

RC4

What is it
What uses it
Is it good

RC4
Rivest Cipher 4
-Symmetric encryption algorithm
-Symmetric stream cipher
-Was used in WEP and SSL
-Cracked; Not used anymore

Blowfish

What is it
What uses it
Is it good
Block size
Key size

Blowfish

Symmetric encryption algorithm
64-bit block cipher
Key up to 448 bits
Open source: Not limited by patents
No way to break 16 rounds of encryption
Faster than AES due to smaller block size
strong

Twofish

What is it
What uses it
Is it good
Block size
Key size

Twofish

Symmetric block encryption algorithm
Successor to Blowfish
128-bit block size
Key up to 256 bits
Open source: not limited by pattents

Diffie-Hellman

Key exchange method for asymmetric keys
Does not encrypt or authenticate
Privately share symmetric key
RSA uses for static keys
Used for Perfect Forward Secrecy (PFS)
Ephemeral DH (EDH or DHE)
Combine with Elliptical Curve (ECDHE)

RSA

Asymmetric encryption with public/private key
Static keys
Public domain
Encrypt email: recipient’s public key encrypts symmetric key; recipient’s private key decrypts

DSA

``` DSA Digital Signature Algorithm -Asymmetric encryption -Modifies Diffie-Hellman -Can combine with Elliptical Curve (ECDSA) -Fast and efficient digital signatures ```

S/MIME | -What does it use (two things)?

S/MIME Secure Email -RSA for asymmetric encryption -AES for symmetric encryption

CSR

CSR | Certificate Signing Request

CRL

CRL | Certificate Revocation List

Certificate Stapling

Certificate Stapling - Haver certificate holder verify their own certificate's status so client doesn't have to ask - Appends signed OCSP status to certificate

Public Key Pinning

Public Key Pinning | -Web server sends list of public key hashes that clients can use to validate certificates

PGP

PGP Pretty Good Privacy -Asymmetric encryption

CER

``` CER Canonical Encoding Rules -Format for PKI certificates -ASCII -P7B is common format used to share public keys ```

DER

``` DER Distinguished Encoding Rules -Format for PKI certificates -Base64 binary encoded -P12 is common format used to hold encrypted private keys ```

OCSP

OCSP Online Certificate Status Protocol -Alternative to CRL -Client queries CA for status in real-time -stapling makes it so clients don't have to keep querying CA

ECDSA

ECDSA | Elliptical Curve Digital Signature Algorithm

IDEA

IDEA International Data Encryption Algorithm -Broken -symmetric-key block cipher