Cryptography, hashing and protection

Question 1

Encryption

Answer 1

Encryption uses an algorithm to scramble, or encrypt, data and then uses a key for the receiving party to unscramble, or decrypt,
the data.

Question 2

Plaintext

Answer 2

Data in its readable form

Question 3

ciphertext

Answer 3

data in its unreadable, encrypted form

Question 4

Encryption vs hashing

Answer 4

• Hashing of passwords is one way function (convert plaintext to ciphertext but NOT back again)
• Encryption is a two-way function (convert plaintext to ciphertext and back again)
• Hashing is preferred as the ability to decrypt passwords provides a security risk.

Question 5

Cryptography definition

Answer 5

The study of securing data from outside observers

Question 6

Encryption definition

Answer 6

The act of scrambling readable data into unreadable ciphertext

Question 7

Decryption definition

Answer 7

The act of unscrambling ciphertext into readable data

Question 8

Algorithm

Answer 8

The set of steps that the encryption and decryption process follows

Question 9

Encryption keys

Answer 9

Key: a random string of bits created specifically for encrypting and/or decrypting data.
Symmetric-key encryption:
* Encryption and decryption uses the same key.
* The key must be kept secret.
Asymmetric-key encryption:
* Encryption and decryption use different keys
* Keys are mathematically relatedbut it is computationally not feasible to find one from another.
* Encryption key can be made public.
* Decryption key must be kept secret.

Question 10

Confidentiality

Answer 10

• Keeps information away from unauthorised persons
• One way of achieving this is by using mathematical algos for data encryption

Question 11

Integrity

Answer 11

• Data may get modified intentionally or accidentally
• This makes sure that the data is still intact since it was last transmitted or stored
• It allows you to see whether the modification of data was necessary or not

Question 12

Non - repudiation

Answer 12

*Is a security service that ensures that an entity cannot refuse the ownership of a previous commitment or an action.
- It is assurance that the original creator of the data cannot deny the creation or transmission of the data to a third party

Question 13

Authentication

Answer 13

• Provides identification of originator
• It confirms to the receiver that the data received has been sent only by an identified/ verified sender

Question 13

2 types of authentication

Answer 13

Message authentication - Identifies the originator of the message without any regard of who has sent the messages
Entity authentication - assurance that the data has been recieved from a specific entity

Question 14

Salting

Answer 14

*A salt is a unique, randomly generated string that is added to each password as part of the hashing process.
*As the salt is unique for every user, an attacker has to crack hashes one at a time using the respective salt,
rather than being able to calculate a hash once and compare it against every stored hash.

Question 15

Generating a salt

Answer 15

1. Generate a salt using a cryptographically secure function.
   * The salt should be at least 16 characters long.
   * Encode the salt into a safe character set such as hexadecimal or Base64.
2. Combine the salt with the password.
   * This can be done using simple concatenation.
3. Hash the combined password and salt.
4. Store the salt and the password hash.