Domain 3: Security Engineering Flashcards
Ceaser Cipher
substitution cipher, shift 3 letters to the right
Four Fundamental Goals of Cryptography
Confidentiality, Integrity, Authentication, Nonrepudiation
Key space
defined by bit size. a 128 bit key has a value from 0 to 2^128
The Kerchoff Principle
a cryptographic system should be secure even if everything about the system, except the key, is public knowledge
Cryptovariables
cryptographic keys
Crptography
the art of creating and implementing secret codes and ciphers
Cryptanalysis
the study of methods to defeat codes and ciphers
Cryptology
Cryptography + Cryptanalysis
Boolean mathematics
defines rules used for bits and bytes
modulo function
remainder after division
One- way function
operation that easily produces output values for each possible combinations of input but makes it impossible to reverse engineer
Nonce
random number that acts as a placeholder variable, must be random and used one time only ex: Initialization Vector
IV
Initialization Vector - a random bit string as long as the block that is XORed with the message
Zero-knowledge proof
The magic door - watch someone go in one entrance and come back before buying their password
Work function
time and effort required to perform a complete brute-force attack, directly proportional to the security and protection of the crytosystem
Difference between Codes and Ciphers
codes are not meant to provide confidentiality
Transposition Ciphers
rearrange the letters of the plaintext
Substitution Cipher
replace each bit of plaintext with a different character
Ceaser Cipher encryption function
C = (P+3) mode 26
Vigenere Cipher
polyalphabetic - alphabet written 26 times
Period Analysis
examination of frequency based on the repeated use of the key
One-Time Pads
substitution cipher, use a different substitution alphabet for each letter
One-Time Pad encryption function
C = (P+K) mod 26, K = key
One-Time Pad Security Requirements (4)
Random, used once, physically protected, as long as the message
Running Key or Book Cipher
key is as long as the message itself and is often from a book
Block Ciphers
operate on chunks of messages
Steam Cipher
act on on bit at a time
Confusion
relationship btwn plaintext and ciphertext is so complicated that an attacker can’t determine the key
Diffusion
a change in the plaintext results in multiple changes spread through the ciphertext
Symmetric Key Algorithm Pros and Cons
Pro - Very Fast, used for bulk encryption
Cons - key distribution, does not implement non repudiation, not scalable, keys must be regenerated often
Symmetric Key Algorithm
relies on a shared key given to all members used to encrypt and decrypt, aka secret key and private key
Asymmetic Key Algorithm
public key, each user has a public and private key, receivers public key encrypts, receivers private key decrypts, also digital signature tech
Asymmetic Key Algorithm Pros and Cons
Pros - adding new users only requires 1 public-private key pair, easier to remove users, less key regeneration, provides integrity, authentication, nonrepudiation, key distribution is easy, no preexisting relationship is necessary
Cons - speed
Which key algorithm? Single shared key vs key pair Confidentiality, Integrity, Nonrepudiation, authentication vs Confidentidality Slow vs Fast Non Scalable vs Scalable In-Band vs Out of band exchange Bulk encyrption vs small blocks of data
Symmetic = Single shared key, Confidentidality, Fast, Non Scalable, Out of band exchange, Bulk encyrption Asymmetric = Key pair, Confidentiality, Integrity, Nonrepudiation, authentication, Slow, Scalable, In-Band, Small blocks of data
Message Digest
Summary of a messages content produced by hashing
Hashing provides ____
Integrity
DES
Data Encryption Standard - no longer secure, 64 bit block cipher with 5 modes of operation, key is 56 bits, uses 16 rounds of XOR operations to generate ciphertext
Symmetric Standards
DES, 3DES, IDEA, Blwofish, Skipjack, AES
DES Modes of Operation
Cipher Block Chaining Mode, Cipher Feedback Mode, Output Feedback Mode, Counter Mode, Electronic Codebook Mode
ECB
Electronic Codebook mode - least secure, simply encrypts block with same key, enemy could build a code book
CBC
Cipher Block Chaining Mode - each block is XORed with the ciphertext block proceeding it before encyrption, IV
CFB
Cipher Feedback Mode - streaming cipher version of CBC, real time operation, IV and chaining
OFB
Output Feedback Mode - same as CFB but XORs with a seed value, no chaining, uses previous seed value to determine next
CTR
Counter Mode - stream cipher, uses a counter for XOR operation
3DES
Triple DES - adapted version of DES
3DES Versions
DES - EEE3 = 168 bit key length
DES - EDE3 = 168 bit key length
DES - EEE2 = 112 bit key length
DES - EDE2 = 112 bit key length
DES-EEE3
encrypts plaintext 3 times using 3 different keys,
C= E (K1, E (K2, E (K3,P)))
DES-EDE3
C= E (K1, D (K2, E (K3,P)))
DES-EEE2
C= E (K1, E (K2, E (K1,P)))
DES-EDE2
C= E (K1, E (K2, E (K1,P)))
IDEA
International Data Encryption Algorithm = 64-bit block with 128 bit key, uses 52 16-bit subkeys, open to all, in PGP, same modes as DES
Blowfish
64 bit blocks of text, allows use of variable length keys ranging from 32 to 448 bits
Skipjack
64 bit block, supports escrow of encryption keys
AES
Advanced Encryption Standard - 3 key strengths, 128 bit (10 round of encryption), 192 bit (12 rounds), 256 bit (14 rounds). Processes 128 bit blocks
Block Size and Key Size: AES Rijndael Blowfish DES IDEA RC2 RC4 RC5 Skipjack 3DES Twofish
Block size and key size AES = 128 bit block, 128, 192 or 256 bit key Rijndael = Variable block, 128, 192 or 256 bit key Blowfish = 64 bit block, 32-338 bit key DES = 64 bit block, 56 bit key IDEA = 64 bit block, 128 bit key RC2 = 64 bit block, 128 bit RC4 = Streaming, 128 bit RC5 = 32, 64 or 128 bit block, 0-2040 bit key Skipjack = 64 bit block, 80 bit key 3DES = 64 bit block, 112 or 168 bit key Twofish = 123 bit, 256 bit key
Three Main methods to distribute Symmetric Keys
Offline distribution, Public key encryption, Diffie-Hellmen Key exchange
Fair Crytosystems Key Escrow
key is divided into two or more pieces and given to independent third parties
Escrow Encryption Standard Key Escro
provides gov’t with technical means to decrypt ciphertext
RSA
Most famous asymmetric algorithm - depends on the difficulty of factoring large prime numbers, key length of 1088 bits
El Gamal
asymmetric encryption, doubles the length of any message it encrypts
Asymmetric Key Algorithms
RSA, El Gamal, Elliptic Curve
Elliptic Curve
more difficult to solve, only 160 bit kit equivalent to 1088 RSA key. Good for small devices with less processing power
Hash Functions
take a long message and generate a unique output known as the message digest
5 Requirements for a Cryptographic Hash Function
- Input can be any length
- Output has a fixed length
- Hash Function in relatively easy to compute
- Hash Function is one-way
- Hash Function is collision free
SHA
Secure Hashing Algorithm, SHA 2 is the most secure
SHA-1 = 512 bit blocks, 160 bit message digest
SHA-256 = 512 bit blocks, 256 bit message digest
SHA-224 = 512 bit blocks, 224 bit message digest
SHA-512 = 1024 bit blocks, 512 bit message digest
SHA-382 = 1024 but blocks, 834 bit message digest
MD2
no longer used, 128 bit message digest
MD4
message padded to be 64 bits smaller than 512 bit multiple, 3 rounds of computation, 128 bit message digest, no longer used
MD5
512 bit blocks, same padding as MD4, reduce the speed, no longer secure, 128 bit message digest
Goals of Digital Signatures
Nonrepudiation and Integrity and Authentication
How to Digitally sign
Alice hashes plaintext, encrypt message digest using her private key (this is the digital signature), Append signed message digest to plaintext message, Send to Bob, Bob decrypts digital signature using Alice’s Public Key, Bob hases the plaintext message, Bob compares the decrypted message digest to his message digest
HMAC
Hashed Message Authentication Code implements a partial digital signature, integrity but not non repudiation
DSS
Digital Signature Standard - by NIST, aka FIPS 186-4
Certificates
provide communicating parties with the assurance that the people they are communicating with are who they claim to be - endorsed copies of an individuals public key
Certificate Authority
neutral organization which offer notarization services for digital certificates
Enrollment
the process of proving your identity to the CA to obtain a certificate
CRL
certificate revocation list
OCSP
Online Certificate Status Protocol - eliminates latency of CRL
Asymmetric Key Management
Choose encryption system wisely, select keys wisely, keep your private key secret, retire old keys, back up your key
If your email needs confidentiality, _________
encrypt the message
If your email needs integrity, ___________
hash the message
If your email needs authentication, integrity, and/or nonrepudiation
digitally sign the message
If your email needs confidentiality, integrity, authentication, and nonrepudiation
encrypt and digitally sign the message
PGP
Pretty Good Privacy is a secure email system combining CA concept with web of trust
S/MIME
Secure Multipurpose Internet Mail Extensions - de factor standard for encrypted email, uses RSA and X.509 certificates
Steganography
embed secret messages within another message
DRM
Digital Rights Management - uses encryption to enforce copyright restrictions on digital media
Link Encryption
used to protect data in transit - protects entire communication circuits by creating a secure tunnel between two points, encrypts header info so you need to decrypt at points
End to End Encryption
used to protect data in transit - protects comms between two parties, more susceptible to eavesdroppers, faster, does not encrypt header info, ex: TLS, Banking, VPN
IPsec
provides a complete infrastructure for secured network communications
IPsec AH
Authentication Header - provides assurances of message integrity and nonrepudiation
IPsec ESP
Encapsulating Security Payload - provides confidentiality and integrity
ISAKMP
Internet Security Association and Key Management Protocol - provides background security support services for IPsec by negotiating, establishing, modifying, and deleting SAs
Two modes of IPsec
Transport mode - only packet is encrypted
Tunnel mode - entire packet is encrypted
Security Association
created to set up IPsec, represents the communication session and records any config and status info about the session, need one SA for each direction of data flow
WEP
Wired Equivalent Privacy - protect comms within wireless LAN, outdates
WPA
WiFi Protected Access, improves on WEP by implementing Temporal Key Integrity Protocol, outdated
WPA
adds AES cryptography
Analytical Attack
algebraic manipulation that attempts to reduce the complexity of the algorithm
Implementation Attack
exploits weaknesses in implementation, focus on sw code
Statistical Attack
focuses on inability to produce totally random numbers
Frequency Analysis and the Ciphertext Only Attack
uses known letter frequencies
Known Plaintext Attack
Attacker has a copy of the plaintext and ciphertext
