GCGA Ch. 10 Understanding Cryptography and PKI Flashcards
Integrity
provides assurances that data has not been modified. Hashing ensures that data has retained integrity. Confidentiality ensures that data is only viewable by authorized users. Encryption protects the confidentiality of data.
Symmetric encryption
uses the same key to encrypt and decrypt data.
Asymmetric encryption
uses two keys (public and private) created as a matched pair.
Digital signature
provides authentication, non-repudiation, and integrity. Users sign emails with a digital signature, which is a hash of an email message encrypted with the sender’s private key. Only the sender’s public key can decrypt the digital signature which reveals hash, providing verification the hash was encrypted with the sender’s private key.
Authentication
validates an identity.
Non-repudiation
prevents a party from denying an action.
Hashing & Hashes
Hashing verifies the integrity of data, such as downloaded files and email messages. A hash is a fixed-length string of hexadecimal characters, which cannot be reversed to re-create the original data.
Checksum
similar to a hash but is typically smaller. It is used to verify the integrity of data but is not intended to be cryptographically secure.
Hashing algorithms
one-way functions used to create a hash. You cannot reverse the process to re-create the original data.
Hash collision
occurs when a hashing algorithm creates the same hash from different inputs.
Common hashing algorithms
Message Digest 5 (MD5), Secure Hash Algorithms (SHA), and Hash-based Message Authentication Code (HMAC). HMAC provides both integrity and authenticity of a message.
Password attacks
attempt to discover passwords. An online password attack attempts to discover a password from an online system. An offline password attack attempts to discover passwords from a captured database or captured packet scan. Passwords are often stored as a hash. Weak hashing algorithms are susceptible to collisions, which allow different passwords to create the same hash.
Brute force attack
attempts to guess all possible character combinations. Account lockout policies thwart online brute force attacks.
Dictionary attack
uses all the words and character combinations stored in a file. Complex passwords thwart offline password attacks.
Spraying attack
attempts to bypass account lockout policies. An automated program starts with a large list of targeted user accounts. It then picks a password and tries it against every account in the list. It then picks another password and loops through the list again.
Pass the hash attack
In a pass the hash attack, the attacker discovers the hash of the user’s password and then uses it to log on to the system as the user.
Birthday attack
an attacker attempts to create a password that produces the same hash as the user’s actual password.
Password salting
adds additional characters to passwords before hashing them and prevents many types of attacks, including dictionary, brute force, and rainbow table attacks.
Key stretching techniques
Three commonly used key stretching techniques are bcrypt, Password-Based Key Derivation Function 2 (PBKDF2), and Argon2. They protect passwords against brute force and rainbow table attacks.
Confidentiality
ensures that data is only viewable by authorized users. Encryption provides confidentiality of data, including data at rest (any type of data stored on disk) or data in transit (any type of transmitted data).
Block cipher
encrypt data in fixed-size blocks. Advanced Encryption Standard (AES) encrypts data in 128-bit blocks and 3DES encrypts data in 64-bit blocks.
Stream ciphers
encrypt data 1 bit or 1 byte at a time. They are more efficient than block ciphers when encrypting data of an unknown size or when sent in a continuous stream. Asymmetric encryption uses public and private keys as matched pairs.
