Lecture 1 & 2

Question 1

What does Encryption achieve?

Answer 1

Makes data incomprehensible to preserve its confidentiality

Question 2

What is a cipher?

Answer 2

The algorithm used by encryption when encrypting data

Question 3

What is meant by Pre-Image resistance in Cryptographic Hash Functions?

Answer 3

If given the output of a hashfunction, is should be very hard to find the input of the hashfunction. Given a hash h, it should be hard to find m such that
h = H(m)

Question 4

what is a adversary model?

Answer 4

Is a generalization of any attack(er) with specific capabilities and computational power

Question 5

what is a threat model?

Answer 5

What adversaries and properties to care about

Question 6

What does the Kerckhoff’s Principle state?

Answer 6

“A cryptosystem should be secure even if everything is known about the system / scheme except for the key.”

Question 7

What is something if it is computationally secure?

Answer 7

To attempt to solve by bruteforcing is impossible

Question 8

What is meant by Second Pre-Image resistance in Cryptographic Hash Functions?

Answer 8

If a input message is given, and creates a hash, it should be very hard to find another input message that gives the same hash. Given input m1, it should be hard to find a distinct m2 such
that H(m1) = H(m2), they yield the same output

Question 9

What is cryptology?

Answer 9

The study of how to hide messages or how to secure communication against adversaries

Question 10

Cryptology can be defined in two parts. What are these parts, and what do they imply?

Answer 10

Cryptography – How to construct cryptographic systems

Cryptanalysis – How to break cryptographic systems

Question 11

What is meant by Collision resistance in Cryptographic Hash Functions?

Answer 11

It should be hard to find any two distinct m1 and m2 such
that H(m1) = H(m2). Attacker is not given a message m1 or m2.

Question 12

There are two types of security, what are these types and what do they imply?

Answer 12

Unconditional – Information-theoretically secure (impossible to break – impractical)

Computational – Broken with enough computation, but not within “reasonable” time

Question 13

Symmetric encryption keys are between what size (in bits)? For example, between 1-2.

Answer 13

128 - 256 bits

Question 14

Describe Symmetric Encryption

Answer 14

Symmetric encryption is a type of encryption where only one key (a secret key) is used to both encrypt and decrypt electronic data. The entities communicating via symmetric encryption must exchange the key so that it can be used in the decryption process.

Question 15

What is the avalanche effect?

Answer 15

Small change in input, large change in output in hash function

Question 16

What does MAC need to produce a tag/MAC?

Answer 16

A secret key sk and a message m

Question 17

What three parts are in an encryption scheme?

Answer 17

Plaintext – A message m you want to encrypt

Algorithms – An encryption algorithm “Enc” and decryption algorithm “Dec”

Key – A secret key sk

Question 18

Describe Semantic Security and its key factors

Answer 18

An encryption scheme is semantically secure, if an adversary cannot guess with better probability than 1/2 whether the given ciphertext is an encryption of message m0 or m1

Question 19

Encryption and decryption oracles definitions

Answer 19

Encryption Oracle: Send a message, get the ciphertext back

Decryption Oracle: Send a ciphertext, get the message back

Question 20

How can MAC be used to provide authenticity and integrity?

Answer 20

By using the secret key along with the tag (MAC). The receiver who knows the secret key can then see the message.

Question 21

What are the two types of algorithms for randomization?

Answer 21

Deterministic: The same input always produces same output

Probabilistic: The same input produces different output

Question 22

What does HMAC improve over regular MAC?

Answer 22

It introduces keyed-Hashing

Question 23

Randomization of algorithms can be…. what?

Answer 23

Implicit: Probabilistic algorithm
Explicit: Deterministic algorithm

Question 24

What is a nonce?

Answer 24

A WEE PEEEEDO

Question 25

What do you do if the secret key is too short or too long in the HMAC?

Answer 25

Too short: Pad it with zeroes
Too long: hash it?

Question 26

What is a nonce? For real this time you know waddaimsaying

Answer 26

A number used once (distinct), ensures non-similar encryption output, can be of any length

Question 27

Why is password hashing often not enough? What’s a solution to improve the security?

Answer 27

Hash algorithms are too fast, making it easy to brute force all hashes.

Solution: Salting the passwords

Question 28

What is Initial Value?

Answer 28

Initial value (IV)^3 has to be distinct and unpredictable (for the adversary), is a random and unique value mixed with the encryption to prevent patterns from emerging

Question 29

What does salting a password do?

Answer 29

It adds a random value when calculating the password hash. So there’s now both the hash and the salt connected to the users password and username.

Question 30

What does password salting force the attacker to do which they didn’t have to do earlier?

Answer 30

Target a specific person, they cannot attack all persons at the same time. They need to try a salt value on all the hash-values.

Question 31

What is IND-CPA and IND-CCA?

Answer 31

IND-CPA (Indistinguishability under Chosen-Plaintext Attack):
Focus: Security property for encryption schemes.
Scenario: Adversary can choose plaintexts and receive corresponding ciphertexts.
Goal: Adversary cannot reliably distinguish ciphertexts of different chosen plaintexts.

IND-CCA (Indistinguishability under Chosen-Ciphertext Attack):
Focus: Stronger security property for encryption schemes.
Scenario: Adversary can obtain decryption of chosen ciphertexts, excluding a target ciphertext chosen after encryption.
Goal: Adversary, even with access to encryption and decryption oracles, cannot reliably distinguish the encryption of the target ciphertext from a random string.