Lecture 2 - Security Protocols Flashcards
Simplest protocol?
Simply memorising the secret key or password
When is using memorisation appropriate?
When the key is short and easy to remember
Second simplest protocol?
Writing the secret key down on a piece of paper. This means this protocol relies on the attacker having physical access.
Threat to writing down our secret key?
- losing the piece of paper
- new copies must be secured, kept track of and updated
- we have to destroy all copies when we are done
Can we use a computer file to store our secret key (no encryption) ?
This is possible, however extremely vulnerable to attackers, while also having backups overwrite versions (all need to be protected) and the fact deleted files can be recovered.
What is an encryption program?
A program that takes our key in plaintext and produces a ciphertext as a result.
What is a decryption program?
A program that takes a ciphertext as input and produces a plaintext as a result.
What must decryption do?
undo the encryption
What must happen after we encrypt the plaintext?
The original plaintext document should be deleted, this includes all copies and backups. This means using encryption also has vulnerability while the plaintext is around.
What is a threat to the encryption and decryption algorithms.
Attacker potentially finding the encryption and decryption algorithms. These themselves cannot be encrypted as they must be running on the machine.
What type of a cybersecurity problem is sending secret information between 2 entities?
This is a confidentiality, integrity (if messaged changed before or during transmission) and potentially an availability (if someone prevents message from being received) problem.
What is the only fully safe medium of transmission.
Meeting in a private place.
First, worse way to use encryption for transfer of data?
Encrypting before sending, sending , then decrypting at source. (decryption algorithm is a secret)
Why is keeping an algorithm a secret bad?
- algorithm designers might be at risk as they know the secret
- peer review of public algorithm reduces flaws (it is easy to fool yourself that an algorithm is more secure than it really is)
What is symmetric encryption / one-key encryption?
Encryption and decryption algorithms must be know by both entities. They’re typically public, however require a secret key to work. The algorithm is useless without the key. The key must be exchanged!
