Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

C839 Cryptography > Module 4- Applications of Cryptography > Flashcards

Module 4- Applications of Cryptography Flashcards

1
Q

FIPS Standard 140

A

Cryptographic Modules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

FIPS Standard 186

A

Digital Signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

FIPS Standard 197

A

AES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

FIPS Standard 201

A

Identity Verification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Encryption of a message digest with the sender’s private key. Provides:

  • Authentication
  • Integrity
  • Non-repudation
A

Digital Signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A digital document that contains a public key and some information to allow your system to verify where that key came from.

A

Digital Certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Uses asymmetric key pairs and combines software, encryption and services to provide a means of protecting the security of business communication and transactions.

A

PKI (Public Key Infrastructure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Put in place by RSA to ensure uniform certificate management throughout the internet.

A

PKCS (Public Key Cryptography Standards)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Certificate, a digital representation of the information that identifies you as a relevant entity.

A

Trusted Third Party (TTP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An entity trusted by one or more users to manage certificates.

A

CA (Certification Authority)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Used to take the burden off of a CA by handling verification prior to certificates being issued. Acts as a proxy between user and CA. Receives request, authenticates it and forwards it to the CA.

A

RA (Registration Authority)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A set of rules that defines how a certificate may be used.

A

CP (Certificate Policy)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The most widely used digital certificate standard. First issued July 3, 1988. It is a digital document that contains a public key signed by the trusted third party, which is known as a Certificate Authority, or CA.

A

X.509

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Relied on by S/MIME. Contains your name, info about you, and a signature of a person who issued the certificate.

A

X.509

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

X.509 Certificate Content

A 
Version
Certificate holder's public key
Serial number
Certificate's validity period
Unique name of certificate issuer
Digital signature of issuer
Signature algorithm identifier
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

X.509 Certificate File Extensions

A 
.pem
.cer, .crt., .der
.p7b, .p7c
.p12
.pfx
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

a Base64 encoded DER certificate, enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–”

A

.pem (Privacy Enhanced Mail)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Usually in binary DER form, but Base64-encoded certificates are common also

A

.cer, .crt, .der

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

PKCS#7 SignedData structure without data, just certificate(s) or CRL(s).

A

.p7b, .p7c

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

PKCS#12, may contain certificate(s) (public) and private keys (password protected).

A

.p12

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g., w/ PFX files generated in IIS).

A

.pfx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The primary role of this is to digitally sign and publish the public key bound to a given user. It is an entity trusted by one or more users to manage certificates. Verisign is an example.

A

Certificate Authority (CA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Certificate for individuals, intended for email

A

Certificate Authority - Verisign - Class 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Certificate for organizations for which proof of identity is required

A

Certificate Authority - Verisign - Class 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Certificate for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing CA

A

Certificate Authority - Verisign - Class 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Certificate for online business transactions between companies

A

Certificate Authority - Verisign - Class 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Certificate for private organizations or governmental security

A

Certificate Authority - Verisign - Class 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Used to take the burden off of a CA by handling verification prior to certificates being issued. Acts as a proxy between the user and the CA. Receives request, authenticates it, and forwards it to the CA.

A

Registration Authority (RA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Distributes digital certificates that contain public keys. A network of trusted certificate authority servers. An arrangement that binds public keys with user identities by means of a CA.

A

Public Key Infrastructure (PKI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A list of certificates that have been revoked.

A

Certificate Revocation List (CRL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A real time protocol for verifying certificates (and a newer method than CRL)

A

Online Certificate Status Protocol (OCSP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

An Internet protocol for determining the path between a X.509 digital certificate and a trusted root (Delegated Path Discovery) and the validation of that path (Delegated Path Validation) according to a particular validation policy.

A

Server-based Certificate Validation Protocol (SCVP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Two types of systems:
Centralized key-management systems
Decentralized key-management systems

A

Digital Certificate Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Three phases of key life cycle (Digital Certificate Management)

A

Setup and initialization
Administration
Cancellation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Process components:
Registration
Key pair generation
Certificate Generation Certificate Dissemination

A

Setup and Initialization Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q 
Expiration
Renewal
Revocation
Suspension
Destruction
A

Cancellation and History Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Key Storage
Certificate retrieval and validation
Backup or escrow
Recovery

A

Administration Phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q
  • Person who can recover keys from the keystore on behalf of a user
  • Highly trusted person
  • Issue recovery agent
    ·EFS recovery agent certificate
    ·Key recovery agent cert
A

Update and Patch Vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Certificate Authority is at the top
Intermediate CAs are the next level
Users are the bottom level

A

Hierarchical Trust Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Certificate Authority is at the top

Users are directly below the CA

A

Single Authority Trust Model

41
Q

Users all trust each other

A

Web of Trust - Trust Model

42
Q

One of the most basic authentication protocols. Passwords are sent over the network in clear text. The basic authentication feature built into HTTP uses this.

A

Password Authentication Protocol (PAP)

43
Q

This is a proprietary version of PAP. Encrypts username and password as it is sent across network.

A

Shiva Password Authentication Protocol (S-PAP)

44
Q

Authenticator sends a “challenge” message to the peer after link establishment. Peer responds with a value using a “one-way hash” function. Authenticator checks the response against its own calculation of the hash value. Authenticator sends new challenges to the peer at random intervals.

A

Challenge-Handshake Authentication Protocol (CHAP)

45
Q

Widely used, particularly with Microsoft operating systems. Created by MIT and derives its name from the mythical three headed dog.

46
Q

A server or client that Kerberos can assign tickets to.

47
Q

Server that authorizes the principal and connects them to the Ticket Granting Server.(Components of Kerberos System)

A

Authentication Server (AS) -

48
Q

Provides tickets in Kerberos System

A

Ticket Granting Server (TGS)

49
Q

A server that provides the initial ticket and handles TGS requests. Often runs as TGS services. (Components of Kerberos System)

A

Key Distribution Center (KDC)

50
Q

A boundary within an organization. Each realm has its own AS and TGS. (Components of Kerberos System)

51
Q

A TGS (Ticket Granting Server) in a remote realm. (Components of Kerberos System)

A

Remote Ticket Granting Server (RTGS)

52
Q

The ticket that is granted during the authentication process. (Components of Kerberos System)

A

Ticket Granting Ticket (TGT)

53
Q

Used to authenticate to the server. Contains identity of client, session key, timestamp, and checksum. Encrypted with servers key. (Components of Kerberos System)

54
Q

Temporary encryption key.(Components of Kerberos System)

A

Session key

55
Q

Proves session key was recently created. Often expires within 5 minutes. (Components of Kerberos System)

A

Authenticator

56
Q

Type cryptography Kerberos uses and the port number

A

Uses symmetric cryptography and UDP port 88.

57
Q

Created by Phillip Zimmerman in early 1990’s. Not itself an algorithm but uses other symmetric and asymmetric algorithms. Open source software for making encryption and decryption readily usable by end users. Most often associated with email encryption. Uses certificates that contain multiple signatures but they are self-signed so they can’t be validated with a CA.

A

Pretty Good Privacy (PGP)

58
Q

Defines it own format. A single certificate can contain multiple signatures. Includes:
Version Number
Certificate holder’s public key
Certificate holder’s information
Digital signature of certificate owner
Certificates validity period
Preferred symmetric encryption algorithm for the key

A

PGP Certificates

59
Q

Uses the RC4 stream cipher to secure the data and a CRC-32 checksum for error checking. Standard version uses a 40bit key with a 24bit initialization vector to form 64bit encryption. 128bit version uses 104bit key with 24bit IV. Because RC4 is a stream cipher, the same traffic key must never be used twice. 24bit IV is not enough prevent repetition on a busy network. Vulnerable to related key attack.

A

Wired Equivalent Privacy (WEP)

60
Q

Uses Temporal Key Integrity Protocol (TKIP). Dynamically generates a new key for each packet.

A

WPA - WiFi Protected Access

61
Q

Uses pre-shared key mode. Designed for home and small networks. Doesn’t require authentication server. Each wireless device authenticates using the same 256bit key.

A

WPA-Personal (can be known as WPA-PSK mode)

62
Q

Designed for enterprise networks. Requires a RADIUS server for authentication. Extensible Authentication Protocol (EAP) is used for authentication. (EAP-TLS and EAP-TTLS)

A

WPA-Enterprise (can be called WPA-802.1x mode)

63
Q

Based on IEEE 802.11i and provides:

  • Advanced Encryption Standard (AES) using the Counter Mode-Cipher Block Chaining (CBC)-Message Authentication Code (MAC) Protocol (CCMP) that provides data confidentiality, data origin authentication, and data integrity for wireless frames.
  • Optional use of Pairwise Master Key (PMK) caching and opportunistic PMK caching. (caches results of 802.1x authentications to improve access time)
  • Optional use of pre-authentication that allows WPA2 wireless client to authenticate with other wireless access points in range.
64
Q

Developed by Netscape and has been replaced by TLS. It was the preferred method used with secure websites (i.e. https)

65
Q

SSL Steps

A
  1. The browser asks the web server to prove its identity.
  2. The server sends back a copy of its SSL certificate.
  3. The browser checks to see if the certificate is from a CA it trusts.
  4. The server sends back a digitally signed acknowledgement and a session is started.
66
Q

A protocol for encrypting transmissions. A client and server negotiate a connection by using a handshaking procedure. The server sends back its identification as a X.509 certificate. The client contacts the CA to confirm the validity of the certificate before proceeding. This protocol also supports secure bilateral connection mode.

A

TLS (Transport Layer Security)

67
Q

A way to use the internet to create a virtual connection between a remote user or site and a central location. Packets are encrypted making the network private. Emulates a direct network connection.

68
Q

Oldest of the three protocols used in VPNs. Designed as a secure extension to the Point-to-Point Protocol (PPP). Adds the feature of encrypting packets and authenticating users to PPP. Works at the data link layer of the OSI model.

A

Point-to-Point Tunneling Protocol (PPTP)

69
Q

Can use two different methods of of authenticating the user:

EAP and CHAP

70
Q 
Designed as an enhancement to PPTP
Like PPTP, works at the data link layer
Offers many modes of authentication: CHAP, EAP, PAP, SPAP, and MS-CHAP
Can work on X.25 networks (phone)
Uses IPSec for its encryption
A

Layer 2 Tunneling Protocol (L2TP) VPN

71
Q

Latest of the three VPN protocols
Encrypts not only the packet data, but also the header information
Has protection against unauthorized re-transmission of packets

A

Internet Protocol Security (IPSec) VPN

72
Q

VPN setup through a web browser, portal that uses secure traffic. Gives user access to the target network.

A

SSL/TLS VPN

73
Q

Since Windows 2000, this has been used along with NTFS. Allows a simple way to encrypt and decrypt files/folders. Simply right-click, choose properties, then advanced. Encrypted files will appear in green and are tied to the user who encrypted them.

A

Encrypting File System (EFS)

74
Q

Introduced with Windows 7. Can encrypt partitions or entire drives. Startup key only. Key information is stored on a flash drive or TPM. Uses AES with 128bit key.

75
Q

Software for maintaining an on-the-fly-encrypted volume. Data is automatically encrypted right before it is saved, then decrypted right after it is loaded, all w/o user intervention.

76
Q

Common Cryptography Mistakes

A
  • Using a standard modulus in RSA (modulus e=216+1=65537)
  • Using seeds for symmetric algorithms that are not random enough
  • Hard coded cryptographic secrets/elements
  • Using too short of a key
  • Re-using keys
  • Unsecure Key Escrow
  • Unsecure cryptographic mode (ECB mode)
  • Proprietary cryptographic algorithms
77
Q

The art and science of writing hidden messages so that no one suspects the existence of the message, a type of security through obscurity. Message can be hidden in picture or audio file for example. Uses least significant bits in a file to store data.

A

Steganography

78
Q

The data to be covertly communicated, the message you wish to hide. (Steganography Terms)

79
Q

The signal, stream, or data file into which the payload is hidden.

80
Q

The type of medium used. This may be still photos, video, or sound files.(Steganography Terms)

81
Q

In every file, there are a certain number of bits per unit of the file. For example, an image file in Windows is 24bits per pixel. With Least Certificate Bit (LSB) replacement, some bits can be replaced without altering the file much.

A

Steganography Details

82
Q

Hiding messages in sound files. Can be done via LSB and Echo Hiding

A

Steganophony

83
Q

Hiding messages in video files. Can be done via Discrete Cosine Transform

A

Video Steganography

84
Q

Stores data in seemingly random files.

A

Steganographic File Systems

85
Q

QuickStego - easy to use but limited
Invisible Secrets - robust, has free and commercial versions
MP3Stego - MP3 files
Stealth File 4 - Sound files, video files, and image files
Snow - Hides data in whitespace
StegVideo - Hides data in a video sequence

A

Steganography Implementations

86
Q

Detecting steganography and extracting the hidden information. Done with software. By analyzing changes in an images close color pairs, the steganalyst can determine if LSB was used. Close color pairs consist of two colors whose binary values differ only in the LSB.

A

Steganalysis

87
Q

A method to analyze an image to detect hidden messages. Based on statistics of the number of unique colors and close-color pairs in a 24bit image. Analyzes the pairs of colors created by LSB embedding. Countermeasure- Maintaining the color palette w/o creating new colors.

A

Steganalysis - Raw Quick Pair

88
Q

Calculates the average LSB and builds a table of frequencies and Pair of Values. Performs a test on the two tables. It measures the theoretical vs. calculated population difference.

A

Steganalysis - Chi-Square Analysis

89
Q

Examines noise distortion in the carrier file. Noise distortion could indicate the presence of a hidden signal.

A

Examines noise distortion in the carrier file. Noise distortion could indicate the presence of a hidden signal.

90
Q

StegSpy
Stegdetect
StegSecret

A

Steganography Detection Tools

91
Q

(How the NSA classifies cryptography) This classification of algorithms are not published. Algorithms are classified.

92
Q

(How the NSA classifies cryptography) This classification of algorithms are published.

93
Q

NSA Suite A Cryptography Algorithms

A

That’s CLASSIFIED!

94
Q
  • AES w/ key sizes of 128 and 256bits
  • For traffic, AES should be used w/ the Galois/Counter Mode (GCM) mode of operation - symmetric encryption
  • Elliptic-Curve Digital Signature Algorithm (ECDSA) - digital signatures
  • Elliptic-Curve Diffie-Hellman (ECDH) - key agreement
  • Secure Hash Algorithm 2 (SHA-256 and SHA-384) - message digest
A

NSA Suite B Cryptography Algorithms

95
Q 
Highest level of encryption algorithms. Used for classified or sensitive U.S. government information. Includes:
JUNIPER - Block Cipher
MAYFLY - Asymmetric
FASTHASH - Hashing
WALBURN - High bandwidth link encryption
PEGASUS - Satellite telemetry
A

NSA Type 1 Algorithms

96
Q

Used for unclassified cryptographic equipment, assemblies, or components. Endorsed by the NSA for use in telecommunications and automated information systems for the protection of national security information. These include:
Skipjack (a block cipher)
KEA (Key Exchange Algorithm - Asymmetric)

A

NSA Type 2 Algorithms

97
Q

product is a device for use with Sensitive But Unclassified (SBU) information on non-national security systems. Algorithms include:
DES
3DES
SHA
AES (some implementations of AES are type 1)

A

NSA Type 3 Algorithms

98
Q

Algorithms that are registered by NIST but not FIPS published. Also, unevaluated commercial cryptographic equipment, assemblies, or components that neither NSA nor NIST certify for any government usage.

A

NSA Type 4 Algorithms

99
Q

The only unbreakable encryption. Has a separate substitution for each character making the key as long as the text. No substitution is used more than once. Key is used one time then destroyed. Impractical for most situations.

A

One Time Pad (OTP)

C839 Cryptography (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions