Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Software Douchebags > SE4472 FINAL > Flashcards

SE4472 FINAL Flashcards

1
Q

How large is a block in DES?

A

8 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How large is a block in AES?

A

16 bytes (128 bits)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is perfect secrecy?

A

No way to brute force (one-time pad)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three goals of security?

A

confidentiality (encryption, public key exchange)
integrity (MACs, hashes)
authenticity (digital signatures, certificates, public key infrastructure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the requirements for an ideal block cipher?

A
  1. Encryption should be reversible
    - returns original message
    - bijection (1:1 mapping)
    - permutation (strings map 1:1 w/ itself)
  2. Easy with the key, hard without
  3. Efficient to compute
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between a PRP and PRF?

A

PRF (pseudo random function) does not require 1:1 mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a feistel network?

A

Method of turning a PRF into a PRP

  • twisted ladder, at least 4 rounds
  • decrypt by running backwards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the security level of CBC?

A

If the IV is known: IND-EAV secure

If the IV is random: IND-CPA secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the security level of AES-GCM?

A

IND-CCA2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the security level of ECB?

A

None (Not IND-EAV secure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the security level of CTR?

A

If the IV is known: IND-EAV secure

If the IV is random: IND-CPA secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the probability of a successful pre-image resistance attack?

A

2^(l-1)

** -1 since we already know 1 hash which is the one we are trying to guess with a guess message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the probability of a successful second pre-image resistance attack?

A

2^(l)

**asked essex about this

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the probability of a successful collision attack?

A

2^(l/2)

**birthday paradox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many bits is an MD5 hash?

A

128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is computational secrecy?

A

Not perfect, but only vulnerable to brute force

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Public-key exchange achieves which security goal?

A

confidentialy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

MAC codes achieve which security goal?

A

Ingetrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Digital signatures achieve which security goal?

A

Authenticity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What security level does a caesar cipher offer?

A

None

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Deterministic ciphers can offer at most what level of security?

A

IND-EAV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

In a Feistel network, how many rounds is required to turn a strong PRF into a PRP?

A

4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What block size does DES use?

A

64 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

what is security rule #1?

A

Don’t roll (create) your own crypto

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is security rule #2?

A

Kerckhoff’s Principal:

  • A crypto system should be secure even if the algorithm is public
  • Secrecy of the message should depend on the secrecy of the KEY, not security through obscurity of the algorithm
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is second pre-image resistance?

A

Given m1 and h, it is hard to find another message m2 that produces the same hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define plaintext

A

A message to be encrypted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define Ciphertext

A

the encrypted message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Define Key

A

secret that is used to transform plaintext into ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How many queries would be required for a padding oracle attack (worst case)?

A

255 queries/byte * 16 bytes = ~4000 queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Goals of cryptosystem designers

A
  1. Key space exponential in key length
  2. Infeasible to brute force ( > 2^100)
  3. Brute force = worst case
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is pre-image resistance?

A

given hash h, it is hard to find a message that hashes to h

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

TLS uses what approach to authenticated encryption?

A

MAC-then-encrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is second pre-image resistance?

A

Given m1 and h, it is hard to find another message m2 that produces the same hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the 3 properties of a one-time pad?

A
  1. Pad chosen independent to text, and at random
  2. Pad is exactly as long as the message
  3. Pad is only ever used once
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Properties of computational (practical) security:

A
  1. Short length key
  2. Crackable with enough computing power
  3. Too many keys to brute force
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

what is message authentication?

A

know who the message came from

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Reasons why one-time pad is not feasible:

A
  1. Generating, transporting, storing too costly
  2. size of key is long
  3. Human error such as pad re-usal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Properties of computational (practical) security:

A
  1. Short length key
  2. Crackable with enough computing power
  3. Too many keys to brute force
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

T/F: A linear modification in the ciphertext is preserved

in the plaintext in CTR mode

A

T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

T/F: Flipping a bit of ciphertext in CBC mode totally corrupts every plaintext block

A

F: Only corrups current plaintext block, but flips the bit in next block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How would you pad this message using AES and PKCS#7:

68 65 6c 6c 6f 20 77 6f 72 06

A

68 65 6c 6c 6f 20 77 6f 72 06 06 06 06 06 06 06

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How many queries would be required for a padding oracle attack (worst case)?

A

255 queries/byte * 16 bytes = ~4000 queries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How do you prevent a padding oracle attack?

A

Don’t let your decryption function return a

plaintext unless the ciphertext was valid (use MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

GCM uses what approach to authenticated encryption?

A

Encrypt-then-MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

TLS uses what approach to authenticated encryption?

A

MAC-then-encrypt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

T/F: public keys are used to undo something (decrypt)

A

F: private keys are used for undoing.

Public keys are used for doing (encrypting)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Why are the Caesar and Vigenere ciphers not secure?

A

They both leak letter frequency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Why is Enigma not secure?

A

Leaks information about what the plain text is not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What does CCA stand for

A

Chosen Ciphertext Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Definition of A’s advantage in winning the game

A

Adv(A) = | P(b’ = b) - 0.5 |

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Does A have an advantage if winning more than 50% of time?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Does A have an advantage if winning LESS than 50% of time?

A

Yes, pick opposite guess of what A thinks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Does A have an advantage if they win exactly 50% of time?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

How is negligibility defined?

A

In terms of how the keyspace grows relative to the adversary advantage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What is a negligible function?

A

e() is a negligible function if it grows more slowly than the inverse of a polynomial function: e(k) < | 1 / poly(k) |

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

what does PPT stand for

A

Probabilistic Polynomial Time

-Realistic to computational resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What happens when you encrypt the same message twice using the same key, and the encryption is non-deterministic?

A

you get a different ciphertext every time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

How can you prove enigma is not CCA2 secure

A

Use CPA or CCA attacks (or anything else of a lower security level than CCA2 such as EAV) to prove it is not CCA2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What does CPA stand for?

A

Chosen Plaintext Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What does CCA stand for

A

Chosen Ciphertext Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the difference between CCA1 and CCA2

A

CCA1: Adversary can only make decryption queries BEFORE the challenge text is sent
CCA2: Adversary can make decryption queries both before and after challenge, but not the challenge itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

List the permitted queries of IND-EAV Security

A

None

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

List the permitted queries of IND-CPA Security

A

Pre challenge: encryption only

Post challenge: encryption only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

List the permitted queries of IND-CCA1 Security

A

Pre challenge: encryption / decryption

Post challenge: encryption only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

List the permitted queries of IND-CCA2 Security

A

Pre challenge: encryption / decryption

Post challenge: encryption / decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

if a ciphertext is IND-CCA1 is it also CPA secure?

A

Yes, each security level inherits the capabilities of anyone before it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

if a cipher text is IND-CPA is it also IND-CCA1?

A

Insufficient information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Prove all deterministic ciphers cannot be IND-CPA secure

A

Query Phase:
A sends m0 / m1 and gets c0 / c1

Challenge Phase: 
A sends m0 and m1 as challenges
B sends cb 
if cb = c0; m0 is correct ... if cb = c1; m1 is correct 
A wins 100% of time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What is the triple of functions for block cipher?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

how many plaintexts are in an ideal block cypher?

A

2^b

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

how many possible permutations of plaintexts are in an ideal block cypher?

A

2^b!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

How do block cyphers work?

A
  1. Take b bits of message plaintext
  2. Encrypt them to b bits of cipher text
    -encryption done in blocks (vs. classical single letter)
    DES - 8 bytes
    AES - 16 bytes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What is the purpose of a PRP in terms of an electronic code book

A

Allows you to efficiently compute the code book with exponentially many entries that would normally be computationally infeasible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

In CBC mode does the XOR come before or after the Encryption?

A

c-B-c mode B= Before

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Why do we need Hash functions?

A

Whenever it would be beneficial to create short fixed-length strings as a fingerprint to digest arbitrary length string

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

In CTR mode, does the XOR come before or after the Encryption?

A

After

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Main difference between CTR and CBC?

A

CTR can be run in parallel while CBC must be run in series since the previous block creates the next block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What does AES stand for?

A

Advanced Encryption Standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Does AES use a feistel network?

A

No, it uses Galois field operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

What is the round function of AES

A

a PRP using Galois field arithmetic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Why Galois fields?

A

Addition is just bit-wise XOR, Multiplication is simple bit wise operations, so GF operations are fast in hardware and easy to explain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

How do block cyphers work?

A
  1. Take b bits of message plaintext
  2. Encrypt them to b bits of cipher text
    -encryption done in blocks (vs. classical single letter)
    DES - 8 bytes
    AES - 16 bytes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

What key sizes does AES support?

A

128bit, 196 bit, or 256 bit keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

In AES can the key length differ from the block size?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

Using AES, under PKCS #7, if I had an 8 byte message, how many bytes of padding do I need, and what HEX value of each byte do I need

A

8 bytes of PKCS7 padding, and they are all 08:

XX XX XX XX XX XX XX XX 08 08 08 08 08 08 08 08

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What i a random oracle?

A
  1. Every arbitrary input, random oracle outputs a random fixed-length string
  2. each unique query is independent of others
  3. if you repeat a query to the oracle, it gives the same answer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What type of function is a hash function?

A

Pseudo-random function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What are the 3 properties of hash functions?

A
  1. Pre-image resistance
  2. Second pre image resistance
  3. Collision resistance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

Explain Pre-image resistance

A

Given a hash, it should be hard to find a message producing the hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Explain Second pre-image resistance

A

Given a message, it should be hard to find another message that produces the same hash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

What is the goal of message authentication?

A

Make it infeasible for an attacker to generate a valid ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

What is a MAC

A

A function that accepts an arbitrary length plaintext and
a key and produces a fixed-length value that serves as an authenticator code/tag

like a hash, but must be infeasible to forge code/tag without key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Do MACs prevent padding oracle attacks?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

How does a MAC prevent padding oracle attacks?

A

Receiver accepts or rejects message based on MAC not based on the message.
Receiver doesn’t look at message unless MAC is valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Under PKCS #7, if I had an 8 byte message, how many bytes of padding do I need, and what HEX value of each byte do I need

A

8 bytes of PKCS7 padding, and they are all 08

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Using AES, under PKCS #7, if I had an 16 byte message, how many bytes of padding do I need, and what HEX value of each byte do I need

A

16 bytes of padding in a new block, and 16 in hex is 10 so it would be 16 bytes of 10:
10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What does a padding oracle tell you?

A

Cipher text —-> Padding oracle —-> tells you either the plaintext has valid or invalid padding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

Can you build a decryption oracle out of a padding oracle?

A

yes

100
Q

How many queries does it take Eve to recover plaintext in a padding oracle attack on one byte of ciphertext

A

255 queries

101
Q

How to stop padding oracle attacks?

A
  1. don’t let decryption return plaintext unless cipher text was valid
  2. make it infeasible for anyone except key holder to create valid ciphertext
  3. Should be efficient for key holders to check ciphertext validity
102
Q

What are the outputs of an authenticated decryption function?

A

Plaintext or error if tag is invalid

103
Q

What are the 3 approaches to authenticated encryption?

A
  1. MAC-then-encrypt (used by TLS)
  2. MAC-and-encrypt (used by SSH)
  3. Encrypt-then-MAC (best choice)
104
Q

Do MACs prevent padding oracle attacks?

A

Yes

105
Q

How does a MAC prevent padding oracle attacks?

A

Receiver accepts or rejects message based on MAC not based on the message.
Receiver doesn’t look at message unless MAC is valid

106
Q

What is the probability of producing a valid MAC?

A

1/2^128

107
Q

what is the probability of producing a valid padding byte?

A

1/256

108
Q

What is authenticated encryption

A

Explicit block cipher mode combining encryption and MAC operations

AE achieves CIA triad

109
Q

What are the inputs of an authenticated encryption function?

A
  1. Plaintext (message)
  2. Encryption key (Cipher key)
  3. MAC key
110
Q

What are the outputs of an authenticated encryption function?

A
  1. Cipher Text

2. Authentication (MAC) tag

111
Q

What are the inputs of an authenticated decryption function?

A
  1. Mac Tag
  2. Ciphertext
  3. MAC Key
  4. Encryption Key (Cipher key)
112
Q

What are the outputs of an authenticated decryption function?

A

Plaintext or error if tag is invalid

113
Q

What are the 3 approaches to authenticated encryption?

A
  1. MAC-then-encrypt
  2. MAC-and-encrypt
  3. Encrypt-then-MAC
114
Q

What are the downsides of Encrypt-then-mac approach?

A

Does two passes on data:

  • 1 block cipher call +2 hash functions
  • 3x as long as just encryption alone
115
Q

What authenticated encryption mode has a lightweight MAC that runs in parallel with encryption?

A

GCM = Galois / Counter Mode

116
Q

What is the discrete logarithm problem?

A

Given a = g^r mod p

It is infeasible to calculate r

117
Q

T/F: Diffie Hellman is vulnerable to man in the middle attack

A

True - very vulnerable!

118
Q

What are the components of the DH tuple?

A

< g, g^a, g^b, g^ab >

119
Q

T/F: In Diffie Hellman agreement, the public key a is used to generate private key g^a

A

False. Private key a is used to generate public key g^a

120
Q

T/F: RSA is a symmetric key encryption scheme

A

False. RSA is a public key (asymmetric) scheme

121
Q

T/F: RSA is not widely used for key agreement, but is widely used for digital signatures

A

True

122
Q

What is the forumula for encryption with RSA?

A

c = Enc(m) = m^e mod n

123
Q

What is the forumula for decryption with RSA?

A

m = Dec(c) = c^d mod n

124
Q

Given two RSA message/signature pairs (m1,s1), (m2,s2), how could you do an existential forgery?

A

m3 = m1m2, s3 = s1s2

125
Q

Walk me through a DCF

A

Unfortunately, due to the high volume of applicants this year, we regret to inform you of your rejection from Chad school of Bullshit and Fuckery.

126
Q

How many bits of security does SHA1 offer?

A

80

Hash length is 160 bits

127
Q

How many bits of security does SHA1 offer?

A

80

Hash length is 160 bits

128
Q

Suppose there are two files f1 and f2 and suppose SHA1(f1) = SHA1(f2). Are these files identical?

A

Possibly. If they were the same, they would definitely have the same hash value since hash functions are deterministic. If they are different, they still could possibly have the same hash (called a collision

129
Q

What is DHE?

A

Ephemeral Diffie Hellman

A new private key is generated for each connection

130
Q

What is DHE?

A

Ephemeral Diffie Hellman

A new private key is generated for each connection

131
Q

What is a total break forgery?

A

Eve determines A’s private key

132
Q

What is a universal forgery?

A

Eve finds a sining algorithm to construct an equivalent signature to A on all messages for A

133
Q

What is a selective forgery?

A

Eve forges a signature on a specific message from A

134
Q

How could an attacker create a valid signature pair without knowing anything except public key

A

Choose s arbitrarily, (1

135
Q

List out Digital Signature Requirements

A
  1. Signature bit pattern depends on message being signed
  2. Signature uses unique information of sender, preventing forgery/denial
  3. Easy to produce signature
  4. Easy to recognize/verify digital signature
  5. Infeasible to forge signature
  6. Must be able to store digital signatures
136
Q

T/F: RSA is forward secret

A

FALSE, RSA is not forward secret

137
Q

What is forward secrecy

A

Forward secret cryptography means messages from the past are secured.

138
Q

T/F: Diffie-Hellman is forward secret

A

Only in ephemeral mode (DHE), not in regular DH

139
Q

What are the 3 types of crypto systems?

A
  1. Generate
  2. Signing
  3. Verifying
140
Q

What is a universal signature forgery?

A

Attacker can generate a signature for any message

141
Q

What is an existential signature forgery?

A

Attacker can generate a signature for some messages, which they cannot control

142
Q

What is a selective signature forgery?

A

Attacker can generate a signature on a particular message that was chosen ahead of time

143
Q

T/F: Signatures are usually performed on the hash of a message, not the message itself

A

True

144
Q

What is the NIST minimum security level requirement?

A

112 bits of security

145
Q

What is the purpose of a digital signature?

A
  • To prevent man-in-middle attacks on public key cryptography, specifically diffie-hellman which is majorly used today
  • verifies the person is who they say they are
146
Q

Who verifies a certificate authorities certificate?

A

self-verification

147
Q

What are the 3 types of validation?

A
  1. Domain Validation
  2. Organization Validation
  3. Extended Validation
148
Q

What is the first certificate in a certificate chain called?

A

A root certificate

149
Q

What is the trust store?

A

Place in your browser, device, or OS where root certificates are stored

150
Q

T/F: you can bypass certificate chains

A

True: If you directly associate with a host you can “pin it” in the browser as trust worthy

151
Q

T/F: all expired certificates are invalid

A

True

152
Q

T/F: all non expired certificates are valid

A

False, there are some the should not be valid, known better as certificate revocation

153
Q

What is OCSP stapling?

A

Server makes OCSP request, staples it to certificate chain

Less work for client and CA, more for server

154
Q

What are 3 main ways to check if a certificate has been revoked?

A
  1. Certificate Revocation List
  2. Request to Online Certificate Status Protocol (OCSP)
  3. OCSP Stapling
155
Q

What are the inputs for the RSA signing function?

A

Message m, signing key (n,d)

156
Q

What are the inputs of the RSA verification function?

A

Message m’, signature s, verification key (n,e)

157
Q

What is the format of the output of PKCS 1.5?

A

p = 00 01 FF … FF 00 || h

Repeat FF’s until length of p must be equal to length of n, in bytes

158
Q

What does DSA stand for?

A

Digital Signature Algorithm

159
Q

What does ECDSA stand for?

A

Elliptic curve digitial signature algorithm

160
Q

What does ECDHE stand for?

A

Elliptic curve diffie hellman ephemeral

161
Q

What is ECC?

A

Elliptic Curve Cryptography

162
Q

What are the pros of ECC?

A
  • point multiplication faster than analog modular exponentiation
  • public-keys in ECC are smaller
163
Q

What are the cons of ECC?

A
  • complex to implement, harder to understand

- concern about potential for backdoors

164
Q

What is the NIST minimum security level requirement?

A

112 bits of security

165
Q

What is OCSP Stapling?

A
  • Client connects to server
  • server OCSP pings CA and gets valid time stamped verification that server certificate has not been revoked
  • server appends revocation stamp onto certificate
  • sends it to client
  • protects client privacy, more efficient
166
Q

List out phase 1 transfers in TLS connection

A
  1. (Client->server): hello

2. (Server->client): hello

167
Q

List out phase 2 transfers in TLS connection

A
  1. (Server->client): server_certificate
  2. (Server->client): server_keyExchange
  3. (Server->client): server_certificate_request
  4. (Server->client): server_hello_done
168
Q

List out phase 3 transfers in TLS connection

A
  1. (Client->server): client_certificate
  2. (Client->server): client_keyExchange
  3. (Client->server): client_certificate_verify
169
Q

List out phase 4 transfers in TLS connection

A
  1. (Client->server): change_cipher_spec
  2. (Client->server): finished
  3. (Server->client): change_cipher_spec
  4. (Server->client): finished
170
Q

If using DHE or ECDHE, what is considered the pre-master secret in the TLS protocol

A

pre-master secret = diffie-hellman shared secret

171
Q

What type of function is used to derive the master secret?

A

PRF

172
Q

What is the master secret used for?

A

Deriving the symmetric keys using a PRF

173
Q

What type of function is used to generate a key block?

A

PRF

174
Q

What is a key block?

A

Consists of all values used in symmetric-key operations, generated by subbing in a master secret to a PRF

175
Q

What are the 4 keys of a key block?

A
  1. client_write_MAC
  2. server_write_MAC
  3. client_write_key
  4. server_write_key
176
Q

What do major TLS attacks focus on?

A

recovering an encrypted single session cookie/token

177
Q

What is entropy?

A

random bits collected by your app/OS from various hardware sources like mouse position, time, network data…

178
Q

T/F: Cryptography needs non-uniform distributions of numbers

A

False

179
Q

T/F: Cryptography needs uniform distributions of numbers

A

True

180
Q

What is a uniform distribution of numbers?

A

Each number in the range has an equal likelihood of being picked

181
Q

What does CSPRNG stand for?

A

Cryptographically Secure Pseudo Random Number Generator

182
Q

What are the 3 key assumptions for CSPRNGs

A
  1. Everyone knows f and h of the machine
  2. Eavesdroppers know output r
  3. State s is a secret, only user knows
183
Q

What are the 3 main security properties of CSPRNGs

A
  1. h is one-way
  2. f is one-way
  3. output r is indistinguishable from uniform random bits
184
Q

in a CSPRNG, if h is not one-way what does this mean in terms of an attacker?

A

An attacker would be able to guess s given r, and could generate all future outputs

185
Q

in a CSPRNG, if f is not one-way what does this mean in terms of an attacker?

A

If an attacker was able to get a hold of s, they could generate all past outputs if f was not one way

186
Q

in a CSPRNG, if output r is a non-uniform set of bits what does this mean in terms of an attacker?

A

Given previous output r, an attacker would be able to guess the next bit with an advantage

187
Q

How much output would you need from a 128-bit CTR mode to be able to distinguish it from true randomness?

A

Another instance of birthday paradox, statistically you would need 2(128/2) tries and then you begin to have an advantage > 50%. Thus, you need 2^64 output for distinguishability.

188
Q

Code for CORRECT way to prevent modulo bias:

A

do {r=rng(b)} while r>n; return r

189
Q

Code for EFFICIENT way to prevent modulo bias:

A

r = rng(n.bitlength +margin) mod n; return r

190
Q

What does b-bits of security mean?

A

attacker must do 2^b operations to crack

191
Q

What are the 2 important parameters when determining security levels?

A
  1. Primitives

2. Applications

192
Q

When are collisions not something that an attacker could make of during hashing?

A

No collisions applies to non-digital signature applications like HMAC and key derivation functions
HMAC:
-Eve would need to know the secret key to be able to compute tags and compare them, so this is not possible.

193
Q

Under NIST, is SHA-1 allowed as a cryptographic primitive?

A

No, SHA-1 is 160 bits implying 80 bits of security, but NIST standards are currently at 112 bits

194
Q

What are the different types of certificate validation?

A

domain
company
extended

195
Q

What is included in a certificate?

A

Subject info (issuer, validity, signature algorithm)

Public key (modulus, exponent)

Extensions

Signature (by CA)

196
Q

What is a root certificate?

A

The endpoint of a certificate chain

Root certificates are stored in the trust store of a browser/OS/device

197
Q

What is certificate pinning?

A

Directly associating a host with a public key, bypassing certificate chain

198
Q

When is it good to use certificate pinning?

A

In high-assurance applications

199
Q

What are possible reasons for certificate revocation?

A
  1. Company hacked (private key compromised)
  2. CA hacked
  3. New business name
  4. Company goes out of business
200
Q

What are the different ways to check if a ceritifcate has been revoked?

A
  1. Certificate revocation list (CRL)
  2. Online certificate status protocol (OCSP)
  3. OCSP Stapling
201
Q

What is OCSP?

A

Online certificate status protocol

Client requests the CA to check certificate in real-time. Less work for clients, but privacy issues

202
Q

What is OCSP stapling?

A

Server makes OCSP request, staples it to certificate chain

Less work for client and CA, more for server

203
Q

T/F: storing just a hash of a password is good enough in a database

A

False. People with the same passwords will map to the same hash, if one gets cracked, many to.

NEED FOR A SALT FACTOR

204
Q

What is a salt factor?

A

A random value appended to the password and then hashed so every hash in a database is unique, even with the same password

205
Q

What is key stretching?

A

making a password slow to hash by extending time it takes, say 1 second, thus infeasible for hacker

206
Q

What does PBKDF2 stand for?

A

Password Based Key Derivation Function

207
Q

What is PBKDF2?

A

Iterative hashing with user chosen number of hash iterations hp=PBKDF2 (Hash(), p, salt, iteration, klength)

208
Q

Describe the 4 phases of TLS Handshake

A
  1. Establish security capabilities
  2. Authentications & public key exchange
  3. Secret key exchange & derivation
  4. Finish
209
Q

What are the 4 components of a TLS ciphersuite?

A

key agreement protocol
signature scheme
block cipher & mode
hash function

210
Q

Why does the server not send the root certificate?

A

Because client already knows it (trust store)

211
Q

T/F: During phase 2 of TLS handshake, server must send certificate chain to client

A

False, certificate is optional

212
Q

What are the three steps to key derivation in TLS?

A
  1. Exchange pre-master secret
  2. Derive master secret
  3. Derive symmetric keys
213
Q

How is the pre-master secret derived in RSA?

A

Client generates pre-master secret, encrypts w/ public key, sends to server

214
Q

How is the pre-master secret derived in DHE?

A

Parties compute shared secret (g^ab), which becomes the pre-master secret

215
Q

What are the symmetric keys derived in TLS?

A

client MAC
client encryption
server MAC
server encryption

216
Q

What PRF does TLS use to derive the master secret?

A

HMAC

217
Q

When deriving master secret in TLS, what are the inputs to the PRF?

A

pre-master secret
label
seed

218
Q

What is a key block?

A

The key block consists of all the values used in the symmetric-key operations

219
Q

PBKDF2 and other key stretching algos are parallelizable. How do you prevent an attacker from making the operations parallel?

A

Make password verification take time AND MEMORY.

Known as memory HARD function

220
Q

What is scrypt?

A

a memory hard password function

Pros: memory hard, popular
Cons: new/not well understood, hard to analyze/implement

221
Q

Why don’t we use passwords in conjunction with keys?

A
  1. Risk if server gets rooted
  2. Hardware-secured encryption oracles (HSM)
  3. HSM has to be bought by admin $$$
  4. Attack at minimum needs physical access
222
Q

What does entropy mean, with respect to passwords?

A

Entropy refers to level of security - higher entropy password is harder to guess

223
Q

How should you store passwords in a database?

A

Store the hash of the password, not the plaintext

Use salting, so that if an attacker finds a hash/password pair, they cannot find all other users with the same password

224
Q

How do you use salting to protect passwords?

A

Append password p with random salt s, then hash.

h = Hash(p||s)

Store (user, h, s)

225
Q

What is key stretching?

A

Hashing is very fast, we want to slow down attackers. Key stretching is how we make hashing slower/require more memory

226
Q

What is PBKDF2?

A

Password based key derivation function - uses iterative hashing, repeating the hash several times based on user chosen number of iterations.

227
Q

What is the drawback of PBKDF2?

A

It is highly parallelizable, so still relatively efficient to compute

228
Q

What is scrypt?

A

A memory-hard derivation function. Cons: New, complicated

229
Q

What is CSPRNG?

A

Cryptographically secure pseudo-random number generator

230
Q

In CSPRNG, if f was not a one-way function, and an attacker knew s, what could they do?

A

They could generate all past outputs

231
Q

In CSPRNG, if h was not a one-way function, and an attacker knew s, what could they do?

A

They could generate all future outputs

232
Q

What are the 3 security requirements in CSPRNG?

A
  1. Attacker shouldnt be able to guess s given output r
  2. Attacker shouldn’t be able to guess previous s based on current s
  3. Attacker shouldn’t be able to guess the next output r given previous r
233
Q

What is Fortuna?

A

A deterministic random bit generator

234
Q

In Fortuna, what is used for output function g?

A

g is the AES encryption of s

235
Q

In Fortuna, what is used for updating function f?

A

Counter

236
Q

How does Fortuna deal with not using a one-way function for f?

A

Reseeding frequently

237
Q

For a given security level b, what is the key length required for symmetric key encryption?

A

|k| >= b

238
Q

For a given security level b, what is the size of q required for an integer discrete log kx or signature?

A

|q| >= 2b

239
Q

For a given security level b, what is the size of q required for an elliptical curve kx or signature?

A

|q| >= 2b

240
Q

What is the size of n required for a RSA kx or signature?

A

|n| >= 2048 bits

241
Q

For a given security level b, what is the required length for a hash, if collisions are a concern?

A

|h| >= 2b

242
Q

For a given security level b, what is the required length for a hash, if collisions are not a concern?

A

|h| >= b

243
Q

What is the NIST minimum security requirement?

A

112 bits

244
Q

How large should p be in an integer discrete log system?

A

|p| ~ 8b

245
Q

What is the minimum hash length for an HMAC hash to comply with NIST?

A

112

Software Douchebags (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions