Security

Question 1

Purpose of Assymetric encryption

Answer 1

To provide better security using a public key and a private key. The message is encrypted using one of the keys then the message is decrypted using the matching key.

Question 2

Benefits of Quantum Cryptography (min 2 - max6)

Answer 2

-Longer keys can be used.(i)
-Detects eavesdropping(i)
-Provides security based on laws of physics rather than mathematical algorithms, so it is more secure.
-To protect the security of data transmitted over fibre optic cables.
-Virtually unhackable.
-The performance of quantum cryptography is continuously improved, making it suitable for most valuable government/industrial secrets.

Question 3

Drawbacks Quantum Cryptography(min 2 max 6)

Answer 3

-High cost of purchasing(i)
-Error rates are high as technology is still under development.(i)
-Only works over relatively short distances.
-Can help terrorists an criminals hide their communications.
-Lacks many vital features such as digital signature, certified mail etc.
-Polarisation of light can change during transmission.

Question 4

Why is encryption used?

Answer 4

-To ensure the message is authentic // came from a trusted source.
-To ensure that only the intended receiver is able to understand the message
- To ensure the message has not been altered during transmission.
-Non-repudiation, neither the sender or receiver can deny the transmission occurred

Question 5

What is a public key?

Answer 5

-An encryption method produced by a trusted authority that can be used by anyone.
-Key widely available that can be used to encrypt messages that only the owner of a private key can decrypt.
-Can be used to decrypt a digital signature, thereby confirming the originator of the message.

Question 6

What is a private key?

Answer 6

-Is a key that is not transmitted anywhere.
-It has a matching public key.
-It is used to decrypt the data that has been encrypted with its matching public key.

Question 7

What is assymetric key cryptography?

Answer 7

-Uses a matching pair of keys.
-The message to be sent is encrypted using the recipient’s public key. // The message to be sent is encrypted using the sender’s private key.
-The message is decrypted using the recipient’s private key. // The message is decrypted using the sender’s public key.

Question 8

Benefits of assymetric encryption.

Answer 8

-Increased message security as one key is private.
-Allow message authentication.
-Allos non-repudiation.
-Detects tampering.

Question 9

What is symmetric encryption and what are some of its drawbacks?

Answer 9

-A single key is used for both encryptin and decryption.

–Key has to be exchanged securely.
-Once compromised, the key can be used to decrypt both sent and received messages.
-Cannot ensure non-repudiation

Question 10

Differences between symmetric and asymmetric encryption.

Answer 10

-Symmetric cryptography uses a single key to encrypt and decrypt messages, Asymmetric cryptography uses two
-The symmetric key is shared, whereas with asymmetric, only the public key is shared (and the private key isn’t).
… the risk of compromise is higher with symmetric encryption and asymmetric encryption is more secure.
-Symmetric cryptography is a simple process that can be carried out quickly, but asymmetric is much more complex, so slower.
-The length of the keys in symmetric encryption are (usually) shorter than those for asymmetric (128/256 bits v 2048 bits)

Question 11

Purpose of quantum cryptography

Answer 11

-To produce a virtually unbreakable encryption system / send virtually unhackable secure messages…
-…using the laws / principles of quantum mechanics / properties of photons.
-Detects eavesdropping…
…because the properties of photons change.
-To protect the security of data transmitted over fibre optic cables.
-To enable the use of longer keys.

Question 12

what is the purpose of SSL and TLS?

Answer 12

-The SSL and TLS protocols provide communications security over the internet / network
… they provide encryption
-They enable two parties to identify and authenticate each other
… and communicate with confidentiality and integrity.

Question 13

Give three situations where SSL/TLS would be appropiate.

Answer 13

-banking
-online shopping
-private / secure email
-financial transactions
-secure file transfer
-instant messaging
-Using VPNs
-Using cloud storage facilities.

Question 14

What are three differences between SSL and TLS?

Answer 14

-It is possible to extend TLS by adding new authentication methods.
-TLS can make use of session ching which improves the overall performance of the computer compared to using SSL.
-TLS separate the handshaking process from the record protocol layer.

Question 15

WHat does secure socket layer do?

Answer 15

-Encrypts the data when the user logs onto a website.
…Only the client’s computer and the web server are able to make sense of what is being transmitted.
-Data compression
-Data integrity checks

Question 16

Explain the record and handshake layers in TLS.

Answer 16

-Record layer: Can be used with or without encryption; it contains the data being transmitted over the internet.

-Handshake protocol: Before data is transmitted over the internet a handshake takes place. Agreeing security parameters, etc.. Permits the web server and client to authenticate each other and make use of encryption algorithms.

Question 17

Exaplain session caching in TLS.

Answer 17

Avoids the need to utilise computer time during each TLS connection; TLS can either initiate new sessions or resume existing sessions; the latter can save considerable computer time.

Question 18

How does TLS work?

Answer 18

-A protocol with two layers
…handshake and record layers
-A TLS/digital certificate is used for authentication.
-Handshake uses asymmetric cryptography
…to generate agreed parameters
… establish a shared session key
-The shared session key provides symmetric cryptography for sending a receiving data (redcord layer).
-At the end of the session, all the parameters, keys, etc are erased.

Question 19

Describe the type of activity where SSL or TLS would be used.

Answer 19

-A client
… is accessing a website
… and needs to communicate with the website
… without the possibility of the communication being intercepted or scrutinised by an unauthorised party.
…because sensitive data is being transferred.

Question 20

Problems that SSL/TLS helps to overcome

Answer 20

-Security: alteration of transmitted messages.
-Privacy: only intended receiver can view data.
-Authentication: trust in another party.

Question 21

The sequence of steps describes what happens when setting up a secure connection using SSL.

Answer 21

-Browser requests that the server identifies itself.
-Server sends a copy of its SSL/digital certificate and its public key.
-Browser checks the certificate against a list of trusted certificate authorities.
-If the browser trusts the certificate, it creates, encrypts and sends the server a symmetric session key using a server’s public key.
-Server decrypts the symmetric session key using its private key.
-Server sends the browser an acknowledgement, encrypted with the session key.
–Server and browser now encrypt all transmitted data with the session key.

Question 22

what are 2 components in a digital certificate?

Answer 22

-Serial number
-Certificate Authority that issued certificate
-CA digital signature
-Name of company/organisation/individual/subject/owner owning
-Certificate
-‘Subject’ public key
-Period during which Certificate is valid // some relevant date

Question 23

How is a digtial certificate obtained?

Answer 23

-A user starts an application for a digital certificate using their computer. On this computer a key pair is generated. This key pair consists of a public key and an associated private key.

-The user submits the application to the CA for the CA to check.

-If the CA verifies the application details. The public key (private key is never sent) and other application data are sent. The key and data are encrypted using the CA’s public key (so the CA can decrypt with their private key).

-The CA creates a digital document containing all necessary data items and signs it using the CA’s private key. (establishes the signature is from the CA)

-The CA sends the digital certificate to the individual.

Question 24

WHat is the purpose of a digital Signature?

Answer 24

-To ensure a document is authentic // came from a trusted source.
-To ensure a document has not been altered during transmission.
-Non-repudiation.

Question 25

Exaplain how we can use a digital signature to ensure a message is authentic

Answer 25

-A’s message is encrypted using B’s public key.
-A’s hashing algorithm is used on the message to produce the message digest.
-The message digest is then encrypted with A’s private key to provide a digital signature.
-Both the encrypted message and the digital signature is sent.
-The message is decrypted with B’s private key.
-A’s digital signature is decrypted with A’s public key to obtain the message digest.
-A’s hashing algorithm recreates the message digest from the decrypted message.
-The two message digests are compared, if they are the same then the message should be authentic / has not been tampered.