Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISSP > Chapter 7: PKI and Cryptographic Applications > Flashcards

Chapter 7: PKI and Cryptographic Applications Flashcards

1
Q

If Dylan and Alexa are using PKI, and Dylan wants to send Alexa an encrypted message, which key would he use to encrypt the message? Which key decrypts the message?

A

Sender encrypts using receiver’s public key
Receiver decrypts using their private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

RSA

A

The most famous public key cryptosystem
Based on the difficulty of factoring operations
Uses two large prime numbers (approx 200 digits each) labeled p and q, which are multiplied together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

ElGamal

A

Public key cryptosystem that is essentially an extension of Diffie-Hellman key exchange
Major disadvantage- algorithm doubles the size of any message that it encrypts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

ECC

A

Elliptic Curve Cryptography
Involves points on a curve, I don’t understand the math but here’s a good analogy:
“Imagine one person plays our game alone in a room for a random period of time. It is easy for him to hit the ball over and over following the rules described above. If someone walks into the room later and sees where the ball has ended up, even if they know all the rules of the game and where the ball started, they cannot determine the number of times the ball was struck to get there without running through the whole game again until the ball gets to the same point. Easy to do, hard to undo.”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Diffie-Hellman

A

Key exchange algorithm that allows two individuals to generate a shared secret key over an insecure communications channel.
Each party agrees on two large numbers, performs calculations on them using random integers, then exchanges the results. When they perform a calculation on the results, they should each get the same result, which can be used as the secret key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Quantum Computing

A

Theory that we can use principles of quantum mechanics to replace binary 1 and 0 bits with multidimensional quantum bits called qubits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Quantum Supremacy

A

The potential that quantum computers may be able to solve problems that are not possible for current computers to solve, rendering popular cryptographic algorithms insecure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the five basic requirements for a cryptographic hash function?

A

The input can be of any length.
The output has a fixed length.
The hash function is relatively easy to compute for any input.
The hash function is one-way.
The hash function is collision resistant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SHA-1

A

Hashing algorithm no longer considered secure
Produces a 160-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Message digest

A

Another name for the output value derived from hashing function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SHA-256

A

SHA-2 variant
Produces a 256-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SHA-224

A

SHA-2 variant
Produces a 224-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SHA-512

A

SHA-2 variant
Produces a 512-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

SHA-384

A

SHA-2 variant
Produces a 384-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

SHA-3

A

Developed to serve as a replacement for SHA-2. Offers the same variants and hash lengths but uses a different algorithm. Provides same level of security, but is slower than SHA-2 so not commonly used.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

MD5

A

Hash algorithm developed by Ronald Rivest (the R in RSA)
Uses four distinct rounds of computation to produce a 128-bit message digest
Cryptanalytic attacks demonstrated that MD5 is subject to collisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

RIPEMD

A

128-bit message digest, no longer secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RIPEMD-128

A

Replaced RIPEMD, also uses 128-bit message digest, also no longer secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

RIPEMD-160

A

Replacement for RIPEMD-128 that remains secure today
160-bit message digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

RIPEMD-256

A

256-bit message digest, but with equivalent security to 128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

RIPEMD-320

A

320-bit message digest, but with equivalent security to 160

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the two distinct goals of digital signature infrastructures?

A

Enforce nonrepudiation
Assure the recipient that the message was not altered in transit (whether intentionally or because of faults in the process)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

If you want to encrypt a confidential message, use ____

A

The recipient’s public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

If you want to decrypt a confidential message sent to you, use ___

A

Your private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

If you want to digitally sign a message you are sending to someone else, use ____

A

Your private key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

If you want to verify the signature on a message sent by someone else, use ___

A

The sender’s public key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

HMAC

A

Hashed Message Authentication Code
To be combined with any standard hashing algorithm by using a shared secret key. This provides integrity, but does not provide nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Digital Signature Standard (DSS)

A

NIST standard that specifies that all federally approved digital signature algorithms must use the SHA-3 hashing functions
Also specifies which encryption algorithms can be used to support digital signature infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which three encryption algorithms are approved for federal use to support digital signature infrastructure?

A

DSA- The Digital Signature Algorithm
RSA
ECDSA- Elliptic Curve DSA

30
Q

Certificate

A

Essentially an endorsed copy of an individual’s public key, signed by a trusted certificate authority

31
Q

X.509

A

International standard that governs digital certificates

32
Q

What data do certificates that conform to X.509 contain?

A

Version of X.509
Serial number
Signature algorithm identifier
Issuer name
Validity period
Subject’s name
Subject’s public key

33
Q

Wildcard Certificate

A

Certificate indicating that the certificate is good for subdomains as well.
Only good for one level of subdomain.

34
Q

Certificate Authorities (CA)

A

Offer notarization services for digital certificates. To obtain a digital certificate from a reputable CA you must prove your identity to the satisfaction of the CA.

35
Q

Registration Authorities (RA)

A

Assist CAs with verifying users’ identities prior to issuing digital certificates

36
Q

How do certificate authorities usually protect their root certificate?

A

Using an offline CA, which is disconnected from networks and powered down until it is needed

37
Q

Certificate Chaining

A

Root CA uses a series of intermediate CAs to protect root certificate

38
Q

Certificate Signing Request (CSR)

A

In the enrollment phase, once you’ve asserted your identity, you provide the CA with your public key, which the CA then adds to a X.509 certificate

39
Q

Domain Validation (DV) Certificate

A

CA simply verifies that the certificate subject has control of the domain name

40
Q

Extended Validation (EV) Certificate

A

Provides a higher level of assurance than DV, CA takes steps to verify that the certificate owner is a legitimate business before issuing the certification

41
Q

What steps are taken to verify a digital certificate?

A

Check the CA’s digital signature using the CA’s public key
Check the validity period of the certificate
Check that the certificate was not revoked using a certificate revocation list (CRL) or the Online Certificate Status Protocol (OCSP)

42
Q

Certificate Pinning

A

Instructs browsers to attach a certificate to a subject for an extended period of time. Browser associates site with their public key.
This allows users or administrators to take notice and intervene if a certificate unexpectedly changes

43
Q

Certificate Revocation Lists (CRLs)

A

Maintained by the various CAs and contain the serial numbers of certificates that have been issued by a CA and that have been revoked and with the date revocation went into effect

Major disadvantage- must be downloaded and cross-referenced periodically, so could miss notification of a revoked certificate

44
Q

OCSP

A

Online Certificate Status Protocol
Provides a means for real-time certificate verification. When a client receives a certificate, it sends OCSP request to the CA’s OCSP server.

45
Q

Certificate Stapling

A

An extension of OCSP that removes some of the overhead of making OCSP requests every single time a certificate is received. Instead, the web server attaches a signed and timestamped response from the CA to the certificate after one user request, then reuses that stapled certificate for the next user, etc.
Stapled certificates typically have a validity period of 24 hours and can reduce millions of requests per day to just one.

46
Q

Distinguished Encoding Rules (DER) format and extensions

A

The most common binary format for certificates
Normally stored with .der, .crt, or .cer extensions

47
Q

Privacy Enhanced Mail (PEM) format and extensions

A

ASCII text version of DER format.
Normally stored with .pem or .crt extensions

48
Q

Personal Information Exchange (PFX)

A

Binary certificate format typically used by Windows systems
Uses .pfx and .p12 file extensions

49
Q

P7B

A

ASCII text format certificates used by windows
Uses .p7b extension

50
Q

Ephemeral Key

A

Shared private key that is used once between parties as part of a hybrid cryptography set up. Asymmetric cryptography used to set up initial communication to conduct a secure key exchange, then switch to using the ephemeral key for faster communication.

51
Q

TPM

A

Trusted Platform Module
Chip that resides on motherboard of devices and handles the storage and management of keys used for full-disk encryption

52
Q

PGP

A

Pretty Good Privacy
Encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications.

53
Q

S/MIME

A

Secure/Multipurpose Internet Mail Extensions protocol
De facto standard for encrypted email
Uses the RSA encryption algorithm

54
Q

TLS

A

Transport Layer Security
Creates secure communications channels that remain open for an entire web browsing session.
Important: not an encryption algorithm itself; it’s a framework within which other encryption algorithms may function

55
Q

Summarize how TLS works

A

When user accesses a website, browser retrieve’s web server’s certificate and extracts server’s public key
Browser creates a random symmetric key (ephemeral key), uses server’s public key to encrypt it, then sends it to the server
Server decrypts the ephemeral key using its private key, then the two systems exchange all future messages using the symmetric encryption key

56
Q

How does Tor anonymously route traffic across the internet?

A

Perfect forward secrecy. Layers of encryption prevent nodes in the relay chain from reading anything other than the specific information they need to accept and forward the traffic.

57
Q

How does steganography work?

A

Modifies the least significant bit of a pixel value. This allows messages to be hidden within files without altering the image

58
Q

Link Encryption

A

All data, including header, trailer, address, and routing data, is encrypted. Each packet has to be decrypted at each hop so it can be properly routed and then reencrypted. Slows routing.

59
Q

End-to-end Encryption

A

Protects communications between two parties but does not encrypt the header, trailer, address or routing data. Moves faster from point to point but is more susceptible to sniffers and eavesdroppers.

60
Q

IPSec

A

A standard architecture for setting up a secure channel to exchange information between two entities. Two main components:
Authentication Header
Encapsulating Security Payload

61
Q

Authentication Header

A

Provides assurances of message integrity and nonrepudiation
Also provides authentication and access control and prevents replay attacks

62
Q

Encapsulating Security Payload

A

Provides confidentiality and integrity of packet contents
Provides encryption and limited authentication and prevents replay attacks

63
Q

What are IPSec’s two modes of operation?

A

Transport mode- end-to-end encryption (only packet payload encrypted)
Tunnel mode- entire packet, including header, is encrypted

64
Q

Security Association

A

Used in IPSec, represents the communication session and records any configuration and status information about the session
You will need one two SAs for bidirectional communication
IPSec can be managed on a per-SA basis.

65
Q

Homomorphic Encryption

A

Encrypts data in a way that preserves the ability to perform computation on that data

66
Q

Analytic Attack

A

Cryptographic attack. Algebraic manipulation that attempts to reduce the complexity of the algorithm. Focuses on the logic of the algorithm itself.

67
Q

Implementation Attack

A

Exploits weaknesses in the implementation of a cryptography system. Focuses on exploiting the software code, not just errors and flaws but the methodology employed to program the encryption system.

68
Q

Statistical Attack

A

Exploits statistical weaknesses in a cryptosystem, such as floating-point errors and inability to produce truly random numbers
Attempt to find a vulnerability in the hardware or operating system hosting the cryptography application

69
Q

Brute-Force Attack

A

Attempts every possible valid combination for a key or password. Uses massive amounts of processing power to methodically guess the key used to secure communications

70
Q

Fault Injection Attack

A

Attacker attempts to compromise the integrity of a cryptographic device by causing some type of external fault. Might use high-voltage electricity, high or low temperatures, etc to cause a malfunction

71
Q

Side-Channel Attack

A

Use information such as changes in processor utilization, power consumption, electromagnetic radiation, etc to monitor system activity and retrieve information that is actively being encrypted

72
Q

Timing Attack

A

Attacker measures precisely how long cryptographic operations take to complete, gaining information about the cryptographic process that may be used to undermine its security

CISSP (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions