Cryptographic Solutions Flashcards
DES (Data Encryption Standard)
Symetric, Block cypher
Widely used from the 1970s to the early 2000s
Triple DES (3DES)
Symetric, Block cypher
Provides 112-bit key strength but is slower than DES
IDEA (International Data Encryption Algorithm)
Symetric, Block cypher
Not as widely used as AES
AES (Advanced Encryption Standard)
Symetric, Block cypher
■ Replaced DES and 3DES as the US government encryption standard
■ Widely adopted and considered the encryption standard for sensitive
unclassified information
Blowfish
Symetric, Block cypher
Developed as a DES replacement but not widely adopted
Twofish
Symetric, Block cypher
Open source and available for use
RC Cipher Suite (RC4, RC5, RC6)
Symetric, Block cypher
■ RC4 is a stream cipher with variable key sizes from 40 to 2048 bits, used in SSL
and WEP
■ RC5 is a block cipher with key sizes up to 2048 bits
■ RC6, based on RC5, was considered as a DES replacement
Diffie-Hellman
Asymetric
● Used for key exchange and secure key distribution
● Vulnerable to man-in-the-middle attacks, requires authentication
● Commonly used in VPN tunnel establishment (IPSec)
RSA (Ron Rivest, Adi Shamir, Leonard Adleman)
Asymetric
● Used for key exchange, encryption, and digital signatures
● Relies on the mathematical difficulty of factoring large prime numbers
● Supports key sizes from 1024 to 4096 bits
● Widely used in organizations and multi-factor authentication
Elliptic Curve Cryptography (ECC)
Asymetric
● Efficient and secure, uses algebraic structure of elliptical curves
● Commonly used in mobile devices and low-power computing
● Six times more efficient than RSA for equivalent security
MD5 (Message Digest Algorithm 5)
Hashing
● Limited unique values, leading to collisions
● Not recommended for security-critical applications due to vulnerabilities
SHA (Secure Hash Algorithm) Family
Hashing
● SHA-1
○ Produces a 160-bit hash digest, less prone to collisions than MD5
● SHA-2
○ Offers longer hash digests (SHA-224, SHA-256, SHA-348, SHA-512)
● SHA-3
○ Uses 224-bit to 512-bit hash digests, more secure, 120 rounds of
computations
RIPEMD (RACE Integrity Primitive Evaluation Message Digest)
Hashing
Open-source competitor to SHA but less popular
HMAC (Hash-based Message Authentication Code)
Hashing
Utilizes other hashing algorithms (e.g., HMAC-MD5, HMAC-SHA1,
HMAC-SHA256)
Digital Signatures
■ Uses a hash digest encrypted with a private key
■ Sender hashes the message and encrypts the hash with their private key
■ Recipient decrypts the digital signature using the sender’s public key
■ Verifies integrity of the message and ensures non-repudiation
Common Digital Signature Algorithms
■ DSA (Digital Security Algorithm)
■ RSA (Rivest-Shamir-Adleman)
● Supports digital signatures, encryption, and key distribution
● Widely used in various applications, including code signing
Common Hashing Attack
Pass the Hash
A hacking technique that allows the attacker to authenticate to a remote
server or service by using the underlying hash of a user’s password
instead of requiring the associated plaintext password
Common Hashing Attack
Brithday Attack
Occurs when two different messages result in the same hash digest
(collision)
Increasing Hash Security
Key Stretching
● Technique that is used to mitigate a weaker key by creating longer, more
secure keys (at least 128 bits)
● Used in systems like Wi-Fi Protected Access, Wi-Fi Protected Access
version 2, and Pretty Good Privacy
Increasing Hash Security
Salting
● Adds random data (salt) to passwords before hashing
● Ensures distinct hash outputs for the same password due to different
salts
● Thwarts dictionary attacks, brute-force attacks, and rainbow tables
Increasing Hash Security
Nonces (Number Used Once)
● Adds unique, often random numbers to password-based authentication
processes
● Prevents attackers from reusing stolen authentication data
● Adds an extra layer of security against replay attacks
Key Escrow
■ Storage of cryptographic keys in a secure, third-party location (escrow)
■ Enables key retrieval in cases of key loss or for legal investigations
Digital Certificates
■ Digitally signed electronic documents■ Bind a public key with a user’s identity
■ Used for individuals, servers, workstations, or devices
■ Use the X.509 Standard
Wildcard Certificate
● Allows multiple subdomains to use the same certificate
● Easier management, cost-effective for subdomains
● Compromise affects all subdomains
