Cryptography Flashcards
(56 cards)
1
Q
What is the Caesar Cipher?
A
- Simple substitution cipher
- ROT3 (rotate 3 spaces to the right)
2
Q
What is the main problem with substitution ciphers?
A
Subject to pattern (frequency) analysis
3
Q
What is Scytale?
A
Ancient Greek cipher. Tape wrapped around a horizontal rod, and message written across the tape.
Diameter of the rod has to be pre-agreed or you can’t read the message.
4
Q
What is Vignere?
A
Polyalphabetic cypher (grid with alphabet horizontally and vertically, and different alphabet variations across each row). Find the character from the cyphertext horizontally, then find the character from the key word vertically.
Keyword agreed out-of-bounds
5
Q
What is Enigma / Purple
A
6-rotor machine. Config of rotors agreed out-of-bounds.
6
Q
What is Vernam cipher?
A
- One time pad
- Mathematically unbreakable
- Pad must be as long as the message
- Pad must be securely distributed and only used once
- A one-time-password (OTP) is a vernam cipher
7
Q
What properties are we trying to achieve through cryptography?
A
PAIN.
Privacy
Authenticity
Integrity
Non-repudiation
8
Q
What things are involved in converting plaintext to cyphertext?
A
Plaintext
+ initialization vector
+ algorithm (cipher)
+ key
= Ciphertext
9
Q
What are initialization vectors?
A
Random starting value.
Adds randomness by changing the starting value.
Like salt in password hashes
10
Q
What are algorithms?
A
- Collection of maths functions.
- Should use string and complex maths for substitution- Should be open (Kerckhoff’s principle)
- Each function is an s-box
- Key length is a trade-off between performance & value of asset (amount of security required)
11
Q
What are the pros of symmetric cryptography?
A
- Fast data transfer
- Good strong privacy
12
Q
What are the cons of symmetric cryptography?
A
- Out-of-band key distribution
- Doesn’t scale well
- Doesn’t provide non-repudiation
13
Q
What are the other names for a symmetric key?
A
- Secret
- Shared key
- Private key (do not confuse with asymmetric private key)
- Session key
14
Q
What are the 2 types of symmetric ciphers?
A
- Stream
- Block
15
Q
What is the formula for determining how many unique symmetric keys are needed to communicate securely?
A
(n * (n-1)) / 2
16
Q
What properties does symmetric encryption provide and not provide?
A
Provides: privacy
Does not provide: integrity, authenticity or non-repudiation
17
Q
What do we know about stream ciphers?
A
- Encrypt 1 bit (up to 1 byte) at a time
- Use transposition, substitution, XOR
- Very fast & efficient
- Not as secure as block ciphers
- RC-4 is a stream cipher
18
Q
How to XOR?
A
- Alike bits = 0
- Different bits = 1
- (Only 1 1)
19
Q
What are the common symmetric algorithms (11)?
A
- DES
- 3DES
- AES
- RC-4
- RC-5
- Blowfish
- Twofish
- IDEA
- CAST
- MARS
- Skipjack
20
Q
Asymmetric cryptography: Process for proving authenticity?
A
- Encrypt message with recipient’s public key (for privacy)
- Encrypt something else (e.g. timestamp) with sender’s private key for authenticity. If it can be decrypted using the sender’s public key, it must have come from them.
21
Q
What are the properties of hashing?
A
- Also known as checksums, message digests
- Provides integrity
- Fixed-length output
- If the input changes, the hash will change
- One-way function
- 2 different plaintexts producing the same hash is a collision
22
Q
What is a birthday attack?
A
Attempt to cause collisions. Idea is that it is easier to find 2 hashes that match than to produce a specific hash.
23
Q
What are the popular hashing algorithms (6)?
A
- MD-5 128-bit
- SHA-1 160-bit
- SHA-2 256, 384, 512-bit
- HAVAL
- Tiger
- RipeMD
24
Q
How to achieve non-repudiation with hashing?
A
Encrypt hash with sender’s private key
25
How to achieve 'PAIN' properties with asymmetric cryptography?
Privacy - encrypt message with receiver's public key
Authenticity - Encrypt something (e.g. timestamp) with sender's private key
Integrity - Include hash / checksum / CRC of message
Non-repudiation - Encrypt hash with sender's private key
26
What are the common asymmetric algorithms?
- RSA
- DSA
- ECC
- El Gamal
- Diffie Hellman
- Knapsack
27
What is RSA?
- Asymmetric algorithm
- Replaced DSA (Digital Signature Algorithm)
- Current standard for digital signatures
- Uses factorisation (prime numbers)
28
What is Diffie Hellman?
- First asymmetric algorithm
- Secure key agreement without pre-shared secrets
- Based on discreet logarithms in a finite field
29
What is ECC?
- Elliptical Curve Cryptography
- Based on plotting points along a curve
- Very efficient but only applicable for key agreement, digital signatures pseudorandom generators & other tasks with small data
- Frequently used in handheld & small devices due to their limited processing capability
30
What are the main uses of symmetric & asymmetric cryptography?
Symmetric: bulk data encryption (files and communication)
Asymmetric: Key encryption & digital signatures
31
What services (properties) are provided by symmetric & asymmetric encryption?
Symmetric: Confidentiality (privacy)
Asymmetric: PAN - Confidentiality (privacy), authenticity, non-repudiation
32
What do we know about certificates?
- X.509 v4 standard
- Provides authenticity of a server's public key
- Necessary to avoid MITM attacks with servers using SSL/TLS
- Digitally signed by the Certificate Authority (CA)
33
PKI terms
- Certificate Authority (CA)
- Registration Authority (RA)
- Certificate Repository
- Certificate Revocation List (CRL)
- Online Certificate Status Protocol (OCSP)
34
How can integrity be achieved (3)?
- Hash - only good for accidental modification (because attacker can create new hash)
- Digital signatures - detects accidental & malicious modification , but requires PKI. Also provides non-repudiation. Asymmetric.
- MAC - Provides reasonable authenticity & integrity, but not string enough to provide non-repudiation (because symmetric).
35
What are the 2 types of Message Authentication Code (MAC)?
- HMAC: HashAlg(Message + Symmetric key)
- CBC MAC: Constructs MAC from block cipher (cipher block chaining)
36
What are algorithms for asymmetric key exchange/agreement?
- Diffie Hellman
- El Gamal
37
What are algorithms for symmetric data exchange?
- AES
- DES, 3DES
- Blowfish, Twofish
- IDEA (PGP)
- CAST
38
What algorithms are used for integrity (6)?
- MD-5
- SHA-1, SHA-2
- Tiger
- HAVAL
- RipeMD
39
What algorithms are used for asymmetric authenticity?
- RSA
- DSA
40
What algorithm can be used for non-repudiation?
SHA-1 RSA
41
What is IPSec?
- Provides the framework for services such as encryption, authentication, integrity (any or all of these)
- Provides encapsulation, not encryption
- What is encapsulated can be protected through the sub-protocols within IPSec
42
What are the IPSec modes?
- Tunnel mode: Whole IP packet is encrypted. Better security.
- Transport mode: Only IP payload encapsulated (not header, trailer). Less security, but better performance. Used on trusted local networks.
43
What are the IPSec sub-protocols
- Authentication Header (AH)
- Encapsulating Security Payload (ESP)
- Internet Key Exchange (IKE)
44
What is IPSec AH?
- Authentication Header (AH)
- Provides integrity, non-repudiation & authenticity through ICV (integrity check value), like a hash.
-ICV runs on static fields e.g. header, data, trailer. Does not run on dynamic fields e.g. TTL
- No confidentiality
- Doesn't work with NAT (because AH prevents address spoofing)
45
What is IPSec ESP?
- Encapsulating Security Payload
- Provides authenticity and integrity through MACs
- Does not provide non-repudiation because MACs are symmetric
- Provides encryption
- ICV is payload only
- Does work with NAT
46
Hash, Digital Signature, MAC - symmetric or asymmetric?
Digital signature - asymmetric
MAC - symmetric (therefore no non-repudiation)
Hash - neither (just an algorithm)
47
What is IPSec IKE?
- Internet Key Exchange
- No security services
- Manages secure connection, such as key negotiation
- Contains:
- Oakley: uses Diffie Hellman to agree on key
- ISAKMP (Internet Security Association & Key Management Protocol)
Manages keys, security associations (SAs), Security Parameters Index (SPIs)
48
What is an IPSec SA?
- Security Association
- Part of IKE
- Unique identifier for each secure session
- 2 SAs for each connection (1 incoming, 1 outgoing)
- Contains:
- Destination address
- SPI
- IPSec transform (AH, HMAC-MD5)
- Key
- Additional attributes e.g. lifetime (8 hours; 100MB; etc)
49
What is an IPSec SPI?
- Security Parameters Index
- Unique ID to differentiate between multiple sessions with same destination
- Used in IKE Security Association (SA)
50
What are the email cryptosystems?
- S/MIME (Secure Multipart Internet Mail Exchange)
- PGP (Pretty Good Privacy)
51
What is S/MIME?
- Secure Multipart Internet Mail Exchange
- Standards-based secure email by creating a digital envelope
- Sender:
- Hashes message
- Encrypts message with session key
- Encrypts hash with private key
- Encrypts session key with receiver's public key
- Receiver:
- Decrypts session key with private key
- Decrypts hash with sender's public key
- Decrypts message with session key
- Calcs hash value of message & compares to hash sent
52
What is PGP?
- Pretty Good Privacy
- Free but uses proprietary software (so users need the software)
- Uses web of trust
- Pass phrases instead of passwords
- Learned keys stored in a keyring (cached)
53
What are the main attacks on cryptography (5)?
- Ciphertext only
- Attacker has captured ciphertext
- Usually attacker has to brute-force
- Known plaintext
- Attacker captures ciphertext and knows option of plaintext
- E.g. standard email signature
- Chosen plaintext
- Attacker sees full text encrypted & decrypted
- Usually attacker initiates message (e.g. ambassador)
Chosen ciphertext
- Attacker can see whatever they want in plain or cipher
- e.g. compromised workstation ("lunchtime/midnight" attack)
Meet in the middle
- Attack on algorithms that use multiple keys (e.g. 3DES)
- Attacker tries to learn what each key does individually
54
What is the Meet-in-the-Middle attack?
For anything double-encrypted (e.g. C = Ek2(Ek1(P)), if you know the plaintext and ciphertext ...
Try every possible key to encrypt P and store the results.
Try every possible key to decrypt C and store the results.
Look for a match from each list - this would be Ek1(P), therefore you have identified both K1 and K2.
55
What type of attacks are polyalphabetic attacks vulnerable to?
Period analysis (because key is repeated).
56
What is a running key cipher
Book cipher. Usually a passage from a book.
