EXAM 1 Flashcards by Unknown Unknown

What is ciphertext

Message after transforming it with encryption

How well did you know this?

Not at all

Perfectly

What is Encryption?

Converting plaintext to ciphertext

How well did you know this?

Not at all

Perfectly

What is Decryption?

Restoring plaintext from ciphertext

How well did you know this?

Not at all

Perfectly

What is a Cipher?

The algo that can take plaintext and convert it to ciphertext, (it goes both ways)

How well did you know this?

Not at all

Perfectly

What is Cryptanalysis?

The science of breaking ciphers

How well did you know this?

Not at all

Perfectly

What is Cryptology?

Cryptography + Cryptanalysis

How well did you know this?

Not at all

Perfectly

How are encryption algorithms classified?

How do they convert plaintext to ciphertext
How many keys they require
How do they process the plaintext

How well did you know this?

Not at all

Perfectly

How do substitution ciphers work?

Replacing elements of plaintext, with elements of ciphertext

How well did you know this?

Not at all

Perfectly

How do Transposition ciphers work?

Shuffle the elements of the plaintext

How well did you know this?

Not at all

Perfectly

How do Product Ciphers work?

Combine Substitution, and Transposition

How well did you know this?

Not at all

Perfectly

What is Symmetric Encryption?

Single key used for encryption and decryption

How well did you know this?

Not at all

Perfectly

What is Asymmetric (public Key) cryptography?

Two-keys, one is used for encryption, the other is used for decryption.

How well did you know this?

Not at all

Perfectly

Asymmetric (public Key) cryptography is commonly used for…

session key distribution, and digital signatures.

How well did you know this?

Not at all

Perfectly

What is the difference between a block and stream cipher?

Stream does 1 by 1, block does multiple at a time.

How well did you know this?

Not at all

Perfectly

What are the security requirements for secure symmetric key cryptography?

Strong encryption algorithm,
Assumption that attacker knows knows the encryption algorithm
Trusted third party, to distribute the key

How well did you know this?

Not at all

Perfectly

What is Kerckhoff’s Principle?

Everything must remain secure even if the attacker knows everything EXCEPT the secret key.

How well did you know this?

Not at all

Perfectly

If an attacker finds, a secret message and modifies it what violation is it?

Integrity violation, Data integrity

How well did you know this?

Not at all

Perfectly

What is Data Integrity?

Assurance that data received is sent by someone trusted.

How well did you know this?

Not at all

Perfectly

What is origin integrity

The source of the data is trustworthy

How well did you know this?

Not at all

Perfectly

What is DAD?

Disclosure, Alteration, Destruction

How well did you know this?

Not at all

Perfectly

What three main aspects of security does ITU-T X.800 consider?

Services
Attacks
Mechanisms

How well did you know this?

Not at all

Perfectly

What is a Passive attack?

An attack that does not involve the modification of systems or data.

How well did you know this?

Not at all

Perfectly

What types of passive attacks are there?

Eavesdropping
Traffic Analysis

How well did you know this?

Not at all

Perfectly

How do we protect against traffic analysis?

Traffic padding

How well did you know this?

Not at all

Perfectly

Why are passive attacks so difficult to detect?

They don't involve any kind of tampering

What are types of active attacks?

Masquerade - Pretending to be someone else Replay - Data transmission gets repeated or delayed Message Modification Denial of Service

What is an active attack?

An attack that modifies systems or data

What is Traffic padding?

Putting bits into gaps in a data stream to make it difficult to figure out the amount of traffic

What are the three main elements of network security?

1. algorithm for security transformation 2. Generate secret keys 3. Distribute and share keys

What is the difference between the internet and the Web?

A web is a protocol. The internet refers to the entire infrastructure

What is a protocol?

A set of rules that govern communication

What is the primary objective of data classification? How does it relate to cryptography?

Securing data based on assigned level of importance and sensitivity it relates because Cryptography is used a defense mechanism for data

What is FIPS-140? What does it provide?

set of standards for designing and implementing modules that defend sensitive / classified data

For what type of government systems was FIPS-140 compliance designed for?

It was designed for data that is sensitive but unclassified

Describe the Top-Secret data category. What type of data does it contain? Give examples.

Nuclear secrets, locations of space satellites

Give some examples of FIPS-140 requirements

Finite State model Physical Security Operational Environment

What is the difference, between brute force and cryptanalytic attack?

Brute force tries every possible key, Cryptanalytic uses nature of algorithm AND some knowledge of the plaintext

what is a chosen-plaintext attack?

Attacker can encrypt any plaintext using the target encryption scheme.

What is ciphertext-only attack?

Stat techniques to discover the key or plaintext

what is a known-plaintext attack?

Has access to the cipher text and knows some properties of the plaintext

Describe the requirements and the basic building blocks of public cryptography

Two keys, public and private. Encrypt with public and use private to decrypt.

Is public key cryptography inherently more secure than symmetric key cryptography

No, public key is less efficient

What is the difference between the RSA and EC approaches to public key cryptography?

RSA is based on the difficulty of factoring large primes EC is based on Elliptical curves over finite fields

What is the Elliptic Curve Discrete Logarithm Problem (ECDLP)?

Find K given P and Q, on a curve where Q = kP

How can quantum cryptography theoretically threaten the security of public key schemes such as RSA?

Quantum computers in theory are able to solve RSA fast

What is a hash function?

one way function that takes a message and produces a fixed-size output

What is a hash function used for?

Used for message integrity, and Digital Signatures

What are the security requirements of the hash function?

1. Can work with any sized M 2. Produces fixed length output 3. Easy to compute hc 4. No repeating hash values

Describe the basic premise of a Birthday attack and be able to do simple probability calculations.

2^(n/2) give you 50% chance to find a match

How can the Birthday Paradox be used to crack hashes?

1. Generate 2^(n/2) random messages 2. Do any two messages produce the same hash? 3. Hash detected 4. If not go back to step 1.

What is the difference between a hash function and a MAC?

input is variable sized, One way function that computes the digest BASED ON a Secret Key,

Compare and contrast symmetric cryptography and a MAC function.

Symmetric: Length of plaintext varies so does length of cipher text Mac function always gives a digest of the same length, and are non invertible.

Why do we (ideally) need both link and end-to-end encryption?

Data is always protected, and our headers are still protected on the link

What is symmetric key distribution? Why is it important?

changing keys every time you start a new session, incase the previous was compromised

Explain the key hierarchy

Decentralized: each person needs a master key Centralized: Trusted third party only need N mater keys.

Why use symmetric master keys to distribute session keys?

It's a good idea to change session keys with every session

What are key components of Symmetric Needham-Shroeder Key Distribution protocol

A Asks, KDC Shares, A Forwards, B Responds, A Confirms.

Why does KDC echo Alice’s message in step (2)?

So Alice knows the session key is for her session with bob and it also has a Nonce

How does the protocol use nonces and time stamps to prevent replay attacks?

if checks if any nonces have been used before

Is Alice able to decrypt entire message from the KDC? Explain

No, she can only decrypt the first part that used her master key

What are the advantages of using a hierarchy of KDCs?

It reduces the load of any single KDC

Assume a key distribution scheme where Bob and Alice both share the symmetric master key MBA. To distribute the session key Alice generates the session key KS encrypts it using MBA and sends the message IDA || E(MBA,KS).

Vulnerable to a replay attack, no nonce or timestamp

Why use public key cryptography to distribute session keys? That is, why not just use public key encryption to send bulk data?

Public key cryptography is too slow.

Consider the Merkle Simple Key Distribution protocol. Is it secure? If so, explain how so and if not so, explain the flaw.

Not secure, There is no public key authenticity

Explain how distribution of symmetric keys using public keys can be combined with the Symmetric Key Needham Shroeder protocol for greater efficiency.

Use secure public to distribute master keys. After master keys are distributed use Needham to distribute session keys, we don't need public until we give out master keys again