Lesson 3: Explain Cryptographic Solutions Flashcards
1
Q
Define ‘Cryptography’
A
The science and practice of encoding or decoding data to make it unintelligible to unauthorized parties.
2
Q
Define ‘security through obscurity’
A
Keeping something a secret by hiding it.
3
Q
Define ‘Plaintext/Cleartext’
A
Unencrypted data.
4
Q
Define ‘Ciphertext’
A
Encrypted data that can’t be read without the cipher key.
5
Q
Define an ‘Algorithm’
A
Process that encrypts and decrypts data.
6
Q
Define ‘Cryptanalysis’
A
The science/practice of breaking ciphers and cryptographic systems.
7
Q
Define an ‘Encryption’ algorithm/cipher
A
Process that encodes data so that it can be stored or transmitted securely and then decrypted only by its owner or its intended recipient.
8
Q
Define a ‘key’ in cryptography
A
Specific piece of data that is used in an algorithm to perform encryption and decryption.
9
Q
What are the two types of encryption algorithms?
A
- Symmetric
- Asymmetric
10
Q
Define a ‘substitution’ cipher/algorithm
A
Replacing characters or blocks in the plaintext with different text or ciphertext.
11
Q
Define a ‘Transposition’ cihper/algorithm
A
The units of data stay the same, but their order is changed depending on the mechanism.
12
Q
Define ‘Symmetric Encryption’
A
Shared-key encryption; Two-way encryption process in which encryption and decryption are both performed by the same key.
13
Q
What is the benefit of symmetric encryption?
A
Used for bulk encryption of large amounts of data due to its speed; Very fast
14
Q
What is the security risk in symmetric encryption?
A
The transmission/receipt of the shared-key; Security is broken if the key is intercepted along with the cipher text.
15
Q
Define ‘key length’
A
Size of a cryptographic key in bits; Longer keys generally offer better security and are harder to crack with brute force.
16
Q
What is the downside to using larger encryption keys?
A
The computer must use more resoruces to perform encryption and decryption.
17
Q
Define ‘Asymmetric Encryption’
A
One-way encryption; Cipher that uses public and private keys mathematically linked by RSA or ECC algorithms;
18
Q
What is the difference between asymmetric encryption and symmetric encryption?
A
An asymmetric key cannot reverse the operation it performs; The public key cannot decrypt what it has encrypted and vise versa.
19
Q
What is the function of the public key in asymmetric encryption?
A
Key is freely distributed and can be used to perform reverse encryption or decryption operation of the linked private key in the pair.
20
Q
What is the function of the private key in asymmetric encryption?
A
Uniquely associated with the owner and is not made public; Used to encrypt data that can be decrypted by the linked public key or vice versa.
21
Q
What is a downfall of asymmetric encryption?
A
Involves substantial computing overhead compared to symmetric encryption and is inefficient for large amounts of data.
22
Q
How can the overhead from asymmetric encryption be mitigated with large amounts of data?
A
Asymmetric encryption can be used to encrypt a symmetric key that was used to encrypt data before transmitting the data.
23
Q
Define ‘cryptographic hashing’ algorithms
A
One-way encryption that produces a fixed-length string of bits from a plaintext input.
24
Q
What does a hashing algorithm produce?
A
The output is a ‘hash’ or ‘message digest’
25
What is the typical function/purpose of hashing algorithms?
To prove integrity; Ensure that data has not been manipulated in transmission/receipt/storage and for authentication.
26
What are the two popular hashing algorithms?
1. Secure Hash Algorithm (SHA)
2. Message Digest Algorithm #5 (MD5)
27
Define 'Secure Hash Algorithm (SHA)'
Replacement for message digest algorithm (MDA); Considered strongest - most popular is SHA256 producing a 256-bit digest.
28
Define 'Message Digest Algorithm #5 (MD5)'
Considered not as safe as SHA256; Produces a 128-bit digest.
29
Define a 'cryptographic primitive'
A single hash function, symmetric cipher, or asymmetric cipher.
30
Define a 'complete cryptographic system/product'
The use of multiple cryptographic primitives within a cipher suite.
31
What two forms of cryptography combine to create a digital signature?
Combines Asymmetric encryption for confidentiality to authenticating the sender with hashing to provide integrity.
32
What is 'Public Key Infrastructure (PKI)'
Framework that establishes trust in the use of public key cryptography to sign and encrypt messages via digital certificates.
33
What is the purpose of Public Key Infrastructure (PKI)?
To prove the owners of public keys are who they say they are.
34
Define a 'Digital Certificate'
A public assertion of identity, authenticated by a certificate authority (CA) that contains a subjects public key.
35
Define a 'certificate authority (CA)'
A server that guarantees subject identities by issuing signed digital certificate wrappers for their public keys.
36
What is a 3rd party certificate authority (CA)?
A public CA that issues certificates for multiple domains; Widely trusted as a root trust by operating systems and browsers.
37
What purpose of a 3rd party public CA?
1. Provide a range of cert services.
2. Ensure the validity of certs and the identity of those applying for them.
3. Manage the repositories that store and administer certs.
4. Key and cert lifecycle management (revoking invalid certs).
38
How does a subject generate a certificate from a public 3rd party root CA?
1. Register to the CA to prove identity
2. Generate a cert signing request (CSR) from a webserver containing the public key and submit the CSR to CA for validation
3. CA generates a signed cert with the public key and sends to subject.
4. Publishing of cert in webservice manager (IIS/Apache/other)
39
Define a 'digitally signed certificate'
Proof that a cert was validly issued to a subject (user/host) by a public 3rd party root CA.
40
When going to a URL, how does the client verify identity?
1. Client checks web server's certificate and validates that it is signed by a trusted CA.
41
What is packaged in a digitally signed cert?
Information identifying the subject and the public key authenticating the connection presented in X.509 format, and digital signature from the issuing CA.
42
Define a 'root certificate/trusted root'
Pre-installed self-signed cert and public key from a CA.
43
What is the purpose/function of a root certificate?
Issues signed certificates to intermediate CAs; Sign other certificates issued by the CA;
44
How do clients trust a public 3rd party root CA?
1. CA generates a root certificate, signs it with private key, and publishes it with the public key.
2. Client obtains CA's certificate and adds it to a store of trusted root certificates.
45
What is the outcome of installing a CA's root certificate?
Host will automatically trust any certificates signed by that CA.
46
Define a 'Single CA' model
Single root CA issues certificates directly to users and computers; Often used on private networks.
47
What is the shortcoming of the single CA model?
Single CA server is exposed; If it is compromised the whole PKI collapses.
48
Define the '3rd party CA model'
Hierarchical model where the root CA issues certs to one or more intermediate CAs; The intermediate CAs issue certs to subjects (end entities).
49
Define 'certificate chaining' or 'chain of trust'
Method of validating a certificate by tracing each CA that signs the certificate, up through the hierarchy to the root CA.
50
Define a 'Self-signed Certificate'
A digital certificate that has been signed by the entity that issued it (any machine, webserver or code), rather than by a CA.
51
What is the process to register with a CA?
End users create an account with the CA and become authorized to request certificates.
52
What is the contents of a 'certificate signing request (CSR)'?
A Base64 ASCII file containing the information that the subject wants to use in the certificate, including its public key.
53
Define a 'common name (CN)'
X.500 certificate identifier expressing a host or username; The subject identifier for a digital certificate.
54
Define a 'subject alternative name (SAN)'
X.500 certificate identifier allowing a host to be represented by multiple host names/subdomains.
55
What takes precedence in a certificate, a subject alternative name (SAN) or common name (CN)?
If a certificate is configured with a SAN, the browser should validate that and ignore the CN value.
56
Define a 'wildcard certificate'
A digital certificate that will match multiple subdomains of a parent domain using a '*' as the subdomain before the parent domain (*.comptia.org)
57
What are the two types of invalid certificates?
1. Revoked - no longer valid and can't be unrevoked
2. Suspended and can be reenabled
58
Define a 'certificate revocation list (CRL)'
A list maintained by a CA of all revoked and suspended certificates.
59
What is the purpose of a certificate revocation list (CRL)?
To inform users whether a certificate is valid, revoked, or suspended.
60
Where can a certificate revocation list (CRL) be found for browsers to check validity of certs?
Each certificate should contain information for the browser on how to check the CRL.
61
What are the 4 attributes of a certificate revocation list (CRL)?
1. Publish Period
2. Distribution Points
3. Validity Period
4. Signature
62
Define the 'Publish Period' attribute of a certificate revocation list (CRL)
Date and time at which the CRL is published. Most CAs are set up to publish the CRL automatically.
63
Define the 'Distribution Point(s)' attribute of a certificate revocation list (CRL)
Location(s) to which the CRL is published.
64
Define the 'Validity Period' attribute of a certificate revocation list (CRL)
Period during which the CRL is considered authoritative. This is usually a bit longer than the publish period
65
Define the 'Signature' attribute of a certificate revocation list (CRL)
CRL is signed by the CA to verify its authenticity.
66
Define an 'Online Certificate Status Protocol (OCSP)' server
Allows clients to request the status of a digital certificate by querying the certificate database directly instead of relying on a CRL.
67
Define 'Key management'
Operational considerations for the various stages in a key's lifecycle.
68
What are the 4 stages in a key's lifecycle?
1. Key Generation
2. Storage
3. Revocation
4. Expiration/Renewal
69
Define the 'Key Generation' stage in the key management lifecycle
Creating an asymmetric key pair or symmetric secret key
70
What is the purpose of the 'Storage' stage in the key management lifecycle
Prevents unauthorized access to a private/secret key and protecting against loss or damage.
71
Define the 'Revocation' stage in the key management lifecycle
Prevents use of the key if it is compromised.
72
What is best practice if a key is revoked?
Re-encrypt any data encrypted by the revoked key with a new key.
73
Define the 'Expiration and Renewal' stage in the key management lifecycle
Every certificate expires after a certain period; Certificates can be renewed with the same key pair or with a new key pair.
74
Define a decentralized key management model
Keys are generated and managed directly on the computer or user account that will use the certificate.
75
Define a key management system
Centralizes generation and storage of cryptographic keys.
76
Define 'Key Management Interoperability Protocol (KMIP)'
Client/server communication protocol for the storage and maintenance of key, certificate, and secret objects.
77
How are cryptographic keys generated?
Generated using a random process with a high degree of disorder.
78
Define 'entropy'
A measure of disorder; Cryptographic systems should exhibit high entropy to better resist brute force attacks.
79
What is the drawback of generating a key pair or secret key on a host running general purpose OS?
Computer hardware and software is extremely low entropy.
80
What two technical controls can be implemented to ensure strong key generation?
pseudo RNG (PRNG) software and true random number generator (TRNG) hardware.
81
Define 'pseudo RNG (PRNG) software'
Software that is still deterministic, but able to approximate a high level of disorder
82
Define 'true random number generator (TRNG) hardware'
Generates random key values by sampling physical phenomena (noise/air movement) that has a high rate of entropy.
83
What is the drawback of storing a key pair or secret key on a host/file system running general purpose OS?
Could easily be compromised via user credential or physical theft of the device; Difficult to ensure that key access is fully audited.
84
What is best practice to securly monitor cryptographic keys?
Tamper evident; Immediately known when a private/secret key has been compromised.
85
Define a 'cryptoprocessor'
Dedicated hardware for key generation and storage and can decrypt and sign on behalf of applications.
86
What is the security benefit of a cryptoprocessor?
Creates smaller attack surface for key management because key material never leaves the cryptoprocessor.
87
What are the two main implementations of cryptoprocessor hardware?
1. Trusted Platform Module (TPM)
2. Hardware security module (HSM)
88
Define a 'Trusted Platform Module (TPM)'
Implemented as a module within the CPU on a computer or mobile device.
89
Define a 'Hardware security module (HSM)'
Implemented in a removable or dedicated form factor, including rack-mounted appliances, plug-in PCIe adapter cards, and USB-connected security keys; Can be provisioned as a virtual appliance.
90
How does a cryptoprocessor decrease attack surface?
Keys are not directly accessible via the file system.
91
How do cryptoprocessors interact with applications that need to access a key?
Via an application programming interface (API)
92
Define an 'Application programming interface (API)'
Mechanisms that enable two software components to communicate with each other using a set of definitions and protocols.
93
What is the mechanism implemented to mitigate vulnerabilities in cryptoprocessors?
A trusted execution environment (TEE) secure enclave
94
Define a 'trusted execution environment (TEE) secure enclave'
CPU extensions that protects data stored in system memory so that an untrusted process cannot read it.
95
What is a vulnerability with cryptoprocessors?
Decrypted data needs to be loaded into the computer's system memory (RAM) for applications to access it raising the potential for a malicious process to gain access to the data via some type of exploit.
96
How do secure enclaves (Trusted Execution Environments, TEEs) protect API's moving data from a cryptoprocessor to another application?
Only authorized processes can have access, regardless if it has system/root privilege.
97
What is the result of a misplaced/damaged cryptographic key?
Ciphertexts cannot be recovered unless a backup of the key has been made.
98
Why is it against best practice to make backups of private keys or secret keys?
Problematic as it becomes more likely that a copy will be compromised and more difficult to detect that a compromise has occurred.
99
What are controls to mitigate issues of making copies of a private key/secret key?
1. Escrow
2. M of N controls
100
Define 'Escrow' in key management
The storage of a backup key with a third party.
101
Define 'M of N controls' in key management
An operation cannot be performed by a single individual; A quorum (M) of available persons (N) must agree to authorize the operation.
102
How can risks of a compromised private key be reduced?
Splitting the key in to parts, and each part being held by sperate escrow providers.
103
Define a 'key recovery agent (KRA)'
An account authorized to access a key held in escrow.
104
What should be included in a key recovery policy to mitigate impersonation?
Require two or more KRAs to authorize an operation.
105
How does encryption fulfill the goal of confidentiality?
Threat actor will not be able to understand or change what has been stolen.
106
List the 3 states data can be described as?
1. Data at rest
2. Data in transit
3. Data in use
107
Define 'Data at rest'
When the data is in some sort of persistent storage media.
108
Define 'Data in transit'
Data transmitted between two hosts, such as over a private network or the Internet.
109
Define 'Data in use'
Data present in volatile memory, such as system RAM or CPU registers and cache.
110
Define 'bulk encrypton'
Encrypting megabytes or gigabytes of data.
111
What encryption method is best suited for bulk encryption?
Symmetric encryption due to overhead of asymmetric.
112
Define an 'encryption level'
Depth of encryption; Ranging from more granular (file/folder or row/record) to less granular (volume/partition/disk or database).
113
Define 'Full-disk encryption (FDE)'
Disk/Drive firmware that encrypts the full contents of a storage device, including metadata, free space.
114
What is the purpose of Full-disk encryption (FDE)?
Protects against physical theft of the disk.
115
What is a software/firmware alternative to Full-disk encryption (FDE)?
A self-encrypting drive (SED).
116
Define a 'A self-encrypting drive (SED)'
Storage device (SSD/HDD/USB) with cryptoprocessor firmware that can perform self-encryption and storage of keys.
117
Define a 'volume'
Any storage resource with a single file system; The way the OS "sees" a storage resource.
118
What can be defined as a 'volume'?
A removable disk; Partition on an HDD or SSD; RAID array.
119
What makes self-encrypting drives less secure?
Typically only encrypts volumes, implemented as a software application rather than disk firmware.
120
What is the difference between 'Full-disk encryption (FDE)' and 'Self-encrypting drive (SDE) software'?
Self-encrypting drive (SDE) software
may or may not encrypt free space and/or metadata.
121
Define a 'file encryption product'
Software that applies encryption to individual files (or perhaps to folders/directories).
122
What products are defined as A self-encrypting drive?
Microsoft's BitLocker and Apple's FileVault products perform volume encryption.
123
What are the two methods of encrypting a database?
1. Database-level encryption
2. Record-level encryption
124
Define how 'Database/Page-Level Encryption' functions
All records and logs are encrypted while they are stored on disk.
125
How does 'Database/Page-Level Encryption' manage the transfer of data between an application and storage?
Encryption and decryption occurs when any data is transferred between disk and memory.
126
Define how 'Record-Level Encryption' is implemented
DBA determines which fields need encryption with asymmetric encryption.
127
How does 'Record-Level Encryption' or 'Cell/column encryption' leverage PKI?
Storing the private key used to unlock the value of a cell outside of the database.
128
How does 'Record-Level Encryption' protect the transfer of data between storage and an application?
Data remains encrypted when loaded into memory; It is only decrypted when the client application supplies the key in the DBMS.
129
Define 'Transport/communication encryption' and its function
Protects data-in-motion using key exchange.
130
Define 'key exchange'
Any method by which cryptographic keys are transferred between users, enabling the use of a cryptographic algorithm.
131
What protocols are commonly used for Transport/communication encryption?
Wi-Fi Protected Access (WPA), Internet Protocol Security (IPsec), Transport Layer Security (TLS).
132
Define 'Wi-Fi Protected Access (WPA)' and its purpose
Securing traffic sent over a wireless network.
133
Define 'Internet Protocol Security (IPsec)' and its purpose
Secured traffic sent between two endpoints over a public or untrusted transport network - refereed to as a VPN.
134
Define 'Transport Layer Security (TLS)' and its purpose
Securing application data, such as web or email data, sent over a public or untrusted network.
135
What protocol is used to ensure integrity/confidentiality of transport encryption?
Cryptographic protocol ‘Hash-based Message Authentication Code (HMAC)’.
136
Define the purpose and function of 'Hash-based Message Authentication Code (HMAC)'
Provides confidentiality/integrity for a message by combining a cryptographic hash of the data with a symmetric secret key.
137
Define the function of 'Perfect Forward Secrecy (PFS)'
Periodically creates a new key value based on data supplied by both parties in the exchange.
138
What is the security benefit of 'Perfect Forward Secrecy (PFS)'
Ensures if a key is compromised, the compromise will only affect a single session and not facilitate recovery of plaintext data from other sessions.
139
What cipher does Perfect Forward Secrecy (PFS) use to implement new session keys?
Diffie-Hellman (D-H) key agreement to create ephemeral session keys.
140
Define an 'ephemeral session key'
Created by Diffie-Hellman (D-H), a key that is used within the context of a single session only.
141
What is the purpose of 'salting' and 'key stretching'?
Help to protect password-derived cryptographic secrets from discovery through cryptanalysis.
142
Define a 'salt' or the process of 'salting'
Adds a random value to each plaintext input.
143
Define a 'salted hash’
The combination of a password and salt, input into a hashing algorithm outputs a salted hash.
144
Why is salting crucial for secure password storage?
Mitigates the risk that if users choose identical plaintext passwords, there won’t be identical hash values in the password file.
145
Define 'Key Stretching'
A salted hash repeatedly inserted into a hashing algorithm to multiply length and disorder.
146
Define 'Blockchain'
A decentralized/public ledger containing a growing list of records secured using cryptographic hashing.
147
How does 'Blockchain' function?
A record (block) is has a hash value, the hash value of the previous record is added to the hash calculation of the next record in the chain.
148
What is security benefit of blockchain?
Ensures integrity of all historical records (blocks); Each block validates the hash of the previous block.
149
Where are blockchain records kept?
Recorded in an open public ledger.
150
Define an 'open public ledger'
Distributed public record of transactions.
151
Define the means of which a ledger is made open to the public
Decentralized peer-to-peer (P2P) network.
152
What is the purpose of a decentralized peer-to-peer (P2P) network?
Mitigate the risks a of a single point of failure/compromise ensuring equal trust between users.
153
What are the potential applications of blockchain technology?
Ensure the integrity and transparency of financial transactions, legal contracts, copyright and intellectual property (IP) protection, online voting systems, identity management systems, and data storage.
154
Define 'Obfuscation'
Security through obscurity; Technique that "hides" or "camouflages" code or data so that it is difficult to find.
155
What are 3 forms of obfuscation?
1. Steganography
2. Data masking
3. Tokenization
156
Define 'Steganography'
Hiding the presence of data, often by embedding information within a file or other entity called 'covertext'
157
Define 'De-identification'
Obfuscates personal data from databases so that it can be shared without compromising privacy.
158
Define 'Data masking'
De-identification method; Generic/placeholder labels are substituted for real data while preserving the structure or format of the original data.
159
Define 'Tokenization'
De-identification method where a unique token is substituted for real data.
160
How is a token stored, and how can it be interacted with?
Token is stored with the original value on a dedicated token server/vault; An authorized query or app can retrieve the original value from the vault.
161
In an FDE product, what type of cipher is used for a key encrypting key (KEK)?
An asymmetric cipher (RSA or ECC) private key.
162
In an FDE product, what type of cipher is used for a data encrypting key (DEK)?
A secret symmetric key to perform bulk encryption of a disk.
163
What is the primary reason to avoid the use of MD5?
Propensity for collisions.
164
What cipher and key length is best practice for asymmetric key pair signing?
RSA 2,048-bit or ECC 256-bit.
165
What cipher and key length is best practice for asymmetric key pair exchange?
RSA 2,048-bit or ECDHE 256-bit.
166
What cipher and key length is best practice for a symmetric secret key?
AES-128 or AES-256
167
What cipher and key length is best practice for hashing?
SHA256 or SHA512; MD5 allowed for documented compatibility requirements.
