Cisco Ccna Chapter 7

Front 1

Authentication

Back 1

Guarantees that the message is not a forgery and does actually come from whom it states.

Front 2

Integrity

Back 2

Guarantees that no one intercepted the message and altered it; similar to a checksum function in a frame.

Front 3

Confidentiality

Back 3

Guarantees that if the message is captured, it cannot be deciphered.

Front 4

authentication with protocols,

Back 4

hash message authentication code (HMAC)

Front 5

confidentiality is ensured through symmetric encryption algorithms

Back 5

Data Encryption Standard (DES), 3DES, and Advanced Encryption Standard (AES).

Front 6

transposition ciphers

Back 6

no letters are replaced; they are simply rearranged.

Front 7

Substitution ciphers

Back 7

substitute one letter for another. In their simplest form, substitution ciphers retain the letter frequency of the original message.

Front 8

Caesar cipher

Back 8

referred to as a monoalphabetic substitution cipher.

Front 9

Brute-force method

Back 9

The attacker tries every possible key knowing that eventually one of them will work.

Front 10

Ciphertext method

Back 10

The attacker has the ciphertext of several encrypted messages but no knowledge of the underlying plaintext.

Front 11

Known-Plaintext method

Back 11

The attacker has access to the ciphertext of several messages and knows something about the plaintext underlying that ciphertext.

Front 12

Chosen-Plaintext method

Back 12

The attacker chooses which data the encryption device encrypts and observes the ciphertext output.

Front 13

Chosen-Ciphertext method

Back 13

The attacker can choose different ciphertext to be decrypted and has access to the decrypted plaintext.

Front 14

Meet-in-the-Middle method

Back 14

The attacker knows a portion of the plaintext and the corresponding ciphertext.

Front 15

Cryptography

Back 15

the development and use of codes

Front 16

Cryptanalysis

Back 16

the breaking of those codes

Front 17

integrity

Back 17

md5

sha

Front 18

authentication

Back 18

hmac-md5

hmac-sha-1

rsa and dsa

Front 19

confidentiality

Back 19

des

3des

aes

Front 20

hashing is vulnerable to

Back 20

man-in-the-middle attacks and does not provide security to transmitted data.

Front 21

Keyed MD5 (HMAC-MD5)

Back 21

it provides a marginal but acceptable security level

Front 22

Keyed SHA-1 (HMAC-SHA-1)

Back 22

Based on the SHA-1 hashing algorithm, it provides adequate security.

Front 23

key generation

Back 23

key generation is usually automated and not left to the end user.

Front 24

key verification

Back 24

weak keys can be identified and regenerated to provide a more secure encryption.

Front 25

key exchange

Back 25

Key management procedures should provide a secure key exchange mechanism that allows secure agreement on the keying material with the other party

Front 26

key storage

Back 26

On a modern multi-user operating system that uses cryptography, a key can be stored in memory.

Front 27

key lifetime

Back 27

Using short key lifetimes improves the security of legacy ciphers that are used on high-speed connections.

Front 28

key revocation and destruction

Back 28

Revocation notifies all interested parties that a certain key has been compromised and should no longer be used.

Destruction erases old keys in a manner that prevents malicious attackers from recovering them.

Front 29

key length/size

Back 29

the measure in bits.

Front 30

keyspace

Back 30

This is the number of possibilities that can be generated by a specific key length.

Front 31

Symmetric keys

Back 31

Can be exchanged between two routers supporting a VPN

same pre-shared key

des, 3des, aes, idea, rc2/4/5/6 and blowfish

Front 32

Asymmetric keys

Back 32

Are used in secure HTTPS applications

different keys to encrypt and decrypt data

RSA, ElGamal. elliptic, curves and DH

Front 33

Digital signatures

Back 33

Are used when connecting to a secure website

Front 34

Hash keys

Back 34

Are used in symmetric and asymmetric key generation, digital signatures, and other types of applications

Front 35

Block Ciphers

Back 35

transform a fixed-length block of plaintext into a common block of ciphertext of 64 or 128 bits

Front 36

stream ciphers

Back 36

encrypt plaintext one byte or one bit at a time

Front 37

Data Encryption Standard (DES)

Back 37

operates in block mode by encrypting data in 64-bit blocks

The key is 64-bits long, but only 56 bits are used for encryption

Front 38

Cipher Block Chaining Mode

Back 38

block cipher mode

the encryption of each 64-bit block depends on previous blocks.

Front 39

3des

Back 39

key size 112 and 168 bits

low speed

symmetric

3DES-Encrypt-Decrypt-Encrypt

Front 40

AES

Back 40

high speed

symmetric

key sizes: 128, 192, 256

resource consumption: low

Front 41

SEAL

Back 41

Stream cipher

160 bit key size

router must support ipsec to run

router must support k9 (encryption)

high speed

resource consumption: low

Front 42

RC2

Back 42

This is a variable key-size block cipher that was designed as a “drop-in” replacement for DES.

key size in bits: 40 and 64

Front 43

RC4

Back 43

This algorithm is a variable key-size Vernam stream cipher that is often used in file encryption products and for secure communications,

key size in bits: 1 to 256

Front 44

RC5

Back 44

This is a fast block cipher that has a variable block size and key length.

key size in bits: 0 to 2048

Front 45

RC6

Back 45

a 128-bit to 256-bit block cipher that was designed by Rivest, Sidney, and Yin

key size in bits: 128, 192, or 256

Front 46

DH

Back 46

asymmetric

key sizes: 512, 1024, 2048, 3072, 4096

slow speed

resource consumption: medium

used for ipsec vpns, ssl, tls, ssh

Front 47

Internet Key Exchange (IKE),

Back 47

which is a fundamental component of IPsec VPNs.

Front 48

Secure Socket Layer (SSL)

Back 48

which is now implemented as IETF standard TLS.

Front 49

Secure Shell (SSH)

Back 49

which is a protocol that provides a secure remote access connection to network devices.

Front 50

Pretty Good Privacy (PGP)

Back 50

which is a computer program that provides cryptographic privacy and authentication and is often used to increase the security of email communications.

Front 51

characteristics of asymmetric keys:

Back 51

The typical key length is 512 to 4,096 bits.

Key lengths greater than or equal to 1,024 bits can be trusted.

Key lengths that are shorter than 1,024 bits are considered unreliable for most algorithms.

Front 52

Public Key (Encrypt) + Private Key (Decrypt) =

Back 52

Confidentiality

Front 53

Private Key (Encrypt) + Public Key (Decrypt) =

Back 53

Authentication

Front 54

Digital signature standard (DSS) and Digital Signature algorithm (DSA)

Back 54

key length in bits: 512 - 1024

Front 55

RSA encryption algorithms

Back 55

key length in bits: 512 -2048

Front 56

EIGamal

Back 56

key length in bits: 512 -1024

Front 57

Elliptical curve techniques

Back 57

key length in bits: 160

Front 58

Code signing

Back 58

Used to verify the integrity of executable files downloaded from a vendor website.

Front 59

Digital certificates

Back 59

Used to verify the identity of an organization or individual to authenticate a vendor website and establish an encrypted connection to exchange confidential data.

Front 60

Nonrepudiation

Back 60

The recipient can take the data to a third party, and the third party accepts the digital signature as a proof that this data exchange did take place.

Front 61

Digital Signature Algorithm (DSA)

Back 61

DSA is the original standard for generating public and private key pairs, and for generating and verifying digital signatures.

Front 62

Rivest-Shamir Adelman Algorithm (RSA) digital signature algorithm

Back 62

RSA is an asymmetric algorithm that is commonly used for generating and verifying digital signatures.

Front 63

Elliptic Curve Digital Signature Algorithm (ECDSA)

Back 63

ECDSA is a newer variant of DSA and provides digital signature authentication and non-repudiation with benefits of computational efficiency, small signature sizes, and minimal bandwidth.

Front 64

SPA

Back 64

S: Stands for digitally signed software.

P: Stands for a production image.

A: Indicates the key version used to digitally sign the image.

Front 65

PKI certificate

Back 65

Certificates contain an entity’s or individual’s public key, its purpose, the CA that validated and issued the certificate, the date range during which the certificate can be considered valid, and the algorithm used to create the signature.

Front 66

PKI Certificate authority

Back 66

The CA is a trusted third party that issues PKI certificates to entities and individuals after verifying their identity. It signs these certificates using its private key.

Front 67

Certificate Database

Back 67

The certificate database stores all certificates approved by the CA.

Front 68

PKI X.509 (PKIX) workgroup,

Back 68

dedicated to promoting and standardizing PKI on the Internet

Front 69

PKCS

Back 69

Public-Key Cryptography Standards refers to a group of Public Key Cryptography Standards devised and published by RSA Laboratories.

Front 70

commonly used PKI communication protocols used in VPN PKI enrollment.

Back 70

PKCS #7 and PKCS #10 standards

Front 71

Simple Certificate Enrollment Protocol (SCEP

Back 71

make issuing and revocation of digital certificates as scalable as possible. The goal of SCEP is to support the secure issuance of certificates to network devices in a scalable manner using existing technology whenever possible.

Front 72

Cross-certified CA topologies

Back 72

this is a peer-to-peer model in which individual CAs establish trust relationships with other CAs by cross-certifying CA certificates.

Front 73

Hierarchical CA topologies

Back 73

the highest level CA is called the root CA. It can issue certificates to end users and to a subordinate CA.

Front 74

Registration Authority (RA).

Back 74

responsible for the identification and authentication of subscribers, but does not sign or issue certificates.

Front 75

RA may handle three specific tasks:

Back 75

Authentication of users when they enroll with the PKI

Key generation for users that cannot generate their own keys

Distribution of certificates after enrollment