Cw Cryptography Cissp 1

Front 1

Front (Term)

is a method of storing and transmitting data in a form that only those it is intended for can read and process.

Back 1

Back (Definition)

Cryptography

Front 2

Front (Term)

• Set of mathematical and logic rules used in cryptographic functions

Back 2

Back (Definition)

Algorithm

Front 3

Front (Term)

Another name for algorithm

Back 3

Back (Definition)

Cipher

Front 4

Algorithm

Back 4

Set of mathematical and logic rules used in cryptographic functions

Front 5

Cipher

Back 5

Another name for algorithm

Front 6

Cryptography

Back 6

Science of secret writing that enables an entity to store and transmit data in a form that is available only to the intended individuals

Front 7

Cryptosystem

Back 7

Hardware or software implementation of cryptography that contains all the necessary software, protocols, algorithms, and keys

Front 8

Cryptanalysis

Back 8

Practice of uncovering flaws within cryptosystems

Front 9

Key

Back 9

Sequence of bits that are used as instructions that govern the acts of cryptographic functions within an algorithm

Front 10

Key clustering

Back 10

Instance when two different keys generate the same ciphertext from the same plaintext

Front 11

Keyspace

Back 11

A range of possible values used to construct keys

Front 12

Plaintext

Back 12

Data in readable format, also referred to as cleartext

Front 13

Substitution cipher

Back 13

Encryption method that uses an algorithm that changes out (substitutes) one value for another value

Front 14

Scytale cipher

Back 14

Ancient encryption tool that used a type of paper and rod used by Greek military factions

Front 15

Kerckhoffs’ principle

Back 15

Concept that an algorithm should be known and only the keys should be kept secret

Front 16

One-Time Pad Requirements

For a one-time pad encryption scheme to be considered unbreakable, each pad in the scheme must be

Back 16

*

Made up of truly random values

*

Used only one time

*

Securely distributed to its destination

*

Secured at sender’s and receiver’s sites

*

At least as long as the message

Front 17

A concealment cipher,

Back 17

also called a null cipher, is a type of steganography method defined . Method of hiding data in another media type with the goal of secrecy

Front 18

Key Derivation Functions (KDFs)

Back 18

are used to generate keys that are made up of random values. Different values can be used independently or together as ran- dom key material. The algorithm is created to use specific hash, password, and/ or salt values, which will go through a certain number of rounds of mathematical functions dictated by the algorithm. The more rounds that this keying material goes through, the more assurance and security for the cryptosystem overall.

Front 19

One-time pad

Back 19

Encryption method created by Gilbert Vernam that is considered impossible to crack if carried out properly

Front 20

Number generator

Back 20

Algorithm used to create values that are used in cryptographic functions to add randomness

Front 21

Running key cipher

Back 21

Substitution cipher that creates keystream values, commonly from agreed-upon text passages, to be used for encryption purposes

Front 22

Concealment cipher

Back 22

Encryption method that hides a secret message within an open message

Front 23

Steganography

Back 23

Method of hiding data in another media type with the goal of secrecy

Front 24

Digital Rights Management (DRM)

Back 24

Access control technologies commonly used to protect copyright material

Front 25

Transposition

Back 25

Encryption method that shifts (permutation) values

Front 26

Caesar cipher

Back 26

Simple substitution algorithm created by Julius Caesar that shifts alphabetic values three positions during its encryption and decryption processes

Front 27

Frequency analysis

Back 27

Cryptanalysis process used to identify weaknesses within cryptosystems by locating patterns in resulting ciphertext

Front 28

Key Derivation Functions (KDFs)

Back 28

Generation of secret keys (subkeys) from an initial value (master key)

Front 29

The following list outlines the strengths of symmetric key systems:

Strengths

Back 29

*

Much faster (less computationally intensive) than asymmetric systems.

*

Hard to break if using a large key size.

Front 30

The following list outlines the Weaknesses of symmetric key systems:

Back 30

*

Requires a secure mechanism to deliver keys properly.

*

Each pair of users needs a unique key, so as the number of individuals increases, so does the number of keys, possibly making key management overwhelming.

*

Provides confidentiality but not authenticity or nonrepudiation.

Front 31

The following list outlines the strengths of asymmetric key al- gorithms:

Strengths

Back 31

*

Better key distribution than symmetric systems.

*

Better scalability than symmetric systems

*

Can provide authentication and nonrepudiation

Front 32

The following list outlines the Weaknesses of asymmetric key al- gorithms:

Back 32

*

Works much more slowly than symmetric systems

*

Mathematically intensive tasks

Front 33

The following are examples of asymmetric key algorithms:

Back 33

*

Rivest-Shamir-Adleman (RSA)

*

Elliptic curve cryptosystem (ECC)

*

Diffie-Hellman

*

El Gamal

*

Digital Signature Algorithm (DSA)

*

Merkle-Hellman Kn

Front 34

asymmetric key algorithm

Back 34

Rivest-Shamir-Adleman (RSA)

Front 35

asymmetric key algorithm

Back 35

*

Elliptic curve cryptosystem (ECC)

Front 36

asymmetric key algorithm

Back 36

*

Diffie-Hellman

Front 37

asymmetric key algorithm

Back 37

*

El Gamal

Front 38

asymmetric key algorithm

Back 38

*

Digital Signature Algorithm (DSA)

Front 39

asymmetric key algorithm

Back 39

Merkle-Hellman Kn

Front 40

Stream Ciphers vs. One-Time Pads

Back 40

Stream ciphers were developed to provide the same type of protection one-time pads do, which is why they work in such a similar manner. In reality, stream ci- phers cannot provide the level of protection one-time pads do, but because stream ciphers are implemented through software and automated means, they are much more practical.

Front 41

Symmetric algorithm

Back 41

Encryption method where the sender and receiver use an instance of the same key for encryption and decryption purposes.

Front 42

Out-of-band method

Back 42

Sending data through an alternate communication channel.

Front 43

Asymmetric algorithm

Back 43

Encryption method that uses two different key types, public and private. Also called public key cryptography

Front 44

Public key

Back 44

Value used in public key cryptography that is used for encryption and signature validation that can be known by all parties.

Front 45

Private key

Back 45

Value used in public key cryptography that is used for decryption and signature creation and known to only key owner.

Front 46

Public key cryptography

Back 46

Asymmetric cryptography, which uses public and private key values for cryptographic functions.

Front 47

Block cipher

Back 47

Symmetric algorithm type that encrypts chunks (blocks) of data at a time.

Front 48

Diffusion

Back 48

Transposition processes used in encryption functions to increase randomness.

Front 49

Confusion

Back 49

Substitution processes used in encryption functions to increase randomness.

Front 50

Avalanche effect

Back 50

Algorithm design requirement so that slight changes to the input result in drastic changes to the output.

Front 51

Stream cipher

Back 51

Algorithm type that generates a keystream (random values), which is XORd with plaintext for encryption purposes.

Front 52

Keystream generator

Back 52

Component of a stream algorithm that creates random values for encryption purposes.

Front 53

Initialization vectors (IVs)

Back 53

Values that are used with algorithms to increase randomness for cryptographic functions.

Front 54

Cryptography

Back 54

Science of secret writing that enables an entity to store and transmit data in a form that is available only to the intended individuals

Front 55

Cryptosystem

Back 55

Hardware or software implementation of cryptography that contains all the necessary software, protocols, algorithms, and keys

Front 56

Cryptanalysis

Back 56

Practice of uncovering flaws within cryptosystems

Front 57

Cryptology

Back 57

The study of both cryptography and cryptanalysis

Front 58

Encipher

Back 58

The study of both cryptography and cryptanalysis Act of transforming data into an unreadable format

Front 59

Decipher

Back 59

Act of transforming data into an unreadable format Act of transforming data into a readable format

Front 60

Key

Back 60

Sequence of bits that are used as instructions that govern the acts

of cryptographic functions within an algorithm

Front 61

Key clustering

Back 61

Instance when two different keys generate the same ciphertext from the same plaintext

Front 62

Keyspace

Back 62

A range of possible values used to construct keys

Front 63

Plaintext

Back 63

Data in readable format, also referred to as cleartext

Front 64

Substitution cipher

Back 64

Encryption method that uses an algorithm that changes out (substitutes) one value for another value

Front 65

Scytale cipher

Back 65

Ancient encryption tool that used a type of paper and rod used by Greek military factions

Front 66

Kerckhoffs’ principle

Back 66

Concept that an algorithm should be known and only the keys should be kept secret

Front 67

One-Time Pad Requirements

For a one-time pad encryption scheme to be considered unbreakable, each pad in the scheme must be

Back 67

*

Made up of truly random values

*

Used only one time

*

Securely distributed to its destination

*

Secured at sender’s and receiver’s sites

*

At least as long as the message

Front 68

concealment cipher

Back 68

also called a null cipher, is a type of steganography method.

Front 69

Key Derivation Functions (KDFs)

Back 69

are used to generate keys that are made up of random values. Different values can be used independently or together as ran- dom key material. The algorithm is created to use specific hash, password, and/ or salt values, which will go through a certain number of rounds of mathematical functions dictated by the algorithm. The more rounds that this keying material goes through, the more assurance and security for the cryptosystem overall.

Front 70

One-time pad

Back 70

Encryption method created by Gilbert Vernam that is considered impossible to crack if carried out properly

Front 71

Number generator

Back 71

Algorithm used to create values that are used in cryptographic functions to add randomness

Front 72

Running key cipher

Back 72

Substitution cipher that creates keystream values, commonly from agreed-upon text passages, to be used for encryption purposes

Front 73

Concealment cipher

Back 73

Encryption method that hides a secret message within an open message

Front 74

Steganography

Back 74

Method of hiding data in another media type with the goal of secrecy

Front 75

Digital Rights Management (DRM)

Back 75

Access control technologies commonly used to protect copyright material

Front 76

Transposition

Back 76

Encryption method that shifts (permutation) values

Front 77

Caesar cipher

Back 77

Simple substitution algorithm created by Julius Caesar that shifts alphabetic values three positions during its encryption and decryption processes

Front 78

Frequency analysis

Back 78

Cryptanalysis process used to identify weaknesses within cryptosystems by locating patterns in resulting ciphertext

Front 79

Key Derivation Functions (KDFs)

Back 79

Generation of secret keys (subkeys) from an initial value (master key)

Front 80

The following list outlines the weakness of symmetric key systems:

Back 80

*

Requires a secure mechanism to deliver keys properly.

*

Each pair of users needs a unique key, so as the number of individuals increases, so does the number of keys, possibly making key management overwhelming.

*

Provides confidentiality but not authenticity or nonrepudiation.

Front 81

The following list outlines the strengths of symmetric key systems:

Back 81

*

Much faster (less computationally intensive) than asymmetric systems.

*

Hard to break if using a large key size.

Front 82

The following list outlines the strengths of asymmetric key al- gorithms:

Back 82

*

Better key distribution than symmetric systems.

*

Better scalability than symmetric systems

*

Can provide authentication and nonrepudiation

Front 83

The following list outlines the weaknesses of asymmetric key al- gorithms:

Back 83

*

Works much more slowly than symmetric systems

*

Mathematically intensive tasks

Front 84

The following are examples of asymmetric key algorithms:

Back 84

*

Rivest-Shamir-Adleman (RSA)

*

Elliptic curve cryptosystem (ECC)

*

Diffie-Hellman

*

El Gamal

*

Digital Signature Algorithm (DSA)

*

Merkle-Hellman Kn

Front 85

Stream Ciphers vs. One-Time Pads

Back 85

Stream ciphers were developed to provide the same type of protection one-time pads do, which is why they work in such a similar manner. In reality, stream ci- phers cannot provide the level of protection one-time pads do, but because stream ciphers are implemented through software and automated means, they are much more practical.

Front 86

Symmetric algorithm

Back 86

Encryption method where the sender and receiver use an instance of the same key for encryption and decryption purposes.

Front 87

Out-of-band method

Back 87

Sending data through an alternate communication channel.

Front 88

Asymmetric algorithm

Back 88

Encryption method that uses two different key types, public and private. Also called public key cryptography.

Front 89

Public key

Back 89

Value used in public key cryptography that is used for encryption and signature validation that can be known by all parties.

Front 90

Private key

Back 90

Value used in public key cryptography that is used for decryption and signature creation and known to only key owner.

Front 91

Public key cryptography

Back 91

Asymmetric cryptography, which uses public and private key values for cryptographic functions.

Front 92

Block cipher

Back 92

Symmetric algorithm type that encrypts chunks (blocks) of data at a time.

Front 93

Diffusion

Back 93

Transposition processes used in encryption functions to increase randomness.

Front 94

Confusion

Back 94

Substitution processes used in encryption functions to increase randomness.

Front 95

Avalanche effect

Back 95

Algorithm design requirement so that slight changes to the input result in drastic changes to the output.

Front 96

Stream cipher

Back 96

Algorithm type that generates a keystream (random values), which is XORd with plaintext for encryption purposes.

Front 97

Keystream generator

Back 97

Component of a stream algorithm that creates random values for encryption purposes.

Front 98

Initialization vectors (IVs)

Back 98

Values that are used with algorithms to increase randomness for cryptographic functions.

Front 99

using purely symmetric key cryptography has three drawbacks, which affect the following

Back 99

*

Security services Purely symmetric key cryptography provides confidentiality only, not authentication or nonrepudiation.

*

Scalability As the number of people who need to communicate increases, so does the number of symmetric keys required, meaning more keys must be managed.

*

Secure key distribution The symmetric key must be delivered to its destination through a secure courier.

Front 100

Diffie-Hellman algorithm

Back 100

Although the ................... algorithm is vulnerable to a man-in- the-middle attack, it does not mean this type of compromise can take place anywhere this algorithm is deployed. Most implementations include another piece of software or a protocol that compensates for this vulnerability. But some do not. As a security professional, you should understand these issues.

Front 101

MQV (Menezes-Qu-Vanstone)

Back 101

is an authentication key agreement cryptography function very similar to Diffie-Hellman.The users’ public keys are exchanged to create session keys. It provides protection from an attacker figuring out the session key because she would need to have both users’ private keys.

Front 102

Strong cryptographic hash functions has the following characteristics:

Back 102

*

The hash should be computed over the entire message.

*

The hash should be a one-way function so messages are not disclosed by their values.

*

Given a message and its hash value, computing another message with the same hash value should be impossible.

*

The function should be resistant to birthday attacks (explained in the upcoming section “Attacks Against One-Way Hash Functions”).

Front 103

Asymmetric Key Algorithms

Back 103

ECC

El Gamal

Knapsack

Front 104

Symmetric Key Algorithms

Back 104

DES
Blowfish
RC4

Front 105

Diffie-Hellman algorithm

Back 105

First asymmetric algorithm created and is used to exchange symmetric key values. Based upon logarithms in finite fields.

Front 106

RSA algorithm

Back 106

De facto asymmetric algorithm used for encryption, digital signatures, and key exchange. Based upon the difficulty of factoring large numbers into their original prime numbers.

Front 107

El Gamal algorithm

Back 107

Asymmetric algorithm based upon the Diffie- Hellman algorithm used for digital signatures, encryption, and key exchange.

Front 108

Elliptic curve cryptosystem algorithm

Back 108

Asymmetric algorithm based upon the algebraic structure of elliptic curves over finite fields. Used for digital signatures, encryption, and key exchange.

Front 109

Knapsack algorithm

Back 109

Asymmetric algorithm based upon a subset sum problem (knapsack problem). It has been broken and no longer used.

Front 110

Zero knowledge proof

Back 110

One entity can prove something to be true without providing a secret value.

Front 111

One-way hash

Back 111

Cryptographic process that takes an arbitrary amount of data and generates a fixed-length value. Used for integrity protection.

Front 112

Message authentication code (MAC)

Back 112

Keyed cryptographic hash function used for data integrity and data origin authentication.

Front 113

Hashed message authentication code (HMAC)

Back 113

Cryptographic hash function that uses a symmetric key value and is used for data integrity and data origin authentication.

Front 114

CBC-MAC

Back 114

Cipher block chaining message authentication code uses encryption for data integrity and data origin authentication.

Front 115

CMAC

Back 115

Cipher message authentication code that is based upon and provides more security compared to CBC-MAC

Front 116

CCM

Back 116

Block cipher mode that combines the CTR encryption mode and CBC-MAC. One encryption key is used for both authentication and encryption purposes.

Front 117

Collision

Back 117

When two different messages are computed by the same hashing algorithm and the same message digest value results.

Front 118

Birthday attack

Back 118

Cryptographic attack that exploits the mathematics behind the birthday problem in the probability theory forces collisions within hashing functions.

Front 119

Digital signature

Back 119

Ensuring the authenticity and integrity of a message through the use of hashing algorithms and asymmetric algorithms. The message digest is encrypted with the sender’s private key.

Front 120

Digital signature standard

Back 120

U.S. standard that outlines the approved algorithms to be used for digital signatures for government authentication activities.

Front 121

Certificate Revocation CRL

Back 121

CRLs are the thorn in the side of many PKI implementations.They are challenging for a long list of reasons. It is interesting to know that, by default, web browsers do not check a CRL to ensure that a certificate is not revoked. So when you are setting up an SSL connection to do e-commerce over the Internet, you could be relying on a certificate that has actually been revoked. Not good.

Front 122

Rules for Keys and Key Management

Back 122

*

The key length should be long enough to provide the necessary level of protection.

*

Keys should be stored and transmitted by secure means.

*

Keys should be extremely random, and the algorithm should use the full spectrum of the keyspace.

*

The key’s lifetime should correspond with the sensitivity of the data it is protecting. (Less secure data may allow for a longer key lifetime, whereas more sensitive data might require a shorter key lifetime.)

*

The more the key is used, the shorter its lifetime should be.

*

Keys should be backed up or escrowed in case of emergencies.

*

Keys should be properly destroyed when their lifetime comes to an end.

Front 123

End-to-end encryption

Back 123

happens within the applications

Front 124

SSL encryption takes place

Back 124

at the transport layer.

Front 125

PPTP encryption takes place

Back 125

at the data link layer.

Front 126

Link encryption takes place

Back 126

at the data link and physical layers.

Front 127

Advantages of end-to-end encryption include the following:

Back 127

*

It provides more flexibility to the user in choosing what gets encrypted and how.

*

Higher granularity of functionality is available because each application or user can choose specific configurations.

*

Each hop device on the network does not need to have a key to decrypt each packet.

Front 128

Disadvantages of end-to-end encryption include the following:

Back 128

Headers, addresses, and routing information are not encrypted, and therefore not protected.

Front 129

Certificate authority

Back 129

Component of a PKI that creates and maintains digital certificates throughout their life cycles.

Front 130

Registration authority

Back 130

Component of PKI that validates the identity of an entity requesting a digital certificate.

Front 131

Certificate revocation list

Back 131

List that is maintained by the certificate authority of a PKI that contains information on all of the digital certificates that have been revoked.

Front 132

Online certificate status protocol

Back 132

Automated method of maintaining revoked certificates within a PKI.

Front 133

Certificate

Back 133

Digital identity used within a PKI. Generated and maintained by a certificate authority and used for authentication.

Front 134

Link encryption

Back 134

Technology that encrypts full packets (all headers and data payload) and is carried out without the sender’s interaction.

Front 135

End-to-end encryption

Back 135

Encryption method used by the sender of data that encrypts individual messages and not full packets.

Front 136

Hardware vs. Software Cryptography Systems

Back 136

Encryption can be done through software or hardware, and there are trade-offs with each. Generally, software is less expensive and provides a slower throughput than hardware mechanisms. Software cryptography methods can be more easily modified and disabled compared to hardware systems, but it depends on the ap- plication and the hardware product.

If a company needs to perform high-end encryption functions at a higher speed, the company will most likely implement a hardware solution.

Front 137

PGP

Back 137

is considered a cryptosystem because it has all the necessary components: symmetric key algorithms, asymmetric key algorithms, message digest algorithms, keys, protocols, and the necessary software components.

Front 138

SET

Back 138

is a cryptographic protocol and infrastructure developed to send encrypted credit card numbers over the Internet.

Front 139

The following entities would be involved with a SET transaction, which would require each of them to upgrade their software, and pos- sibly their hardware:

Back 139

*

Issuer (cardholder’s bank) The financial institution that provides a credit card to the individual.

*

Cardholder The individual authorized to use a credit card.

*

Merchant The entity providing goods.

*

Acquirer (merchant’s bank) The financial institution that processes payment cards.

*

Payment gateway This processes the merchant payment. It may be an acquirer.

Front 140

Multipurpose Internet Mail Extension

Back 140

Standard that outlines the format of e-mail messages and allows binary attachments to be transmitted through e-mail.

Front 141

Secure MIME Secure/Multipurpose Internet Mail Extensions

Back 141

, which outlines how public key cryptography can be used to secure MIME data types.

Front 142

Pretty Good Privacy

Back 142

Cryptosystem used to integrate public key cryptography with e-mail functionality and data encryption, which was developed by Phil Zimmerman.

Front 143

Quantum cryptography

Back 143

Use of quantum mechanical functions to provide strong cryptographic key exchange.

Front 144

HTTPS

Back 144

A combination of HTTP and SSL\TLS that is commonly used for secure Internet connections and e-commerce transactions.

Front 145

Secure Electronic Transaction

Back 145

Secure e-commerce standard developed by Visa and MasterCard that has not been accepted within the marketplace.

Front 146

Cookies

Back 146

Data files used by web browsers and servers to keep browser state information and browsing preferences.

Front 147

Secure Shell (SSH)

Back 147

Network protocol that allows for a secure connection to a remote system. Developed to replace Telnet and other insecure remote shell methods.

Front 148

IPSec

Back 148

Protocol suite used to protect IP traffic through encryption and authentication. De facto standard VPN protocol.

Front 149

Authentication header protocol

Back 149

Protocol within the IPSec suite used for integrity and authentication.

Front 150

Encapsulating security protocol

Back 150

Protocol within the IPSec suite used for integrity, authentication, and encryption.

Front 151

Transport mode

Back 151

Mode that IPSec protocols can work in that provides protection for packet data payload.

Front 152

Tunnel mode

Back 152

Mode that IPSec protocols can work in that provides protection for packet headers and data payload.

Front 153

Internet Security Association and Key Management Protocol

Back 153

Used to establish security associates and an authentication framework in Internet connections.

Front 154

Passive attack

Back 154

Attack where the attacker does not interact with processing or communication activities, but only carries out observation and data collection, as in network sniffing.

Front 155

Active attack

Back 155

Attack where the attacker does interact with processing or communication activities.

Front 156

Ciphertext-only attack

Back 156

Cryptanalysis attack where the attacker is assumed to have access only to a set of ciphertexts.

Front 157

Known-plaintext attack

Back 157

Cryptanalysis attack where the attacker is assumed to have access to sets of corresponding plaintext and ciphertext.

Front 158

Chosen-plaintext attack

Back 158

Cryptanalysis attack where the attacker can choose arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts.

Front 159

Chosen-ciphertext attack

Back 159

Cryptanalysis attack where the attacker chooses a ciphertext and obtains its decryption under an unknown key.

Front 160

Differential cryptanalysis

Back 160

?

Front 161

Linear cryptanalysis

Back 161

Cryptanalysis method that uses the study of affine transformation approximation in encryption processes.

Front 162

Side-channel attack

Back 162

Attack that uses information (timing, power consumption) that has been gathered to uncover sensitive data or processing functions.

Front 163

Replay attack

Back 163

Valid data transmission is maliciously or fraudulently repeated to allow an entity gain unauthorized access.

Front 164

Algebraic attack

Back 164

Cryptanalysis attack that exploits vulnerabilities within the intrinsic algebraic structure of mathematical functions.

Front 165

Analytic attack

Back 165

Cryptanalysis attack that exploits vulnerabilities within the algorithm structure.

Front 166

Statistical attack

Back 166

Cryptanalysis attack that uses identified statistical patterns.

Front 167

Social engineering attack

Back 167

Manipulating individuals so that they will divulge confidential information, rather than by breaking in or using technical cracking techniques.

Front 168

Meet-in-the-middle attack

Back 168

Cryptanalysis attack that tries to uncover a mathematical problem from two different ends.

Front 169

Cryptography is the science of protecting information by

Back 169

encoding it into an unreadable format.

Front 170

The most famous rotor encryption machine is

Back 170

the Enigma used by the Germans in World War II.

Front 171

A readable message is in a form called plaintext, and once it is encrypted,

Back 171

it is in a form called ciphertext.

Front 172

Cryptographic algorithms are the mathematical rules that dictate

Back 172

the functions of enciphering and deciphering.

Front 173

Cryptanalysis is the study of

Back 173

breaking cryptosystems

Front 174

Nonrepudiation is a service that ensures the

Back 174

sender cannot later falsely deny sending a message.

Front 175

Key clustering is an instance in which two different keys

Back 175

generate the same ciphertext from the same plaintext.

Front 176

The range of possible keys is referred to as the

Back 176

keyspace. A larger keyspace and the full use of the keyspace allow for more random keys to be created. This provides more protection.

Front 177

The two basic types of encryption mechanisms used in symmetric ciphers

Back 177

are substitution and transposition. Substitution ciphers change a character (or bit) out for another, while transposition ciphers scramble the characters (or bits).

Front 178

A polyalphabetic cipher uses more than one

Back 178

alphabet to defeat frequency analysis.

Front 179

Steganography is a method of hiding data within

Back 179

another media type, such as a graphic, WAV file, or document. This method is used to hide the existence of the data.

Front 180

A key is

Back 180

a random string of bits inserted into an encryption algorithm. The result determines what encryption functions will be carried out on a message and in what order.

Front 181

In symmetric key algorithms, the sender and receiver use

Back 181

use the same key for encryption and decryption purposes.

Front 182

In asymmetric key algorithms, the sender and receiver use

Back 182

different keys for encryption and decryption purposes.

Front 183

Symmetric key processes provide barriers of secure key distribution and scalability. However, symmetric key algorithms perform

Back 183

much faster than asymmetric key algorithms.

Front 184

Symmetric key algorithms can provide confidentiality,

Back 184

but not authentication or nonrepudiation.

Front 185

Examples of symmetric key algorithms include

Back 185

DES, 3DES, Blowfish, IDEA, RC4, RC5, RC6, and AES.

Front 186

Asymmetric algorithms are used to encrypt keys

Back 186

and symmetric algorithms are used to encrypt bulk data.

Front 187

Asymmetric key algorithms are much slower than

Back 187

symmetric key algorithms, but can provide authentication and nonrepudiation services.

Front 188

Examples of asymmetric key algorithms include

Back 188

RSA, ECC, Diffie-Hellman, El Gamal, Knapsack, and DSA.

Front 189

Two main types of symmetric algorithms are

Back 189

stream and block ciphers. Stream ciphers use a keystream generator and encrypt a message one bit at a time. A block cipher divides the message into groups of bits and encrypts them.

Front 190

Many algorithms are publicly known, so the secret part of the process is the

Back 190

key. The key provides the necessary randomization to encryption.

Front 191

Data Encryption Standard (DES) is a block cipher that divides

Back 191

a message into 64-bit blocks and employs S-box-type functions on them.

Front 192

Because technology has allowed the DES keyspace to be successfully broken, Triple-DES (3DES)

Back 192

was developed to be used instead. 3DES uses 48 rounds of computation and up to three different keys.

Front 193

International Data Encryption Algorithm (IDEA) is a

Back 193

symmetric block cipher with a key of 128 bits.

Front 194

RSA is an asymmetric algorithm developed by

Back 194

Rivest, Shamir, and Adleman and is the de facto standard for digital signatures.

Front 195

Elliptic curve cryptosystems (ECCs) are used as asymmetric algorithms and can provide

Back 195

digital signature, secure key distribution, and encryption functionality. They use fewer resources, which makes them better for wireless device and cell phone encryption use.

Front 196

When symmetric and asymmetric key algorithms are used together, this is called a

Back 196

hybrid system. The asymmetric algorithm encrypts the symmetric key, and the symmetric key encrypts the data.

Front 197

A session key is a symmetric key used by the sender and receiver of messages for

Back 197

encryption and decryption purposes. The session key is only good while that communication session is active and then it is destroyed.

Front 198

A public key infrastructure (PKI) is a framework of programs, procedures, communication protocols, and public key cryptography that

Back 198

enables a diverse group of individuals to communicate securely.

Front 199

A certificate authority (CA) is a trusted third party that generates and maintains

Back 199

user certificates, which hold their public keys.

Front 200

The CA uses a certification revocation list (CRL)

Back 200

to keep track of revoked certificates.

Front 201

A certificate is the mechanism the CA uses to

Back 201

associate a public key to a person’s identity.

Front 202

A registration authority (RA) validates the

Back 202

user’s identity and then sends the request for a certificate to the CA. The RA cannot generate certificates.

Front 203

A one-way function is a mathematical function that is easier to compute

Back 203

in one direction than in the opposite direction

Front 204

RSA is based on a one-way function that factors large numbers into prime numbers. Only the private key knows how to

Back 204

use the trapdoor and how to decrypt messages that were encrypted with the corresponding public key.

Front 205

Hashing algorithms provide

Back 205

data integrity only.

Front 206

When a hash algorithm is applied to a message, it produces

Back 206

a message digest, and this value is signed with a private key to produce a digital signature.

Front 207

Some examples of hashing algorithms include

Back 207

SHA-1, MD2, MD4, MD5, and HAVAL.

Front 208

HAVAL produces a variable-length

Back 208

hash value, whereas the other hashing algorithms mentioned produce a fixed-length value.

Front 209

SHA-1 produces a

Back 209

160-bit hash value and is used in DSS

Front 210

A birthday attack is an attack on hashing functions

Back 210

through brute force. The attacker tries to create two messages with the same hashing value.

Front 211

A one-time pad uses a pad with random values that are

Back 211

XORed against the message to produce ciphertext. The pad is at least as long as the message itself and is used once and then discarded.

Front 212

A digital signature is the result of a user signing a hash value with

Back 212

a private key. It provides authentication, data integrity, and nonrepudiation. The act of signing is the actual encryption of the value with the private key.

Front 213

Examples of algorithms used for digital signatures include

Back 213

RSA, El Gamal, ECDSA, and DSA.

Front 214

Key management is one of the most challenging pieces of cryptography. It pertains to

Back 214

creating, maintaining, distributing, and destroying cryptographic keys.

Front 215

The Diffie-Hellman protocol is a key agreement protocol and does not

Back 215

provide encryption for data and cannot be used in digital signatures.

Front 216

TLS is the “next version” of SSL and is an open-community protocol, which allows

Back 216

for expansion and interoperability with other technologies.

Front 217

Link encryption encrypts the entire packet, including headers and trailers, and

Back 217

has to be decrypted at each hop. End-to-end encryption does not encrypt the headers and trailers, and therefore does not need to be decrypted at each hop.

Front 218

Pretty Good Privacy (PGP) is an e-mail security program that uses

Back 218

public key encryption. It employs a web of trust instead of the hierarchical structure used in PKI.

Front 219

S-HTTP provides protection for each message sent between two computers, but not

Back 219

the actual link. HTTPS protects the communication channel. HTTPS is HTTP that uses SSL for security purposes.

Front 220

Secure Electronic Transaction (SET) is a proposed electronic commerce technology that

Back 220

provides a safer method for customers and merchants to perform transactions over the Internet.

Front 221

In IPSec, AH provides

Back 221

integrity and authentication, and ESP provides those plus confidentiality.

Front 222

IPSec protocols can work in transport mode (the data payload is protected) or

Back 222

tunnel mode (the payload and headers are protected).

Front 223

IPSec uses IKE as its key exchange protocol. IKE is the

Back 223

de facto standard and is a combination of ISAKMP and OAKLEY.

Front 224

Trusted Platform Module is a secure cryptoprocessor that

Back 224

can be used for platform integrity, disk encryption

Front 225

An asymmetric algorithm performs encryption and decryption by using

Back 225

by using public and private keys that are related to each other mathematically.

Front 226

A symmetric algorithm performs

Back 226

encryption and decryption by using a shared secret key.

Front 227

A symmetric key is used to

Back 227

encrypt and/or decrypt the actual message.

Front 228

Public keys are used to encrypt

Back 228

the symmetric key for secure key exchange

Front 229

A secret key is synonymous

Back 229

with a symmetric key.

Front 230

An asymmetric key refers to

Back 230

a public or private key.

Front 231

So, that is how a hybrid system works.

Back 231

The symmetric algorithm creates a secret key that will be used to encrypt the bulk, or the message, and the asymmetric key encrypts the secret key for transmission.

Front 232

*

If a symmetric key is encrypted with a receiver’s public key, what security service(s) is (are) provided?

Back 232

Confidentiality, because only the receiver’s private key can be used to decrypt the symmetric key, and only the receiver should have access to this private key.

Front 233

If data are encrypted with the sender’s private key, what security service(s) is (are) provided?

Back 233

Authenticity of the sender and nonrepudiation. If the receiver can decrypt the encrypted data with the sender’s public key, then she knows the data was encrypted with the sender’s private key.

Front 234

If the sender encrypts data with the receiver’s private key, what security services(s) is (are) provided?

Back 234

None, because no one but the owner of the private key should have access to it. Trick question.

Front 235

Why do we encrypt the message with the symmetric key?

Back 235

Because the asymmetric key algorithm is too slow.

Front 236

Why don’t we encrypt the symmetric key with another symmetric key?

Back 236

We need to get the necessary symmetric key to the destination securely, which can only be carried out through asymmetric cryptography through the use of public and private keys to provide a mechanism for secure transport of the symmetric key.

Front 237

Sadly, you could see sym- metric cryptography referred to as any of the following:

Back 237

*

Single key cryptography

*

Secret key cryptography

*

Session key cryptography

*

Private key cryptography

*

Shared-key cryptography

Front 238

Among the long laundry list of security problems with WEP

Back 238

not using unique session keys for data encryption is one of them. If only WEP is being used to encrypt wireless traffic, then in most implementations, just one static symmetric key is being used over and over again to encrypt the packets. This is one of the changes and advancements in the 802.11i standard, which makes sure each packet is encrypted with a unique session key.

Front 239

DEA is the algorithm that fulfills DES, which is really just a standard. So DES is the standard and DEA is the algorithm, but in the industry we usually just refer to it as

Back 239

DES.The CISSP exam may refer to the algorithm by either name, so remember both.

Front 240

In some resources, you may run across rc5-w/r/b or RC5-32/12/16. This is a type of shorthand that describes the configuration of the algorithm:

Back 240

*

w = Word size, in bits, which can be 16, 32, or 64 bits in length

*

r = Number of rounds, which can be 0 to 255

So RC5-32/12/16 would mean the following:

*

32-bit words, which means it encrypts 64-bit data blocks

*

Using 12 rounds

*

With a 16-byte (128-bit) key

A developer configures these parameters (words, number of rounds, key size) for the algorithm for specific implementations. The existence of these parameters gives developers extensive flexibility.

Front 241

Hybrid cryptography

Back 241

Combined use of symmetric and asymmetric algorithms where the symmetric key encrypts data and an asymmetric key encrypts the symmetric key.

Front 242

Session keys

Back 242

Symmetric keys that have a short lifespan, thus providing more protection than static keys with longer lifespans.

Front 243

Digital envelope Message

Back 243

is encrypted with a symmetric key and the symmetric key is encrypted with an asymmetric key. Collectively this is called a digital envelope.

Front 244

Data Encryption Standard Block symmetric algorithm chosen by NIST as an encryption standard in 1976. It uses

Back 244

a 56-bit true key bit size, 64-bit block size, and 16 rounds of computation.

Front 245

Lucifer Algorithm that was chosen for the

Back 245

Data Encryption Standard, which was altered and renamed Data Encryption Algorithm.

Front 246

Data Encryption Algorithm Algorithm chosen to fulfill the

Back 246

Data Encryption Standard. Block symmetric cipher that uses a 56-bit true key size, 64-bit block size, and 16 rounds of computation.

Front 247

Advanced Encryption Standard U.S. encryption standard that replaced

Back 247

DES. Block symmetric cipher that uses 128-bit block sizes and various key lengths (128, 192, 256).

Front 248

Rijndael Block symmetric cipher that was chosen to fulfill the

Back 248

Advanced Encryption Standard. It uses a 128-bit block size and various key lengths (128, 192, 256).

Front 249

Triple DES Symmetric cipher that applies

Back 249

DES three times to each block of data during the encryption process.

Front 250

International Data Encryption Algorithm Block symmetric cipher that

Back 250

uses a 128-bit key and 64-bit block size.

Front 251

Blowfish Block symmetric cipher that uses

Back 251

64-bit block sizes and variable-length keys.

Front 252

RC4 Stream symmetric cipher that

Back 252

was created by Ron Rivest of RSA. Used in SSL and WEP.

Front 253

RC5 Block symmetric cipher that uses

Back 253

variable block sizes (32, 64, 128) and variable-length key sizes (0–2040).

Front 254

RC6 Block symmetric cipher that uses a

Back 254

128-bit block size and variable- length key sizes (128, 192, 256). Built upon the RC5 algorithm

Front 255

MAC

Back 255

Mandatory Access Control Under a mandatory access control environment, the system or security administrator

will define what permissions subjects have on objects. The administrator does not

dictate user’s access but simply configure the proper level of access as dictated by

the Data Owner.

Front 256

will look at the Security Clearance of the subject and compare it

with the object sensitivity level or classification level. This is what is called the

dominance relationship. The subject must DOMINATE the object sensitivity level.

Which means that the subject must have a security clearance equal or higher than the

object he is attempting to access

Back 256

The MAC system

Front 257

introduce the concept of labels. Every objects will have a label attached

to them indicating the classification of the object as well as categories that are used

to impose the need to know (NTK) principle. Even thou a user has a security

clearance of Secret it does not mean he would be able to access any Secret

documents within the system

Back 257

MAC

Front 258

If there is no clearance and no labels then

Back 258

IT IS NOT Mandatory Access Control

Front 259

simple security rule,” or “no read up.”

Back 259

MAC policy

Front 260

“*-property” (pronounced “star

property”) or “no write down.

Back 260

MAC Policy

Front 261

no read up

Back 261

MAC

Front 262

no read up

Back 262

MAC

Front 263

strict *-

property”

Back 263

requires that information can be written at, but not above, the subject’s

clearance level. MAC

Front 264

also known as: Identity Based access control system.

The owner of an object is define as the person who created the object. As such the

owner has the discretion to grant access to other users on the network. Access will

be granted based solely on the identity of those users.

Such system is good for low level of security. One of the major problem is the fact

that a user who has access to someone's else file can further share the file with other

users without the knowledge or permission of the owner of the file. Very quickly

this could become the wild west as there is no control on the dissemination of the

information.

Back 264

DAC = Discretionary Access Control

Front 265

is a form of Non-Discretionary access control. access control usually maps directly with the different types of jobs

performed by employees within a company

Back 265

RBAC = Role Based Access Control

Front 266

is a form of Non-Discretionary access control. access control device would be a Firewall. A

single set of rules is imposed to all users attempting to connect through the firewall.

Back 266

RuBAC = Rule Based Access Control

Front 267

provide access protection by

calling back the number of a previously authorized location, but this control can be

compromised by call forwarding.

Back 267

Call back Systems

Front 268

The use of database views is another example of a

constrained user interface.

Back 268

Another method for controlling access is by restricting users to specific functions

based on their role in the system.

Front 269

job rotation, the sharing of

responsibilities, and reviews of audit records.

Back 269

detective/administrative controls

Front 270

The control measures that are intended to reveal the violations of security policy

using software and hardware are associated with:

Back 270

detective/technical control measures

Front 271

The controls that usually require a human to evaluate the input from sensors or

cameras to determine if a real threat exists are associated with:

Back 271

Detective/physical controls usually require a human to evaluate the input from

sensors or cameras to determine if a real threat exists.

Front 272

A central authority determines what subjects can have access to certain objects

based on the organizational security policy is called:

Back 272

Non-Discretionary Access Control

Front 273

Type 1 Something you

know, such as a PIN or password

Type 2 Something you have, such as an ATM card or smart card

Type 3 Something you are (Unique physical characteristic), such as a fingerprint or

retina scan

Back 273

Authentication is based on the following three factor types

Front 274

is verification that the user's claimed identity is valid and is usually

implemented through a user password at log-on time.

Back 274

Authentication

Front 275

provides maximum security because a new password is

required for each new log-on.

Back 275

"One-time password"

Front 276

is a sequence of characters that is usually longer than the allotted

number for a password.

Back 276

passphrase

Front 277

Which of the following would be true about Static password tokens?

Back 277

The owner identity is authenticated by the token

Front 278

In Synchronous dynamic password tokens

Back 278

The token generates a new non-unique password value at fixed time intervals

(this password could be based on the time of day encrypted with a secret key).

Front 279

identification is a "one-to-many" search of an individual's

characteristics from a database of stored images.

Back 279

biometrics,

Front 280

It is used for identification in physical controls and for authentication in logical

controls.

Back 280

Which of the following is true of biometrics

Front 281

What is called the percentage of valid subjects that are falsely rejected by a

Biometric Authentication system?

Back 281

False Rejection Rate (FRR) or Type I Error

Front 282

What is called the percentage of invalid subjects that are falsely accepted by a

Biometric authentication system?

Back 282

False Acceptance Rate (FAR) or Type II Error

Front 283

What is called the percentage at which the False Rejection Rate equals the False

Acceptance Rate?

Back 283

Crossover Error Rate (CER)

Another name for the CER is the Equal

Error Rate (EER), any of the two terms could be used. the

device with the lowest EER is most accurate

Front 284

Considerations of privacy, invasiveness, and psychological and physica

Back 284

Acceptability of biometrics systems

Front 285

Which of the following is implemented through scripts or smart agents that replays

the users multiple log-ins against authentication servers to verify a user's identity

which permit access to system services?

Back 285

SSO

Front 286

File฀Transfer฀Protocol฀(FTP)

•฀ Trivial฀File฀Transfer฀Protocol฀(TFTP)

•฀ Simple฀Network฀Management฀Protocol฀(SNMP)

•฀ Simple฀Mail฀Transfer฀Protocol฀(SMTP)

•฀ Telnet

•฀ Hypertext฀Transfer฀Protocol฀(HTTP)

Back 286

OSI: Application Layer

The protocols at the application layer handle file transfer, virtual terminals, network

management, and fulfilling networking requests of applications. A few of the protocols

that work at this layer include

Front 287

What OSI Layer? File฀Transfer฀Protocol฀(FTP)

Back 287

Application

FTP฀ports฀21฀and฀20

Front 288

What OSI Layer? Trivial฀File฀Transfer฀Protocol฀(TFTP)

Back 288

Application

Trivial฀File฀Transfer฀Protocol฀(TFTP)฀servers฀are฀commonly฀used฀

to฀save฀the฀configuration฀settings฀from฀network฀devices.฀However,฀TFTP฀is฀an฀

insecure฀protocol,฀some฀network฀settings฀are฀sensitive฀and฀should฀be฀kept฀

confidential,฀and฀a฀coordinated฀attack฀is฀possible฀against฀network฀devices฀

that฀load฀their฀configurations฀using฀TFTP฀by฀first฀causing฀the฀network฀device฀

to฀fail฀and฀then฀attacking฀the฀TFTP฀download฀of฀the฀configuration฀to฀cause฀a฀

malicious฀configuration฀to฀be฀loaded.฀Alternatives฀to฀TFTP฀should฀be฀sought.

Front 289

What OSI Layer? Simple฀Network฀Management฀Protocol฀(SNMP)

Back 289

Application

Simple฀Network฀Management฀Protocol฀(SNMP)

SNMP฀ports฀161฀and฀162

Front 290

What is SNMP ports 161 and 162

SNMP฀uses฀agents฀and฀managers.฀Agents฀collect฀and฀maintain฀device-oriented฀

data, which are held in management information bases. Managers poll the

agents using community string values for authentication purposes.

Back 290

Application layer. Simple Network Management Protocol (SNMP) A protocol within the IP suite that is used for network device management activities through the use of a structure that uses managers, agents, and Management Information Bases.. Management Information Base (MIB). An MIB is a logical grouping of managed objects that contain data used for

specific management tasks and status checks.

Front 291

which version of SNMP uses encryption ?

Back 291

with version 3, cryptographic functionality has been added, which provides

encryption, message integrity, and authentication security. So the sniffers that

are installed on the network cannot sniff SNMP traffic.

Front 292

Which of the following is the best countermeasure to put into place to help

reduce the threat of network sniffers viewing network management traffic?

A. SNMP v3

B. L2TP

C. CHAP

D. Dynamic packet filtering firewall

Back 292

SNMP v3

with version 3, cryptographic functionality has been added, which provides

encryption, message integrity, and authentication security. So the sniffers that

are installed on the network cannot sniff SNMP traffic.

Front 293

Bob has noticed that one of the network switches has been acting strangely

over the last week. Bob installed a network protocol analyzer to monitor the

traffic going to the specific switch. He has identified UDP traffic coming from

an outside source using the destination port 161. Which of the following best

describes what is most likely taking place?

A. Attacker is modifying the switch SNMP MIB.

B. Attacker is carrying out a selective DoS attack.

C. Attacker is manipulating the ARP cache.

D. Attacker is carrying out an injection attack.

Back 293

A. If an attacker can uncover the read-write string she could change values

held within the MIB, which could reconfigure the device. The usual default

read-only community string is “public” and the read-write string is “private.”

Many companies do not change these, so anyone who can connect to port 161

can read the status information of a device and potentially reconfigure it. The

SNMP ports (161 and 162) should not be open to untrusted networks, like

the Internet, and if needed they should be filtered to ensure only authorized

individuals can connect to them.

Front 294

Which OSI layer? Simple฀Mail฀Transfer฀Protocol฀(SMTP)

An Internet standard protocol

for electronic mail (e-mail) transmission across IP-based networks.

Back 294

Application port 25 works฀as฀a฀transfer฀agent฀for฀e-mail฀messages. When

SMTP technologies were developed, the concept of e-mail spoofing didn’t exist, so

countermeasures for this type of threat were not embedded into the protocol. A user

could use an SMTP server to send e-mail to anyone from any e-mail address.

Front 295

SMTP authentication (SMTP-AUTH)

Back 295

was developed to provide an access control

mechanism. This extension comprises an authentication feature that allows clients to

authenticate to the mail server before an e-mail is sent. Servers using the SMTP-AUTH

extension are configured in such a manner that their clients are obliged to use the extension

so that the sender can be authenticated.

E-mail spoofing can be mitigated in several ways. The SMTP server can be configured

to prevent unauthenticated users from sending e-mails. It

Front 296

E-mail spoofing

Back 296

Activity in which the sender address and other

parts of the e-mail header are altered to appear as though the e-mail

originated from a different source. Since SMTP does not provide any

authentication, it is easy to impersonate and forge e-mails

Front 297

Which OSI layer? Telnet

Back 297

Application Telnet฀port฀23

SSH should be used instead of Telnet

Front 298

Secure Shell (SSH)

Back 298

Network protocol that allows for a secure

connection to a remote system. Developed to replace Telnet and other

insecure remote shell methods. SSH can encrypt. Telnet can't

Front 299

Which OSI Layer? Hypertext฀Transfer฀Protocol฀(HTTP)

Back 299

Application layer port 80

SSL works to protect HTTP. HTTP

sits on top of TCP/IP. HTTP is a stateless protocol, which means the client and web server make and break

a connection for each operation.

Front 300

Which Layer of OSI SSL Secure Sockets Layer? SSL is currently at version 3.0. Since SSL was developed by Netscape, it is not an

open-community protocol. Although SSL is almost always used with HTTP, it can also be used with other types

of protocols. So if you see a common protocol that is followed by an s, that protocol is

using SSL to encrypt its data.

Back 300

SSL is on the Transport layer. HTTP Secure (HTTPS) is HTTP running over SSL. (HTTP works at the application layer, and SSL works at the transport layer.) Secure Sockets Layer (SSL) uses public key encryption

and provides data encryption, server authentication, message integrity, and optional client authentication.

Front 301

TLS replaces Netscapes SSL since it's not open community SSL and TLS are commonly used when data need to be encrypted while “in transit,”

which means as they are moving from one system to another system.

Back 301

So the open-community and standardized

version of SSL is Transport Layer Security (TLS). The differences between SSL 3.0 and

TLS are slight, but TLS is more extensible and is backward compatible with SSL.

Front 302

Secure HTTP

Back 302

S-HTTP is a technology that protects each message sent between two computers,

SSL/TLS is for all data

Front 303

In฀IPSec AH provides _____ and ______

ESP provides those plus _______

Back 303

In฀IPSec AH provides integrity and authentication

ESP provides those plus confidentiality

Front 304

What IPSEC provides integrity and authentication?

Back 304

AH

Front 305

What IPSEC provides integrity, authentication and confidentiality?

Back 305

ESP

Front 306

IPSEC protocols can work in the ______ mode (the data payload is protected)

Back 306

transport mode

Front 307

IPSEC protocols can work in the ______ mode (the payload and headers are protected)

Back 307

tunnel mode

Front 308

Encapulating Security Protocol ESP

Back 308

Protocol within IPSEC suite used for integrity, authentication and protection

isn't impacted by NAT which changes the ICV (integrity check value aka MAC value) it doesn't encrypt the network header portion so NAT won't change the IP. ESP is calculated over only the data payload and transport headers

Front 309

Authentication Header Protocol AH

Back 309

Protocol in IPSEC used for integrity and authentication

is impacted by NAT which changes the ICV (integrity check value aka MAC value). AH is calculated over the data payload, transport and network headers

Front 310

Ipsec

Back 310

used to protect IP traffic through authentication. The de facto standard in vpn protocol.

Front 311

Internet Key Exchange IKE

Back 311

is a combination of ISAKMP (Internet Security Association and Key Management Protocol) and OAKLEY

ISAKMP set's up the playing field and OAKLEY is the player on the field carrying out steps of the negotiation

works with SKIP at Network Layer

Front 312

SKIP Simple Key Management Protocol

Back 312

another key exchange protocol that provides basically the same functionality as IKE working at the network layer

Front 313

why AH vs ESP

Back 313

AH is impacted by NAT which will change the network header. ESP won't.

Front 314

SA (Security Association)

Back 314

critical to Ipsec is a record of configurations the device needs to support an Ipsec connection

Front 315

SPI Security Perimeter Index

Back 315

Each device has a spi TO KEEP TRACK of different SA's and tells the device which one is appropriate to invoke for the different packets it receives.