Quick Tips Chapter 8: Cryptography

Front 1

• Cryptography is the science of protecting information by encoding it into an
unreadable format.

Back 1

• The most famous rotor encryption machine is the Enigma used by the
Germans in WWII.

Front 2

• A readable message is in a form called plaintext, and once it is encrypted, it is
in a form called ciphertext.

Back 2

• Cryptographic algorithms are the mathematical rules that dictate the functions
of enciphering and deciphering.

Front 3

• Cryptanalysis is the study of breaking cryptosystems.

Back 3

• Nonrepudiation is a service that ensures the sender cannot later falsely deny
sending a message.

Front 4

• Key clustering is an instance in which two different keys generate the same
ciphertext from the same plaintext.

Back 4

• The range of possible keys is referred to as the keyspace. A larger keyspace and
the full use of the keyspace allow for more random keys to be created. This
provides more protection.

Front 5

• The two basic types of encryption mechanisms used in symmetric ciphers are
substitution and transposition. Substitution ciphers change a character (or bit)
out for another, while transposition ciphers scramble the characters (or bits).

Back 5

• A polyalphabetic cipher uses more than one alphabet to defeat frequency
analysis.

Front 6

• Steganography is a method of hiding data within another media type, such as
a graphic, WAV file, or document. This method is used to hide the existence of
the data.

Back 6

• A key is a random string of bits inserted into an encryption algorithm. The
result determines what encryption functions will be carried out on a message
and in what order.

Front 7

• In symmetric key algorithms, the sender and receiver use the same key for
encryption and decryption purposes.

Back 7

• In asymmetric key algorithms, the sender and receiver use different keys for
encryption and decryption purposes.

Front 8

• Symmetric key processes provide barriers of secure key distribution and
scalability. However, symmetric key algorithms perform much faster than
asymmetric key algorithms.

Back 8

• Symmetric key algorithms can provide confidentiality, but not authentication
or nonrepudiation.

Front 9

• Examples of symmetric key algorithms include DES, 3DES, Blowfish, IDEA,
RC4, RC5, RC6, and AES.

Back 9

• Asymmetric algorithms are used to encrypt keys, and symmetric algorithms
are used to encrypt bulk data.

Front 10

• Asymmetric key algorithms are much slower than symmetric key algorithms,
but can provide authentication and nonrepudiation services.

Back 10

• Examples of asymmetric key algorithms include RSA, ECC, Diffie-Hellman,
El Gamal, Knapsack, and DSA.

Front 11

• Two main types of symmetric algorithms are stream and block ciphers. Stream
ciphers use a keystream generator and encrypt a message one bit at a time. A
block cipher divides the message into groups of bits and encrypts them.

Back 11

• Block ciphers are usually implemented in software, and stream ciphers are
usually implemented in hardware.

Front 12

• Many algorithms are publicly known, so the secret part of the process is the
key. The key provides the necessary randomization to encryption.

Back 12

• Data Encryption Standard (DES) is a block cipher that divides a message into
64-bit blocks and employs S-box-type functions on them.

Front 13

• Because technology has allowed the DES keyspace to be successfully broken,
Triple-DES (3DES) was developed to be used instead. 3DES uses 48 rounds of
computation and up to three different keys.

Back 13

• International Data Encryption Algorithm (IDEA) is a symmetric block cipher
with a key of 128 bits.

Front 14

• RSA is an asymmetric algorithm developed by Rivest, Shamir, and Adleman
and is the de facto standard for digital signatures.

Back 14

• Elliptic curve cryptosystems (ECCs) are used as asymmetric algorithms
and can provide digital signature, secure key distribution, and encryption
functionality. They use much less resources, which makes them better for
wireless device and cell phone encryption use.

Front 15

• When symmetric and asymmetric key algorithms are used together, this is
called a hybrid system. The asymmetric algorithm encrypts the symmetric key,
and the symmetric key encrypts the data.

Back 15

• A session key is a symmetric key used by the sender and receiver of messages
for encryption and decryption purposes. The session key is only good while
that communication session is active and then it is destroyed.

Front 16

• A public key infrastructure (PKI) is a framework of programs, procedures,
communication protocols, and public key cryptography that enables a diverse
group of individuals to communicate securely.

Back 16

• A certificate authority (CA) is a trusted third party that generates and
maintains user certificates, which hold their public keys.

Front 17

• The CA uses a certification revocation list (CRL) to keep track of revoked
certificates.

Back 17

• A certificate is the mechanism the CA uses to associate a public key to a
person’s identity.

Front 18

• A registration authority (RA) validates the user’s identity and then sends the
request for a certificate to the CA. The RA cannot generate certificates.

Back 18

• A one-way function is a mathematical function that is easier to compute in
one direction than in the opposite direction.

Front 19

• RSA is based on a one-way function that factors large numbers into prime
numbers. Only the private key knows how to use the trapdoor and how to
decrypt messages that were encrypted with the corresponding public key.

Back 19

• Hashing algorithms provide data integrity only.

Front 20

• When a hash algorithm is applied to a message, it produces a message digest,
and this value is signed with a private key to produce a digital signature.

Back 20

• Some examples of hashing algorithms include SHA-1, MD2, MD4, MD5, and
HAVAL.

Front 21

• HAVAL produces a variable-length hash value, whereas the other hashing
algorithms mentioned produce a fixed-length value.

Back 21

• SHA-1 produces a 160-bit hash value and is used in DSS.

Front 22

• A birthday attack is an attack on hashing functions through brute force. The
attacker tries to create two messages with the same hashing value.

Back 22

• A one-time pad uses a pad with random values that are XORed against the
message to produce ciphertext. The pad is at least as long as the message itself
and is used once and then discarded.

Front 23

• A digital signature is the result of a user signing a hash value with a private
key. It provides authentication, data integrity, and nonrepudiation. The act
of signing is the actual encryption of the value with the private key.

Back 23

• Examples of algorithms used for digital signatures include RSA, El Gamal,
ECDSA, and DSA.

Front 24

• Key management is one of the most challenging pieces of cryptography. It
pertains to creating, maintaining, distributing, and destroying cryptographic
keys.

Back 24

• The Diffie-Hellman protocol is a key agreement protocol and does not
provide encryption for data and cannot be used in digital signatures.

Front 25

• TLS is the “next version” of SSL and is an open-community protocol, which
allows for expansion and interoperability with other technologies.

Back 25

• Link encryption encrypts the entire packet, including headers and trailers, and
has to be decrypted at each hop. End-to-end encryption does not encrypt the
headers and trailers, and therefore does not need to be decrypted at each hop.

Front 26

• Privacy-Enhanced Mail (PEM) is an Internet standard that provides secure
e-mail over the Internet by using encryption, digital signatures, and key
management.

Back 26

• Message Security Protocol (MSP) is the military’s PEM.

Front 27

• Pretty Good Privacy (PGP) is an e-mail security program that uses public key
encryption. It employs a web of trust instead of the hierarchical structure used
in PKI.

Back 27

• S-HTTP provides protection for each message sent between two computers,
but not the actual link. HTTPS protects the communication channel. HTTPS
is HTTP that uses SSL for security purposes.

Front 28

• Secure Electronic Transaction (SET) is a proposed electronic commerce
technology that provides a safer method for customers and merchants to
perform transactions over the Internet.

Back 28

• In IPSec, AH provides integrity and authentication, and ESP provides those
plus confidentiality.

Front 29

• IPSec protocols can work in transport mode (the data payload is protected)
or tunnel mode (the payload and headers are protected).

Back 29

• IPSec uses IKE as its key exchange protocol. IKE is the de facto standard and
is a combination of ISAKMP and OAKLEY.

Front 30

• DEA is the algorithm used for the DES standard.

Back 30

• DEA is the algorithm used for the DES standard.