Security+ - Cryptography

Front 1

What is a cipher?

Back 1

A method used to encode characters to hide their value. Ciphering is the process of using a cipher to encode a message.

Front 2

What is a substitution cipher?

Back 2

a type of coding or ciphering system that changes one character or symbol into another.

Front 3

What is a transposition cipher or transposition code?

Back 3

A cipher that involves transposing or scrambling the letters in a certain manner.

Front 4

What is steganography?

Back 4

Steganography is the process of hiding one message in another. Also called electronic watermarking.

Front 5

What is hashing?

Back 5

Hashing refers to performing a calculation on a message and converting it into a numeric hash value.

Front 6

What is a TPM?

Back 6

A Trusted Platform Module is a name assigned to a chip that can store cryptographic keys, passwords, and certificates.

Front 7

What scientific principle does quantum cryptography rely on?

Back 7

The Heisenberg Uncertainty Principle, which states that in the process of measuring the results, the results are changed.

Front 8

What is Frequency Analysis?

Back 8

Frequency Analysis involves looking at blocks of an encrypted message to determine if any common patterns exist.

Front 9

What are the three primary methods of encoding messages?

Back 9

hashing, symmetric algorithms, and using asymmetric algorithms.

Front 10

What is a one-way hash and a two-way hash?

Back 10

A one-way hash doesn't allow a message to be decoded back to the original value. A two-way hash allows a message to be reconstructed from the hash. Most hashing functions are one-way.

Front 11

What is SHA?

Back 11

Secure Hash Algorithm.
One-way Hash
Designed to ensure message integrity
Produces 160-bit hash value
New standard is SHA-1

Front 12

What is MD?

Back 12

The Message Digest Algorithm
One-way hash
most common are MD5, MD4, & MD2
MD5 = 128-bit hash

Front 13

Which is faster to process MD5 or SHA-1?

Back 13

MD5 is faster

Front 14

What is LANMAN?

Back 14

LANMAN was used for protocol authentication in windows prior to NT. It uses LM Hash and two DES keys.

Front 15

What is NTLM?

Back 15

NTLM replaced the LANMAN protocol and uses MD4/MD5. Still in widespread use despite the fact that microsoft has pointed to kerberos as the preferred protocol.

Front 16

What is a symmetric algorithm?

Back 16

an algorithm that requires both ends of the encrypted message to have the same key and processing algorithms. They generate a key that must be protected.

Front 17

How are keys typically sent with a symmetric algorithm?

Back 17

Using an out-of-band method: by letter, courier, or by some other method.

Front 18

What is the disadvantage of a symmetric algorithm?

Back 18

Everyone must have their own key.

Front 19

Define block cipher

Back 19

the algorithm works on chunks of data

Front 20

Define stream cipher

Back 20

the data is encrypted a bit, or byte, at a time.

Front 21

What is DES?

Back 21

Data Encryption Standard
56-bit key
Replaced by AES

Front 22

What is AES?

Back 22

Advanced Encryption Standard
Replaced DES
key sizes 128, 192, and 256 with 128 being the default
AES-256 qualifies US government Top Secret

Front 23

What is CAST?

Back 23

algorithm used in some MS and IBM products. Named after its creators. Uses 40-bit to 128-bit key and is very fast and efficient.

Front 24

What is Rivest's Cipher?

Back 24

RC is an encryption family produced by RSA laboratories. Current levels are RC5 and RC6. RC5 uses a key size of 2,048 bits.

Front 25

What is Blowfish?

Back 25

encryption system by Bruce Shneier. Performs a 64-bit block cipher at very fast speeds. Is a symmetric block cipher that can be use variable length keys.
Twofish is the same thing but with 128-bit blocks.

Front 26

What is IDEA?

Back 26

International Data Encryption Algorithm. Uses a 128-bit key and is similar to DES in speed and capability but is more secure.
Used in PGP.

Front 27

What are Asymmetric Algorithms?

Back 27

Public key and private key system of algorithms. The public key is used to encrypt the message and the private key is used to decrypt.

Front 28

What is PKC?

Back 28

Public Key Cryptography. Two-key system.

Front 29

What is RSA?

Back 29

public-key encryption system that uses large integer numbers as a basis of the process.
The defacto standard.
works for both encryption and digital signatures
Used in SSL

Front 30

What is the Diffie-Hellman key exchange?

Back 30

Process of splitting keys into two parts. Not used to encrypt or decrypt just to transmit keys in a secure manner.

Front 31

What is ECC?

Back 31

Elliptic Curve Cryptography provides similar functionality to RSA but is smaller and requires less computing power. It is used in cellphones and wireless devices. It is based on the idea of using points on a curve to define public/private key pair.

Front 32

What is El Gamal

Back 32

An algorithm used for transmitting digital signatures and key exchanges. Similar process to Diffie-Hellman key exchange. the Digital Signature Algorithm (DSA) is based on El Gamal.

Front 33

What is an algorithm's work factor?

Back 33

The estimated amount of time and effort that would be needed to break it.

Front 34

What is MAC in cryptography?

Back 34

Message Authentication Code - a method of verifying integrity. The MAC value is a key, usually derived using a hashing algorithm.

Front 35

What is a digital signature?

Back 35

A digital signature validates the integrity of the message and the sender. The sender uses the receiver's public key to create a hash value that is stored in the message digest.

Front 36

What is nonrepudiation?

Back 36

Nonrepudiation prevents one party from denying actions they carried out. It can be achieved by a two key system.

Front 37

Define Access Control.

Back 37

Access control refers to the methods, processes, and mechanisms of preventing unauthorized access to the systems.

Front 38

What are the four parts of a PKI?

Back 38

Certificate Authority (CA)
Registration Authority(RA)
RSA
Digital Certificates

Front 39

What is a registration authority (RA)?

Back 39

An RA offloads some of the work from a CA. It operates as a middleman. It can distribute keys, accept registrations for the CA, and validate identities. It doesn't issue certificates.

Front 40

What is a LRA?

Back 40

Local Registration Authority - Takes an RA a step further. It can be used to identify or establish the identity of an individual for certificate issuance.

Front 41

Standard certificate format supported by the International Telecommunications Union (ITU) and many other standards organizations.

Back 41

X.509 (version 3 is most current)

Front 42

What defines what a certificate does?

Back 42

Certificate Policies.

Front 43

the process of requiring interoperability in certificates is called...

Back 43

cross certification

Front 44

a detailed statement the CA uses to issue certificates and implement its policies of the CA

Back 44

Certificate Practice Statement

Front 45

What problem occurs with a Certificate Revocation List (CRL) that using the Online Certificate Status Protocol (OSCP) resolves?

Back 45

OCSP solves the latency problem: If the recipient or relying party uses OCSP for verification, the answer is available immediately.

Front 46

What are the four trust models used with PKI?

Back 46

Hierarchical, Bridge, Mesh, & Hybrid

Front 47

Responsible for creating codes, breaking codes, and coding systems for the U.S. Government.

Back 47

National Security Agency (NSA)

Front 48

Independently functioning part of NSA, created to help standardize and support DoD and military.

Back 48

NSA/Central Security Service (NSA/CSS)

Front 49

Has been involved in developing and supporting standards for the US government for over 100 years. Has become very involved in cryptography standards, systems, and technology. Formerly known as the National Bureau of Standards (NBS)

Back 49

National Institute of Standards and Technology (NIST)

Front 50

the mechanism used to propose a standard

Back 50

Request for Comments (RFC)

Front 51

International community of computer professionals, mainly concerned with improving the internet and computer security issues.

Back 51

Internet Engineering Task Force (IETF)

Front 52

A professional group who oversees a number of committees and groups including IETF.

Back 52

the Internet Society (ISOC)

Front 53

Association concerned with interoperability, growth, and standardization of the World Wide Web.

Back 53

World Wide Web Consortium (W3C)

Front 54

Responsible for virtually all aspects of telecommunications and radio communications standards worldwide.

Back 54

International Telecommunications Union (ITU)

Front 55

Three main groups the ITU is broken into?

Back 55

ITU-R -- Radio communication and spectrum management.
ITU-T -- telecommunications standards
ITU-D -- expanding telecommunications throughout developed countries.

Front 56

International organization actively involved in the development of PKC, wireless, and networking protocol standards.

Back 56

Institute of Electrical an Electronics Engineers (IEEE)

Front 57

Standards and protocols that emerge from individual or corporate efforts and are released to the general public for use.

Back 57

Public domain cryptography
PGP and RSA are two common types

Front 58

What kind of encryption does Pretty Good Privacy (PGP) use?

Back 58

symmetrical and asymmetrical

Front 59

Provides cryptographic systems to both private businesses and government. Has been very involved in developing Public-Key Cryptography Standards (PKCS) and maintains a list of these standards.

Back 59

RSA

Front 60

The working group formed by the IETF to develop standards and models for the PKI environment.

Back 60

Public-Key Infrastructure X.509 (PKIX)

Front 61

A set of voluntary standards created by RSA and security leaders. Currently there are 15 of these standards.

Back 61

Public-Key Cryptography Standards (PKCS)

Front 62

Standard that defines the certificate formats and fields for public keys. Also defines the procedures that should be used to distribute public keys.

Back 62

X.509 (version 3 is most common)

Front 63

Two basic types of X.509 v3 certificates.

Back 63

The most common is end-entity certificate, which is issued by a certificate authority to an end entity. An end entity is a system that doesn't issue certificates but merely uses them.

The CA certificate is issued by one CA to another CA.

Front 64

What is X.509 v2 used for?

Back 64

Issuing Certificate Revocation List (CRL) certificates.

Front 65

Used to establish a secure communication connection between two TCP-based machines. Uses the handshake method of establishing a session.

Back 65

Secure Sockets Layer (SSL)

Front 66

What are the steps in an SSL handshake?

Back 66

1) A connection request is made to the server.
2) The server sends a message to client indicating that a secure connection is needed.
3) The client sends the server a certificate indicating the capabilities of the client.
4) The server then evaluates the certificate and responds with a session key and an encrypted key.
5) The session is secure at the end of this process.

Front 67

Security protocol that expands upon SSL. Referred to as SSL 3.1 but despite its name it doesn't interoperate with SSL. Supported by the IETF

Back 67

Transport Layer Security (TLS)

Front 68

A messaging protocol used between PKI entities, not yet widely used.

Back 68

Certificate Management Protocol (CMP)

Front 69

Designed to allow XML-based programs access to PKI services.

Back 69

XML Key Management Specification (XKMS)

Front 70

A standard used for encrypting email. Contains signature data. Most widely supported standard used to secure e-mail communications.

Back 70

Secure Multipurpose Internet Mail Extensions (S/MIME)

Front 71

Provides encryption for credit card numbers that can be transmitted over the Internet. Most suited for transmitting small amounts of data. Works in conjunction with an electronic wallet.

Back 71

Secure Electronic Transaction (SET)

Front 72

A tunneling protocol with a handshake process similar to SSL. Connections are established in two phases: The first phase is a secure channel to negotiate the channel connection, and the second phase is a secure channel used to establish the connection.

Back 72

Secure Shell (SSH)

Front 73

The secure version of HTTP. Uses SSL to secure the channel. Uses port 443.

Back 73

Hypertext Transport Protocol Secure (HTTPS)

Front 74

HTTP with message security, uses port 443.

Back 74

Secure Hypertext Transport Protocol (S-HTTP)

Front 75

A security protocol that provides authentication and encryption across the Internet. Becoming the standard for encrypting VPN channels. Works on layer 3 of the OSI model.

Back 75

IP Security (IPSec)

Front 76

The two primary protocols used by IPSec at the bottom layer. What ports?

Back 76

Authentication Header (AH) - port 51
Encapsulating Security Payloud (ESP) - port 50

Front 77

A favorite low end protocol for VPNs. The negotiation between the two ends of a connection are done in the clear. Once the negotiation is performed the channel is encrypted. Uses port 1723

Back 77

Point-to-Point Tunneling Protocol (PPTP)

Front 78

A method crated by Cisco for creating tunnels primarily for dialup connections. Uses port 1701. Doesn't provide encryption.

Back 78

Layer 2 Forwarding (L2F)

Front 79

A hybrid of PPTP and L2F. Doesn't provide encryption by itself but can be provided by IPSec. Uses port 1701 and UDP for connection

Back 79

Layer 2 Tunneling Protocol (L2TP)

Front 80

A set of guidelines for the United States federal government information systems. Issued by NIST.

Back 80

Federal Information Processing Standard (FIPS)

Front 81

An internationally agreed-upon set of standards to evaluate IT security.

Back 81

Common Criteria (CC)

Front 82

Provides encrypted and authenticated connection between a wireless client and server. Similar in function to TLS, but it uses lower bandwidth and less processing power.

Back 82

Wireless Transport Layer Security (WTLS)

Front 83

Places a 128-bit wrapper around the Wired Equivalent Privacy (WEP) encryption with a key that is based on such things as the MAC address of your machine and the serial number of the packet.

Back 83

Temporal Key Integrity Protocol (TKIP)

Front 84

Designed to address the problems with WEP. These technologies implement the 802.11i standard.

Back 84

WiFi Protected Access (WPA) & (WPA2)

Front 85

Provides a framework for authentication that is often used with wireless networks. Adopted by the WPA standard.

Back 85

Extensible Authentication Protocol (EAP). EAP-TLS and EAP-MD5

Front 86

refers to the process of working with keys from the time they are created until the time they are retired or destroyed.

Back 86

Key management

Front 87

Allows the key-generation process to take advantage of large-scale system resources. Has the advantage of allowing additional management functions to be centralized. Has a major disadvantage of single point of failure or attack.

Back 87

Centralized Key Generation

Front 88

Allows key-generation process to be pushed out into the organization or environment. Spreads the risks but creates a storage and management issue.

Back 88

Decentralized Key Generation

Front 89

Distributing keys is usually accomplished using a ____, as in Kerberos, or by using a _____, as in the case of PKI.

Back 89

Key Distribution Center (KDC) & Key Exchange Algorithm (KEA)

Front 90

Negotiates a secret key between two parties; the secret key is a short0term, single-use key intended strictly for key distribution.

Back 90

Key Exchange Algorithm (KEA)

Front 91

A system that stores keys for the purpose of law enforcement access.

Back 91

Key Escrow

Front 92

Identifies when a key is no longer valid.

Back 92

key expiration

Front 93

What is the difference between key ravocation and key suspension?

Back 93

Suspended keys can be used again. Revoked keys cannot, a new key must be issued.

Front 94

What is the M of N Control method of access used in key recovery?

Back 94

If n people have access to the archive server at least m must be present to accomplish access.