Security+ Domain 5 - Cryptography

Front 1

What are some essentials to key management?

Back 1

Keys should be long enough
Keys should be stored and transmitted securely
Keys should be random and use the full spectrum of keyspace
The more the key is used or the shorter the key is, the shorter the lifetime should be.
Keys should be backed up or escrowed.
Keys should be properly destroyed at end of lifetime.

Front 2

What is Centralized key management?

Back 2

Gives complete control of cryptographic keys to the organization and takes it away from the end users
Allows key generation process to take advantage of large scale system resources.
Algorithms tend to be processor intensive
Management functions can be centralized
Key archive and storage may be vulnerable to attack - stores keys in escrow

Front 3

What is Decentralized key managment?

Back 3

Controlled by end users and end users private key is always kept private
Work decentralized and risks spread
No single point of failure or attack
Storage and management issues

Front 4

What is Steganography?

Back 4

Hiding one message in another like electornic watermarking.

Front 5

What are Substitution Ciphers?

Back 5

Changes one character or symbol into another. Simple. May keep someone out for a short time.

Front 6

What is Symmetric Key Cryptography?

Back 6

Requires both ends of encrypted message to have same key and processing algorithms
Symmetric key = secret key = private key
Typically keys are not sent across encrypted channel. Usually sent out of band
Strengths: Fast, strong encryption when larger keys are used
Weaknesses: keys must be kept private or not at all secure, key exchange is a common problem, not scalable when used alone.

Front 7

What is a Block Cipher?

Back 7

Works against a complete static data set. Data set is broken into fixed length segments called blocks and each block is encrypted separately.

Front 8

What is a Stream Cipher?

Back 8

Works against data that is constantly being produced on the fly. Can operate on a bit, character or buffer basis. Encrypts data in real time.

Front 9

Describe Advanced Encryption Standard (AES).

Back 9

Symmetric Cryptography Solution.
Uses Rijndael block cipher algorithm
Uses block size 128
Supports key sizes 128, 192, 256. (128 by default)

Front 10

Describe Data Encryption Standard (DES).

Back 10

Symmetric Cryptography Solution.
Uses block size 64
Supports key size 56 bits

Front 11

Describe Triple DES.

Back 11

Symmetric Cryptography Solution.
Uses block size 64
Supports key size 128 bits

Front 12

Describe Carlisle Adams/Stafford Tavares (CAST).

Back 12

Symmetric Cryptography Solution.
Uses block sizes of 32, 64, 128
Uses 40 bit to 128 bit key size in increments of 8
Fast and efficient

Front 13

Describe Rivest's cipher.

Back 13

Symmetric Cryptography Solution.
Uses block sizes of 32, 64, 128
Uses key size 0-2040

Front 14

Describe Blowfish.

Back 14

Symmetric Cryptography Solution.
64 bit block size
Uses key size of 32 - 448

Front 15

Describe Twofish.

Back 15

Symmetric Cryptography Solution.
Block size 128
Key size 128, 192, 256

Front 16

Describe International Data Encryption Algorithm (IDEA).

Back 16

Symmetric Cryptography Solution.
Block size of 64
Key size 128
Similar to speed and capability to DES but more secure

Front 17

Describe Asymmetric Algorithms.

Back 17

Also called Public Key Cryptography
Public keys and private keys - use two keys to encrypt and decrypt
Public key may be private or could be known by both sides
Strengths: scalable, possession of the public key doesn't allow someone to generate the private key.
Weaknesses: slower than symmetric.
Provides authentication, integrity and non repudiation.

Front 18

Describe Rivest-Shamir-Adleman (RSA).

Back 18

Asymmetrical Key Soution
Early system
Uses large integer numbers as basis of process
De facto standard
Works for encryption and digital signatures

Front 19

Describe Diffie Hellman.

Back 19

Asymmetrical Key Soution
Algorithm is used primarily to send keys across public network

Front 20

Describe Elliptical Curve Cryptography (ECC)

Back 20

Asymmetrical Key Soution
Used in cell phones and wireless devices
Uses points on a curve to define public/private key pair.
Similar to RSA but less mathematically intensive

Front 21

Describe El Gamal

Back 21

Asymmetrical Key Soution
Used for transmitting digital signatures and key exchanges
Process similar to Diffie Hellman

Front 22

What is confidentiality?

Back 22

Prevents or minimizes unauthorized access of data.

Front 23

What is integrity?

Back 23

Prevents unauthorized alterations of data.

Front 24

What is Non-repudiation?

Back 24

Prevents the sender from being able to deny that they sent the message.

Front 25

What is Authentication?

Back 25

Security service that verifies the identity of the sender or receiver of a message.

Front 26

What are Digital Signatures?

Back 26

Electronic mechanism to prove that a message was sent from a specific user and that the message wasn't changed while in transit.
Derived from a hash process known only by the originator.

Front 27

What is Trusted Platform Module (TPM)?

Back 27

Whole disk encryption which uses a TPM chip to release the hard drive encryption keys into memory.

Front 28

What is Hashing?

Back 28

Hashing is used to produce a unique data identifier. Takes variable length input and produces a fixed length output. One directional. Hash value can be used to ensure data integrity.

Front 29

What is Secure Hash Algorithm (SHA)?

Back 29

Hashing Algorithm.
Produces hash value that can be used with an encryption protocol
160-bit hash value

Front 30

What is Message Digest 5 (MD)?

Back 30

Hashing Algorithm.
MD5, MD4, MD2
Text expresses as single string of digits
MD5 is faster than SHA and uses 128 bit hash

Front 31

What is LANMAN?

Back 31

Legacy storage mechanism used by older versions of windows.
Was replaced by NTLM
Limited password length to 14 characters and shorter passwords were padded out to 14

Front 32

What is NTLM?

Back 32

Challenge response protocol system
Came with Windows NT
Uses MD4 and MD5 hashing

Front 33

What is Pretty Good Privacy (PGP)?

Back 33

Similar to S/MIME
Uses digital signatures
Now de facto encryption for email.
Uses both symmetrical and asymmetrical

Front 34

What is One time pad?

Back 34

Basis for modern cryptography from SSL to IPSec.
Real or virtual paper pad contains codes or keys on each page that are random and do not repeat.

Front 35

What is S/MIME?

Back 35

Standard used to encrypt email
MIME is the de facto standard for email messages. S/MIME is secure version

Front 36

What is Point to Point Tunneling Protocol (PPTP)?

Back 36

Encapsulation in a single point to point environment
Encapsulates and encrypts PPP packets
Vulnerability - negotiation in the clear. Can be sniffed
Uses TCP and UDP
Does not work with IPSE

Front 37

What is Layer 2 Tunneling Protocols (L2TP)?

Back 37

Hybrid of PPTP and L2F
Point to point (PPP)
Supports multiple network protocols
Can be used in networks besides TCP/IP (interoperability)
Uses UDP
Works with IPSec (very secure)

Front 38

What is the difference between HTTPS and S-HTTP?

Back 38

HTTPS is a secure channel between client and server. S-HTTP creates secure message rather than secure channel. Also provides data integrity and authentication.

Front 39

What is IP Security (IPSec)?

Back 39

Both stand alone VPN protocol and module that can be used with L2TP.
Authentication and encryption across internet
Standard for encrypting VPN channels
Together with Layer 2 Tunneling Protocol (L2TP) and Layer 2 Forwarding (L2F) creates packets that are difficult to read if intercepted
Works on Layer 3 (Network Layer) of OSI model
In tunnel mode, provides encryption for payload and message header. In tansport mode only encrypts payload.

Front 40

What are AH and ESP?

Back 40

Two of the primary protocols of IPSec. Authentication Header (AH) and Encapsulating Security Payload (ESP)
AH: Authentication Header, responsible for authenticity and integrity. Authenticates packets by signing them.
ESP Encapsulating Security Payload. Handles payload

Front 41

What is IKE?

Back 41

Internet Key Exchange ensures secure exchange of secure keys between communications partners to establish VPN tunnel.

Front 42

What is ISAKMP?

Back 42

Internet Security Association Key Management Protocol: A framework for establishing, negotiating, modifying and deleting security associations between to parties.

Front 43

What is Overloading NAT?

Back 43

Multiple inside local addresses share a single inside global address

Front 44

What is a PKI?

Back 44

PKI defines infrastructure that should work across multiple vendors, systems, networks.
Framework, not a technology.
Focuses on providing identity of communication partners, providing a secure means to exchange session based symmetric encryption keys through asymmetric cryptographic solutions, and providing a means to protect message integrity through the use of hashing.

Front 45

What are certificates?

Back 45

Provide identity of a user or the source of an object. Don't provide proof of reliability or quality of the object or service

Front 46

What is X.509 version 3 certificate standard?

Back 46

Supported by International Telecommunications Union (ITU) and many other standards organizations
Information stored: version, serial number, signature algorithm, issuer, valid from, valid to, subject, public key, extensions, signature algorithm signature

Front 47

What are Certificate Policies?

Back 47

Define what purpose certificates have: financial transactions: email: ecommerce etc
Policy regarding interoperability
Acceptable use policies

Front 48

What are Certificate Practice Statements?

Back 48

Describe how a CA will manage the certificates. How managment will be performed. How security will be maintained.

Front 49

What can cause a certificate to be revocated?

Back 49

Subjects identity information has changed.
Subject used certificate to commit a crime.
Subject used certificate in a way that violated the CA's certificate policy.

Front 50

What is Online Certificate Status Protocol (OCSP)?

Back 50

Revocation solution that funtions on direct query basis.

Front 51

What is a Trust Model?

Back 51

Trust hierarchy used by a certificate authority system.

Front 52

What is Key Escrow?

Back 52

Storage process by which copies of private keys are retained by a centralized managment system.

Front 53

What is M of N control?

Back 53

If environment doesn't warrant the trust of a single key recovery agent, M of N can be implemented.
Indicates that there are Multiple key recovery agents (M) and that a specific minimum number of these key recovery agents (N) must be present and working in tandem to extract the keys from the escrow database.

Front 54

What is KHMAC used for?

Back 54

To digitally sign packets that are transmitted on IPSec connections.

Front 55

What is ISAKMP used for?

Back 55

Supports establishment of security associations (SAs) which are sets of parameters that define methods used by computers to communicate securely.