5 - Cryptography

Cryptography

The science of protecting data by transforming it into a format that cannot be understood by unauthorized users.

Plaintext

Readable or recognizable information before encryption.

Ciphertext

Unreadable or unrecognizable data after encryption.

Encryption

The process of converting plaintext to ciphertext.

Decryption

The process of converting ciphertext back to plaintext.

Encryption Algorithm

A mathematical formula used to perform encryption.

Key

A secret value used in the encryption and decryption process.

Message Digest

The resulting output from a hashing algorithm.

Diffusion

Spreads out the influence of plaintext over the ciphertext.

Entropy

Measure of randomness used in key generation.

Symmetric Encryption

Encryption using the same key for both encryption and decryption.

Asymmetric Encryption

Encryption using a public and private key.

Hashing

One-way transformation that ensures data integrity.

Non-Repudiation

Prevents users from denying they sent or received data.

Block Cipher

Encrypts fixed-size chunks of data (e.g., AES, 3DES)

Stream Cipher

Encrypts data one bit or byte at a time using a keystream

Initialization Vector (IV)

A random value used with a key for added uniqueness

Block cipher operation modes

What are these? ECB/CBC/CTR/GCM

Session Key

A symmetric key used for a single session

DES

Symmetric encryption algorithm, 56-bit key, outdated, first cracked in 1997

3DES

Symmetric encryption algorithm, applies DES three times with two or three keys

AES

Symmetric encryption algorithm, most widely used today; 128, 192, or 256-bit keys

Blowfish / Twofish

Symmetric encryption algorithm, flexible, secure alternatives

RC5

Symmetric encryption algorithm, part of the Rivest Cipher family, variable block/key sizes

Salsa20

Symmetric encryption algorithm, modern, efficient stream cipher

IDEA

Symmetric encryption algorithm, known for strong encryption, less common today

ECB (Electronic Codebook)

block cipher mode, semantically secure, same key on every block, insecure

CBC (Cipher Block CHaining)

block cipher mode, semantically secure, chains blocks using IV and previous ciphertext

CTR (Counter Mode)

block cipher mode, semantically secure, encrypts blocks using incrementing counter as IV

GCM (Galois/Counter Mode)

block cipher mode, authenticated, combines CTR with integrity checks

CCM

block cipher mode, authenticated, combines CTR with CBC-MAC

EtM (Encrypt-then-MAC)

block cipher mode, authenticated, encrypts then authenticates

AEAD (Authenticated Encryption with Associated Data)

block cipher mode, authenticated, encrypts while authenticating headers and payload

Block Cipher

fixed data size blocks, slightly slower speed, more robust modes of security. e.g., AES, DES

Stream Cipher

bit or byte stream/dynamic data size, faster speed, vulnerable to key reuse. e.g., RC4, Salsa20

Public Key

Shared freely, used to encrypt or verify.

Private Key

Kept secret, used to decrypt or sign.

RSA

encryption & signatures, asymmetric algorithms, based on two large primes, can be broken by quantum computers

DSA

digital signatures only, asymmetric algorithm, governement-backed standard

ECDSA

ECC-based signature, asymmetric algorithm, used in cryptocurrency

Elliptic Curve Cryptography (ECC)

encryption & signatures, asymmetric algorithm, efficient with smaller keys, can be broken with quantum computers

Diffie-Hellman (DH)

A method for secure key exchange, asymmetric algorithm, not for direct encryption

FIPS 140-3

U.S. cryptographic module validation standard

Post-Quantum Cryptography (PQC)

Encryption designed to resist quantum attacks

Digital Signature

Encrypted hash proving message origin and integrity.

Checksum

A basic type of hash used for detecting errors.

Avalanche Effect

A small change in input causes a large change in output.

Deterministic

The same input always produces the same output. Hash functions do have this quality.

Collision Resistance

It is difficult to find two different inputs that result in the same hash.

Cryptographic Hash Function

A secure form of hashing used in security applications

Non-Cryptographic Hash

Used in databases or indexing, not for security.

MD5

hash algorithm, fast but vulnerable to collisions; obsolete

SHA-1

hash algorithm, better than MD5, still considered insecure

SHA-2 (SHA-256, SHA-512)

hash algorithm, modern standard, used widely

SHA-3

successor to SHA-2; not yet widely adopted

RIPEMD

hash algorithm, used in OpenSSL and some crypto systems; european standard

Digital Certificate

Verifies a public key’s association with an entity.

Certificate Authority (CA)

Entity that issues and verifies digital certificates.

Public Key Infrastructure (PKI)

Framework for managing digital certificates and public-key encryption.

Rainbow Table

A precomputed list of hashes used to reverse simple hashed passwords

NTLM (NT LAN Manager)

Legacy Microsoft password hashing method. Relies on MD5, which is now broken.

brypt

Hashing algorithm. Built on the Blowfish algorithm, uses a 128-bit salt and produces a 184-bit hash, supports key stretching to slow brute-force attacks

PBKDF2 (Password-Based Key Derivation Function 2)

Hashing algorithm. IETF standard created by RSA, combines passwords with salt and HMAC, slower and more customizable than bcrypt, generally weaker than bcrypt, still used in some enterprise applications

scrypt

hashing algorithm, builds on bcrypt with increased memory-hardness, good for defending against ASICs

Argon2

Hashing algorithm, winner of the password hashing competition, supports multiple modes of resistance (time, memory, parallelism)

PGP (Pretty Good Privacy)

Encryption tool used to sign and verify files

CSR (Certificate Signing Request)

Request submitted to a CA to issue a certificate

CRL (Certificate Revocation List)

List of revoked certificates

OSCP (Online Certificate Status Protocol)

Checks certificates’ status in real time

Domain Validation (DV)

Digital certificate validating ownership of a domain

User/Machine Auth

Digital certificate for identity and system validation

Email (S/MIME)

Digital certificate that encrypts/signs emails

Code Signing

Digital certificate that verifies software authenticity.

SAN / Wildcard

Digital certificate that supports multiple domains/subdomains

EV

Digital certificate that has an extended validation for high-assurance identity

Qualified

Digital certificate issued by a QTSP for legal compliance

GPG (GNU Privacy Guard)

Open-source replacement for PGP

OpenSSL

Software library supporting SSL/TLS and encryption protocols

X.509 Certificates

Digital certificates used to verify identity and support encrypted communication

Cryptanalytic Attack

Attacks aimed to exploit mathematical weaknesses in the encryption algorithm, implementation flaws in how encryption is deployed, and human errors in key management or usage.

Brute Force Attack

Attack that tries every possible key until the correct one is found, effective only against weak encryption or short keys, requires massive computational power and time

Ciphertext-Only Attack

An attack where the attacker only has intercepted ciphertext and uses frequency analysis, statistical methods, and guesswork/brute force to move forward.

Known Plaintext Attack

An attack where the attacker has both the plaintext and the corresponding ciphertext. Their goal is to determine the encryption key.

Implementation Attack

An attack where how the system is used is exploited. E.g., poor key storage, misconfigured crypto libraries.

Side Channel Attack

An attack where the attacker observes physical or operational characteristics for an in. (e.g., power consumption, electromagnetic leaks, sound or timing)

Chosen Ciphertext Attack

An attack where the attacker provides the victim with a crafted ciphertext, observes the resulting plaintext, and their goal is to infer the key or decryption method.

Fault Injection

A more active version of a side-channel attack. They use techniques like power surges, overclocking, heating or cooling the system to induce errors that reveal internal behavior or key bits.

Timing Attack

An attack where attackers measure how long the system takes to encrypt/decrypt, revealing key length, algorithm type, and pattern of operation.

Man-in-the-Middle (MITM) Attack

An attack where the attacker intercepts communication between sender and recipient, modifying, capturing, or relaying data while both parties they think are talking directly. Can defeat key exchanges (if no authentication) and SSL/TLS if not properly validated.

Pass-the-Hash (PtH)

Modern cryptanalytic technique. Exploits password hashes, used in Windows systems, attacker obtains a stored NTLM or Kerberos hash and reuses it to authenticate.

Kerberos Exploitation

Modern cryptanalytic technique. Happens in SSO environments. If one system or token is compromised, all connected services may be accessible. E.g., ticket reuse, session hijacking.

Rainbow Table Attacks

Modern cryptanalytic technique. Uses precomputed hashes of common passwords. Fast and effective if passwords aren’t salted.