Chapter 7: Cryptography and the PKI

Mike is sending David an encrypted message using a symmetric encryption algorithm. What key should he use to encrypt the message?

Shared secret key

Shahla discovered an attack where an attacker forced a user to use weak encryption and then decrypted the content. What term best describes this attack?

Downgrade

Norm is using full-disk encryption to protect laptops against theft. What goal of cryptography is he achieving?

Confidentiality

Brian suspects a user is hiding sensitive data inside image files. What technique might they be using?

Steganography

Which one of the following statements about cryptographic keys is incorrect?

All cryptographic keys should be kept secret

What type of cipher operates on one character of text at a time?

Stream cipher

Vince wants the strongest symmetric encryption algorithm from the list. Which should he choose?

AES

Kevin wants clients to verify certificate status without contacting a remote server. What technology should he use?

Certificate stapling

Acme Widgets adds an 11th employee to a symmetric encryption system. How many new keys are required?

10

If Acme Widgets used asymmetric encryption, how many keys are required to add the 11th employee?

2

What type of digital certificate provides the greatest level of assurance?

EV

Which domain would not be covered by a wildcard certificate for *.mydomain.com?

dev.www.mydomain.com

Which server is almost always an offline CA in a large PKI deployment?

Root CA

Which certificate format is closely associated with Windows binary certificate files?

PFX

What security solution provides a hardware platform for storage and management of encryption keys?

HSM

What type of cryptographic attack forces users to reduce encryption strength?

Downgrade

David wants to send Mike a message using asymmetric encryption. What key should he use to encrypt it?

Mike's public key

When Mike receives the encrypted message, what key should he use to decrypt it?

Mike's private key

If David digitally signs the message, what key does he use to create the signature?

David's private key

When Mike verifies David's digital signature, what key does he use?

David's public key

What is the practice of encoding information so it cannot be decoded without the required decryption key

Cryptography.

In cryptography, what is the process of transforming plain-text information into ciphertext?

Encryption.

What cryptographic goal ensures that data is protected from prying eyes and corresponds to a leg of the CIA triad

Confidentiality.

Which goal of cryptography ensures that data is not maliciously or unintentionally altered

Integrity.

The cryptographic goal of _____ refers to the validation of an individual's identity

authentication

What cryptographic goal ensures that a sender cannot later claim they never sent a message

Non-repudiation.

A _____ is a method used to scramble or obfuscate characters to hide their value

cipher

What type of cipher changes one character or symbol into another

A substitution cipher.

What is the name of the ancient substitution cipher that works by shifting all letters a certain number of spaces in the alphabet, famously used by Julius Caesar with a shift of three?

The Caesar cipher.

What simple substitution cipher works by rotating every letter 13 places in the alphabet, allowing the same process to be used for both encryption and decryption?

ROT13.

Ciphers that use multiple substitution alphabets for the same message are known as _____ substitution ciphers

polyalphabetic

What famous historical polyalphabetic substitution cipher used a keyword and a Vigenère table for encryption

The Vigenère cipher.

What type of cipher involves scrambling the letters of a message in a certain manner, typically by breaking the message into blocks and reordering the characters within each block?

A transposition cipher.

What was the name of the machine used by the German government during World War II that implemented a polyalphabetic substitution for secure communications

The Enigma machine.

What is the art of using cryptographic techniques to embed secret messages within another file, such as an image or audio file?

Steganography.

What is a legitimate use of steganography for protecting intellectual property

Adding digital watermarks to documents or media.

Symmetric cryptosystems use a _____ secret key available to all users of the cryptosystem

shared

Asymmetric cryptosystems use individual combinations of _____ and _____ keys for each user

public; private

Data that resides in a permanent location awaiting access, such as on a hard drive or in cloud storage, is known as what?

Data at rest.

What term describes data being transmitted across a network between two systems, also known as data on the wire?

Data in transit.

Data that is stored in the active memory of a computer system where it may be accessed by a process is known as what

Data in use.

What form of encryption automatically encrypts all data on a hard drive, including the operating system?

Full-disk encryption (FDE).

Encrypting a specific partition of a hard drive rather than the entire disk is known as _____ encryption

partition

What level of encryption focuses on individual files, allowing users to encrypt specific files rather than entire drives?

File-level encryption.

Encrypting a defined set of folders and files on a storage device, as a middle ground between partition and file-level encryption, is called what?

Volume encryption.

A more granular form of database encryption that allows individual records within a database to be encrypted is known as _____ encryption

record-level

What cryptographic technique is used to verify the claimed identity of system users, often using a challenge-response protocol?

Authentication.

Before a message is encrypted, it is known as a _____-text message.

plain

After a plain-text message is encrypted, it becomes a _____-text message.

cipher

The range of values that are valid for use as a key for a specific algorithm is known as the _____

key space

What is the term for the number of binary bits (0s and 1s) in a cryptographic key

Key length.

What principle states that a cryptographic system should be secure even if everything about the system, except the key, is public knowledge?

The Kerckhoffs' principle.

The study of methods to defeat codes and ciphers is known as _____

cryptanalysis

_____ ciphers operate on 'chunks,' or blocks, of a message and apply the encryption algorithm to an entire message block at the same time.

Block

What type of cipher operates on one character or bit of a message at a time

A stream cipher.

Modern cryptosystems do not rely on the secrecy of their algorithms but rather on the secrecy of one or more _____

cryptographic keys

Symmetric key algorithms rely on a '_____ secret' encryption key that is distributed to all members who participate in the communications

shared

What is a major problem with symmetric key cryptography that involves the secure distribution of keys

Key exchange.

The major strength of symmetric key cryptography is its great _____

speed

In asymmetric key algorithms, each user has two keys: a _____ key, which is shared with all users, and a _____ key, which is kept secret.

public; private

If Alice wants to send an encrypted message to Bob using an asymmetric algorithm, which key should she use to encrypt the message?

Bob's public key.

When Bob receives an asymmetrically encrypted message from Alice, what key must he use to decrypt it?

Bob's private key.

What type of algorithm produces a summary of a message's content, known as a message digest?

A hashing algorithm.

In hashing, when two different messages produce the same hash value, this is known as a _____.

collision

What symmetric encryption standard, published in 1977 and using a 56-bit key, is no longer considered secure?

Data Encryption Standard (DES).

Which symmetric algorithm was chosen by NIST in 2000 as the replacement for DES and allows for key strengths of 128, 192, and 256 bits?

Advanced Encryption Standard (AES).

What key exchange algorithm allows two parties to establish a shared secret over an insecure channel without a pre-existing public key infrastructure

The Diffie-Hellman algorithm.

The security principle of providing two different individuals with half of a key, requiring them to collaborate to re-create it, is known as _____.

split knowledge

What system involves a third party storing a protected copy of a cryptographic key for use in an emergency, such as a lost key?

Key escrow.

What is the most famous public key cryptosystem, developed in 1977, whose security depends on the difficulty of factoring large prime numbers?

RSA.

The security of Elliptic Curve Cryptography (ECC) is based on the difficulty of solving the elliptic curve _____ logarithm problem

discrete

What is a key requirement for a cryptographic hash function, meaning it is extremely hard to determine the input when provided with the output?

It must be a one-way function.

What government standard hash function, promoted by NIST, includes variants like SHA-256 and SHA-512?

Secure Hash Algorithm (SHA).

To create a digital signature, a sender encrypts a message digest with their own _____ key.

private

To verify a digital signature, a recipient decrypts the signed message digest using the sender's _____ key.

public

What does HMAC stand for in the context of cryptographic algorithms

Hash-Based Message Authentication Code.

The hierarchy of trust relationships that facilitates communication between parties previously unknown to each other is known as the _____

Public Key Infrastructure (PKI)

What is the international standard that governs the construction and format of digital certificates

X.509.

What type of digital certificate can be valid for a domain and all of its first-level subdomains, designated by an asterisk (*)?

A wildcard certificate.

In PKI, what is the name for the neutral organizations that offer notarization services for digital certificates?

Certificate Authorities (CAs).

What is the term for the top-level certificate in a PKI that serves as the basis of trust for all certificates issued by the CA

The root certificate.

To obtain a digital certificate, a user provides their public key to a CA in the form of a _____.

Certificate Signing Request (CSR)

What type of certificate provides the highest level of assurance, where the CA verifies that the certificate owner is a legitimate business?

Extended Validation (EV) certificate.

A _____ is a list maintained by a CA that contains the serial numbers of certificates that have been revoked

Certificate Revocation List (CRL)

What protocol provides a means for real-time certificate verification, eliminating the latency of CRLs?

Online Certificate Status Protocol (OCSP).

What extension to OCSP allows a web server to attach a timestamped OCSP response to its certificate, reducing the load on CA servers?

Certificate stapling.

What is the most common binary format for digital certificates, often using .der, .crt, or .cer extensions?

Distinguished Encoding Rules (DER).

The _____ certificate format is an ASCII text version of the DER format, often using .pem or .crt extensions.

Privacy Enhanced Mail (PEM)

What hardware devices store and manage encryption keys in a secure manner, preventing direct human interaction with the keys?

Hardware security modules (HSMs).

What type of cryptographic attack involves trying every possible key

A brute-force attack.

A cryptographic attack on hashes based on the probability of finding two inputs that produce the same output is known as a _____ attack

birthday

What type of attack tricks a system into shifting to a less secure cryptographic mode

A downgrade attack.

What is the practice of adding a randomly generated value to each password before it is hashed to protect against rainbow table attacks

Salting.

What process is used to create strong encryption keys from passwords by using thousands of iterations of salting and hashing

Key stretching.

What technology, formerly known as The Onion Router, provides a mechanism for anonymously routing traffic across the Internet using layers of encryption?

Tor.

Tor relies on a technology called _____ where layers of encryption prevent nodes in the relay chain from reading more than the necessary forwarding information

perfect forward secrecy

What technology is described as a distributed and immutable open public ledger, originally invented for Bitcoin?

Blockchain.

What emerging technology allows for data to be encrypted in a way that preserves the ability to perform computations on it

Homomorphic encryption.

What emerging field of computing attempts to use quantum mechanics and may be able to defeat current cryptographic algorithms that rely on factoring large prime numbers

Quantum computing.