8: Cryptography

Cryptography

The practice of writing and solving codes to hide information's true meaning.

Asymmetric Algorithms

RSA, ECC, Diffie-Hellman, El Gamal, Knapsack, and DSA

Symmetric Algorithms

- DES & 3DES
- IDEA
- AES
- Blowfish
- Twofish
-Rivest Ciphers

Encryption

The process of converting plaintext into unreadable ciphertext.

Plaintext data

Ordinary, unencrypted information in a readable format.

Ciphertext data

Unintelligible, encrypted data produced by an encryption cipher.

Data at rest

Inactive data stored on physical devices like hard drives or archives.

Data in transit

Data moving across a network or between memory and processors.

Data in use

Data actively undergoing computation or processing in system memory.

ROT 13

Rotation cipher that shifts 13 letters to the right.

Source of encryption strength

The secrecy and length of the cryptographic key, not the algorithm.

Cryptographic key length principle

Longer keys provide exponentially higher security against brute force attacks.

Key rotation

The practice of periodically replacing encryption keys to mitigate compromise risks.

Security through obscurity

Relying on secret algorithms for security, which is considered unreliable and insecure.

Symmetric key encryption (single key)

An encryption method using the same key for encryption and decryption. AKA Private key encryption

Asymmetric key encryption

An encryption method using a key pair: public for encryption, private for decryption. Ex. Diffie-Hellman, RSA, Elliptic Curve (ECC).

Hybrid Implementation

Utilizes asymmetric encryption to securely transfer a private key that can then be used with symmetric encryption.

Stream cipher

Algorithm that utilizes a keystream generator to encrypt data bit by bit using a XOR function to create ciphertext. Good for securing real-time comms and tend to be symmetric algs.

Block cipher

An algorithm that encrypts data in fixed-size blocks using padding if needed.

DES (Data Encryption Standard) - bad

A legacy symmetric block cipher that breaks input into 64-bit blocks and uses transposition and substitution ciphers to create ciphertext using 56-bit key strength

Triple DES (3DES) - bad

A symmetric cipher that uses three separate symmetric keys to encrypt, decrypt, then encrypt plaintext into cipher text. Increases the strength of DES.

International Data Encryption Algorithm (IDEA)

Symmetric block cipher, which uses 64-bit blocks to encrypt plaintext into ciphertext. Key size is 128 bits. Not widely utilized but commonly known in PGP.

AES (Advanced Encryption Standard) - Winner

The primary symmetric encryption standard using 128-, 192-, or 256-bit blocks and a matching encryption key size to encrypt. Adopted by NIST. AKA Rijndael Alg/cipher

Blowfish

Symmetric block cipher that uses a 32-448 bit encryption key and can encrypt 64 bits of data at a time when going through and doing those blocks.

Twofish

Developed to provide a 128-bit blocks in the encryption algorithm, and uses a 128-bit, 192-bit, or 256-bit encryption key.

RC Cipher Suite

created by Ron Rivest, a cryptographer who's created six algorithms under the name RC which stands for the Rivest Cipher (RC4, RC5, RC6)

RC4

A symmetric stream cipher using a variable key from 40-2048 Bits that is used in SSL and WEP.

RC5

Symmetric block cipher that key sizes up to 2048 bits.

RC6

Symmetric block cipher that was introduced as a replacement for DES but AES was chosen instead

Digital Signature

Hash digest of a message encrypted with the sender’s private key to let the recipient know that document was created and sent by the person claiming to have it.

Diffie-Hellman

An asymmetric key-exchange algorithm used to establish shared secrets over insecure networks. Widely used when setting up a VPN tunnel but is susceptible to on-path or MiTM.

RSA (Rivest, Shamir, Adleman)

An asymmetric algorithm relying on prime factorization for key exchange and digital signatures. Supports key sizes between 1024 bits and 4096 bits. Widely used.

Elliptic Curve Cryptography (ECC)

Heavily used in mobile devices due to the algebraic structure of elliptical curves over finite fields to define its keys. Less processing power.

ECDH (Elliptic Curve Diffie-Hellman)

An ECC-based version of the Diffie-Hellman key exchange protocol.

ECDH Ephemeral

uses a different key for each portion of the key establishment process inside the Diffie-Hellman key exchange

ECDSA (Digital Signature Algorithm)

Used as a public key encryption algorithm by the US Gov in their digital signatures.

Hashing

A one-way cryptographic function mapping variable inputs to a fixed-length output.

Hash collision

An event where two distinct inputs produce the exact same hash digest.

MD5

A widely used 128-bit hashing algorithm susceptible to collision attacks.

SHA-1

creates a 160-bit hash digest, which significantly reduces the number of collisions that occur

RACE Integrity Primitive Evaluation Message Digest (RIPEMD)

open-source hashing algorithm that was created as a competitor to the SHA family

HMAC

A message authentication code combining a cryptographic hash function with a secret key. Ex. Supports MD5, SHA1, SHA256

Digital Security Standards (DSS)

Used by the federal government, this relies upon a 160-bit message digest created by the Digital Security Algorithm (DSA)

Pass-the-Hash attack

An authentication attack reusing captured password hashes to log into remote systems.

Mimikatz

Penetration tool that gives the ability to automate the harvesting of hashes to conduct an attack.

Birthday attack

A cryptographic attack that occurs when two different messages are sent through a hash algorithm and creates a hash collision.

Birthday paradox

If you have random people in a group, the chances are you are going to have two people in that group with the same birthday. - probability.

Key stretching

A technique that processes weak keys through algorithms to increase cracking difficulty.

Salting

Adding random data to passwords before hashing to prevent rainbow table attacks.

Dictionary Attack

An attack that uses a predefined list of words.

Nonce

Number used once. A unique, random number that is added to password-based auth processes.

Preventing Hash Attacks

Key stretch, nonce and rate limit incorrect logins.

PKI (Public Key Infrastructure)

A framework of systems, policies, and certificates managing asymmetric cryptographic keys.

Key escrow

Storing cryptographic private keys with a secure third party for recovery.

Wildcard certificate

Certificate that allows all subdomains to use the same public key certificate and have it displayed as valid. They’re easy to manage and can save money. Server compromise will require cert revocation though.

Digital Certificate

Digitally signed electronic document that binds a public key with a user’s identity. Commonly use the X.509 standard.

Subject Alternate Name (SAN field)

Certificate that specifies what additional domains and IP addresses are going to be supported. Supports different domains to one certificate.

Single-sided Certificate

Only requires the server certificate to be validated. Users aren’t required to have their own digital certificate, resulting in one sided authentication.

Double-sided Certificate

Authentication between the server and user certificates. Better security but requires twice the processing power on the server.

Self-Signed Certificate

Digital certificate that is signed by the same entity whose identity it certifies. Offer encryption but don’t provide the same level of trust due to no external verification of user identities.

Third-Party Certificate

Digital certificates issued and signed by a trusted CA.

Root of Trust/Chain of Trust

each certificate is validated using the concept of a root of trust or the chain of trust (like a family tree). Ex. Amazon, Google, Cloudflare

Certificate Authority (CA)

Trusted third party who issues digital certificates. Contains their name, digital signatures, serial number, issue and expiration date, and version of that cert.

Registration Authority (RA)

This requests identifying information from a user and forwards that certificate request up to the CA to create the digital certificate. Ex. Verisign, Digisign…

Certificate Signing Request (CSR)

A block of encoded text that contains information about the entity requesting a certificate. It is a vital process in obtaining a cert.

Certificate Revocation List (CRL)

A CA-maintained list of revoked digital certificates.

Online Certificate Status Protocol (OCSP)

A protocol for querying the real-time revocation status of a digital certificate.

OCSP Stapling

Allows the certificate holder to get the OCSP record from the server at regular intervals. Served as an alternative to OCSP and used to be known as TLS cert status request extension.

Public Key Pinning

Allows an HTTPS website to resist impersonation attacks from users who are trying to present fraudulent certificates. I.E it prevents server impersonation.

Key Recovery Agent

Specialized type of software that allows the restoration of a lost or corrupted key to be performed. Essentially a backup of all the CA keys.

Blockchain

A shared, immutable ledger used for recording transactions and tracking assets.

Public Ledger

A record-keeping system that maintains participants’ identities in a secure and anonymous format.

Smart contracts

Self-executing digital contracts with terms directly written into code.

Permissioned blockchain

A blockchain used for business transactions and it promotes new levels of trust and transparency using these immutable public ledgers. We know everything about that particular piece of information stored inside this blockchain.

Trusted Platform Module (TPM)

dedicated microcontroller designed to secure hardware through integrated cryptographic keys

Hardware Security Module (HSM)

A tamper-proof physical device safeguarding keys and accelerating cryptographic operations.

Key Management System (KMS)

A centralized system controlling the full lifecycle of cryptographic keys.

Secure Enclave

An isolated co-processor protecting sensitive data like biometric information inside a device.

Steganography

Concealing secret data inside ordinary, non-secret files to avoid detection.

Tokenization

Replacing sensitive data with non-sensitive equivalents that have no intrinsic value.

Data masking

Disguising original data to protect sensitivity while maintaining usability for testing or viewing.

Downgrade attack

Forcing a system to revert to an older, vulnerable cryptographic protocol.

POODLE attack

A downgrade attack forcing systems to fall back from TLS to insecure SSL 3.0.

Quantum Computing

Computer that uses quantum mechanics to generate and manipulate qubits in order to access enormous processing power.

Qubit

A quantum bit that uses superpositioning to represent multiple combinations of ones and zeros.

Quantum Communication

Communication network that relies on qubits made of photons (light) to send multiple combinations of ones and zeros simultaneously which results in tamper resistant and extremely fast communications.

Post-quantum cryptography

Algorithms designed for classical hardware that withstand attacks from quantum computers.

CRYSTALS-Kyber

NIST's primary post-quantum algorithm recommended for general encryption. It uses a small encryption key and focuses on learning with error problems over modular lattices. Strength equivalent to AES 256 used in symmetric.

CRYSTALS-Dilithium (Primary)

FALCON

SPHINCS+

Which algorithms does NIST prefer for the post-quantum digital signature algorithm?