Cryptography concepts

■ Diffie-Hellman

■ RSA

■ Elliptic Curve Cryptography

**List the 3 Asymmetric algorithms.**

ECC Variants

○ ECDH (Elliptic Curve Diffie-Hellman)

○ ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)

○ ECDSA (Elliptic Curve Digital Signature Algorithm)

Check digits (hashing)

The simplest hash values are called?

■ MD5 (Message Digest Algorithm 5)

■ SHA (Secure Hash Algorithm) Family

■ RIPEMD (RACE Integrity Primitive Evaluation Message Digest)

■ HMAC (Hash-based Message Authentication Code)

List 4 common hashing algorithms.

● SHA-1

○ Produces a 160-bit hash digest, less prone to collisions than MD5

● SHA-2

○ Offers longer hash digests (SHA-224, SHA-256, SHA-384, SHA-512)

● SHA-3

○ Uses 224-bit to 512-bit hash digests, more secure, 120 rounds of computations

SHA (Secure Hash Algorithm) Family

RIPEMD (RACE Integrity Primitive Evaluation Message Digest)

● Versions available

○ 160-bit (Most common)

○ 256-bit

○ 320-bit

● Open-source competitor to SHA but less popular

DSA (Digital Security Algorithm)

(Common Digital Signature Algorithm)

● Utilized for digital signatures

● Uses a 160-bit message digest created by DSS (Digital Security Standard)

RSA (Rivest-Shamir-Adleman)

(Common Digital Signature Algorithm)

● Supports digital signatures, encryption, and key distribution

● Widely used in various applications, including code signing

■ Pass the Hash Attack

■ Birthday Attack

Common Hashing Attacks

■ Key Stretching

■ Salting

■ Nonces (Number Used Once)

■ Limiting Failed Login Attempts

Increasing Hash Security (4 techniques)

Key Stretching

● Technique that is used to mitigate a weaker key by creating longer, more secure keys (at least 128 bits)

○ increases the time needed to crack the key

● Used in systems like Wi-Fi Protected Access, Wi-Fi Protected Access version 2, and Pretty Good Privacy

Public Key Infrastructure (PKI)

■ An entire system involving hardware, software, policies, procedures, and people

■ Based on asymmetric encryption

■ Facilitates secure data transfer, authentication, and encrypted communications

■ Used in HTTPS connections on websites

Key Escrow

■ Storage of cryptographic keys in a secure, third-party location (escrow)

■ Enables key retrieval in cases of key loss or for legal investigations

■ Relevance in PKI

Wildcard Certificate

● Allows multiple subdomains to use the same certificate

● Easier management, cost-effective for subdomains

● Compromise affects all subdomains

SAN (Subject Alternate Name) field

● Certificate that specifies what additional domains and IP addresses are going to be supported

● Used when domain names don't have the same root domain

Single-Sided and Dual-Sided Certificates

● Single-sided

○ Only requires the server to be validated

● Dual-sided

○ Both server and user validate each other

○ Dual-sided for higher security, requires more processing power

Self-Signed Certificates

● Digital certificate that is signed by the same entity whose identity it certifies

● Provides encryption but lacks third-party trust

● Used in testing or closed systems

Third-Party Certificates

● Digital certificate issued and signed by trusted certificate authorities (CAs)

● Trusted by browsers and systems

● Preferred for public-facing websites

Root of Trust

(Key Concepts)

● Highest level of trust in certificate validation

● Trusted third-party providers like Verisign, Google, etc.

● Forms a certification path for trust

Certificate Authority (CA)

● Trusted third party that issues digital certificates

● Certificates contain CA's information and digital signature

● Validates and manages certificates

Registration Authority (RA)

● Requests identifying information from the user and forwards certificate request up to the CA to create a digital certificate

● Collects user information for certificates

● Assists in the certificate issuance process

Certificate Signing Request (CSR)

● A block of encoded text with information about the entity requesting the certificate

● Includes the public key

● Submitted to CA for certificate issuance

● Private key remains secure with the requester

Certificate Revocation List (CRL)

● Maintained by CAs

● List of all digital certificates that the certificate authority has already revoked

● Checked before validating a certificate

Online Certificate Status Protocol (OCSP)

● Determines certificate revocation status or any digital certificate using the certificate's serial number

● Faster but less secure than CRL

OCSP stapling

● Alternative to OCSP

● Allows the certificate holder to get the OCSP record from the server at regular intervals

● Includes OCSP record in the SSL/TLS handshake

● Speeds up the secure tunnel creation

Public Key Pinning

● Allows an HTTPS website to resist

impersonation attacks from users who are trying to present fraudulent certificates

● Presents trusted public keys to browsers

● Alerts users if a fraudulent certificate is detected

TPM (Trusted Platform Module)

(Encryption Tool for Data Security)

● Dedicated microcontroller for hardware-level security

● Protects digital secrets through integrated cryptographic keys

● Used in BitLocker drive encryption for Windows devices

● Adds an extra layer of security against software attacks

HSM (Hardware Security Module)

(Encryption Tool for Data Security)

● Physical device for safeguarding and managing digital keys

● Ideal for mission-critical scenarios like financial transactions

● Performs encryption operations in a tamper-proof environment

● Ensures key security and regulatory compliance

Key Management System

(Encryption Tool for Data Security)

● Manages, stores, distributes, and retires cryptographic keys

● Centralized mechanism for key lifecycle management

● Crucial for securing data and preventing unauthorized access

● Automates key management tasks in complex environments

Secure Enclaves

(Encryption Tool for Data Security)

● Coprocessor integrated into the main processor of some devices

● Isolated from the main processor for secure data processing and storage

● Safeguards sensitive data like biometric information

● Enhances device security by preventing unauthorized access

■ Steganography, ■ Tokenization, ■ Data Masking (Data Obfuscation)

3 Types of Obfuscation Techniques in Data Security

Cryptographic Attacks

■ Techniques and strategies that adversaries employ to exploit vulnerabilities in cryptographic systems with the intent to compromise the confidentiality, integrity, or authenticity of data

Cryptographic obfuscation (Digital encryption)

Protects the code of a program itself from those who would try to reverse engineer it, without changing its functions. (often used by malware trying to hide itself from scanners).

Symmetric ciphers

Can be categorized by how they encrypt data, either a bit at a time in a stream (Stream ciphers), or in blocks of a discrete size typically 64 or 128 bits (Block cipher).

■ DES

■ Triple DES

■ IDEA

■ AES

■ Blowfish

■ Twofish

■ Rivest Cipher

**List the 7 Symmetric algorithms.**

Triple DES (3DES) (Symmetric algorithm)

■ Utilizes three 56-bit keys

■ Encrypts data with the first key, decrypts with the second key, and encrypts again with the third key

■ Provides 112-bit key strength but is slower than DES

RC Cipher Suite (RC4, RC5, RC6)

■ Created by cryptographer, Ron Rivest

■ RC4 is a stream cipher with variable key sizes from 40 to 2048 bits, used in SSL and WEP

■ RC5 is a block cipher with key sizes up to 2048 bits

■ RC6, based on RC5, was considered as a DES replacement

Single session cryptography

Often used for a single communication session. (Also known as symmetric cryptography).

Ephemeral keys

In Asymmetric cryptography, keys used for a short term are often called?

In-band key exchange

The key is exchanged over the same communications channel that's going to be encrypted. (problem: how do you keep the key secret if the channel isn't encrypted yet?).

Out-of-band key exchange

The key is exchanged over a different, more secure channel than the one to be encrypted. (is secure if and only if the other channel is) (less convenient).

Rivest, Shamir, and Adleman (RSA) (Asymmetric algorithm)

● Used for key exchange, encryption, and digital signatures

● Relies on the mathematical difficulty of factoring large prime numbers

● Supports key sizes from 1024 to 4096 bits

● Widely used in organizations and multi-factor authentication

Man-in-the-middle attacks

Without additional authentication public key exchanges are very vulnerable to what type of attack?

Checksum (hashing)

Longer hash value. A value used to verify the integrity of a file or a data transfer. In other words, it is a sum that checks the validity of data. (are typically used to compare two sets of data to make sure they are the same).

Message digest (hashing)

Longer hash value. A cryptographic hash function containing a string of digits created by a one-way hashing formula. (are designed to protect the integrity of a piece of data or media to detect changes and alterations to any part of a message).

MD5 (Message Digest Algorithm 5)

● Creates a 128-bit hash value

● Limited unique values, leading to collisions

● Not recommended for security-critical applications due to vulnerabilities

HMAC (Hash-based Message Authentication Code)

● Checks message integrity and authenticity

● Utilizes other hashing algorithms (e.g., HMAC-MD5, HMAC-SHA1, HMAC-SHA256)

*1. Data integrity 2. Data identification 3. Key generation 4. Password storage

List 4 common uses for hashing.

Data identification (common use for hashes)

Used to uniquely identify a file or other data element. (stored in a database called hash table).

Pass the Hash Attack

A hacking technique that allows the attacker to authenticate to a remote server or service by using the underlying hash of a user's password instead of requiring the associated plaintext password

Birthday Attack

● Occurs when two different messages result in the same hash digest (collision)

● Named after the Birthday Paradox, where shared birthdays become likely in a group

● Collisions in hashes can be exploited by attackers to bypass authentication systems

● Use longer hash output (e.g., SHA-256) to reduce collisions and mitigate the attack

Salting

● Adds random data to passwords before hashing

● Ensures distinct hash outputs for the same password due to different salts

● Thwarts dictionary attacks, brute-force attacks, and rainbow tables

Nonces (Number Used Once)

● Adds unique, often random numbers to password-based authentication processes

● Prevents attackers from reusing stolen authentication data

● Adds an extra layer of security against replay attacks

Limiting Failed Login Attempts

● Restricts the number of incorrect login attempts a user can make

● Increases security by deterring attackers attempting to guess passwords

● Typically, lock the account after three incorrect attempts

Secure Hash Algorithm 1 (SHA-1) (Hash algorithm)

A cryptographic hash function which takes an input and produces a 160-bit (20-byte) hash value. Hash value is known as a message digest. MD is usually then rendered as a hexadecimal number which is 40 digits long. It is a U.S. Federal Information Processing Standard and was designed by the NSA. (was used a replacement for MD5) (now considered insecure since 2005).

Digital Certificates

■ Digitally signed electronic documents

■ Bind a public key with a user's identity

■ Used for individuals, servers, workstations, or devices

■ 5 different types

Blockchain

■ Shared immutable ledger for transactions and asset tracking

■ Builds trust and transparency

■ Widely associated with cryptocurrencies like Bitcoin

■ Is essentially a really long series of information with each block containing information in it

Steganography

● Conceals a message within another to hide its very existence

● Involves altering image or data elements to embed hidden information

● Primary goal is to prevent the suspicion that there's any hidden data at all

● Used alongside encryption for added security

● Detection is challenging due to hiding data in plain sight

Tokenization

● Substitutes sensitive data with non-sensitive tokens

● Original data securely stored elsewhere

● Tokens have no intrinsic value

● Reduces exposure of sensitive data during transactions

● Commonly used for payment systems to comply with security standards

Data Masking (Data Obfuscation)

● Disguises original data to protect sensitive information

● Maintains data authenticity and usability

● Used in testing environments, especially for software development

● Reduces the risk of data breaches in non-production settings

● Common in industries handling personal data

● Masks portions of sensitive data for privacy, e.g., credit card digits, social security numbers

*1. (MD5) 2. (SHA-1) 3. (SHA-2) 4. (SHA-3) 5. RIPEMD

List 5 Hash algorithms.

NTLM

Was developed for storing strong password hashes in Windows NT 4.0 and is included on every windows version since. Designed for both local user password storage and network logon. Modern Windows versions uses Kerberos-based network logon by default.

Bcrypt

A specialized hash based on the Blowfish key setup process. Designed for password storage but also useful for key derivation and key stretching.

**Transport encryption** (Digital encryption)

**Protects data in transit.** (Most popular for secure network protocols, because data is at most risk of being exposed to attack while in transit. SSL, TLS, VPN, IPSec)

**Storage encryption** (Digital encryption)

**Protects data at rest.** (Like FDE: Full Disk Encryption)

**Memory encryption** (Digital encryption)

**Protects data in use.** (RAM) (difficult to implement without hurting performance and interoperability. Encryption at the Application Level).

**Symmetric encryption**

**Uses one key to encrypt and decrypt data. (aka secret key or private key).**

**Asymmetric encryption**

**Uses two mathematical-related keys: data encrypted with one key can only be decrypted with the other. (aka public key cryptography, because one key can be shared with the public without compromising the security of the other key). (can be used to provide authenticity and confidentiality).**

Cryptographic hashing

Converts data into a hash, or unique signature. (the hash cannot be turned back into the original data, but can be compared to the data to verify its integrity and/or authenticity.

Symmetric-key encryption 1

The main advantage is it's possible to achieve high security with a fairly short key and limited computational complexity, so it's easy to encrypt large amounts of data for either storage or transport.

Symmetric-key encryption 2

The main disadvantage is that the key must be kept a secret to avoid compromising security. (aka secret key or private key cryptography). Challenges with key distribution in large scale use (more people means more sharing of the keys)

Stream ciphers

Tend to be very high performance and are well-suited to data stream of arbitrary length, like network communication. (are vulnerable to certain attacks unless very carefully designed). Encrypts data bit-by-bit or byte-by-byte in a continuous

Block ciphers

Well suited for bulk storage, like encrypted drives. Breaks input data into fixed-size blocks before encryption(has more processing overhead, but easier to keep secure).

Data encryption Standard (DES) (Symmetric algorithm)

■ Uses a 64-bit key (56 effective bits due to parity)

■ Encrypts data in 64-bit blocks through 16 rounds of transposition and substitution

■ Widely used from the 1970s to the early 2000s

IDEA (International Data Encryption Algorithm) (Symmetric algorithm)

■ A symmetric block cipher with a 64-bit block size

■ Uses a 128-bit key, faster and more secure than DES

■ Not as widely used as AES

Advanced encryption standard (AES) (Symmetric algorithm)

■ Replaced DES and 3DES as the US government encryption standard

■ Supports 128-bit, 192-bit, or 256-bit keys and matching block sizes

■ Widely adopted and considered the encryption standard for sensitive unclassified information

Blowfish (Symmetric algorithm)

■ A block cipher with key sizes ranging from 32 to 448 bits

■ Developed as a DES replacement but not widely adopted

Twofish (Symmetric algorithm)

■ A block cipher supporting 128-bit block size and key sizes of 128, 192, or 256 bits

■ Open source and available for use

Elliptic Curve Cryptography (ECC) (Asymmetric algorithm)

● Efficient and secure, uses algebraic structure of elliptical curves

● Commonly used in mobile devices and low-power computing

● Six times more efficient than RSA for equivalent security

Diffie-Hellman key exchange (DH) (Asymmetric algorithm)

● Used for key exchange and secure key distribution

● Vulnerable to man-in-the-middle attacks, requires authentication

● Commonly used in VPN tunnel establishment (IPSec)

Data integrity (common use for hashes)

The accuracy and consistency (validity) of data over its lifecycle. (unless the hash itself is stored or transmitted securely, an attacker who alters a file could also replace its hash).

Key generation (common use for hashes)

Generate a new key by hashing an existing key, arbitrary data, or some combination of the two. (adding a key stretching algorithm can make brute force decryption more difficult).

Password storage (common use for hashes)

Instead of storing the passwords in the plaintext form, they are instead put through a one way hash function before being stored in the database. (adding a key stretching algorithm can make brute force decryption more difficult) (salt).

Secure Hash Algorithm 2 (SHA-2) (Hash algorithm)

The cryptographic hashing standard that all software and hardware should be using now. Was also developed by the NSA, and is actually a family of algorithms, six different hash functions that produce digest/hash values of varying lengths: 224, 256, 384 or 512-bit digests. (aka SHA-256).

Secure Hash Algorithm 3 (SHA-3) (Hash algorithm)

Finalized by NIST in 2015. Based on Keccak algorithm and produces between 224 and 512 bits. (It doesn't replace SHA-2, which has not shown any problem, but offers a backup) (mathematically different than SHA-2).

Downgrade Attacks

(Type of Cryptographic Attack)

■ Force systems to use weaker or older cryptographic standards or protocols

■ Exploit known vulnerabilities or weaknesses in outdated versions

Collision Attacks

(Type of Cryptographic Attack)

■ Find two different inputs producing the same hash output

■ Undermine data integrity verification relying on hash functions

■ Vulnerabilities in hashing algorithms, e.g., MD5, can lead to collisions

■ Birthday Paradox or Birthday Attack

Quantum Computing Threat

(Type of Cryptographic Attack)

● A computer that uses quantum mechanics to generate and manipulate quantum bits in order to access enormous processing powers.

● Uses quantum bits (qubits) instead of using ones and zeros

Still learning (80)

You've started learning these terms. Keep it up!