COMPTIA Security+ Cryptographic Solutions

Cryptography

Practice and study of writing and solving codes

Encryption

Convert Plain text to ciphertext

Data at Rest

Inactive data on storage device

Data in Transit

Data actively moving across networks

Data in use

Data currently undergoing change

Algorithm (Cipher)

An algorithm is a mathematical formula that tells you how to encrypt or decrypt something

Key

Essential for determining cipher output

Key Length

Proportional to security

Key Rotation

Best practice for security longevity

Types of Encryption

Symmetric and Asymmetric

Symmetric Encryption

Uses a single key for both encryption and decryption

Asymmetric Encryption

Uses a public key for encryption and a separate private key for decryption

Stream Cipher

Encrypts data bit by bit or byte by byte in a continuous stream

Block Cipher

Breaks input data into fixed-size blocks before encryption

Symmetric Algorithms

DES, Triple DES, IDEA, AES, Blowfish, Twofish, Rivest Cipher Family

Asymmetric Algorithms

RSA, Diffie-Hellman, Elliptic Curve Cryptography

Hashing

Converts data into fixed-size string (digest) using hash functions

Hashing Algorithms

MD5, SHA Family, RIPEMD, HMAC

Public Key Infrastructure (PKI)

Framework managing digital keys and certificates for secure data transfer

DES (Data Encryption Standard)

Symmetric. Uses a 64-bit key (56 effective bits due to parity). Not widely used today (1970s-2000s)

Triple DES (3DES)

Symmetric. Utilizes three 56-bit keys. Provides 112-bit key strength but is slower than other algorithms. Not widely used today.

IDEA (International Data Encryption Algorithm)

Symmetric. A symmetric block cipher with a 64-bit block size. Uses a 128-bit key, faster and more secure than DES. It is not as widely used.

AES (Advanced Encryption Standard)

US government encryption standard. Supports 128-bit, 192-bit, or 256-bit keys and matching block sizes

Blowfish

A block cipher with key sizes ranging from 32 to 448 bits

Developed as a DES replacement but not widely adopted

Twofish

A block cipher supporting 128-bit block size and key sizes of 128, 192, or 256 bits

Open source and available for use

RC Cipher Suite (RC4, RC5, RC6)

Created by cryptographer, Ron Rivest

RC4 is a stream cipher with variable key sizes from 40 to 2048 bits, used in SSL and WEP

RC5 is a block cipher with key sizes up to 2048 bits

RC6, based on RC5, was considered as a DES replacement

Of all of the symmetric encryption algorithms, which is stream cipher?

RC4

Digital Signature

A hash digest of a message encrypted with the sender's private key

Diffie-Hellman

Asymmetric. Used for key exchange and secure key distribution

RSA (Ron Rivest, Adi Shamir, Leonard Adleman)

Used for key exchange, encryption, and digital signatures. Relies on the mathematical difficulty of factoring large prime numbers.

Elliptic Curve Cryptography (ECC)

Efficient and secure, uses algebraic structure of elliptical curves

When is RSA most often used?

Multifactor identification via those key chains that contain 6 digit codes that rotate every 30-60 seconds, or in environments where more computing resources are available like desktops and laptops

When is ECC most often used?

Mobile devices and low power computing

Hash Digest

digital fingerprint for the original data

MD5 (Message Digest Algorithm 5)

128-bit hash value. Limited unique values, leading to collisions. Not recommended due to security risks

SHASecure Hash Algorithm) Family

Different iterations, though the most important one uses 224-bit to 512-bit hash digests, more secure, 120 rounds of computations

RIPEMD

RACE Integrity Primitive Evaluation Message Digest

HMAC

(Hash-based Message Authentication Code). Utilizes other hashing algorithms.

DSA

Digital Security Algorithm

Pass the Hash Attack

Authenticate to a remote

server or service by using the underlying hash of a user's password

Birthday Attack

Occurs when two different messages result in the same hash digest

(collision)

Key Stretching

creating longer, more

secure keys (at least 128 bits)

Salting

Adds random data (salt) to passwords before hashing

Nonces

(Number Used Once). Adds unique, often random numbers to password-based authentication

processes

Key Escrow

Storage of cryptographic keys in a secure, third-party location

Digital Certificates

Electronic credentials verifying entity identity for secure communications

Wildcard Certificate

Allows multiple subdomains to use the same certificate

SAN (Subject Alternate Name) field

Certificate that specifies what additional domains and IP addresses are

going to be supported. Used when domain names don't have the same root domain

Single-sided Certificates

Only requires the server to be validated

Dual-sided Certificates

Both server and user validate each other

Self-Signed Certificates

signed by the same entity whose identity it it certifies

Third-Party Certificates

issued and signed by trusted certificate authorities (CAs)

Root of Trust

Highest level of trust in certificate validation. rusted third-party providers like Verision, Google, etc.

Certificate Authority (CA)

Trusted third party that issues digital certificates

Registration Authority (RA)

Requests identifying information from the user and forwards certificate

Certificate Signing Request (CSR)

A block of encoded text with information about the entity requesting the

certificate. Submitted to CA for certificate issuance

Certificate Revocation List (CRL)

List of all digital certificates that the certificate authority has already revoked.

Online Certificate Status Protocol (OCSP)

Determines certificate revocation status or any digital certificate

Blockchain

Shared immutable ledger for transactions and asset tracking. Essentially a really long series of information with various "categories"

TPM (Trusted Platform Module.)

Dedicated microcontroller for hardware-level security. Internal device.

HSM (Hardware Security Module)

Physical device for safeguarding and managing digital keys

Key Management System

Manages, stores, distributes, and retires cryptographic keys

Secure Enclaves

Coprocessor integrated into the main processor of some devices. Safeguards sensitive data like biometric information

Steganography

Conceals a message within another

Tokenization

Substitutes sensitive data with non-sensitive tokens

Data Masking (Data Obfuscation)

Disguises original data to protect sensitive information

Downgrade Attacks

Force systems to use weaker or older cryptographic standards or protocols