Cryptographic Solutions

Cipher

Algorithm that performs the encryption to decryption

Key

Piece of information that determines the output of the cipher (The longer the key the better)

Symmetric Encryption (Private Key)

(1 Key)

both the sender and receiver must know the same shared secret using a private key

Faster than Asymetric

Private Key Risk

-Non-repudiation

-Distribution

Asymmetric Algorithms (Public Key)

(2 Keys)

One encryption the other for decryption

EX: Diffie-Hellman, RSA, ECC

Easier to distribute

Stream Cipher

Encrypts one character or bit of a message.

Block Cipher

Encrypt blocks of a message. (64,128 or 256 bit blocks instead of one at a time)

Data Encryption Standard (DES)

Symmetric algorithm which breaks the input into 64-bit blocks.

The cipher text it creates has a key strength of only 56-bits

Triplet DES (3DES)

Uses 3 seperate symmetric keys to (Encrypt - decrypt - encrypted) plaintext into cipherext.

Increasing the strength of DES

112-bit key

International Data Encryption Algorithm (IDEA)

Symmetric block cipher

Uses 64-bit blocks to encrypt plaintext to ciphertext

Advanced Encryption Standard (AES)

Symmetric block cipher

(128,192 or 256 bit blocks) and a matching encryption key size to encrypt plaintext to ciphertext

Standard for symmetric keys today

Digital Signature

A hash digest of a message encrypted with the senders private key to let the recipient know the document was created and sent by the person claiming to have sent it

Hashing

One-way cryptographic function that takes an input and produces a unique message digest as its output (digital fingerprint)

Hashing Algorithmsn

• MD5 - Popular

• SHA - More Secure

• RIPEMD

• HMAC

Pass the Hash Attack

Attacks can authenticate to a server by using a hash of a user’s password

Birthday Attack

When an attacker is able to send send 2 different messages through a hash algorithm and it results in the same hash digest/ collision

Key Stretching

Helps mitigate a weaker key by increasing the time needed to cracks it

Salting

Adding random data into a hash to help protect against password cracking

Public Key Intrastructure (PKI)

A Framework for managing digital certificates and keys that facilitate secure data transfer, authentication and encrypted communication over networks.

Certificate Authority (CA)

Issues digital certificates and keep the level of trust between all of the certificate authorities

Key Escrow

Cryptographic key are stored in a secure, third party location.

Digital Certifiicate

Digitally signed electronic document that binds a public key with a users identity

Wildcard Certficate

Allows all of the subdomains to use the same public key certificate and have it displayed as valid

Single-Sided Certificate

Only requires the sever to be validated.

Dual-Sided Certificate

Requires both the server and user to be validated

Self-Signed Certificate

Digital certificate that is signed by the same entity whose identity it certifies (No external verification of users identity/ 3rd party)

Third Party Certificates

Digital Certificate issued and signed by a trusted certificate authority (CA)

Root of Trust

Each certificate is validated using the concept of a root of trust/chain of trust

root of trust providers

Verisgin , Amazon, Google , CloudFlare

Registration Authority

Users requests identifying information from the user and forwards that certificate request up the (CA) to create the digital certificate.

(Verisign, Digisign)

Certificate Signing request (CSR)

A block of encoded text that contains information about the entity requesting the certificate. (Domain name, Org name, locality, country)

Certificate Revocation List (CRL)

An online list of digital certificates that the (CA) has revoked

OSCP

Determines the revocation status of any digital certificates using a serial number (faster than CRL, due to lack of encryption )

OCSP Stapling

Allows the certificate holder to get the OCSP record from the server at regular intervals

Public Key Pinning

Allows an HTTPS website to resist impersonations attacks from users who are trying to present fake certificates

Key recovery agent

Specialized type of software that allows the restoration of a lost or corrupted key to be perfromed