T INFO 441 Midterm Study Guide

Unskilled Attackers

Individuals who lack technical knowledge and use freely available or low-cost, easy-to-use attack tools (formerly called "script kiddies") to perform attacks. Their primary motivation is data exfiltration (unauthorized copying of data) or service disruption (obstructing normal business electronic processes)

Shadow IT

Employees who bypass corporate approval processes to purchase and use technology (hardware or software) on their own. Their motivation is typically ethical (having sound moral principles to get their work done faster), though it unintentionally weakens organizational security.

Organized Crime

A close-knit group of highly centralized criminal enterprises run like businesses for illegal activities. Their motivation is financial gain (earning revenue), as they view cyberattacks as less risky and more rewarding than traditional crimes.

Insiders / Insider Threats

A company's own trusted employees, contractors, and business partners. Their primary motivations are revenge (retaliation, such as being passed over for a promotion) or blackmail (coercion or extortion using threats), as well as alerting citizens to clandestine government actions or taking intellectual property they feel belongs to them.

Hacktivists

Groups or individuals strongly motivated by ideology (philosophical or political beliefs). Their motivation is to cause disruption/chaos (extreme confusion), retaliate, or "make a statement" through website defacements and disinformation campaigns.

Nation-State Actors

Highly skilled, state-sponsored attackers employed by governments with deep resources to launch cyberattacks against foreign foes or hostile citizens. Their motivation is espionage (spying), creating war, or extracting sensitive economic, proprietary, or national security information over long periods using Advanced Persistent Threats (APTs).

Competitors

Rival business entities that launch attacks against an opponent's system. Their motivation is to steal classified information, such as new product research or customer lists, to gain a competitive advantage

Brokers

Individuals who uncover system or software weaknesses. Instead of reporting the flaw to the vendor, their motivation is financial gain by selling their knowledge of the unknown weakness to the highest bidder (other attackers or governments)

Cyberterrorists

Threat actors who target critical computers or networks that affect a massive number of users, such as an electrical power grid. Their motivation is to attack a nation's infrastructure to cause widespread disruption and panic among citizens.

Layering / Defense in Depth

Using multiple layers of security defenses to make it difficult for an attacker to break through all layers, resist a variety of attacks, and provide the most comprehensive protection. A practical example is protecting credit card numbers on a web server by using encryption software alongside physical door locks to restrict server access.

Limiting

Restricting users' access to information and resources strictly to what they need to perform their job duties. A practical example is applying technology methods like file permissions, or procedural methods like prohibiting employees from removing sensitive documents from the premises.

Diversity

Implementing security products from different manufacturers across the security architecture so that a vulnerability or flaw in one vendor's product does not compromise the entire defense. A practical example is deploying perimeter network security hardware from one manufacturer and internal endpoint security from a different manufacturer.

Obscurity

Avoiding revealing internal system details to outsiders so attackers have less information to exploit. A practical example is hiding details such as the type of computer, operating system version, or brand of software running on the network.

Simplicity

Designing security systems so that they are simple to understand, configure, and manage from the inside, while remaining complex to penetrate from the outside. A practical example is maintaining clean, straightforward security configurations for administrators so they do not make human configuration errors

Plaintext

The original, readable, unencrypted message or data that is input into an encryption procedure, or is the final output of a decryption procedure.

Ciphertext

The scrambled, unreadable encrypted message that is output by an encryption algorithm and transmitted or stored until decrypted.

Encryption

The procedure of changing original text (plaintext) into a scrambled, secret message (ciphertext) using a cryptographic algorithm and a key

Decryption

The reverse cryptographic procedure of changing a scrambled secret message (ciphertext) back into its original, readable data form (plaintext) using a decryption algorithm and key.

Algorithm

The set of rules and step-by-step procedures based on a mathematical formula used to perform encryption and decryption.

Key

A secret mathematical value entered into a cryptographic algorithm alongside the data to "lock" plaintext into ciphertext or "unlock" ciphertext back into plaintext.

Distinguish between plaintext and ciphertext.

Plaintext is the original, unencrypted, and readable data that serves as the input for an encryption procedure or the final restored output of a decryption procedure (whereas unencrypted data that is never intended to be encrypted is referred to as cleartext). Conversely, ciphertext is the scrambled and completely unreadable output produced after plaintext has been processed through an encryption algorithm using a mathematical key

What must be kept secret in encryption for confidentiality? Cipher or Key?

The individualized mathematical key must always be kept secret to maintain confidentiality—specifically the shared key in symmetric cryptography and the private key in asymmetric cryptography. Cryptographic algorithms (ciphers) are intentionally designed to be public and well-known so they can be thoroughly vetted and tested by the cryptographic community, whereas secret proprietary algorithms are considered weak because their flaws remain unanalyzed

Distinguish between transposition and substitution ciphers.

Substitution ciphers hide the meaning of a message by replacing one or more characters or bits of plaintext with different letters, numbers, or symbols according to a specific rule or key, such as in the Caesar, Monoalphabetic, or Vigenère ciphers. In contrast, transposition ciphers hide the message simply by rearranging the positional order of the existing characters without altering the actual letters used, such as in the Rail-Fence or columnar transposition ciphers.

How do you decipher a ciphertext?

To decipher a ciphertext, the recipient inputs the scrambled ciphertext along with the appropriate mathematical decryption key into the decryption algorithm, which reverses the encryption procedure to "unlock" the message and restore the original plaintext. In symmetric cryptography, the recipient uses the exact same secret key that was used to encrypt the message, whereas in asymmetric cryptography, the recipient uses the corresponding key from the mathematical key pair, such as using their own private key to decrypt a message that was encrypted with their public key.

When two parties communicate with each other using symmetric key encryption, how many keys are used in total?

When two parties communicate using symmetric key encryption, only one single, identical key is used in total by both the sender and the receiver to both encrypt the plaintext and decrypt the ciphertext, which is why symmetric encryption is also known as private key cryptography.

How does a Monoalphabetic cipher work?

A Monoalphabetic cipher works as a substitution cipher that uses a 26-letter key to scramble the alphabet, permanently mapping each plaintext letter to a single, different random ciphertext letter throughout the entire message so that every occurrence of a specific plaintext letter is always replaced by the exact same ciphertext letter.

How does the Vigenère Cipher work?

The Vigenère cipher is a polyalphabetic substitution cipher that uses a repeating keyword to apply multiple shifts across multiple cipher alphabets arranged in a 26x26 grid called a Vigenère tableau. By aligning the repeating keyword beneath the plaintext message and intersecting each plaintext letter with its paired key letter on the tableau, the same plaintext letter can be encrypted into different ciphertext letters at different points in the message, effectively obscuring natural letter frequencies.

DES (Data Encryption Standard)

A symmetric block cipher algorithm that uses a 56-bit key (a 64-bit key block containing 56 bits plus 8 redundant bits) to encrypt plaintext in 64-bit blocks. It combines substitution, transposition, and XOR operations, but is now deprecated and insecure due to its short 56-bit key length.

3DES (Triple Data Encryption Standard)

A symmetric block cipher designed to strengthen DES by performing three consecutive rounds of encryption on 64-bit blocks using a 112-bit or 168-bit key, where the ciphertext of the first round becomes the input for the second iteration. Its most secure versions use three different keys (one for each round), though 3DES has also been deprecated

AES (Advanced Encryption Standard)

A symmetric block cipher approved by NIST in 2000 that is designed to be much more secure and efficient than DES and 3DES. It encrypts data in 128-bit blocks using 128-bit (9 internal rounds), 192-bit (11 rounds), or 256-bit (13 rounds) keys, combining substitution, transposition, XOR, and mixing operations.

DES vs. 3DES vs. AES

All three are symmetric (private key) block ciphers that combine substitution, transposition, and XOR operations. However, DES and 3DES process smaller 64-bit blocks (using 56-bit and 112/168-bit keys, respectively) and are now deprecated, whereas AES processes larger 128-bit blocks with longer 128-, 192-, or 256-bit keys, adds a mixing step, and remains unbroken against attacks.

Caesar Cipher on "I love crypto"

Replace each plaintext letter in I LOVE CRYPTO with the 3rd letter forward in the alphabet (I → L, L →0, 0→R, V → Y, E →H, C →F, R →U, Y → B, P→S, T → W, 0 → R), producing the ciphertext L ORY FUBSWR.

Monoalphabetic Cipher on "I love crypto"

Create a 26-letter scrambled key table where each letter of the alphabet maps to a random unique letter, and replace each letter of I LOVE CRYPTO with its mapped ciphertext letter (e.g., using the lecture slide key table where a=D, b=K, c=V....

ILOVECRYPTO encrypts to W PRUF VYZNUR

Vigenère (Polyalphabetic) Cipher on "I love crypto"

Write the plaintext ⁠ILOVECRYPTO⁠ and repeat a keyword underneath it (e.g., ⁠LEMONLEMONL⁠). Use the Vigenère tableau to find the intersection of each plaintext letter column and key letter row, encrypting the two ⁠O⁠s into different ciphertext letters depending on the key letter aligned with each. 

Columnar Transposition Cipher on "I love crypto"

Rearrange the letter order by writing ⁠ILOVECRYPTO⁠ across rows of n columns (for a 3-columnar transposition: Row 1 ⁠ILO⁠, Row 2 ⁠VEC⁠, Row 3 ⁠RYP⁠, Row 4 ⁠TOX⁠, padded with ⁠X⁠) and reading vertically down the columns from left to right to get ⁠IVRTLEYOOECPX⁠. 

XOR Cipher on "I love crypto"

Convert the characters of ⁠I love crypto⁠ and a secret key into binary (ASCII bits) and compare them bit-by-bit using Exclusive OR logic: output ⁠0⁠ when the plaintext bit and key bit are the same (⁠0 XOR 0⁠ or ⁠1 XOR 1⁠), and output ⁠1⁠ when the two bits are different (⁠1 XOR 0⁠ or ⁠0 XOR 1⁠). 

Are these classical cryptography methods secure? Why or why not?D

No, classical ciphers used alone are not sufficiently secure. Substitution and transposition ciphers used independently fail to hide underlying language characteristics and letter frequency patterns, and small key spaces are easily broken by statistical analysis or brute-force exhaustive searches. Only by combining a substitution followed by a transposition (a Product Cipher) do you create a much harder cipher that bridges classical and modern cryptography.

Caesar Cipher

Take each letter of the ciphertext and shift it backward by 3 positions in the alphabet (e.g., shifting L ORYH FUBSWR back 3 letters restores I LOVE CRYPTO).

Monoalphabetic Cipher

Locate each ciphertext letter in the bottom row of the 26-letter key mapping table and replace it with its corresponding original plaintext letter from the top row.

Vigenère (Polyalphabetic) Cipher

Write the repeating keyword under the ciphertext, find the row in the Vigenère tableau corresponding to the key letter, scan across that row to find the ciphertext letter, and read the column header at the top to recover the plaintext letter.

Columnar Transposition Cipher

Divide the total number of ciphertext letters by the number of columns ($n$) to find the column height, write the ciphertext letters vertically down each column in a grid, and read horizontally across the rows to reconstruct the plaintext (removing any trailing padding Xs)

XOR Cipher

Take the binary ciphertext and compare it bit-by-bit with the exact same binary secret key using Exclusive OR logic (0 for same bits, 1 for different bits) to immediately restore the original binary plaintext.

What method is best to quickly decrypt a message (with an example)?

• For a computer: The XOR Cipher is the fastest because encryption and decryption use the exact same fundamental binary hardware operation in a single step—for example, Ciphertext 11010110 XOR Secret Key 11100011 immediately yields Plaintext 00110101.

• For a human (manual): The Caesar Cipher (especially using a mechanical Cipher Disk) is the fastest because aligning the inner and outer alphabet plates with a fixed 3-letter shift allows you to read off every plaintext letter (PHHW → MEET) without complex grid reconstruction or multi-row table lookups.

How do you encrypt a message using XOR? Is XOR subject to any security attack? If so, how do you prevent it against the attack?

To encrypt a message using the XOR cipher, the plaintext message and the secret key are converted into binary bits and compared bit-by-bit using Exclusive OR logic, which outputs a 0 if the two bits are identical (0 XOR 0 = 0 and 1 XOR 1 = 0) and outputs a 1 if the two bits are different (1 XOR 0 = 1 and 0 XOR 1 = 1). Standalone XOR encryption is vulnerable to exhaustive brute-force search if the key length is short, as well as known ciphertext (ciphertext-only) statistical attacks if the same key is reused or has low entropy, because repeating keys create a larger, predictable data footprint of patterns in the ciphertext. To prevent these attacks, you should never reuse keys, use a truly random key that is only used once (such as a One-Time Pad) or has a strong key length ($\ge 100$ bits), and combine XOR with substitution, transposition, and mixing rounds inside a modern block cipher like AES rather than relying on XOR alone.

Is 3DES subject to any security attack? If so, how do you prevent it against the attack?

Yes, 3DES is a deprecated symmetric block cipher with an older 64-bit block architecture and shorter effective key lengths (112 or 168 bits) compared to modern standards, making it vulnerable to longevity/brute-force cracking by modern powerful computers, known ciphertext analysis, misconfiguration implementation attacks (when an administrator mistakenly selects a weak deprecated cipher or reuses keys across rounds), and downgrade attacks where an attacker forces a system to fall back to an older, weaker encryption mode. Within the 3DES algorithm itself, security is maximized by using three completely different, independent keys—one for each of the three rounds of encryption—rather than reusing keys across rounds. However, because 3DES is officially deprecated, the primary way to prevent attacks in a modern enterprise is to disable 3DES completely so attackers cannot force a downgrade or misconfiguration, and migrate to a strong modern block cipher like AES.

Is AES subject to any security attack? If so, how do you prevent it against the attack?

While no mathematical attacks have ever been successful against the AES algorithm itself to date, real-world AES implementations are still subject to known ciphertext attacks (where attackers capture and statistically analyze large sets of ciphertext, especially on wireless networks or when keys are reused), downgrade attacks (where an attacker forces a system to abandon AES and fall back to an older, weaker mode), misconfiguration implementation attacks, and brute-force attacks if weak or predictable keys are generated. To prevent these attacks, administrators should configure AES with its longest 256-bit key length (AES-256, which performs 13 internal rounds), use high-entropy random number generators, prevent key reuse by implementing ephemeral keys (DHE) or Perfect Forward Secrecy (generating a unique random key for every session), disable legacy backward-compatibility modes to block downgrade attacks, and store keys inside tamper-resistant hardware like a Hardware Security Module (HSM) or Trusted Platform Module (TPM).