CMPE 132: Information Security - Cryptographic Tools

Vocabulary practice flashcards covering classical ciphers, symmetric encryption fundamentals, Feistel networks, DES, 3DES, AES round transformations, stream ciphers (RC4, ChaCha20), block cipher operational modes (ECB, CBC, CFB, OFB, CTR, GCM), cryptanalytic attack models, and key distribution.

Encryption

The process of encoding a message in such a way that only authorized parties can read the content of the original message, with historical records dating back to $1900\text{ BC}$.

Secret-Key Encryption

An encryption scheme where the sender and receiver share and use the exact same key for both encryption and decryption; also referred to as conventional or single-key encryption.

Public-Key Encryption

An encryption scheme that uses two mathematically related but distinct keys: one public key for encryption and one private key for decryption.

Caesar Cipher

A classic monoalphabetic substitution cipher in which each letter in the plaintext is shifted and replaced by the letter located $3$ places down in the alphabet (e.g., $\text{A} \rightarrow \text{D}$, $\text{B} \rightarrow \text{E}$).

Transposition Cipher

A cryptographic method based on permutation, wherein the characters of the plaintext are rearranged into a different order based on a numerical key rather than being substituted with other characters.

Symmetric Encryption Model

A simplified framework consisting of a plaintext input $X$, a shared secret key $K$, an encryption algorithm $Y = \text{E}[K, X]$, transmitted ciphertext $Y$, and a decryption algorithm $X = \text{D}[K, Y]$ to recover the original plaintext.

Cryptanalytic Attack

An attack that relies on the nature of the cryptographic algorithm, knowledge of plaintext characteristics, and sample plaintext-ciphertext pairs to deduce a specific plaintext or recover the secret key.

Brute-Force Attack

An attack that systematically tries all possible keys on ciphertext until an intelligible plaintext translation is produced, requiring an average search of half the entire key space ($2^{k-1}$ attempts for a $k$-bit key).

Ciphertext-Only Attack

A cryptanalytic scenario where the adversary has access only to the encryption algorithm and the intercepted ciphertext to be decoded.

Known-Plaintext Attack

A cryptanalytic attack where the cryptanalyst knows the encryption algorithm, the target ciphertext, and one or more plaintext-ciphertext pairs generated using the same secret key.

Chosen-Plaintext Attack

A cryptanalytic scenario where the attacker can select arbitrary plaintext messages and observe their corresponding ciphertexts generated with the secret key.

Chosen-Ciphertext Attack

A cryptanalytic scenario where the attacker chooses arbitrary ciphertext strings and obtains their corresponding decrypted plaintexts generated with the secret key.

Chosen-Text Attack

A cryptanalytic scenario where the attacker has access to the encryption algorithm, the ciphertext, chosen plaintext messages with their resulting ciphertexts, and chosen ciphertexts with their resulting decrypted plaintexts.

Computationally Secure Encryption

A cipher design where the financial or computational cost of breaking the cipher exceeds the value of the protected information, or the time required to break it exceeds the useful lifetime of the information.

Block Cipher

A symmetric cipher that takes a fixed-size block of plaintext bits (e.g., $64$ or $128$ bits) and transforms it into a ciphertext block of identical size using the same shared key.

Stream Cipher

A symmetric cipher that continuously processes input elements (typically byte-by-byte or bit-by-bit) by XORing the plaintext with a pseudorandom keystream generated from an input key.

Feistel Network

A classic block cipher structure that splits a $2w$-bit plaintext block into two $w$-bit halves ($L$ and $R$), passes the right half through a round function $F$ controlled by a round subkey $K_i$, XORs the result with the left half, and swaps the halves across successive rounds.

Data Encryption Standard (DES)

A block cipher developed by IBM and the NSA, adopted in 1977 as FIPS 46, that utilizes a $64$-bit block size, a $56$-bit key, and $16$ Feistel rounds; withdrawn by NIST in 2005 due to vulnerability to brute-force attacks.

Triple DES (3DES)

A symmetric cipher that applies the standard DES algorithm three consecutive times in an Encrypt-Decrypt-Encrypt (EDE) sequence using two or three keys, providing an effective key strength of $112$ bits against meet-in-the-middle attacks.

Advanced Encryption Standard (AES)

A NIST-standardized symmetric block cipher published as FIPS 197 in 2001 (based on the Rijndael algorithm) that processes $128$-bit blocks using key sizes of $128$ bits ($10$ rounds), $192$ bits ($12$ rounds), or $256$ bits ($14$ rounds).

SubBytes

The non-linear byte substitution step in an AES round where each byte of the $4 \times 4$ state array is independently replaced with another byte using a predefined substitution table known as the S-box.

ShiftRows

The transposition step in an AES round where the bytes in the last three rows of the $4 \times 4$ state array are cyclically rotated to the left by $1$, $2$, and $3$ byte positions, respectively, to diffuse bytes across columns.

MixColumns

The diffusion step in an AES round where each column of the state array is multiplied by a fixed matrix over a finite field, ensuring every output byte depends on all four input bytes of that column.

AddRoundKey

The key addition step in an AES round where the $128$-bit state array is bitwise XORed with a round subkey generated from the master key schedule.

AES-NI

A dedicated hardware instruction set integrated into Intel, AMD, and modern ARM processors that accelerates AES encryption and decryption operations with near-zero CPU overhead.

RC4

A byte-oriented variable-key-size stream cipher designed by Ron Rivest in 1987 consisting of a Key Scheduling Algorithm (KSA) and a Pseudo-Random Generation Algorithm (PRGA); banned in TLS by RFC 7465 due to keystream biases.

ChaCha20

A modern 20-round stream cipher designed by Daniel J. Bernstein in 2008 that employs Add-Rotate-XOR (ARX) operations on a $4 \times 4$ state matrix of $32$-bit words with a $256$-bit key and a $96$-bit nonce.

ChaCha20 State Matrix

The initial $4 \times 4$ internal array of sixteen $32$-bit words consisting of four fixed constant words ("expa", "nd 3", "2-by", "te k"), eight key words, one counter word, and three nonce words.

Electronic Codebook (ECB) Mode

A block cipher mode of operation where each block of plaintext is encrypted independently using the same key; prone to pattern leakage because identical plaintext blocks always produce identical ciphertext blocks.

Cipher Block Chaining (CBC) Mode

A block cipher mode where each plaintext block is XORed with the preceding ciphertext block (or an Initialization Vector for the first block) prior to encryption; encryption is strictly sequential, while decryption can be parallelized.

Cipher Feedback (CFB) Mode

A mode of operation that turns a block cipher into a stream cipher by encrypting preceding ciphertext blocks to produce pseudorandom output that is then XORed with plaintext; allows decryption to be parallelized.

Output Feedback (OFB) Mode

A stream-like mode of operation where the preceding pseudorandom output of the block encryption algorithm is fed back as the input to the next encryption step; prevents bit errors from propagating across blocks on noisy channels.

Counter (CTR) Mode

A block cipher mode where a counter value prepended with a unique nonce is encrypted and XORed with each plaintext block; allows both encryption and decryption to be fully parallelized without requiring padding.

Galois/Counter Mode (GCM)

An Authenticated Encryption with Associated Data (AEAD) mode that pairs Counter (CTR) mode confidentiality with Galois field polynomial multiplication (GHASH) to generate an authentication tag.

Key Distribution Center (KDC)

A trusted network entity that shares a distinct master key with each host and dynamically issues secret session keys when two hosts request a secure connection.