Advanced Cryptography Practice Flashcards

Vocabulary flashcards covering the key terms and concepts of Advanced Cryptography, including Digital Certificates, PKI components, trust models, secure protocols, and implementation standards.

Digital Certificate

The technology that binds a user's verified identity to their public key, with the entire package digitally signed by a trusted third party.

Certificate Signing Request (CSR)

A structured process for the creation and issuance of a digital certificate, where a user generates a key pair and signs a request with their public key.

Registration Authority (RA)

An entity responsible for receiving certificate requests and verifying the authenticity and identity of the applicant.

Intermediate Certificate Authority (CA)

A subordinate entity within the PKI hierarchy that processes CSRs and issues digital certificates, protecting the root CA from exposure.

Certificate Repository (CR)

A publicly accessible, centralized directory of digital certificates used to look up a certificate's current status.

Certificate Revocation List (CRL)

A published list of all digital certificates that have been revoked by the issuing CA before their scheduled expiration date.

Online Certificate Status Protocol (OCSP)

An improvement on CRLs that performs a real-time lookup of a certificate's revocation status by sending its serial number to a trusted responder.

OCSP Stapling

An optimization where a web server proactively queries the OCSP responder and attaches the signed, time-stamped response to the TLS handshake.

Certificate Chaining

A hierarchical validation process that creates a verifiable trail of trust from the trusted root CA down to the end-user certificate.

Root Digital Certificate

The beginning of the certificate chain, created and self-signed by a CA, which is trusted implicitly without higher-level authority.

Domain Validation (DV)

A web server certificate that verifies the applicant controls the domain; it is the fastest and least expensive to obtain.

Extended Validation (EV)

A web server certificate requiring rigorous vetting of an organization's legal identity to provide the highest level of trust assurance.

Wildcard Certificate

A certificate that covers a domain and all of its subdomains, designated by an asterisk (e.g., $\text{*.example.com}$).

Subject Alternative Name (SAN)

An attribute that allows a single certificate to secure multiple distinct domain names.

Machine / Computer Certificate

A certificate assigned to a specific device, such as a workstation or server, to authenticate the machine itself within a network.

Code Signing Certificate

A certificate used by software developers to digitally sign executables and scripts, ensuring the code has not been tampered with.

X.509 Version 3

The globally recognized standard format for digital certificates, defining mandatory and optional fields such as validity period and public keys.

Common Name (CN)

A field in an X.509 certificate representing the fully qualified domain name (FQDN) or identifier of the protected entity.

Public Key Infrastructure (PKI)

The comprehensive framework of people, technology, and policies needed to manage digital certificates at scale.

Certificate Policy (CP)

A published set of rules governing the overall operation of a PKI and setting baseline security requirements.

Certificate Practice Statement (CPS)

A detailed technical document describing exactly how a CA manages, issues, distributes, and revokes certificates.

Direct Trust

A trust model where two parties trust each other based on a direct personal relationship and firsthand identity verification.

Third-Party Trust

A model where two individuals trust each other because they both independently trust a common third party, such as a CA.

Web of Trust

A decentralized model where users sign each other's certificates directly, common in PGP email encryption.

Hierarchical Trust Model

A structure with a single root CA at the top that signs all subordinate certificates; it is simple to manage but represents a single point of failure.

Distributed Trust Model

A structure featuring multiple CAs that can independently sign certificates, providing redundancy and scalability.

Bridge Trust Model

A model where a central Bridge CA interconnects independent CA infrastructures to facilitate cross-organizational trust.

Key Escrow

A process where keys are held by a trusted third party for recovery purposes if the original key is lost.

Cryptoperiod

The defined length of time a cryptographic key is authorized for use.

M-of-N Control

A security mechanism requiring a minimum number (M) of authorized individuals out of a total group (N) to cooperate to perform sensitive key operations.

Tunneling

A technique that wraps original data inside a new protocol layer to ensure confidentiality and integrity over untrusted networks.

Transport Layer Security (TLS)

A protocol operating at the transport layer that secures communications like web browsing using asymmetric and symmetric cryptography.

IP Security (IPSec)

A suite of protocols securing communications at the network layer, commonly used for VPNs and remote access.

Cipher Suite

A named combination of cryptographic algorithms (encryption, authentication, and MAC) used within a TLS session.

Authentication Header (AH)

An IPSec protocol that ensures data integrity and authenticates the source of IP packets.

Encapsulating Security Payload (ESP)

An IPSec protocol that encrypts packet payloads to ensure confidentiality.

HTTPS

HTTP transmitted over TLS, typically using port $443$.

SSH (Secure Shell)

An encrypted alternative to Telnet used for secure remote system administration.

S/MIME

A protocol for providing encryption and digital signatures for email messages.

SRTP

A secure extension of RTP designed to protect real-time audio and video transmissions from interception and replay attacks.

CSPRNG

A cryptographically secure random number generator used to ensure the randomness and strength of cryptographic keys.

Kerckhoffs's Principle

A foundational rule stating that a system should be secure even if everything about it is public knowledge, except for the secret key.

ECB (Electronic Code Book)

A block cipher mode where each block is encrypted independently with the same key; it is considered insecure because it reveals data patterns.

CBC (Cipher Block Chaining)

A mode where each block is XOR'd with the previous ciphertext block before encryption, requiring an initialization vector (IV).

CTR (Counter Mode)

A mode that converts a block cipher into a stream cipher using a counter value, allowing for parallelization.

GCM (Galois/Counter Mode)

A mode combining CTR encryption with Galois field authentication to provide both confidentiality and data integrity.