Ch. 5 Cryptography

substitution box (S-box) function

A cryptographic primitive that transforms a number of input bits into a number of output bits and produces a fixed or dynamic lookup table.

exclusive OR (XOR) function

A cryptographic primitive based on binary bit logic and used as a linear mixing function, combining values for use in further computations.

Feistel network

A cryptographic primitive that forms the basis of many symmetric algorithms. Feistel networks combine multiple rounds of repeated operations, such as processing cleartext input with XOR functions. A key schedule is used to produce different keys for each round.

cryptographic protocol

A detailed description that incorporates standardized requirements and guidelines for key generation and management, authentication, encryption, hashing functions, nonrepudiation methods, and other aspects of message security.

Secure Hash Algorithm (SHA)

A hashing algorithm that the NSA designed as a replacement for MD5. SHA-1 produces a 160-bit message digest.

Message Authentication Code (MAC)

A hashing algorithm that uses a shared secret key to generate a MAC tag for a message.

digital signature

A method of verifying nonrepudiation and integrity in messages.

encryption algorithm

A precise set of instructions that provides an encoding function for a cryptographic system or generates output for use in additional operations.

Transport Layer Security (TLS)

A protocol designed to provide additional security for Internet communication. TLS uses a hashed message authentication code (HMAC) to combine the hashing algorithm with a shared secret key. TLS splits input data in half, processes each half with a different hashing algorithm, and recombines them with an XOR function.

Internet Protocol Security (IPsec)

A set of standard procedures that the Internet Engineering Task Force (IETF) developed for enabling secure communication on the Internet.

public key cryptography standards (PKCSs)

A set of standards that RSA developed to provide standardization guidelines for cryptography. Many of these 15 standards have moved into the IETF standards track.

block cipher

A type of encryption algorithm that encrypts groups of cleartext characters.

stream cipher

A type of encryption algorithm that encrypts one bit at a time.

symmetric algorithm

A type of mathematical formula in which the key for encrypting cleartext is the same key for decrypting ciphertext.

asymmetric algorithm

A type of mathematical formula that generates a key pair; ciphertext generated by one key can only be decrypted by the other key.

key management

A way to prevent keys from being discovered and used to decipher encrypted messages. One form of key management is to change keys frequently.

Message Digest 5 (MD5)

A widely used hashing algorithm that produces a 128-bit hash value displayed as a 32-character hexadecimal number.

X.509

An International Telecommunication Union standard for PKI that specifies standard formats for public key certificates, a strict hierarchical system for CAs issuing certificates, and standards for certificate revocation lists. X.509 certificates use RSA for key generation and encryption, and MD5 hashes to verify the certificate's integrity.

Triple DES (3DES)

An enhanced variation of DES that uses three 64-bit keys to process data. See also Data Encryption Standard (DES).

Data Encryption Standard (DES)

An older protocol composed of a 16-round Feistel network with XOR functions, permutation functions, 6×4 S-box functions, and fixed key schedules. DES generates 64 bits of ciphertext from 64 bits of plaintext by using a 56-bit key.

permutation functions

Bit-shuffling cryptographic primitives that reorder sets of objects randomly.

pseudorandom number generators (PRNGs)

Cryptographic primitives used to generate sequences of numbers that approximate random values.

public key exchange

In asymmetric cryptography, two keys are required: the public key and the private key. The public key used to encrypt the message is shared freely. The private key used to decrypt the message is kept secret.

private key exchange

In symmetric cryptography, the same key is used to encrypt and decrypt a message. Public-key Infrastructure is often used for private key exchange.

cryptographic primitives

Modular mathematical functions that perform one task reliably. They form the basic building blocks of modern cryptography.

hashing functions

Processes that a computer runs to verify message integrity by generating a hash value (also known as a message digest), which is a fixed-size string representing the original input's contents. Hashing functions are also used for error detection.

plaintext

Readable text, programs that execute, and graphics you can view.

hashing algorithms

Sets of instructions applied to variable-length input (the message) that generate a fixed-length message digest representing the input. Hashing algorithms do not provide confidentiality because they do not encrypt the message contents, but they do provide verification that a message has not been altered.

Advanced Encryption Standard (AES)

The current U.S. government standard for cryptographic protocols, AES uses the Rijndael algorithm with key sizes of 128, 192, or 256 bits and a fixed block size of 128 bits.

Rijndael

The encryption algorithm used in AES; a symmetric block cipher composed of 10 to 14 rounds of S-box and XOR functions. It supports 128-bit, 192-bit, or 256-bit keys and block sizes. Rijndael applies 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys.

cryptography

The process of converting plaintext into ciphertext by using an encoding function.

cryptanalysis

The study of breaking encryption methods. Some common attack methods against cryptographic systems include differential and integral cryptanalysis, random number generator attacks, side channel attacks, and XSL attacks.

ciphertext

Unreadable text, programs that do not execute, and graphics you cannot view.