Module 6 - Basic Cryptography

Data in transit/motion

Actions that transmit the data across a network. - example: an email sent across the Internet

Primary difference between a hardware security module (HSM) and trusted platform module (TPM)

An HSM is external while a TPM is internal.

hash algorithm

An algorithm that creates a unique digital fingerprint. - process is called hashing, and the resulting fingerprint is a digest (sometimes called a message digest or hash) that represents the contents - used primarily for comparison purposes - its purpose is NOT to create ciphertext that can later be decrypted. - Instead, hashing is intended to be one-way in that its digest cannot be reversed to reveal the original set of data. - it is not possible to determine the plaintext from the digest.

stream cipher

An algorithm that takes one character and replaces it with one character. - manipulates plaintext one character at a time

elliptic curve cryptography (ECC) (asymmetric cryptography algorithm)

An algorithm that uses elliptic curves instead of prime numbers to compute keys. - an elliptic curve is a set of points that satisfy a specific mathematical equation - An elliptic curve is a function drawn on an X-Y axis as a gently curved line. By adding the values of two points on the curve, a third point on the curve can be derived, of which the inverse is used - users share one elliptic curve and one point on the curve. - One user chooses a secret random number and computes a public key based on a point on the curve; the other user does the same - They can now exchange messages because the shared public keys can generate a private key on an elliptic curve. - used by the U.S. government to protect internal communications, by the Tor project to help assure anonymity, and as the mechanism to prove ownership of bitcoins. - All modern OSs and web browsers rely on ECC. - generates much smaller key sizes than RSA, resulting in faster computations and lower power consumption. - extremely complex algorithm

Downgrade Attack (Algorithm Attack)

An attack in which the system is forced to abandon the current higher security mode of operation and "fall back" to implementing an older and less secure mode. - Because new hardware and software are introduced frequently, they often include backwards compatibility so that a newer version can still function with the older version. - However, in most instances, the newer version must revert to the older and less secure version.

quantum computing drawback for cybersecurity

Asymmetric cryptography begins by multiplying two prime numbers, a strong method because it is difficult for today's computers to determine the prime numbers that make up the value (factoring). - However, a single quantum computer could perform factoring by using hundreds of atoms in parallel to quickly factor huge numbers, rendering virtually all current asymmetric cryptographic algorithms useless.

(T/F) The basis of a quantum computer is a bit.

false - The basis of a quantum computer is a qubit.

steganography

Hiding the existence of data within another type of file, such as an image file. - often hides data in a harmless image, audio, or even video file - typically takes the data, divides it into small pieces, and hides the pieces among invisible portions of the file. - common scheme is to hide data in the file header fields that describe the file, between sections of the metadata (data that is used to describe the content or structure of the actual data), or in the areas of a file that contain the content itself

Reuse (Cryptographic Constraints)

If someone reuses the same key for each encryption, then it provides a larger data footprint for an attacker to use in attempting to break the encryption.

Operating System Encryption (File and File System Cryptography)

Modern OSs provide encryption support natively. - Microsoft's Encrypting File System (EFS) is a cryptography system for Windows releases that use the Windows NT file system (NTFS), while Apple's FileVault performs a similar function. - Because the technology is tightly integrated with the file system, file encryption and decryption are transparent to the user. - Any file created in an encrypted folder or added to an encrypted folder is automatically encrypted. - When an authorized user opens a file, it is decrypted as data is read from a disk; when a file is saved, the OS encrypts the data as it is written to a disk.

Attacks Based on Misconfigurations (Algorithm Attack)

Most breaches of cryptography are the result of incorrect choices or misconfigurations of the cryptography options - Selecting weak algorithms, such as DES or SHA-1, should be avoided since they are no longer secure. - Many cryptographic algorithms have several configuration options, and unless careful consideration is given to the options during setup, the cryptography may be improperly implemented.

message digest (MD) (hash algorithm)

One of the earliest hash algorithms - most widely used of these algorithms is MD5 - This hash algorithm uses four variables of 32 bits each in a round-robin fashion to create a value that is then compressed. - Serious weaknesses have been identified in MD5, and it is no longer considered suitable for use.

Nonrepudiation (why use cryptography?)

The process of proving that a user performed an action. - Nonrepudiation prevents an individual from fraudulently denying performing an action.

key exchange

The process of sending and receiving secure cryptographic keys.

Size (Cryptographic Constraints)

The resulting size of an encrypted file can be as much as one-third larger than the plaintext.

Speed (Cryptographic Constraints)

The speed at which data can be encrypted or decrypted depends upon several hardware and software factors, and in some instances, a slower speed is unacceptable.

Longevity (Cryptographic Constraints)

The useful lifetime of service of a cipher. - As computers continue to become more powerful and can "crack" keys, the longevity of ciphers may diminish.

Third-Party Software (File and File System Cryptography)

Third-party software tools available for performing encryption include GNU Privacy Guard (which is abbreviated GNuPG), AxCrypt, Folder Lock, and VeraCrypt

plaintext

Unencrypted data that is input for encryption or is the output of decryption - is input into a cryptographic algorithm (also called a cipher)

cleartext

Unencrypted data that is not intended to be encrypted - it is "in the clear"

collision

When two files have the same hash - While for hash algorithms that produce long digests, such as SHA3-512, the odds of such a collision are very low, yet for hash algorithms that produce shorter digests, such as MD5, the odds increase.

Diffie-Hellman Ephemeral (DHE) (key exchange solution)

Whereas DH uses the same keys each time, Diffie-Hellman Ephemeral (DHE) uses different keys - Ephemeral keys are temporary keys that are used only once and then discarded.

Blowfish (symmetric cryptography algorithm)

a BLOCK cipher algorithm that operates on 64-bit blocks and can have a key length from 32 to 448 bits. - To date, no significant weaknesses have been identified - A later derivation of Blowfish known as Twofish is also considered a strong algorithm, although it has not been used as widely as Blowfish.

(T/F) Unencrypted data that is input for encryption or is the output of decryption is called cleartext.

false - called plain text

(T/F) What makes cryptography secure is the obscurity of the key and not of the algorithm.

true

(T/F) obfuscation in encryption can provide confidentiality to data, while obfuscation in other areas of cyber security cannot provide confidentiality

true

(T/F) Although hashing and checksums are similar in that they both create a value based on the contents of a file, hashing is NOT the same as creating a checksum

true - A checksum is intended to verify (check) the integrity of data and identify data-transmission errors - a hash is designed to create a unique digital fingerprint of the data.

(T/F) Cryptography can be applied through either software or hardware

true - a relatively new technology known as blockchain uses cryptography as its basis.

Elliptic Curve Diffie-Hellman (ECDH) (key exchange solution)

uses elliptic curve cryptography instead of prime numbers in its computation.

opal

A set of specifications/standards for self encrypting drives developed by the Trusted Computing Group (TCG). - ensures the interoperability of SEDs among vendors

Obfuscation (why use cryptography?)

- Obfuscation is making something obscure or unclear - By being made obscure, the original information cannot be determined.

Two of the most common types of attacks on cryptography

- algorithm attacks - collision attacks

A hashing algorithm is considered secure if it has the following characteristics:

- fixed size: A digest of a short set of data should produce the same size as a digest of a long set of data - unique: Two different sets of data cannot produce the same digest; Changing a single letter in one data set should produce an entirely different digest. - original: It should not be possible to produce a data set that has a desired or predefined hash. - secure: The resulting hash cannot be reversed to determine the original plaintext.

principles of asymmetric cryptography

- key pairs: Unlike symmetric cryptography that uses only one key, asymmetric cryptography requires a pair of keys. - public key: Public keys, by their nature, are designed to be public and do not need to be protected. They can be freely given to anyone or even posted on the Internet. - private key: private key must be kept confidential and never shared. - both directions: Asymmetric cryptography keys can work in both directions. A document encrypted with a public key can be decrypted with the corresponding private key. In the same way, a document encrypted with a private key can be decrypted with its public key.

important factor that helps determine the strength of a cryptographic algorithm

- the quality of random numbers, or numbers that do not follow an identifiable pattern or sequence - Software usually relies upon a pseudorandom number generator (PRNG), which is an algorithm for creating a sequence of numbers whose properties approximate those of a random number. - PRNGs attempt to create numbers that are as random as possible.

Cryptography can provide protection to data as that data resides in any of three states:

1. data in processing 2. data at rest 3. data in transit

Two techniques can be added to a cryptographic algorithm to thwart known ciphertext attacks by making the ciphertext more difficult to analyze:

1. diffusion: changes a single character of plaintext into multiple characters of ciphertext 2. confusion: makes each character of the ciphertext based upon several parts of the key.

The three broad categories of cryptographic algorithms

1. hash algorithms 2. symmetric cryptographic algorithms 3. asymmetric cryptographic algorithms

lightweight cryptography

A category of cryptography that has fewer features and is less robust than normal cryptography. - goal of providing cryptographic solutions uniquely tailored to low-power devices that need to manage resource vs. security constraints. - is NOT a weakened cryptography but may simply have fewer features and be less robust than normal cryptography.

Trusted Platform Module (TPM) (hardware encryption)

A chip on the motherboard of the computer that provides cryptographic services. - includes a true random number generator instead of a PRNG as well as full support for asymmetric encryption - can also generate public and private keys - can measure and test key components as the computer is starting up - will prevent the computer from booting if system files or data have been altered - if the hard drive is moved to another computer, the user must enter a recovery password before gaining access to the system volume.

block cipher

A cipher that manipulates an entire block of plaintext at one time. - plaintext message is divided into separate blocks of 8 to 16 bytes, and then each block is encrypted independently. - For additional security, the blocks can be randomized

substitution cipher

A cipher that substitutes one character with another - ROT13: the entire alphabet is rotated 13 steps (A = N, B = O, etc.) so that the word security becomes frphevgl - XOR: based on the binary operation eXclusive OR to compare two bits: if the bits are different, a 1 is returned, but if they are identical, then a 0 is returned

quantum computer

A computer that relies on quantum physics using atomic-scale units (qubits) that can be both 0 and 1 at the same time. - As a result, one qubit can carry out two separate streams of calculations simultaneously, meaning that quantum computers will be much faster and more efficient than today's computers. - Although quantum computers are potentially much more powerful than traditional computers, they are also more delicate and prone to faults

sponge function

A cryptographic function that takes as input a string of any length and returns a string of any requested variable length. - This function repeatedly applies a process on the input that has been padded with additional characters until all characters are used (absorbed in the sponge)

Weak keys (Cryptographic Constraints)

A key that causes the cipher to behave in unpredictable ways or may compromise overall security.

resource vs. security constraint

A limitation in providing strong cryptography due to the "tug-of-war" between the available resources (time and energy) and the security provided by cryptography. - three facets: 1. security 2. energy 3. latency

Hardware Security Module (HSM) (hardware encryption)

A removable external cryptographic device. - can be a USB device, an expansion card, a device the connects directly to a computer through a port, or a secure network server - includes an onboard random number generator and key storage facility, as well as accelerated symmetric and asymmetric encryption, and can even back up sensitive material in encrypted form. - Because the security is based on hardware and not through software, malware cannot compromise it.

low latency

A small amount of time that occurs between when a byte is input into a cryptographic algorithm and the time the output is obtained. - a cryptographic algorithm should have this - however, some algorithms require multiple (even 10 or higher) "cycles" on sections of the plaintext, each of which draws power and delays the output

birthday attack (collision attack)

A statistical phenomenon that makes finding collisions easier. - based on the birthday paradox, which says that for someone in a given room to have a 50 percent chance of sharing your birthday, 253 people would need to be in the room. - If, however, you are looking for a greater than 50 percent chance that any two people in the room have the same birthday, you only need 23 people. That's because the matches are based on pairs. - If you are concerned only with matches and not with matching someone to you specifically, then you need only 23 people in the room, because 23 people can form 253 pairs when cross-matched with each other - if not, comparing only your single birthday to everyone else's, 253 people are needed - The same situation applies to hashing collisions. - It is much harder to find something that collides with a specific hash than it is to find two inputs that hash to the same value.

quantum communication

A subcategory of quantum cryptography used to secure telecommunications. - Because eavesdropping changes the physical nature of the information, users in a quantum communication exchange can easily detect eavesdroppers. - The most well-known and developed application of quantum communication is quantum key distribution (QKD)

ephemeral keys

A temporary key that is used only once before it is discarded in encryption

Predictability (Cryptographic Constraints)

A weak random number generator or PRNG of the cipher may create predictable output.

What is data called that is to be encrypted by inputting it into a cryptographic algorithm? A. opentext B. plaintext C. cleartext D. ciphertext

B. plaintext

important note about the security of block ciphers

Block ciphers are considered more secure than stream ciphers because the output is more random, as the cipher is reset to its original state after each block is processed.

post-quantum cryptography

Cryptographic algorithms that are secure against an attack by a quantum computer.

cryptographic algorithm

Consists of procedures based on a mathematical formula used to encrypt and decrypt the data. - Also called a cipher - A key is a mathematical value entered into the algorithm to produce the ciphertext.

File and File System Cryptography

Cryptographic software can be used to encrypt or decrypt files one by one. - However, this process can be cumbersome. Instead, protecting groups of files, such as all files in a specific folder, can take advantage of the OS's file system. - A file system is a method used by an OS to store, retrieve, and organize files. - Protecting individual files or multiple files through file system cryptography can be performed using third-party software or OS cryptographic features.

Full Disk Encryption (FDE) (File and File System Cryptography)

Cryptography can also be applied to entire disks instead of individual files or groups of files - protects all data on a hard drive. - ex. Microsoft Windows BitLocker drive encryption software. - BitLocker encrypts the entire system volume, including the Windows Registry and any temporary files that might hold confidential information - BitLocker prevents attackers from accessing data by booting from another OS or placing the hard drive in another computer.

Encryption through Software

Cryptography can be implemented through software running on a device. - Encryption can also be performed on a larger scale by encrypting the entire disk drive itself.

confidentiality (why use cryptography?)

Cryptography can protect the confidentiality of information by ensuring that only authorized parties can view it. - Encrypted information can only be viewed by those who have been provided the key.

Integrity (why use cryptography?)

Cryptography can protect the integrity of information. - Integrity ensures that the information is correct and no unauthorized person or malicious software has altered that data. - Because ciphertext requires that a key must be used to open the data before it can be changed, cryptography can ensure its integrity. - Encrypted information cannot be changed except by authorized users who have the key.

asymmetric cryptographic algorithms

Cryptography that uses two mathematically related keys. - also known as public key cryptography - The keys are mathematically related and are known as the public key and the private key. - public key is known to everyone and can be freely distributed - private key is known only to the individual to whom it belongs - public key used to encrypt messages - private key used to decrypt messages

Data in processing

Data actions being performed by "endpoint devices," such as printing a report from a desktop computer.

Data at rest

Data that is stored on electronic media.

Diffie-Hellman (DH) (key exchange solution)

Diffie-Hellman (DH) key exchange requires Alice and Bob to each agree upon a large prime number and related integer. - Those two numbers can be made public, yet Alice and Bob, through mathematical computations and exchanges of intermediate values, can separately create the same key.

Self-Encrypting Drives (SED) (hardware encryption)

Drives that can automatically encrypt any data stored on them. - When the computer or other device with an SED is initially powered up, the drive and the host device perform an authentication process. - If the authentication process fails, the drive can be configured to simply deny any access to the drive or even perform a cryptographic erase on specified blocks of data. (A cryptographic erase deletes the decryption keys so that no data can be recovered.) - It is also impossible to install the drive on another computer to read its contents. - A set of specifications for SEDs developed by the Trusted Computing Group (TCG) is Opal.

symmetric cryptographic algorithm

Encryption that uses a single key to encrypt and decrypt a message. - The original cryptographic algorithms for encrypting and decrypting data - Because the key must be kept private (confidential), also known as private key cryptography - identical keys are used to encrypt and decrypt a document. - can provide strong encryption—if the key is kept secure between the sender and all the recipients

Data Encryption Standard (DES) (symmetric cryptography algorithm)

One of the first widely used symmetric cryptography algorithms - U.S. government officially adopted DES as the standard for encrypting unclassified information. - Although DES was once widely implemented, it is no longer considered suitable for use. - The popularity of DES helped move cryptography implementation and research from military use only to academic and commercial organizations.

perfect forward secrecy

Public key systems that generate different random public keys for each session.

Perfect forward secrecy (key exchange solution)

Public key systems that generate random public keys that are different for each session are called perfect forward secrecy - value of perfect forward secrecy is that if the secret key is compromised, it cannot reveal the contents of more than one message.

Computational overhead (Cryptographic Constraints)

Sensors and Internet of Things (IoT) devices often lack the capacity to accommodate the computational overhead for cryptography.

low-power devices (Limitations of Cryptography)

Small electronic devices that consume very small amounts of power. - these devices need to be protected from threat actors who could accumulate their data and use it in nefarious ways - adding cryptography can be difficult, as cryptographic algorithms require time and energy, both of which are typically in short supply for low-power devices and applications needing ultra-fast response times.

hardware encryption

Software encryption suffers from the same fate as any application program: it can be subject to attacks to exploit its vulnerabilities. - As a more secure option, cryptography can be embedded in hardware. - Hardware encryption cannot be exploited like software encryption. - Hardware encryption can be applied to USB devices and standard hard drives. - More sophisticated hardware encryption options include self-encrypting drives, the trusted platform module, and the hardware security model.

important note about the security of stream ciphers

Stream ciphers are less secure than block ciphers because the engine that generates the stream does not vary; the only change is the plaintext itself

high resiliency

The ability to quickly recover from resource vs. security constraints.

Authentication (why use cryptography?)

The authentication of the sender can be verified through cryptography. - Proof that the sender was legitimate and not an imposter can be obtained.

Entropy (Cryptographic Constraints)

The measure of randomness of a data generating function. - ciphers with low entropy give the ability to predict future-generated values.

Key length (Cryptographic Constraints)

The number of bits in a key. - Some ciphers have a short key length, which results in weaker security.

cryptography

The practice of transforming information so that it is secure and cannot be understood by unauthorized persons, and thus is secure - usually accomplished through "scrambling" the information so that only approved recipients (either human or machine) can understand it.

RIPEMD (RACE Integrity Primitives Evaluation Message Digest) (hash algorithm)

The primary design feature of RIPEMD is two different and independent parallel chains of computation, the results of which are then combined at the end of the process - all versions are based on the length of the digest created, including RIPEMD-128, RIPEMD-256, and RIPEMD-320

decryption

The process of changing encrypted text into the original text. - part of cryptography

encryption

The process of changing plaintext into ciphertext. - part of cryptography

hashing

The process of creating a digital fingerprint (hash) - often used as a check to verify that the original contents of an item have not been changed - done by comparing digest values of the hashed data - A match indicates the original file did not change while it was being downloaded.

Digital Signature Algorithm (DSA) (asymmetric cryptography algorithm)

a U.S. federal government standard for digital signatures. - a digital signature is an electronic verification of the sender - digital signature can: - verify the sender: digital signature serves to confirm the identity of the person from whom the electronic message originated. - prevent sender from disowning the message (nonrepudiation) - Prove the integrity of the message - The basis for a digital signature rests on the ability of asymmetric keys to work in both directions (a public key can encrypt a document that can be decrypted with a private key, and the private key can encrypt a document that can be decrypted by the public key). - Using a digital signature does NOT encrypt the message itself - utilizes hashes and message digest comparison

secure hash algorithm (SHA) (hash algorithm)

a family of hashes - SHA-1 was developed in 1993 but is no longer considered suitable for use - SHA-2 has six variations, the most common are SHA-256, SHA-384, and SHA-512 (the last number indicates the length in bits of the digest that is generated) and is currently considered a secure hash - SHA-3 (created in 2015, newest one): design goal was to make it dissimilar to previous hash algorithms to prevent threat actors from building on earlier work of compromising the algorithms.

Rivest Cipher (RC) (symmetric cryptography algorithm)

a family of six algorithms - RC4, the most common RC cipher, is a STREAM cipher that accepts keys up to 128 bits in length.

Advanced Encryption Standard (AES) (symmetric cryptography algorithm)

a symmetric algorithm that performs three steps on every block (128 bits) of plaintext - Within step 2, multiple rounds are performed depending upon the key size: a 128-bit key performs nine rounds, a 192-bit key performs 11 rounds, and a 256-bit key, known as AES-256, uses 13 rounds. - Within each round, bytes are substituted and rearranged, and then special multiplication is performed based on the new arrangement - To date, no attacks have been successful against AES.

RSA (asymmetric cryptography algorithm)

algorithm multiplies two large prime numbers (a prime number is a number divisible only by itself and 1), p and q, to compute their product (n=pq). - Next, a number e is chosen that is less than n and a prime factor to (p − 1)(q − 1) - Another number d is determined so that (ed − 1) is divisible by (p − 1)(q − 1) - The values of e and d are the public and private exponents - The public key is the pair (n,e) - the private key is (n,d) - The numbers p and q can be discarded. - The basis of RSA asymmetric encryption security is factoring, or the prime numbers that make up a value. - As computers become faster and more powerful, the ability to "crack" RSA asymmetric encryption by computing the factoring has grown.

collision attack

an attempt to find two input strings of a hash function that produce the same hash result.

(T/F) SHA-1 is considered a secure hash algorithm.

false

Triple Data Encryption Standard (3DES) (symmetric cryptography algorithm)

designed to replace DES - 3DES uses three rounds of encryption instead of just one. - The ciphertext of one round becomes the entire input for the second iteration. - employs a total of 48 iterations in its encryption (3 iterations × 16 rounds). - most secure versions of 3DES use different keys for each round - Although 3DES addresses several of the key weaknesses of DES, it is no longer considered the most secure symmetric cryptographic algorithm.

the primary weakness of symmetric encryption algorithms:

distributing and maintaining a secure single key among multiple users, who are often scattered geographically, poses significant challenges.

USB Device Encryption (hardware encryption)

encrypted hardware-based USB devices such as flash drives can be used to prevent these types of software-based attacks. - The drives resemble standard USB flash drives, with the following significant differences: - Encrypted hardware-based USB drives will not connect to a computer until the correct password has been provided - All data copied to the USB flash drive is automatically encrypted - The external cases are designed to be tamper-resistant - Administrators can remotely control and track activity on the devices - Compromised or stolen drives can be remotely disabled

ciphertext

the scrambled and unreadable output of encryption.

Known Ciphertext Attacks (Algorithm Attack)

the use of sophisticated statistical tools to analyze the ciphertext and discover a pattern in the ciphertexts, which may be useful in revealing the plaintext text or key - all that is known is the ciphertext, though it can still reveal clues that may be mined. - Wireless data networks are particularly susceptible to these - Threat actors can capture large sets of ciphertexts to analyze and then inject their own frames into the wireless transmissions

(T/F) A digest of a short set of data should produce the same size as a digest of a long set of data.

true

(T/F) Asymmetric cryptography keys can work in both directions.

true

(T/F) Cryptographic algorithms are public and well known; however, the individualized key for the algorithm that a user possesses must at all costs be kept secret.

true

(T/F) Cryptography is viewed as a necessary feature to add to protect low-power devices and applications that require fast response times to make them secure.

true