Cryptography

Kerchoff's Principle

"A cryptosystem should be secure even if the attacker (Oscar) knows all details about the system, with the exception of the secret key. In particular, the system should be secure when the attacker knows the encryption and decryption algorithm."

MAC security concerns

(prefix) - subject to man in middle attacks (suffix) - subject to collisio attacks

What is static and dynamic

(static) a resource on the local file system (dynamic) to a program

Linux to know

*nix is a variant Samba is attack surface

Asymmetric Key - Discrete Log Take Aways

- Diffle-Hellman widely used method for key exchange -based on discrete log problem - one way function -prime p should be > 1024 -Elgamal is extension of DHKE -Elgamal is probabalistic - two identical plaintexts result in two distinct ciphertext

3 problems with symmetric key encryption

- Issue securly distiburing keys - Number of keys needed , n is number poeple (n*(n-1)/2) - cant protect against cheating (no nonrepudation)

What are two ways to increase block cipher security?

- Multiple encryption (double encrypt, but vulnerable to meet-in-middle atatck) -Key whitening

What does Symmetric Key encryption require to be successful?

- One key for decryption and encryption - Sender and receiver needs same key -Each unique sender/receiver must have the same key -Number of keys grows at a rate of n(n-1) / 2 a class of 32 would need 496 keys

Analytical attacks for DES?

- no real weaknesses until 1990s -cryptoanaysisi can be applied to block ciphers -s-boxes proved pretty effective against this attack

What is DES?

- symmetric cipher - uses an iterative algorithm, for each block of plaintext encryption is preformed in 16 rounds of same operation -in each round a different subkey is used which is dervied from the mainkey, using a key scheudle

How does Initialization Vector occur in CBC?

- to agree on it, just send it to one another in plaintext, the secrecy of this is not required because dont have key

Frequency hopping spread spectrum(FHSS) Direct Sequence Spread Spectrum (DSSS) Orthogonal Frequency Division Multiplexing (OFDM)

-Data hops between frequencies to avoid interference -Data is simultaneously spread between frequencies, and uses a chipping code which enables messages to be put back together should interference occur -Bandwidth is divided into ranges of frequencies called tones This allows a higher data transfer rate than FHSS an DSSS

Important things you should know about cryptography history?

-Dates back to 2000BC -Egyptian hieroglyphics - First used substitution cipher where a character in plain text was taken and offset -Enigma Machine WWII: operators put a character in and a sub char would be sent out

What does public key (asymmetirc) encrpyiton have that shared (symmetic) does not?

-Digital signatures -key establishment

4 Bullets of Block Ciphers

-Encrypt an entire block of plaintext at a time -Blocks have fixed length( Often 64 or 128 bit) -Each block is encrypted with the same key Examples of block ciphers include: Advanced Encryption Standard (AES) Data Encryption Standard (DES)

What is public key / RSA mainly used for? And what is it NOT used for?

-Encrypting small pieces of data -Digital signatures -replacing symmetric key encryption (bc public key is slow)

Two ways to speed up RSA process?

-Fast encryption with Short Public Exponents: using smaller encryption exponents does not reduce security and it can reduce number of operations -Fast Decryption with Chinese remainder theorem the reciever has knowledge of both the large prime numbers used to generate keys so they can take advantage of additional mathematical properties

Weanesses of Electronic codebook mode (ECM) for block ciphers?

-Given same key outputs are deterministic so attackers can preform traffic analysis to gather info -blocks can be rearranged, attacker preform subsistion attack -does not protect integrity

Why is symmetric key encryption good?

-Much faster than asymmetric -difficualt to break if a large key size is used -Only one key needed for enc and dec

Three general RSA attacks?

-Protocl Attacks -Math Attacks -Side Channel Attacks

What is cipher feedback mode (CFB)?

-also uses block ciphers as foundation for stream cipher -instead of using block to encrypt to generate the next cipher, it uses cipher text Process: 1. first block - encrypt IV - generate b keystream bits 2. encrypt b plaintext bits (XOR) with keystream to generate b ciphertext bits 3. encrpyt b cipher text bits into the next block to generate b more keystream bits IV makes it non deterministic (use nonce)

What is probabilistic encryption?

-associated with cipher-block-chaining -different cipher texts for same given plain text - occurs through randomness, with initialization vector

Why is it important to study DES?

-considered most popular cipher for almost 30 years -design principles in DES are used in modern block ciphers -gives us understanding of other symmetric algorithms

What is key schedule in DES?

-derives 16 round keys of 48 bits (aka subkeys) from original 56 bits

Overview of AES

-does not encrypt each block on every iteration -encrypts all 128 bits on each iteration -comprised of layers which manipulate all 128 bits of the data path -all rounds but first use all three layers -last round does not use MixColumn transformation

What are S-boxes in DES?

-each s-box contains 2^6, or 64 entries in a 16 column, 4 row tables -s-box maps a 6 bit input to a 4 bit output -S-box introduce confusion as non-linear building blocks Lookup: MSB and LSB determine row 4 inner values determine column

What is Output feedback mode (OFB)?

-enables block ciphers to be used in stream cipher -key stream is generated blockwise (not bitwise) with a size b -here is encrypts IV b keystream bits -encrypt output of first encryption (b*n) keystream bits

What is an RSA protcol attack?

-exploited because RSA is maleable -addressed with proper padding

What are RSA mathematical attacks?

-factoring the modulus -similar to brute force -to prevent make value 1024 bits or greater

How was AES modified for implementation?

-merges round functions through use of lookup tables -result in 4 tables with 256 entries, each 32 bit referred to as T-box

What is electronic codebook mode (ECM) as used for block ciphers?

-messages broke into blocks of b bits -if not an even interval of b, padding is used -each block encrypted with key k

What are Block ciphers - counter mode (CTR)

-mode for using block cipers to generate stream ciphers input to block cipher is important, no two blocks can encrypt with the same values - NONCE same for all blocks -Counter increments for each block to do - nonce counter generates each b blocks to keystream

General AES info?

-most widely used symmetric cipher - government applications -commercial standards IPSEC, TLS, SSH - can be used for secret (any key length) and Top secret (192, 256 bit)

Elliptic Curve overview and advantages

-newest of public key -same security as RSA with shorter operands -fewer computations -less bandwith

Attributes of Elliptic Curve

-no self intersections -no verticies

What is function f in DES?

-plays big rule in DES security -enables confusion and diffusion -designed to prevent analytical attacks -maps 64 inputs to 64 outputs -In round x, it takes the right half of the prior round (x-1). So first round is 32 bits of the 64

What properties must hash functions possess?

-should be computationally efficient to apply to messages of any size -output should be a fixed length, and independent of input length -fingerprint should be highly sensitive to input bits

Why have initial and final permutations in DES do?

-unknown why we have them for they do not increase security -likely related to hardware limitations at the time - easy to implement in hardware, but more complex in software

What is a meet-in-the-middle attack?

1- Left encryption brture force (lookup table created) 2- right encryption brute force if the candidate key is the right key, cipher is cracked, otherwise contunine incrementing in step 2 until another candidate is discovered

What does KEY schedule do?

1. 56 keys are split in half to 28 bit halves 2. each half keys are shifted based on rounds 3. when x = 1, 2, 9, 16 the halves are rotated to the left 1 bit, other wise rotated left by two bits iteration 0 and 16 have same key 4. After rotation, halves are permuted against PC-2 which takes 56 bits, ignoring the 8 for a 48 bit output key Notes: East to implement in hardware, each round has different key, each bit in original key is used about 14 times (of 16 rounds)

Supplicant, Authenticator, and Authentication Server

1. A wireless user that is attempting to access a wireless network 2.The access point functions as an entity that allows or denies a supplicant's access 3.A server

What is in important when using random number generators to identify primes?

1. Ensuring they are not predictable 2. The number we need to test before finding a prime (more numbers = more time) 3. how fast we can check if a number is prime

What steps foes DES f-function take?

1. In round x, it takes the right half of the prior round (x-1). So first round is 32 bits of the 64 2. Expansion step -> expands 32 bits o 48, having 16 of the 32 bits appear twice increases diffusion because input bits influence two different output locations 3. Expanded value is XOR with 48bit round key 4. 48 bits broken down into 8, 6 bit boxes 5. 6 bit boxes are fed into 8 substitution boxes, called S-boxes 6. block size reduced back to 32 bits 7. Final permutation Result known as Avalanche Key

What are the basic "block" steps of DES?

1. Initial Permutation 2. 16 rounds of Encryption (where f-function and key schedule are used) 3.Final Permutaion

Attack Lifecycle

1. Initial Recon: target research, target selection 2. Penetration: attack vulnerbilities, social engineering (XXS, phishing), 3. Gaining Foothold: backdoor software 4. Approrpating/Escalating Privileges: crash poor password hashes, gain user into to guess passwords 5. Internal recon: what processes running? What info available? 6.Lateral Movement (Network): launch attacks on systems in network and repeat lifecycle 7. Maintain Presence: additional backdoor, rootkits 8. Mission Accomplished: Information obtained

4 things we can do with public key crypt

1. Key establishment: secert keys over insecure channels 2. Non-repudiation: and message integrity can be realized with digital signature algorithms 3.Identification: entities can be identified with challenge/response portocls 4.Encryption: messages such as RSA and Elgmal can be used for encryp

Three ECDSA properties

1. Key generation - requires finding elliptic curves with good crypt properties, along with double and add mathematical operations 2. Signing - when possible, cetain elements can be precomputed. When preconsumption is used, signing is a fast operation Verification: arithmetic in this calculation straightforward.

More RSA takeaways

1. Most widely used public key cryptosystems 2.Mainly used for key transport (encryption of symmetic keys) and digital signaturesWhat 3. public key can be a short inter, but private key must be full length 4. encryption much quicker than decryption 5. based on complexity with integer factorization -1024 bit secure now, but not long 6. Schoolbook RSA allows several attacks which can be addressed with padding

Three types of testing

1. Penetration - hacker actively attempts to break into an organization network / appliances 2. Vulnerability testing- tester does not actively attempt to gain access to target network, but do identify and enumerate potential vulnerabilities 3. Security - actively try to "break in". ut also utilize companies security policies to idenify weakness

5 types of social engineering

1. Pure Social Engineering 2. Shoulder Surfing:Looking over someone's shoulder 3.Dumpster Diving :Looking through the trash for recon, looking for things like bills 4: Piggybacking Following someone into a restricted area using their credentials 5.Phishing Fake emails designed to trick users Spear Phishing Phishing combined with social engineering

Waht two protocol does DHKE contain?

1. Setup protocol -chose large prime choose integer publish both 2.main protocl

AES key schedule

1. Takes original key and derives subkey 2. Requires n+1 keys where n is number of rounds 3. initial keys are XOR to preform "key whitening" 4. prevents man - in - middle attack

Expected hash function properties?

1. arbitrary message size 2. fixed output length 3. efficiency 4. preimage resistance 5. second preimage resisitance 6. collosion resisitance

Steps in asymmetric encryption

1. choose two large primes p,q 2. computer N = p*q 3. computer theta(n) = (p-1)(q-1) 4. select public exponent such that gcd (e, theta (n)) = 1 5. compute private key so d*e = 1 mod theta (n)

Three properties hash functions need to be secure?

1. preimage resistance (one-wayness) 2. second preimage resistance (or weak collision resistance) 3. collision resisitance (strong collision resistance)

Special home IP address

127.0.0.1

How many rounds of AES are preformed with 128 bit, 192 and 256?

128 - 10 192 - 12 256 - 14

What block lengths does AES use?

128 bit, but Rijnadels algorithm supports 128, 192, and 256

DES History

1972 Nat Board Standards wanted standardized cipher Invited vendors to submit algorithms IBM created code names "Lucifer" Lucier was a feistel cipher w/ 64 bit blocks and key of 128 bits National Board of Standards requested help of NSA

Formula to predict random number is prime

2 / ln(p) If we are searching for 512 bits 2/ln(2^512)

Given the following info whats the probability of false positive K = number of bits in length of key (80) N = number of bits in block length (64) t = number of plaintext/ciphertext pairs (2)

2^(80 - 2 *64) = 2^(-48)

What is the linklihood of a false key block ciphers?

2^(K-tn) K = number of bits in length of key N = number of bits in block length t = number of plaintext/ciphertext pairs

How is IPV4 built

4 8 bit numbers no higher than 255

What is the byte substitution layer AES

8 input bits --> 8 output bits same s- box for all rounds

What is jackpotting

A sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machine to spit out huge volumes of cash on demand

What is framebusting?

A technique that enables a website originally displayed in an iFrame to "bust out" of the frame enabling it to "take over the window"

What were some windows issues with NFTS - new technology file systems

ADS (alternate data streams) was a big compatibility issue with Apples hierarchy system which allows source of stream to be hidden behind file

How is AES and DES different in implementation?

AES designed for easy software implementation it is great on 8 bit processor Requires more hardware than DES uses modern hardware ASIC or FPGA (field program gate arrays) no great on 32/64 because byte sub, shift rows and mix columns all use 1 byte per instruction

How can asymmetric and symmetric encryption be used together?

AES is faster and more effiecnt but we run into an issue to share keys. Share your encryption key using asymmtric encryption and encrypt message with symmetric

Client Side

Active X Flash JavaScript

What is remote procedure call and vulnerabilities?

Allows a program running on one host to execute code on another host Dangerous because there must be trust between the machines

What is metasploit and common practices?

An open source tool that is designed to streamline the process of identifying and exploiting vulnerabilities Perform initial recon Perform vulnerability scans (OpenVAS, nessus) Discover target OS/service and associated exploit Select exploit, configure and launch!

Four types of cryptoanalysis attacks?

Analytical attacks - exploit the internal structure of the encryption method Brute force attacks - treat the encryption method as a black box, and try all possible keys Implementation Attacks - attacks that may utilize "side channel analysis" such power consumption or electromagnetic radiation from the processor operating on the secret key. Social Engineering Attacks - Threatening, Bribing, blackmailing, tricking, or general espionage attacks. Finally, there are other attacks that are possible due to weaknesses such as buffer overflows, malware attacks, etc

How do digital signatures work?

Bob keeps his private key a secret, so only he can sign a message contents of message are included in signature, so it cant be reused digital sig is appended to message alice takes signature, message and public key to use them to verify NOTES: signature must be appended to message, it does not provide confidentiality

Only known AES attacks?

Brute Froce

What is a common issue with block ciphers?

Brute force attacks produce false positives

What is public key not good for?

Bulk data because it is computationally intensive and therefor slow

Server Side:

CGI: Common Gateway Interface ASP: Active Server Pages JSP: Java Server Pages PHP: PHP Hypertext Preprocessor Node.js

What are CVE, CERT and NVD

CVE: Common Vulnerabilities and Exposures CERT: Computer Emergency Readiness Team NVD: National Vulnerability Database

Cipher block chaining attacks and integrity v. confidentiality?

Cipher blocks may have issues with substitution attacks Good with confidentiality but not integrity

Three mechanisms for stream ciphers encryption?

Cipher feedback mode (CFB) Output feedback mode (OFB) Counter mode (CTR)

RSA signature scheme

Computational -slow -speed up using public exponents Algorithm attacks if oscar factors number he can sign with private key use large module to prevent Existential forgery oscar generates a signature first and assins it to plaintext

CIA of security

Confidentiality Integrity Authenticity

According to Claude Shannon what are two primitive operations which strong encryption algorithms can be build

Confusion - an encryption operation where the relationship between key and ciphertext is obscured Diffusion - an encryption operation where the influence of one plaintext symbol is spread over many ciphertext symbols with the goal of hiding statistical properties of the plaintext (such as bit permutation)

What are the two branches of Cryptology

Cryptography: science of secert writing with goal of hiding the meaning of message and Cryptanalysis: science/art of breaking cryptosystems

What digital signature algorithm is used in government?

DSA (digital signature algorithm) -costly bc generates 160 bit prime first

Whihc signatures are shorter than RSA?

DSA (elgamal) and ECDSA (Elliptical curve)

What does DES stand for?

Data encryption standard

Two hash function families?

Dedicated hash functions: alrogithms dedicated to preform hash functions Block cipher based hash functions: AES can be used to construct hashes

Three examples of non-RSA public key encryption

Diffle-Hellman Key exchange Elgamal Encryption Elliptic Curve Crypto Systems

Which posses integrity?

Digital signatues, message authentication codes

(EAP-POTP) (EAP-PSK) (EAP-PWD)

EAP-Protected One-Time Password (EAP-POTP) Enables multifactor authentication through the use of token generation hardware/software EAP-Pre Shared Key (EAP-PSK) A pre shared key is used for mutual authentication and session key creation EAP-Password (EAP-PWD) Uses shared passwords for authentication

Embedded OS vulnerbilities

EOSs are ubiquitous EOSs are increasingly being network EOSs are extremely difficult to patch EOSs are in most networking devices EOSs are in most network peripherals (printers, scanners, multipurpose stations, etc.)

What are the rounds of AES

Each round of 128 -byte subsitiation layer -shift rows layer -mix column layer -key addition layer repeat

Three mechanisms for block ciphers encryption?

Electronic codebook mode (ECM) Cipher block chaining (CBC) Galois Counter Mode (GCM)

How dies asymmetric key encryption work?

Everybody has a public and private key. If someone wants to send you a message, give them your public key. Use your private key to decrypt

Two types of prime tests?

Fermat picks random value,checks for mod 1, then chose another random number, repeat until certain level confidence reached Miller-Rabin - similar but less weakness, 2^-80 confidence level

How does Cipher Block chaining work?

First block is XOR with Initialization Vector, all subsequent blocks are the prior encrypted block, XOR with the next plaintext block so each encrypted block is a result of IV and prior block. If IV changes between messages, encryption becomes a problem

What is sandboxing?

Forces scripts to run seperatley

For RSA/Public Key/ Asymmetric Encry what is -encryption function -public key -private key

Functioon: E(m) = m^e mod n, for messge m D(c) = c^d mod n, for ciphertext c Public key: pair of ints Private key: triple of ints (p, q, d)

Stengths and weakness of GCM, ECB and CTR?

GCM - allows for message authenitcations (Integrity) ECM - weak CTR - allows parallelization and high speed implementaion

HTML GET vs POST

GET Contents are sent as part of the URL Back button works normally and entire URLs can be bookmarked Included values (parameters) can be retrieved from history NEVER USE FOR PASSWORDS POST Contents are sent as a part of the message body (message that is sent to the web server) Back button retransmits data (user is warned) and full URLs cannot be bookmarked Included values (parameters) cannot be retrieved from browser history Still does not encrypt USE FOR PASSWORDS

What is GMAC?

Galosis Counter message authentication code: not used for encryption, just decryption is an authentication-only variant of the GCM which can be used as an incremental message authentication code minimum latency and minimum operation overhead. 128

What problems arise from symmetric key encryption?

How does one safely transfer they key? Email and Web? - insecure USB? - better but difficult How do you know who send a who received? if both use same key, don't support authentication and non-repudiation

Hub, Switch and Router

Hub: Sends traffic to all connected nodes Switch: Tracks who is connected to which port, and directs traffic to a specific destination (instead of sending it to everyone) Router: Generally connect to network segments, an internal and an external

How is asymmetric key cryptography different from symmetric?

In symmetric each party must have access to same key to preform both encryption and decryption In asymmetric the key used to encrypt does NOT need to be a secret, only the key used to decrypt

What is SQL Injection

Including extra SQL code into an input in an attempt have your code run

What is a primary way to increase security in crypt?

Increasing the size of the keyspace to protect against brute force 8 bit - treid in a second 256 < uncrackable in reasonable time

Two ways to assist in public key crypt?

Integer factorization and discrete logorithm problem (elliptic curve)

Three primary families of public key encryption?

Integer factorization, discrete logarithm, elliptic curve

What two open standards does AES use?

Ipsec adn TLS

Can CTR Counter mode be paralized and does it require feedback?

It can be paralized and does not require feedback

Key? KeySpace?

Key - A set of bits generated from the range of allowable values Keyspace -The size of the range of allowable values for a key If the keyspace was 8 bit, there are 2^8 possible keys (256) If the keyspace is 256 bit, there are 2^256 possible keys (1.15*10^77)

What is a KDC and what does it do

Key distribution center which assumes a server is trusted by users and shares key with each user The KEK or key encryption key transmits keys each user has sahred key with server, KDC encrypts and sends key so alice can talk to bob

What is the security of stream cipher dependent on?

Key stream

Whats to note on base DES Key size?

Keys contain 64 bits, every 8th is an odd parity bit, DES does a 56 bit cipher bc parity bits are removed during initial permutation. These don't increase security.

What is Diffusion layer - Mix columns?

Linear transformation Mixes columns in matrix every byte influences 4 output bits each 4 byte columns is multiplied by a constant matrix So you have a 128 bit matrix (state matrix) and 128 bit key, use XOR Keys come from key schedule

Which is faster MACS or digital signatures?

MACS bc of symmetric

what s-box location would the following find? 100101

MSB and LSB determine row so (11) = row 3 (0010) = 2 column (They start at 0, so depending on could be 4,3

How are server message block vulnerable (SMB)?

Man in middle attacks, weak for of password security, wanna cry ransomware attack

DES secuity?

Many weakness, but two main 1. key space is too small and vulnerable to brute force attacks 2. design criteria for s-boxes were a secret

Whats a MAC address

Media Access Control Address - used by NIC to identify device on network

What was MBSA?

Microsoft baseline security analyzer as a countermeasure to increase window security. had password policy and firewall status

Whats a NIC

Network interface card: physical network device

Are ciphers that are primary confusion based of diffusion based secure?

No, neither exclusivity one or the either are secure. The enigma was confusion based

What random number generator gives perfect encryption? What do we need for unconditional security?

None A cryptosystem is unconditionally (or information-theoretically) secure if it cannot be broken even with infinite computational resources

Why is AES harder to decrypt than DES?

Not based on Feistel network, instead each layer must become an inverse layer Byte Sub --> inverse byte sub Shift rows --> inverse shift rows Mix Columns -->inverse mix columns

What is H=DHKE secure/not secure agaisnt?

Not secure agasint main-in-middle, passive attacks - oscar can listen not alter

What unconditional secure exists?

One Time Pad (OTP). First described by Frank Miller in 1882 1919, patent was issues to Gilbert Vernam The "pad" portion of the name comes from how the keys were originally distributed on a "pad" of paper where it was easy to tear off and destroy the key used When used, they were Printed extremely small to require a magnifying class Printed on sheets of highly flammable paper so they could be easily destroyed

Problems associated with pseudo random number gen?

Only a very small initial number is used to generate the random value From there, each one is passed in to generate another value If any of the plaintext becomes available, one can uncover the seeded random value If one can uncover 4 or more plaintext portions, then they should have enough to discover the recursive seed sequence that generates the keystream!

Outcomes of primality tests?

P ic composite - always true, p is def not prime p is prime - could be false, high probability

Security of Elgamal

Passive: eave-stopping based on hardness of DHKE Active: Elgamal is maleable like RSA, use key authn certificates, reuse of secret exponent

Ping Scan, SYN scan, Connect Scan, Null Scan, XMAS scan, ACK, FIN scan

Ping: Quick but easy to block SYN: stealth scan, machine respong quit before handshake completes Connect: complete handshake NULL: all flags turned off, if no packet returned, probably open XMAS: opposite of null, all flags set ACK: used to identify firewall filters, attempts to confirm connection target has to record of Fin: only fin flag is set

Plain Text? Cipher Text? Encryption? Decryption?

Plain Text - the text of the message which can be read by an observer and understood Cipher Text - the result of encryption performed on plaintext Encryption - The process of using an encryption algorithm or code to turn plaintext into ciphertext Decryption - the inverse of encryption, the process of turning ciphertext into readable plaintext.

2 profiles of e-STREAM project (2004-2008)

Profile 1: Stream ciphers for software applications with high throughput requirements Profile 2: Stream ciphers for hardware applications with restricted resources such as limited storage, gate count our power consumption

What is ransomware, adware and macro virus

Ran: Type of virus that locks a target system until a ransom is paid Ad: Similar to spyware Send you to cryptic part of web MAcro:Code often written in programming language, such as visual basic Effects software not OS Attackers can Steal credentials Delete information

In 1997 NIST puts out request for new encryption standard who wins are who are finalists?

Rijnadel (Joan Daemen adn Vincent Rijmen) win finalsits: MARS, RC6, Serpent, twofish

What does RSA stand for?

Rivest, shamir and adleman

What is diffusion layer -shift rows?

Row 1 - no shift row 2 - 3 byte position right shift row 3 - 2 byte shift right row 4 - 1 byte shift right 8 bits in byte

4 TCP flags

SYN Flag - beginning of a session ACK Flag - acknowledgement RST Flag - Reset flag resets or drops a connection FIN Flag - indicates that the connection is finished

Three DNS (Denial of Service) atacks

SYN Flood: Network connection can only handle so many tcp connection requests, Attack initiates a bunch of connections with SYN Zombie Flood: Attacker initiates many connections but users are not legitimate users ICMP Flood: Send larger volume ICMP traffic

commercial roles for fundamental key agreement (DHKE)

Secure shell (ssh) Transport Layer Secuity (TLS) Internet protocol security

What is a product cipher?

Several encryption operations are concatenated consisting of "rounds" repeatedly applied to data

Static application security testing vs. dynamic

Static:Analyzes source code Requires source code to be available Can help find coding errors Dynamic:Analyzes security of running applications Used when source code is unavailable Can be used alongside SAST to prioritize findings

What is a stream cipher and what are the two key streams associated?

Stream Cipher: encrypt bits of the message individually through the use of a keystream. (XOR stuff) Synchronous key streams - key stream uses only the key Asynchronous key streams - utilize key streams that change dynamically based on the cipher text

Two Types of Symmetric Crytpogrpahy

Stream Ciphers and Block Ciphers

Stream Cipher takeaways

Stream ciphers generally require fewer resources (code size, chip area) to implement than bulkier block ciphers When working with stream ciphers Cryptographically Secure Pseud Random Number Generators (CSPRNGs) are far more important than other areas (simulation/testing) One-Time Pad is the provable secure symmetric cipher, however, it is impractical as the key must be as long as, or longer than the message

What is SCADA

Supervisory Control and Data Acquisition Systems special system that is often used for monitoring and controlling Large equipment in industrial situations Manufacturing Built on a variety of different embedded systems Supposed to be safe because of an "air gap", but it is still vulnerable to some attacks

Message Authentication Code (MAC) properties

Symmetric Arbitrary size fixed output length message integrity message authentication no non-repudiation

What are the three branches of cryptography

Symmetric:The message is encoded with a secret key, and decoded with the same secret key. Asymmetric: - Introduced in 1976 this relies on two keys, a private key (used to encrypt the message) and a public key (used to read the message) Protocols- This focuses on using symmetric/ asymmetric algorithms to build higher level concepts (such as TLS)

Three common IP Protocols

TCP (transmission control protocol) UDP (User datagram protocol) ICMP(Internet Control Message Protocol)

What is Cross Site Request Forgery

Taking advantage of the browser remembering the user, bad guy finds a way for someone already using a bank website to click that link, bc the bank account and browser have a trust connection, the request is sent to the banks server and the transfer occurs

What is 0 day vulnerability?

The vulnerability has just been discovered (or reported) Usually to a vendor There are no fixes for it yet

Basic concept behind stream cipher? How does it work?

Two binary streams, key stream and plain text XOR generates ciphertext XOR with ciphertext and key stream decrypts

What is the diffusion layer AES

Two sublayers Shiftrows transformation and MixColumn transformation

Three types organized crime

Type I - Exclusively Online Swarm: disorganized, hacktivism Hub: organized, piracy, phishing, botnets, scareware Type II - Online/Offline Hybrid Skim card numbers Type III - Mostly Offline Use technology to export their activities online

5 social engineering techniques

Urgency -"I need <x> quickly to prevent the system from going down" Quid Pro Quo - "I can get you <x> but I need you to give me <y>" Status Quo -"I have been doing this all day, everyone else in the department has done it, they were just as reluctant as you are!" Kindness- "No need to come in at 4am to test it out, give me your username and password and I will do it for you" Position - "I am the CIO and we have a serious problem with your network. Can you give me your login and password? I won't share it with any of my subordinates, this is a high level problem and I am personally looking into it!"

What are Galois Counter Mode (GCM) block ciphers?

Used to prevent against substitution attacks (whihc are vulnerable in ECB and CBC) GCM includes a Message Authentication Code (MAC) whihc provides a checksum computed by the sender. Reciver double checks checksum with sent message DOES have authentication and integrity

What is a virus, worm, trojan ?

Virus: Program that attach themselves to a file of program Don't stand on their own Do not replicate themselves How program/file is required Once attached and running can perform the task the creator intended. Worm: Malicious software that replicates and propagates itself without having to attach itself to host file Trojan:Code disguises itself as useful program User who install it are tricked

What is wardriving and warchalking

Wardriving: person uses some sort of connected device to search for wifi networks, not illigal warchalking: marking information about detected wifi based on hobo symbols

What is clickjacking?

When an attacker takes over the page so when an item is clicked, it actually takes it to the malicious site

What is a synchronous stream cipher?

When keystream does not depend on plain or cipher text

Beenfits of TCP

While packets may not arrive in the same order they were sent, the protocol will ENSURE that they are ordered before doing anything with them If part of the message gets lost, it will be retransmitted As a result, there is error free data transfer This relies on sequence numbers

Black Box v White Box

White box: tester is provided detailed info about network --> testing easier but less realistic Black Box: tester not given any info about network and employees not warned in advance

Diffle-Hellman Key exchange (DHKE)

Whitfield Diffie and Martin Hellman first aymmetric scheme published -solution to key distribution problem - enabled two parties to derive a common secret key by communicating over insecure channel

Difference in using subnetting

Without: Send traffic to IP address, just send it to everyone everywhere and hope you get it to the right place With:Use routing tables to get it to the network closest to the destination Then let that destination handle getting it to the specific host

What is computational security?

a cryptosystem exhibits computational security if the best known algorithm for breaking it requires at least t operations (a period short enough that it is not practicable with current computing constraints)

Whats an Encryption algorithm

a mathematical function or algorithm that works to hide the plaintext of a message through the use of a key. The strength of the algorithm along with the secrecy of the key determines how secure encrypted data is.

Cryptographically secure Pseudorandom Number Generators (CSPRNG)

a special type of pseudorandom number generators (PNRGs) with the additional property of, given n output bits of the key stream, that there is no known polynomial time way to determine any of the n+1 bits with a greater than 50% accuracy

What is Cipher Block Chaining (CBC)?

addresses issues with ECB mode by "chaining the blocks" - each block not only depends on the bits in that block, but all of the prior plaintext blocks as well -randomization is added through use of initialization vecor

Whats a kerberos

another key distribution protocol resilient to replay and key confirmation attacks assures times less protocol

What did NSA fear in 1988

attackers would soon find holes and crack DES, in 1998 a computer system was designed to crack it in three days. In 1999 it is replaced with AES

Benefits of Electronic codebook mode (ECM) for block ciphers?

block can be received in any order and decrypted as it arrives bit errors only effect single blocks process can be paralleled

Which is more popular.. stream or block ciphers?

block ciphers

What is a main application of digital signatures?

certificates

True Random Number Generator (TRNG)

characterized buy output that cannot be reproduced Often based on physical processes Coin flips, rolling dice, semiconductor noise, clock jitter, radioactive decay During the HW part 3, you will need to generate random values when generating the key

What is a hash function?

create a message digest, short fixed length bit strings, like a fingerprint NO KEY to reserve the process essential for digital signatures schemes and message authentication codes

What is a message authentication code? MAC

cryptographic checksum or keyed hash function provides message integrity and message authentication different from digital signatures because: it is symmetric key NOT non-repudiation much faster

What is SHA-1 deigned for?

designed for software implementations but hard to paralellize

What is Hashes - SHA-1

digest function in MD4 family produces 160 bit outputs maximum message length is 2^64 message is preprocessed into 512 bit blocks function has 80 rounds padded divided into 512 bit blocks each block processed in 4 stages and each stage has 20 rounds

Whihc system posses non-repudation?

digital signatues

Which system posses Message authentication?

digital structures, message authentication codes

What are windows issues with FAT / file access table?

does not support file -level access control danger in multi suer env

Advantages to double / triple encryption and key whitening?

double - small small amount more secure triple - doubles effective key length whitening - enlarges DES key length without much more computational power

What are MACS based on?

either hash functions of block ciphers

What is padding?

embeds a random structure into plaintext before encoding ex- OAEP (Optimal Asymmetric Encryption Padding)

How to prevent against weak collisions?

ensure that hash cannot be calculated other than in brute force

What is RSA side channel attack?

exploit information about leaked private key through physical charactersists such as power consumption/timing ex. Simple Power anaylsis - attack traces of cpu power consumption

Pseudorandom Number Generators (PRNG)

generated sequences which are based on an initial seed value -values are computed recursively -output is aprox. a sequence of true random number -not truly random bc can be computed - RANDOM in bash

What is preimage resistance (one-wayness) in hash functions?

given hash value should be computationally unfeasible to determine plaintext.

What does Euler's Phi Function do?

gives number of elements smaller than n that are relatively prime to n

How is common internet file systems vulnerable (CIFS)

has multiple ports open when running, search for things in global catalog

what is key freshness

having a key which is valid for a limited time

What is steganography?

hiding information in plain within another source such as pictures/graphics or text.

Whats perfect forward secrecy

if it compromises long-term keys does not allow attacker to obtain past session key

How was DES cracked with exhaustive key search or brute force?

in 1998 Electronic frontier fondation built Deep Crack for under 250,000 to crack in 15 days 2006 Cost-Optimised Parallel Code Breaker (COPOCOBANA) for 10,000 to crack in less than 7 days

Elliptic Curve Digital Signature (ECDSA)

in comparison to RSA, Elgamal and DSA ECDSA: small requirmented bit lengths to maintain secruity, shorter bit length often result in shorter processing times/signatures use public key which is your starting ponit A. You can take the dot product of this "n" number of times and n becomes your private key and your max value becomes a public key

How does RSA work?

in the integer factorization family of Triassic key cryptography, it multiply two large numbers and factors resulting number

What is Cross Site Scripting (XXS) and three type?

injecting java script into a website Persistent XXS - malicious script originates from original website database Reflected XXS - malicious script originates from victim request DOM-Based XXS - The malicious script originates client side and never leaves the browser

How is pubic key cryptography (asymmetric) easy, but unfeasible?

it is easy bc it used polynomial time, is fast and doesnt lead to slowdown its unfeasible in non-polynomial time so its computationally intensive and not easy to compute in reasonable amount of time

What can ECC (ellptic cruve) be used for

key exchange, digital structures and encryption

Hash function takeaways

keyless used in digital signatures and message authenticaion codes need at least 160 bot output to withstand collisions MD5 and SHA-1 should be phased out, SHA-2 considered for fair use

Problem with MS SQL

large SA password vulnerbility

What is unicity distance?

length of respective plaintexts required to break the cipher with plaintext. After typing every possible key there should only be one plaintext that makes sense

benefits of key freshness

less damage if key is exposed less cipher text per key available multiple keys required to decrypt a larger plaintext

What is most important job of network security? Also important?

maintaining confidentiality of data as it traverses a network, or as it is stored in a computer. We also care about integrity

Commonly used stream ciphers:

may include RC4, A5/1 (GSM phones)

Linear Feedback Shift Registers (LFSR)

mechanism that we can utilize to to realize long pseudorandom sequences (think good for key streams) reduce some weakness While LFSR are has good statistical properties, it is in and of itself cryptographically weak WHAT IS IT a shift register whose input bit is a linear function of its previous state What is a shift register? A cascade of flip flops (think bits) , that share the same clock, in which the input of and outputs are connected in such a way that on each tick of the clock, the circuit shifts by one position

Decrypt DES?

nearly same as encryption, but need to change to a reversed key schedule so round 1 = no rotation round 2,9,16 = bit shift one right remaining = bit shifts 2 right so round 1 decrypts round 16, 2 decrypts 15 , ect

What is key transport

one party generates and distributes a secret key

What are most non RSA public key algrothms based on

one-way functions, discrete logarithm problem (DLP)c

What is collision resistance (strong collision resistance) in hash functions?

oscar hides message in nonvisible locations (spaces, tabs,) to make a 10,000 money transfer look like a 10

What should RSA always be used with

padding

what is key agreement

parties jointly contribute to secret key and no parties have control over final joint value (DHKE)

What is a Hash Function

produce a "digest" of a message (a short, fixed length bit string) which results in a fingerprint/unique representation of the message, which cannot be decrypted as there is no key -Should be quick, similar words should produce completey different hashes

Elgamal Encryption

proposed in 1985, views as extentsion of DHKE 3 phases: Setup Encryption Decryption

What did NSA change when they got hold of Lucifer

reduced key size to 56, differential analysis to make resistant to attack released in 1977 as DES

What does the euclidian algorithm do? What about the extended euclidian algorithm?

reduenced the GCD process to find answer recursively (used in public keys) Extended: calculate modular inverse

What is KDC safe / not safe agaisnt?

safe: passive attacks not safe: key replay attacks - tricking into using old compromised key key confirmation attacks - tricked into communication with oscar

Elgamal for digital signatures

start with setup construct the discrete log problem results in public and private keys

What is a feistal network?

structure operation in DES. They have an advantage of extremely similar encryption/decryption mechanisms, need to preserve key schedule

What system best posses confidentiality?

symmetric key encryption

What is a cryptosystem

the technology that converts between plaintext and ciphertext

How many iterations for a multiple encryption (twice) of three times?

twice? 2^(k+1) three? 2^(2k) K = key size bits N = block size bits M = number plaintext/ciphertext pairs collected

What is second preimage resistance (weak collision resistance) in hash functions?

two messages should not hash to the same value (aka collision) Weak collision: given a fixed x1, find a matching hash with x2 Strong - given ability to choose both x1 and x2

What is key whitening? How many iterations?

use two addional keys k1 and k2 to create XOR mask for plaintext and ciphertext (XOR encrypt-XOR) 2^(K+N+M) K = key size bits N = block size bits M = number plaintext/ciphertext pairs collected

What is diffusion operation and what does it ensure?

used by many modern block ciphers to change 1 bit of plaintext, which results in a chnage of half the cipher text output. This makes the second ciphertext statistically independent from the first one

RSA Padding - Probabilistic Signature Standard

used to prevent exsistential forgery attacks

How do we prove who sent something?

when signing - signature is done with private key when verifying - signature verified with public key

Is RSA melleable?

yes