Cryptography

117 flashcards by MentisLibrary

Symmetric and public-key primitives, hashing and MACs, password storage, TLS and other protocols, key management, the attacks that broke real deployments, and the post-quantum transition.

What are the four goals of cryptography?
Confidentiality, integrity, authentication and non-repudiation. No single primitive supplies all four, so real systems combine ciphers, MACs and signatures.
Kerckhoffs's principle
A cryptosystem should stay secure even if everything about it except the key is public knowledge. Security must rest on the key, never on the secrecy of the design.
Why is "do not roll your own crypto" standard advice?
Cryptographic code fails silently: a broken implementation produces output that looks random and passes every functional test. Correctness only shows up under expert cryptanalysis and side-channel review.
Confusion and diffusion
Two design goals named by Claude Shannon. Confusion makes the relationship between key and ciphertext complex; diffusion spreads the influence of one plaintext bit over many ciphertext bits.
What is the one-time pad and why is it not practical?
A cipher that XORs the message with a truly random key of the same length, used only once. It has perfect secrecy, proven by Shannon, but the key is as long as the message and can never be reused.
Symmetric vs asymmetric encryption
Symmetric uses one shared secret key for both encryption and decryption and is fast. Asymmetric uses a mathematically linked key pair, public for encryption or verification and private for decryption or signing, and is orders of magnitude slower.
What is a nonce?
A number used once. It is a value that must never repeat under the same key, so identical plaintexts do not produce identical ciphertexts.
IV, nonce and salt: how do they differ?
An IV randomizes a cipher mode and is usually required to be unpredictable. A nonce only has to be unique. A salt makes password hashes unique per user and is stored alongside the hash.
What is a CSPRNG and when must you use one?
A cryptographically secure pseudorandom number generator, whose output an attacker cannot distinguish from random or predict from earlier output. Every key, IV, nonce, salt and token must come from one.
What does "128 bits of security" mean?
That the best known attack needs about 2 to the power 128 operations. It is a measure of attack cost, not of key length, and the two differ for asymmetric schemes.
What is semantic security (IND-CPA)?
An encryption scheme is IND-CPA secure if an attacker who can obtain encryptions of chosen plaintexts still cannot tell which of two chosen messages a ciphertext holds.
Attack models: ciphertext-only, known-plaintext, chosen-plaintext, chosen-ciphertext
A ladder of attacker power. Ciphertext-only sees only ciphertexts; known-plaintext also sees matching plaintexts; chosen-plaintext can encrypt anything it likes; chosen-ciphertext can also get chosen ciphertexts decrypted.
How does frequency analysis break a simple substitution cipher?
Each plaintext letter always maps to the same ciphertext letter, so the statistics of the language survive encryption. Matching letter and digram frequencies recovers the mapping.
Caesar cipher vs Vigenere cipher
Caesar shifts every letter by a fixed amount, so there are only 25 keys. Vigenere shifts by a repeating keyword, which flattens single-letter frequencies but repeats with the key length.
What was the structural weakness in the Enigma machine?
Its reflector guaranteed no letter ever encrypted to itself. That, plus predictable message formats and operator habits, let cryptanalysts rule out candidate settings at enormous speed.
What is a block cipher?
A keyed permutation that encrypts a fixed-size block of bits at a time. It is not usable alone; a mode of operation turns it into something that encrypts messages of arbitrary length.
What is a stream cipher?
A cipher that generates a pseudorandom keystream from a key and nonce and XORs it with the plaintext, one bit or byte at a time. No padding is needed and ciphertext length equals plaintext length.
What is AES, and what are its parameters?
The Advanced Encryption Standard, a 128-bit block cipher with 128, 192 or 256-bit keys, performing 10, 12 or 14 rounds. It is the Rijndael design by Joan Daemen and Vincent Rijmen, standardized by NIST as FIPS 197 in 2001.
Why are DES and Triple DES no longer acceptable?
DES has a 56-bit key, which is brute-forceable in hours with modest hardware. Triple DES extends it to a 112-bit effective key but keeps the 64-bit block, which allows birthday collisions after a few dozen gigabytes under one key.
What is a Feistel network?
A block cipher structure that splits the block in half, applies a round function to one half, XORs the result into the other, and swaps. Encryption and decryption use the same circuit with the round keys reversed.
What is a substitution-permutation network?
A block cipher structure that repeats rounds of key addition, a substitution layer of S-boxes, and a permutation or mixing layer over the whole block.
Why must ECB mode never be used?
Electronic Codebook encrypts each block independently with no randomization, so identical plaintext blocks produce identical ciphertext blocks and the structure of the data shows through.
What is CBC mode?
Cipher Block Chaining XORs each plaintext block with the previous ciphertext block before encrypting, starting from a random IV. It hides repetition but is sequential and requires padding.
What is CTR mode?
Counter mode encrypts a nonce concatenated with a counter and XORs the result with the plaintext, turning a block cipher into a stream cipher. It is parallelizable, needs no padding, and supports random access.
What is AES-GCM?
Galois/Counter Mode: CTR-mode encryption combined with a GHASH authentication tag over the ciphertext and the associated data. It is an AEAD mode, so one call gives both confidentiality and integrity.
What does AEAD mean, and what is associated data?
Authenticated Encryption with Associated Data. It encrypts and authenticates the plaintext while also authenticating, but not encrypting, extra context such as headers.
What is ChaCha20-Poly1305?
An AEAD construction pairing the ChaCha20 stream cipher with the Poly1305 one-time authenticator, designed by Daniel J. Bernstein and specified in RFC 8439. It uses a 256-bit key and a 96-bit nonce.
Why does disk encryption use XTS instead of GCM?
A disk sector must be encrypted in place with no room for a nonce or an authentication tag, and any sector must be readable independently. XTS is a tweakable mode that uses the sector number as the tweak.
What is PKCS#7 padding?
A padding scheme that appends N bytes each holding the value N, so a block-aligned plaintext is always produced and the padding is unambiguously removable.
Why is encrypt-then-MAC the correct order?
Authenticating the ciphertext lets the receiver reject forged data before performing any decryption, which removes every oracle that leaks information through decryption errors.