Flashcards
Intro to computer security
Cards in this deck (97)
- 1What is RC4 and where is it used?RC4 is the fastest stream cipher and is used in real-time applications. It is also used in WEP and SSL.
- 2How does RC4 work?RC4 uses pseudo-random number generation from a given seed. The bits of the random numbers are XORd with the bits of the unencrypted bits.
- 3What does CMS stand for and what is it?Cryptographic Message Syntax. It is used for padding block ciphers in hexadecimal numbers representing the number of padding bytes.
- 4What is ZeroLength and how is it used?A padding technique in which all empty bytes are filled in with zeros, accept for the last byte which is assigned a number to represent the total amount of padding bytes.
- 5What is the Random padding technique?When random bytes are used to fill in the empty bytes of a block, accept for the last byte which is assigned a number to represent the total amount of padding bytes.
- 6What type of attack can be made on the padded blocks?Intruders could analyse the end block and look for patterns
- 7How do you add salt to an encryption algorithm?With and IV (Initialisation Vector) which must be the same for all approved parties involved. In WEP the IV is incremented for each data-frame so that the cipher text changes.
- 8How does cipher block chaining work?An IV is used for the first block, and then in each round the output of each next block is used to encrypt the blocks ahead of them.
- 9What is CIA and how does it relate to the 3 main security issues?Confidentiality - keeping information secret
Integrity - ensure information is intact
Authentication - check people are really who they claim to be - 10In which ways can cipher functions process plaintext?Stream and block.
- 11In which ways can plaintext be transformed into ciphertext?Substitution and transposition.
- 12What are the types of keys which can by used in crypto-systems?Symmetric and Asymmetric.
- 13What is the auto-key version of the Vigenere cipher? Also what is the problem with this method?Append plaintext to key. The problem is that the key and plaintext share same frequency.
- 14Name a cipher which is unconditionally secureOne Time Pad
- 15What are the main keywords used in the cryptosphere?Cryptography, Cryptoanalysis and Cryptology!
- 16What are the three characteristics of a cryptographic system?1) Substitution & transposition
2) Block & stream
3) Symmetric & Asymmetric - 17What is steganography?When data is concealed in some unsuspecting format such as PDF and JPEG
- 18What are the typical block sizes in block encryption?128, 194 and 256 bits
- 19Name 8 block ciphers1) RC2
2) RC5
3) IDEA
4) DES
5) 3DES
6) AES
7) Blowfish
8) Twofish - 20Name 6 substitution ciphers1) Ceasar
2) Playfair
3) Hill Cipher
4) Vigenere
5) Vernam
6) One Time Pad - 21In Playfair, lets say you have letters x1 and x2 which are both on different rows and columns, how do you perform the encryption?You first take the value which is on the row of x1 that intersects with the column of x2. Then you take the value which is on the row of x2 that intersects with the column of x1.
- 22In Playfair, lets say you have letters x1 and x2 which are both on the same column, how do you perform encryption?You take the value below x1 and x2. If x1 or x2 are on the lowest row, then you go round back up to the top.
- 23In Playfair, lets say you have letters x1 and x2 which are both on the same row, how do you perform encryption?You take the values to the right of x1 and x2. If x1 or x2 are on the rightmost column, then you go round to the leftmost column.
- 24How do you get the inverse of a 2x2 matrix?|a, b|
|c, d|
BECOMES
|d, -b|
|-c, a| - 25What is the determinant of a 2x2 matrix?For the matrix:
|a, b|
|c, d|
The determinant is: (a*d) - (b*c) - 26What is the scalar value in relation to the decryption process of the Hill Cipher?The scalar value is some number S which satisfies the following condition: Let K be the key, D be the determinant of K, and K* be the inverse of the key.
(D * S) % 26 = 1 - 27How is the decryption key computed in the Hill Cipher?By taking the inverse of the encryption key and performing a scalar multiplication using the scalar value.
- 28How does the Hill Cipher make cryptoanalysis harder when using a 2x2 matrix and a 3x3 matrix key?The 2x2 matrix key hides single letter frequencies and the 3x3 matrix key hides two-letter frequencies.
- 29Which structure does the DES, 3DES and most other block ciphers adhere to?Feistel
- 30How large is the key in DES?56 bits
- 31What are the 3 key processes in DES?1) Permutation
2) Round function
3) Key generation - 32What is the protocol of 2DES?When two 56-bit keys are used. First step is to encrypt 64-bits of plain text with the first key K1, and then decrypt with the second key K2 and then encrypt once again with K1. This yields a key of 112-bits
- 33What is the protocol of 3DES?When three keys are used. First step is to encrypt 64-bits of plain text with the first key K1, and then decrypt with the second key K2 and then encrypt once again with the third key K3. This yields a key of 168-bits
- 34What does AES stand for?Advanced Encryption Standard.
- 35What is the problem with DES?Key size too small, exhaustive key search possible with increasing computing power
- 36What is the problem with 3DES?Too slow
- 37How can end-to-end encryption be achieved?With a combination of Diffie Hellman and RSA.
- 38What does WEP stand for?Wired Equivalent Privacy
- 39What are the two different modes of WEP?1) First mode uses 64 bits of which 40 make the key and 24 make the IV.
2) Second mode uses 128 bits of which 104 make the key and 24 make the IV. - 40Name 2 major weaknesses of WEPOne weakness is that it only uses a 24-bit IV. The other weakness is that the IV is sent in clear text of an insecure channel.
- 41What is kerckhoff's principle?The cipher must not depend on the secrecy of the mechanism, it must not matter if it falls into the hands of the enemy.
- 42What is the main security property needed for a cipher?That the ciphertext reveals nothing about the key or the message.
- 43What is the correctness property of a cipher?∀m,k: Dk(Ek(m)) = m
- 44How many rounds of encryption does AES use?Depends on key size.
128 bits = 10 rounds
192 bits = 12 rounds
256 bits = 14 rounds - 45What component of AES makes it difficult to cryptoanalyse?S-boxes. They make the data non-linear using lookup tables. Each S-box takes in 8 bits and and finds the corresponding mapping of those bits to some other 8 bits. The lookup table therefore has 256 (2^8) possible entries / mappings .
- 46What are the two main components of AES?Shifts which permutes the bits and S-boxes for mapping some byte for another byte.
- 47What security does salting a password add?Depends on how many bits the salt is made up of. However, assuming a 12 bit salt is used it makes a dictionary attack 2^12 times harder.
- 48What is a checksum and how can one be produced?Checksums are used to prove the integrity of messages. They can be produced with hashing algorithms such as SHA2 & SHA3.
- 49What is a hashing function?A hashing function is a mathematical function which takes in a message of arbitrary length and produces a compressed fixed size output.
- 50What is a message digest?Another word for hash value.
- 51What are the two main characteristics needed of a hash function?Must be computationally infeasible to find the original message of a given hash (i.e., needs to be a one-way function).
Must be computationally infeasible to find two different messages M1 and M2 such that H(M1) == H(M2) - 52What does SSL stand for?Secure Sockets Layer
- 53Explain the concept of 'perfect secrecy'If Alice and Bob frequently send each other encrypted messages and always use the same key, then if one were to find the key all past messages will be compromised. So ensure such a scenario does not occur, Alice and Bob must always use a different key.
- 54What are digital certificates?Electronic credentials used to assert the online identities of individuals, computers and other identities on a network.
Similar to ID cards as they contain the public key and identity of the owner. - 55What are the five penetration testing phases?1) Reconnaissance
2) Scanning
3) Gaining access
4) Maintaining access
5) Covering track - 56What are the essential tools for penetration testing?Kali Linux, Metasploit, Netsparker, Burp Suite and Wireshark.
- 57Why is penetration testing important?To identify vulnerabilities of a system in a controlled environment before anyone else does.
- 58Give a definition of pen testing.A method for gaining assurance in the security of an IT system by attempting to breach some or all of that system's security, using the same tools and techniques as an adversary might.
- 59What are the 4 main things which can be identified from the results of pen testing a system?1) How well the system tolerates real world attack patterns.
2) The likely level of sophistication an attacker would need to compromise the system.
3) Countermeasures that could mitigate vulnerabilities
4) Ways to detect and respond to attacks - 60Describe the reconnaissance phase of pen testing.In this phase the objective is to find out as much information as possible about the target. For example, data of the company such as IP addresses which can be leaked via Google, Domain name lookup and so on. The type of data which can be used to attack the company is of main interest.
- 61Describe the scanning phase of pen testing.In this phase weaknesses in the system are looked for. Some examples include: open ports, open services, application vulnerabilities and information leakage.
- 62Describe the gaining access phase of pen testing.This phase involves identifying the attack vectors of a system. This involves software and hardware-based attacks, and also social engineering. The usual goal is to use the victim's resources such as information, computational resources and network resources.
- 63Describe the maintaining access phase of pen testing.This is the point where attackers try to stay in the system undetected and use it as they like whenever they want in the future. However, it is risky because if the attacker acts recklessly he or she will be discovered and extruded. In addition to this, the attacker is more vulnerable to detection in this phase.
- 64Explain the covering track phase of pen testing.In this phase the attacker will remove all invasion traces while also hiding Trojan and RootKit viruses. In addition to this the attacker will clear the system and application logs.
- 65What are the 3 most relevant acts in the UK legal system and when were they released?1) The Investigatory Powers Act 2016 (IPA)
2) The Computer Misuse Act 1990 (CMA)
3) The Fraud Act 2006 - 66A hacker performs a DoS attack on a website. Which law has been violated?The Computer Misuse Act 1990
- 67The creation and supply of software and hardware that might aid an attack violates which act?The Computer Misuse Act 1990
- 68The development of programs designed to break passwords or he development of certain types of malware violates which act?The Computer Misuse Act 1990
- 69CMA has been successfully used in a wide range of criminal cases which includes:1) DoS attacks against: Kent police, Oxford University, US Air force and Sony.
2) Fraudulent activities in online games
3) Illegal access to emails and personal information
4) Theft from online banks
5) Hoax calls to emergency telephone number and piracy - 70In which three ways does the The Fraud Act 2006 define fraud?1) False representation
2) Failing to disclose information
3) Abusing power - 71Dishonestly obtaining electronic communications services violates which act?The Fraud Act 2006
- 72Cloning mobile phones so that calls made on one handset are billed to another violates which act?The Fraud Act 2006
- 73Reprogramming mobile phones to interfere with their operation or change their unique identifier information violates which act?The Fraud Act 2006
- 74Breaking encryption on encrypted communications services violates which act?The Fraud Act 2006
- 75Describe the Investigatory Powers Act 2016(IPA)Governs the use of surveillance technologies by public bodies such as the police, the intelligence services and local authorities
- 76What is one thing that the Investigatory Powers Act 2016(IPA) ensures?Ensures intrusive powers are subject to strict safeguards
- 77What is the Euclidean Algorithm for finding the greatest common divisor of two numbers using subtraction?
- 78What is the Euclidean Algorithm for finding the greatest common divisor of two numbers using modulo?
- 79What do most block ciphers have that increase their strength?SP-Networks
- 80What is the main security of RSA?Integer factorisation. It is very hard to factorise a very large number into product of primes.
- 81What is the hard mathematical problem on which the Diffie Hellman key exchange algorithm relies on?Discrete logarithm.
Let g^x = y, it is very hard to find x given g and y. - 82In RSA with the two prime keys p and 1, what is the modulus?p*q
- 83How do you find the phi of N given its two prime factors p and q?phi(N) = (p-1)*(q-1)
- 84The encryption exponent e must satisfy which condition?gcd(e,phi) = 1
So e must be co-prime to phi - 85The decryption exponent d of RSA must satisfy which condition?e*d = 1 mod phi(N)
- 86In RSA what is the ciphertext of the message M?M^e mod N
- 87How do you find the multiplicative inverse of a number? For example x mod nYou would need to find a value y such that:
a*x mod n = 1 - 88In RSA, with the values p = 7, q = 13, N = 91, phi = 72, e = 23 and d = 47, what is the public key?PublicK = (e,N) or (23, 91)
- 89In RSA, with the values p = 7, q = 13, N = 91, phi = 72, e = 23 and d = 47, what is the private key?PrivateK = (d,N) or (47, 91)
- 90How do you compute X mod Y where X is a positive integer?X - (Y * int(X / Y))
- 91How do you compute X mod Y where X is a negative integer?Y + (X - (Y * int(X / Y)))
- 92Python code for modular arithmetic
- 93Explain affine encryption in regards to the key (a,b) and also explain the rules of the key.Let gcd(a, 26) == 1
f(x) = a*x + b - 94What is the Rectangular cipher?
- 95In the affine cipher, with the key (a, b) how do you decrypt each letter?
- 96How do you find the multiplicative inverse of "a" in the affine cipher?Need to find some value x such that
a*x mod 26 = 1 - 97What is "a^-1" in the affine cipher?The multiplicative inverse. So if "a" were 15, then the multiplicative inverse of "a" would be 7 which is used for decryption.
for example:
p = 7*(c - b) mod 26
Information
- Description
- Flashcards on Intro to computer security, created by zenos pavlakou on 13/01/2019.
- Created by
- zenos pavlakou
- Views
- 8
- Rating