Cryptographic Systems

Cryptographic Systems

1. 7.1: Cryptographic Services

   • 7.1.1: Securing Communications
     • three primary objectives of securing communications: •Authentication •Integrity •Confidentiality
   • 7.1.2: Cryptography
     • methods of creating ciphertext: •Transposition •Substitution •One-time pad
   • 7.1.3: Cryptanalysis
     • methods are used in cryptanalysis
   • 7.1.4: Cryptographic Services
     • cryptology combines two separate disciplines
       • Cryptography
       • Cryptanalysis

2. 7.2: Basic Integrity and Authenticity

   • 7.2.1: Cryptographic Hashes
     • Two well-known hash functions are:
       • MD5 with 128-bit digest
       • SHA-256 with 256-bit digest
   • 7.2.2: Integrity with MD5, SHA-1, and SHA-2
     • MD5
       • The MD5 algorithm is a hashing algorithm. s a one-way function that makes it easy to compute a hash from the given input data but makes it very difficult to compute input data given only a hash value.
     • SHA1
       • takes a message of less than 2^64 bits in length and produces a 160-bit message digest. The algorithm is slightly slower than MD5
     • SHA2
       • includes use in other cryptographic algorithms and protocols, for the protection of sensitive unclassified information.
   • 7.2.3: Authenticity with HMAC
     • HMAC
       • Is a type of message authentication code (MAC). HMACs use an additional secret key as input to the hash function. This adds authentication to integrity assurance.
       • Cisco technologies use two well-known HMAC functions:
         • •Keyed MD5 (HMAC-MD5 •Keyed SHA-1 (HMAC-SHA-1)
   • 7.2.4: Key Management
     • Two terms that are used to describe keys are:
       • Key length
       • Keyspace
     • Types of Cryptographic Keys
       • Symmetric keys - Can be exchanged between two routers supporting a VPN
       • Asymmetric keys - Are used in secure HTTPS applications
       • Digital signatures - Are used when connecting to a secure website
       • Hash keys - Are used in symmetric and asymmetric key generation, digital signatures, and other types of applications

3. 7.3: Confidentiality

   • 7.3.1: Encryption
     • two classes of encryption algorithms
       • Symmetric algorithms - These algorithms use the same pre-shared key, sometimes called a secret key, to encrypt and decrypt data. A pre-shared key is known by the sender and receiver before any encrypted communications commence
         • The most commonly used techniques in symmetric encryption cryptograph
           • Block Ciphers
           • Stream Ciphers
       • Asymmetric algorithms - These encryption algorithms use different keys to encrypt and decrypt data. Secure messages can be exchanged without having to have a pre-shared key
   • 7.3.2: Data Encryption Standard
     • Data Encryption Standard (DES) is a legacy symmetric encryption algorithm that usually operates in block mode by encrypting data in 64-bit blocks.
     • 3DES uses a method called 3DES-Encrypt-Decrypt-Encrypt (3DES-EDE) to encrypt plaintext
     • AES was chosen to replace DES for a number of reasons. The key length of AES makes the key much stronger than DES. AES runs faster than 3DES on comparable hardware. AES is more efficient than DES and 3DES on comparable hardware
   • 7.3.3: Alternate Encryption Algorithms
     • The Software-Optimized Encryption Algorithm (SEAL) is an alternative algorithm to software-based DES, 3DES, and AES. has a lower impact on the CPU compared to other software-based algorithms
     • RC Algorithms
       • RC algorithms are widely deployed in many networking applications because of their favorable speed and variable key-length capabilities.
         • Types of RC algorithms:
           • •RC2: Block Cipher, key size: 40 and 64 •RC4: Stream Cipher, key size: 1 to 256 •RC5 Block Cipher, key size: 0 to 2048 •RC6 Block Cipher, key size: 128, 192. or 256
   • 7.3.4: Diffie-Hellman Key Exchange
     • The DH algorithm is the basis of most modern automatic key exchange methods, and is one of the most common protocols used in networking today. it is a method to securely exchange the keys that encrypt data.
       • DH is commonly used when data is exchanged using an IPsec VPN,

4. 7.4: Public Key Cryptography

   • 7.4.1: Symmetric Versus Asymmetric Encryption
     • Asymmetric Key Algorithms
       • protocols that use asymmetric key algorithms:
         • Internet Key Exchange (IKE)
         • Secure Socket Layer (SSL)
         • Secure Shell (SSH)
         • Pretty Good Privacy (PGP)
     • Public Key (Encrypt) + Private Key (Decrypt) = Confidentiality
     • Private Key (Encrypt) + Public Key (Decrypt) = Authentication
     • Types of Asymmetric Algorithms
       • •DH •DSS •DSA •RSA •ElGamal •Elliptical Curves Techniques
   • 7.4.2: Digital Signatures
     • used in the two situations:
       • Code signing - Used to verify the integrity of executable files downloaded from a vendor website. Code signing also uses signed digital certificates to authenticate and verify the identity of the site.
       • Digital certificates - Used to verify the identity of an organization or individual to authenticate a vendor website and establish an encrypted connection to exchange confidential data.
     • SPA
       • S: Stands for digitally signed software.
       • P:Stands for a production image.
       • A:Indicates the key version used to digitally sign the image.
   • 7.4.3: Public Key Infrastructure
     • PKI Framework
       • PKI enables users and computers to securely exchange data over the Internet and to verify the identity of the other party