Also referred to as conventional encryption or single-key encryption, was the only type of encryption in use prior to the introduction of public-key encryption in the late 1970s.
Nội dung chính
- Is the scrambled message produced as
output?
- What is the principal use of symmetric encryption?
- Is a procedure that
allows communicating parties to verify?
- Is symmetric encryption is used primarily to provide confidentiality?
Symmetric encryption
Symmetric encryption ingredients:
- Plaintext
- Encryption algorithm
- Secret key
- Ciphertext
- Decryption algorithm
This is the original message or data that is fed into the algorithm as input.
Plaintext
Performs various substitutions and transformations on the plaintext.
Encryption algorithm
Also input to the encryption algorithm. The exact substitutions and transformations performed by the algorithm depend on the key.
Secret key
This is the scrambled message produced
as output. It depends on the plaintext and the secret key. For a given message, two different keys will produce two different __________.
Ciphertext
This is essentially the encryption algorithm run in reverse. It takes the ciphertext and the secret key and produces the original plaintext.
Decryption algorithm
2 requirements for secure use of symmetric encryption:
- A strong encryption algorithm
- Sender and receiver must have
obtained copies of the secret key in a secure fashion and must keep the key secure.
Rely on the nature of the algorithm plus perhaps some knowledge of the general characteristics of the plaintext or even some sample plaintext-ciphertext pairs.
Cryptanalytic attack
First attack is known as:
Cryptanalysis
Try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
Brute-force attack
The most commonly used symmetric encryption algorithms are ___________.
block ciphers
The most widely used encryption scheme was based on the _________ adopted in 1977 by the National Institute of Standards and Technology (NIST), as Federal Information Processing Standard 46 (FIPS PUB 46).1 The algorithm itself is referred to as the ____________ Algorithm.
Data Encryption Standard (DES)
Takes a plaintext
block of 64 bits and a key of 56 bits, to produce a ciphertext block of 64 bits.
Data Encryption Standard (DES)
A more serious concern is ________.
key length
The life of DES was extended by the use of ________, which involves repeating the basic DES algorithm three times, using either two or three unique keys, for a key size of 112 or 168 bits. It was first standardized for use in financial applications in ANSI standard X9.17 in 1985.
triple DES (3DES)
Most studied encryption algorithm in existence
Data Encryption Standard (DES)
Have a security strength equal to or better than 3DES and significantly improved efficiency.
Advanced Encryption Standard (AES)
To increase the security of symmetric block encryption for large sequences of data, a number of alternative techniques have been developed, called __________.
modes of operation
Processes the input one block of elements at a time, producing an output block for each input block.
Block cipher
Processes the input elements continuously, producing output one element at a time, as it goes along.
Stream cipher
(T/F) Although block ciphers are far more common, there are certain applications in which a stream cipher is more appropriate.
True
(T/F) A typical stream cipher encrypts plaintext one byte at
a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time.
True
A __________ is one that is unpredictable without knowledge of the input key and which has an apparently random character.
Pseudorandom stream
The output of the generator, called a _________, is combined one byte at a time with the plaintext stream using the bitwise exclusiveOR (XOR) operation.
keystream
(T/F) The primary advantage of a stream cipher is that stream ciphers are almost always faster and use far less code than do block ciphers.
True
(T/F) The advantage of a block cipher is that you can reuse keys.
True
(T/F) For applications that require encryption/decryption of a stream of data, such as over a data communications channel or a browser/Web link, a stream cipher might be the better alternative.
True
(T/F) For applications that deal with blocks of data, such as file t ansfer, e-mail, and database, block ciphers may be more appropriate.
True
Encryption protects against ___________ (eavesdropping).
passive attack
A different requirement is to protect against ___________ (falsification of data and transactions).
active attack
Protection against passive and active attacks is known as
__________.
message or data authentication
A message, file, document, or other collection of data is said to be _______ when it is genuine and came from its alleged source.
authentic
Procedure that allows communicating parties to verify that received or stored messages are authentic.
Message or data authentication
(T/F) The two important aspects are to verify that the contents of the message have not been
altered and that the source is authentic. We may also wish to verify a message’s timeliness (it has not been artificially delayed and replayed) and sequence relative to other messages flowing between two parties.
True
The simplest approach to multiple-block encryption is known as __________ mode, in which plaintext is handled 64 or 128 bits at a time and each block of plaintext is encrypted using the same key.
electronic codebook (ECB)
(T/F)It would seem possible to perform authentication simply by the use of symmetric encryption.
True
If the message includes an ______ and a ________, the receiver is assured that no alterations have been made and that sequencing is proper.
- error-detection code
- sequence number
If the message includes a ________, the receiver is assured that the message has not been delayed beyond that normally expected for network transit.
timestamp
(T/F) Symmetric encryption alone is not a suitable tool for data authentication.
True
(T/F) Although sequence numbers may be used at some level, it is typically not the case that a separate sequence number will be associated with each b-bit block of plaintext. Thus, block reordering is a threat.
True
One authentication technique involves the use of a secret key to generate a small block of data, known as
a __________, that is appended to the message.
message authentication code (MAC)
If we assume that only the receiver and the sender know the identity of the secret key, and if the received code matches the calculated code, then the receiver is assured that:
- the message has not been altered
- the message is from the alleged sender
- (if with sequence number) the proper sequence
Accepts a variable-size message M as input and
produces a fixed-size message digest H(M) as output
Hash function
Unlike the MAC, a ________ does not take a secret key as input.
hash function
(T/F) Encryption software is quite slow; Encryption hardware costs are non-negligible; Encryption hardware is optimized toward large data sizes; An encryption algorithm may be protected by a patent.
True
This technique, known as a __________, assumes that two
communicating parties, say A and B, share a common secret key K. This secret key is incorporated into the process of generating a hash code.
keyed hash MAC
(T/F) The secret key is used as both a prefix and a suffix to the message. If the secret key is used as either only a prefix or only a suffix, the scheme is less secure.
True
The ________, or _________, is important not only in message authentication but in digital signatures.
- one-way hash function
- secure hash function
The purpose of a ________ is to produce a “fingerprint” of a file, message, or other block of data.
hash function
For any given code h, it is computationally infeasible to find x such that H(x) = h. A hash function with this property is referred to as _________.
one-way or preimage resistant
For any given block x, it is computationally infeasible to find y ≠ x with H(y) =
H(x). A hash function with this property is referred to as _________.
second preimage resistant or weak collision resistant
It is computationally infeasible to find any pair (x, y) such that H(x) = H(y). A hash function with this property is referred to as __________.
collision resistant or strong collision resistant
(T/F) The strength of a hash function against brute-force attacks depends solely on the length of the hash code
produced by the algorithm.
True
(T/F) Cryptanalysis of a hash function involves exploiting logical weaknesses in the algorithm
True
The most widely used hash function has been the ________.
Secure Hash Algorithm (SHA)
A hash of a password is stored by an operating system rather than the password itself.
Password
Store the hash value for a file, for each file on a system and
secure the hash values
Intrusion detection
The first truly revolutionary advance in encryption in literally thousands of years. It is based on mathematical functions rather than on simple operations on bit patterns, such as are used in symmetric encryption algorithms.
Public-key encryption
Public-key cryptography is __________, involving the use of two separate keys, in contrast to symmetric encryption, which uses only one key.
asymmetric
(T/F) Misconception: Public-key encryption is more secure from cryptanalysis than symmetric encryption. In fact, the security of any encryption scheme depends on the length of the key and the computational work involved in breaking a cipher.
True
(T/F) Misconception: Public-key encryption is a general- purpose technique that has made symmetric encryption obsolete.
True
This is a pair of keys that have been
selected so that if one is used for encryption, the other is used for decryption. The exact transformations performed by the encryption algorithm depend on the ________ that is provided as input.
Public and private key
(T/F) The public key of the pair is made public for others to use, while the private key is known only to its owner.
True
Relies on one key for encryption and a different but related key for decryption.
General-purpose public-key cryptographic algorithm
(T/F) A user encrypts data using his or her own private key. Anyone who knows the corresponding public key will then be able to decrypt the message.
True
Only the intended recipient should be able to decrypt the ciphertext because only the intended recipient is in possession of the required private key.
Confidentiality
Most widely accepted and implemented approach to
public-key encryption. It is a block cipher in which the plaintext and ciphertext are integers between 0 and n – 1 for some n.
RSA (Rivest, Shamir, Adleman)
Enable two users to securely reach agreement about a shared secret that can be used as a secret key for subsequent symmetric encryption of messages. The algorithm itself is limited to the exchange of the keys.
Diffie-Hellman key exchange algorithm
Provides only a digital
signature function with SHA-1. It cannot be used for encryption or key exchange.
Digital Signature Standard (DSS)
It has a security like RSA, but with much smaller keys.
Elliptic curve cryptography (ECC)
Calculates a hash value for the message; decrypts the signature using the public key of the other person; and compares the calculated hash value to the decrypted hash value. If the two hash values match, it assured that the
message must have been signed by that other person.
Digital signature
(T/F) It is important to emphasize that the digital signature does not provide confidentiality. That is, the message being sent is safe from alteration but not safe from eavesdropping.
True
Used to protect a message without needing to first arrange for sender and receiver to have the same secret key.
Digital Envelopes
The distribution of numbers
in the sequence should be uniform; that is, the frequency of occurrence of each of the numbers should be approximately the same.
Uniform distribution
No one value in the sequence can be inferred from the others.
Independence
Criteria in Randomness
- Uniform distribution
- Independence
Each number is statistically independent of other numbers in the sequence and therefore unpredictable. Opponent not be able to
predict future elements of the sequence on the basis of earlier elements.
Unpredictability
_____________ typically make use of algorithmic techniques for random number generation.
Cryptographic applications
Sequences produced that satisfy statistical randomness tests. It is likely to be predictable
Pseudorandom numbers
A __________ uses a nondeterministic source to produce randomness. Most operate by measuring
unpredictable natural processes, such as pulse detectors of ionizing radiation events, gas discharge tubes, and leaky capacitors.
true random number generator (TRNG)
Enables a user to generate a key from a password and then use that key to encrypt selected files on the hard disk. Its package does not store the password.
Pretty Good Privacy (PGP)
This is a hardware device that sits between servers and storage systems and encrypts all data going
from the server to the storage system and decrypts data going in the opposite direction.
Back-end appliance
This is provided by means of a co-processor board embedded in the tape drive and tape library hardware.
Library-based tape encryption
A number of vendors offer software products that provide encryption that is transparent to the application and the user.
Background laptop and PC data encryption
3.2.1.
A symmetric encryption scheme has five ingredients: ● Plaintext: This is the original intelligible message or data that is fed into the algorithm as input. Encryption algorithm: The encryption algorithm performs various substitutions and transformations on the plaintext.
Plaintext is the input to a crypto system, with ciphertext being the output. In cryptography, algorithms transform plaintext into ciphertext, and ciphertext into plaintext. These respective processes are called encryption and decryption.
In cryptography, Triple DES (3DES or TDES), officially the Triple Data Encryption Algorithm (TDEA or Triple DEA), is a symmetric-key block cipher, which applies the DES cipher algorithm three times to each data block.
