Unit 2 - Practice Quiz

Cryptography is the practice and study of techniques for secure communication in the presence of third parties called adversaries. Its main goal is to protect information.

Plaintext is the original, unencrypted message or data that is readable by anyone.

Encryption is the process of encoding a message or information in such a way that only authorized parties can access it. It converts plaintext to ciphertext.

Ciphertext is the result of encryption performed on plaintext using an algorithm, called a cipher. It is unreadable until it has been decrypted.

Decryption is the reverse process of encryption. It transforms unreadable ciphertext back into understandable plaintext.

Symmetric cryptography, also known as secret-key cryptography, relies on a single key that both the sender and receiver use to encrypt and decrypt information.

The main challenge of symmetric encryption is key distribution. Both parties must have the same secret key, and it must be exchanged over a secure channel, which can be difficult to establish.

AES is a widely used symmetric encryption algorithm. RSA and ECC are asymmetric algorithms, and SHA-256 is a hash function.

Symmetric encryption algorithms are computationally less intensive and therefore much faster than asymmetric algorithms, making them ideal for encrypting large amounts of data.

Asymmetric cryptography, also known as public-key cryptography, uses a mathematically linked key pair: a public key that can be shared with anyone, and a private key that is kept secret.

To send a confidential message, the sender encrypts it using the recipient's public key. Only the recipient, who holds the corresponding private key, can decrypt it.

The security of asymmetric cryptography relies on the private key remaining secret. The public key is designed to be distributed openly.

Asymmetric cryptography elegantly solves the key distribution problem. You can share your public key over an insecure channel without compromising the security of your private key.

Cryptographic primitives are well-established, low-level cryptographic algorithms that are used to build more complex security systems (protocols).

A key property of a cryptographic hash function is that it produces a fixed-size output (e.g., 256 bits for SHA-256) regardless of the size of the input data. This output is called a hash or digest.

A digital signature ensures that a message was sent by the claimed sender (authenticity) and has not been altered in transit (integrity).

A web browser is an application that uses cryptographic primitives to secure connections (like HTTPS), but it is not a primitive itself. Encryption algorithms, hash functions, and signature schemes are fundamental building blocks.

Because it uses a single key that must be kept secret between the communicating parties, it is commonly called secret-key or private-key cryptography.

Digital signatures are created using the sender's private key and verified using their public key. This is a core function of asymmetric cryptography and is fundamental to blockchains like Bitcoin.

According to Kerckhoffs's Principle, a cryptosystem should be secure even if everything about the system, except the key, is public knowledge. Therefore, the security relies on keeping the key(s) secret.

In CBC mode, the decryption of a plaintext block is calculated as . A change in will completely garble the output of , thus corrupting all of . For the next block, . Since the original (now modified) is used in this calculation, it will flip the corresponding bit in while the rest of the block decrypts correctly.

Asymmetric encryption is computationally expensive and not suitable for large files. The standard hybrid approach is to use a fast symmetric cipher (like AES) for the bulk encryption of the file. This requires a session key. To securely transmit this session key to Bob, Alice encrypts it using Bob's public key. Bob can then decrypt the session key with his private key and use it to decrypt the file.

The core difference lies in the key used. A MAC (like HMAC) uses a symmetric, shared secret key for both generation and verification. This means anyone who can verify the MAC can also create it. A digital signature uses an asymmetric key pair; it is created with a private key and verified with the corresponding public key. This provides the property of non-repudiation, as only the holder of the private key could have created the signature.

A replay attack involves an adversary intercepting a legitimate, encrypted message and re-transmitting it later to impersonate the original sender or repeat an action (e.g., a financial transaction). By including a unique, single-use nonce in each message, the server can check if it has seen that nonce before. If it has, the message is rejected as a replay, even if it is otherwise validly encrypted.

In Diffie-Hellman, two parties exchange public values derived from their private keys ( and ). An eavesdropper can see the public values (), but to find the shared secret, they would need to compute the private key ( or ). Finding from requires solving the discrete logarithm problem, which is considered computationally infeasible for large numbers.

Second preimage resistance means that given an input M1, it is computationally infeasible to find a different input M2 such that hash(M1) = hash(M2). This is crucial for evidence integrity. If an attacker could find a second preimage, they could modify the evidence (M1 to M2) while keeping the hash fingerprint the same, thus bypassing the integrity check. While collision resistance is also important, second preimage resistance is the specific property that prevents modification of a known document.

Symmetric ciphers like AES require both parties to have the same secret key. The challenge of securely establishing this shared key over an insecure channel, where an attacker might be listening, is known as the Key Distribution Problem. This is typically solved using an asymmetric protocol like Diffie-Hellman key exchange before switching to the symmetric cipher for the actual communication.

Kerckhoffs's Principle states that a cryptosystem's security should not depend on the secrecy of its design or algorithm. Instead, it should hinge solely on the secrecy of the key. This allows for public scrutiny, analysis, and standardization of algorithms (like AES and RSA), leading to more robust and trusted systems, as opposed to 'security through obscurity' where the algorithm itself is kept secret.

The primary benefit of ECC's smaller key sizes is efficiency. Generating keys, performing encryption/decryption, and creating digital signatures are all faster with ECC. The smaller keys and signatures also consume less storage space and require less bandwidth to transmit, which is particularly advantageous in resource-constrained environments like mobile devices and IoT.

There are two main reasons. First, asymmetric signing operations are computationally intensive. Hashing the message first produces a short, fixed-size digest, making the signing process much faster than signing a potentially very large message. Second, signing algorithms are designed to work on fixed-size inputs. The hash function provides this required input format, ensuring the process is both efficient and standardized.

Stream ciphers (or block ciphers in a mode like Counter/CTR mode) encrypt data bit-by-bit or byte-by-byte. A key advantage is that there is no error propagation. An error in one part of the ciphertext will only affect the corresponding part of the plaintext. In contrast, modes like CBC have error propagation, where a single bit error in a ciphertext block will corrupt its entire corresponding plaintext block and a part of the next one, making them less ideal for lossy, real-time streams.

Cryptographic hash functions exhibit the avalanche effect, which means a tiny change in the input (like appending M2 to M1) results in a drastic and unpredictable change in the output hash. There is no simple way to compute H(M1 || M2) from H(M1) and H(M2). The entire concatenated message M3 must be processed by the hash function to get the final result.

This is a classic 'challenge-response' authentication mechanism that uses digital signatures. The user signs the specific message provided by the challenger with the private key corresponding to their public key (and thus their address). The challenger can then use the user's public key to verify that the signature is valid for that specific message. This proves ownership of the private key without it ever being revealed.

Key escrow is a system where the keys needed to decrypt encrypted data are held in escrow by a trusted third party. Under certain conditions (like a court order), this third party can release the keys to authorized entities. This is in direct contrast to end-to-end encryption where only the communicating parties have the keys.

In ECB mode, each block of plaintext is encrypted independently with the same key. This means that if two plaintext blocks are identical, their corresponding ciphertext blocks will also be identical. This leaks a significant amount of information about the structure of the original data. A famous example is an image of a penguin encrypted in ECB mode, where the outline of the penguin remains clearly visible in the ciphertext.

Perfect Forward Secrecy ensures that a unique, ephemeral session key is generated for each communication session without using the server's long-term private key to directly encrypt it. Protocols like Diffie-Hellman Ephemeral (DHE) are used. This means that even if an attacker later steals the server's long-term private key, they cannot use it to go back and decrypt previously recorded sessions, as each session was protected by a temporary key that has been discarded.

The security of RSA relies on the properties of modular arithmetic. The modulus is the product of two large prime numbers, and . Euler's totient function . The public exponent and private exponent are chosen to be modular multiplicative inverses of each other modulo . This relationship ensures that encrypting with and decrypting with (or vice versa) correctly restores the original message.

The main vulnerability of DES is its small key size of 56 bits. This means there are only possible keys. While this was a large number when DES was created, modern computing power makes it feasible to try every possible key in a reasonable amount of time. This is a brute-force attack. AES, with key sizes of 128, 192, or 256 bits, has a key space that is astronomically larger, making brute-force attacks computationally infeasible.

The security of ephemeral session keys depends on their randomness and unpredictability. A CSPRNG is specifically designed for this purpose. It generates sequences of numbers that are not only statistically random but also computationally infeasible to predict, even with knowledge of previous outputs. Standard PRNGs are not suitable as their outputs can often be predicted if the internal state is discovered.

This is a classic trade-off. A 4096-bit RSA key provides a significantly higher level of security against brute-force and factorization attacks compared to a 2048-bit key. However, the mathematical operations (key generation, signing, verification) with the larger key are much more computationally expensive, which can lead to increased latency and higher CPU usage on servers. System architects must balance the required security level against the performance impact.

This construction is the classic example of a length extension vulnerability. Since SHA-256 (like MD5, SHA-1) processes data in blocks and outputs its internal state, an attacker can use the MAC (the hash of key || m) as the initial state to continue hashing appended data (|| padding || new_data). This allows them to compute a valid MAC for m || padding || new_data without knowing the secret key. The HMAC construction was designed specifically to prevent this.

In CBC decryption, each plaintext block is calculated as . A change in will make the result of completely random, thus garbling the entire plaintext block . For the next block, . Since the decryption of is correct, the error from the modified will be XORed with it, flipping exactly the bit(s) in that correspond to the flipped bit(s) in . Subsequent blocks are not affected.

Asymmetric algorithms like RSA and ECC are based on complex mathematical problems and are computationally very expensive (slow) compared to symmetric algorithms like AES. Furthermore, 'textbook' RSA can only encrypt data smaller than its modulus size (e.g., < 256 bytes for RSA-2048). A hybrid scheme combines the best of both worlds: it uses the efficiency of a symmetric cipher for the large data and the convenience of public-key crypto to securely exchange the small symmetric key.

The ECDSA signature equation for a message hash h is , where . Here, d is the private key and k is the secret nonce. If two signatures and are generated for two message hashes and using the same k (and thus the same r), an attacker can set up two linear equations: and . By manipulating the equations, they can solve for . Once k is known, they can substitute it back into either equation to solve for the private key d. This is a complete security failure.

CTR mode turns a block cipher into a stream cipher. It encrypts a nonce and a counter value, then XORs the result with the plaintext. The encryption of counter block i depends only on the key, the nonce, and i, not on any other plaintext or ciphertext block. This decoupling means that any block can be encrypted or decrypted on its own, making it perfectly suited for parallel processing and random access. CBC, CFB, and OFB all have sequential dependencies that prevent this.

The fundamental weakness of the raw Diffie-Hellman protocol is that it is unauthenticated. When Alice receives a public value, she has no way of knowing it actually came from Bob; it could have come from Eve. Eve can intercept Alice's public value, send her own to Bob, intercept Bob's, and send her own to Alice. This results in Eve establishing a shared secret with Alice, and a different shared secret with Bob, while relaying their messages. To fix this, the public values must be authenticated, typically by signing them.

This is a classic padding oracle. The server's differential response to padding validity acts as an 'oracle' that tells the attacker whether their guess for the last byte of a plaintext block was correct. By systematically manipulating the last byte of the preceding ciphertext block () and observing the server's response, an attacker can iteratively guess the value of the last byte of the intermediate state (). Once that is known, they can work backwards byte-by-byte to decrypt the entire ciphertext block, all without ever learning the encryption key.

The key requirement is proving the message's origin to a third party. A MAC cannot achieve this. Since a MAC is generated with a key shared between Alice and Bob, Bob could have also generated the MAC himself. Therefore, he cannot prove to a judge that Alice was the unique source. This property is called repudiation. A digital signature, however, is created with Alice's private key, which only she knows. Anyone, including a judge, can use her publicly available public key to verify the signature, proving that it could have only been created by the holder of the corresponding private key. This provides non-repudiation.

Textbook RSA is deterministic. If an attacker suspects a message is one of a few possibilities (e.g., 'YES' or 'NO'), they can simply encrypt each possibility with the public key and see if it matches the intercepted ciphertext. This is a serious information leak. Furthermore, textbook RSA is malleable. Padding schemes like OAEP introduce randomness, making the encryption probabilistic and preventing these and other attacks.

Perfect Forward Secrecy ensures that the compromise of a long-term key does not compromise past session keys. This is achieved by generating a new, temporary (ephemeral) key pair for each session via a key exchange protocol like Diffie-Hellman (DHE or ECDHE). The long-term private key is only used to sign the parameters of this ephemeral key exchange to authenticate the server. Since the ephemeral keys are discarded after the session, an attacker who later steals the long-term key has no way to derive the old session keys and cannot decrypt the recorded traffic.

This scenario is the definition of breaking second pre-image resistance. Given a specific input X, the goal is to find a different input Y that produces the same hash. Collision resistance is the ability to find any two different inputs M1, M2 that hash to the same value, but M1 and M2 can be chosen by the attacker. Breaking second pre-image resistance is harder because one of the inputs (X) is fixed. Pre-image resistance is finding an input for a given hash output.

Kerckhoffs's Principle is a fundamental tenet of modern cryptography. It posits that the security of a system should depend solely on the secrecy of the key, not the secrecy of the algorithm itself. Relying on a secret algorithm is 'security through obscurity,' which is widely discredited. Public algorithms like AES and SHA-3 have been subjected to years of intense public scrutiny by experts, giving us confidence in their security. A proprietary algorithm has not undergone this vetting and is likely to contain flaws.

AEAD schemes are designed for exactly this purpose. They take a key, a nonce, plaintext, and 'associated data' (AD) as input. The plaintext is encrypted to provide confidentiality. Both the resulting ciphertext and the associated data are authenticated to provide integrity. In this case, the packet header would be the associated data—it is not encrypted but is included in the authentication tag calculation. This ensures that if an attacker modifies the header, the tag verification will fail upon receipt.

Scheme A (AES) offers computational security. Its security relies on the assumption that certain mathematical problems are too hard to solve in a reasonable amount of time. An adversary with infinite computational power could simply brute-force the 256-bit key. Scheme B (OTP), however, offers unconditional or perfect security. The ciphertext produced by an OTP leaks zero information about the plaintext. Even with infinite computing power, every possible plaintext of the same length is equally likely, so the adversary can never be certain which one is correct.

Second pre-image resistance means that for a given input m1, it is infeasible to find a different input m2 such that hash(m1) = hash(m2). If an attacker can break this for a transaction TX_A, they can craft a malicious transaction TX_B where hash(TX_A) = hash(TX_B). Since the Merkle tree is built upon these hashes, the attacker could present TX_B to a light client along with the original Merkle proof for TX_A. The proof would still validate against the block's Merkle root, effectively tricking the client into accepting the malicious transaction.

In CTR mode, encryption is performed by generating a keystream and XORing it with the plaintext: . If the same key and IV are used for two plaintexts and , they will be XORed with the exact same keystream. The attacker gets and . If the attacker XORs the two ciphertexts together, the keystream cancels out: . This is the classic 'two-time pad' vulnerability and is a catastrophic failure of confidentiality.

For keys of comparable security strength (ECC-256 vs RSA-2048), ECC signature generation is relatively fast. RSA signature generation (which involves the large private exponent) is slow. Conversely, RSA signature verification is extremely fast because it uses the small public exponent (e.g., 65537). ECC signature verification is slower than RSA's as it requires two point multiplications. Therefore, an IoT device that mostly signs data would benefit greatly from ECC's fast generation, while a system that mostly verifies signatures might find RSA's fast verification advantageous.

This is a textbook description of Differential Power Analysis (DPA), a powerful form of side-channel attack. It works by collecting many power consumption traces while the device encrypts different plaintexts and then using statistical methods to test hypotheses about bits of the secret key. If a key bit hypothesis is correct, it will correlate with a predictable pattern in power consumption across the many traces. A timing attack measures execution time, a fault injection attack induces errors, and a chosen-ciphertext attack is a purely mathematical attack.

This is the definition of a trapdoor one-way function. 'One-way' means it's easy to compute but hard to find given . The 'trapdoor' is the secret information (e.g., the private key) that makes the hard inverse computation easy. For RSA, the function is modular exponentiation (). Inverting it is equivalent to factoring N, which is hard. The trapdoor is the factorization of N, which allows for easy inversion. This property is the bedrock of all public-key cryptosystems.

The security of HMAC against length extension attacks comes from the outer hash. In a simple attack, the attacker uses the MAC output, which is the internal state of the hash function, to continue hashing new data. In HMAC, the output of the inner hash is not revealed. It is then prepended with another secret value () and hashed again. Because the attacker does not know this intermediate hash result to use as a starting state, the attack is foiled. The secret key is involved at both the beginning and the end of the process, effectively 'sealing' the hash.