Cryptography and Authentication Quiz
48 Questions
4 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What distinguishes authentication from authorization?

  • Authentication checks if a user is permitted access to certain data.
  • Authorization verifies the identity of a user.
  • Authorization processes user credentials for access.
  • Authentication ascertains a user's identity while authorization determines access rights. (correct)

    • Which cryptographic primitive is used to ensure the integrity of a message?

  • Hash (correct)
  • Symmetric keys
  • Digital signature
  • MAC

    • In the context of HTTP authentication, which method does NOT provide a way of proving identity?

  • OAuth2 (correct)
  • JSON Web Token (JWT)
  • HMAC authentication
  • HTTP Basic

    • What role does a digital signature play in cryptographic security?

    <p>It ensures integrity while providing non-repudiation.</p> Signup and view all the answers

    Which type of key is used in MAC (Message Authentication Code) for ensuring authenticity?

    <p>Symmetric keys</p> Signup and view all the answers

    What is the purpose of multi-factor authentication?

    <p>To enhance security by requiring multiple forms of verification.</p> Signup and view all the answers

    How does token authentication differ from traditional username/password methods?

    <p>It allows for stateless session management.</p> Signup and view all the answers

    Which of the following statements about HTTP Digest authentication is accurate?

    <p>It enhances security by hashing the credentials.</p> Signup and view all the answers

    What are the three components of a JWS?

    <p>Header, Payload, Signature</p> Signup and view all the answers

    What is the correct structure of a JWS?

    <p>header.payload.signature</p> Signup and view all the answers

    Which character is used in base64url encoding instead of '+'.

    <ul> <li></li> </ul> Signup and view all the answers

    What is true about padding in base64url?

    <p>Padding is optional.</p> Signup and view all the answers

    How many alphanumeric characters are used in base64url encoding?

    <p>62</p> Signup and view all the answers

    What is the purpose of using base64url encoding?

    <p>To make binary data URL safe.</p> Signup and view all the answers

    Which punctuation mark is unreserved and can be used as a separator in base64url?

    <p>.</p> Signup and view all the answers

    Which of the following is NOT true regarding the base64url character set?

    <ul> <li>is included as a valid character.</li> </ul> Signup and view all the answers

    What does the server respond with when it requires authentication using HTTP Basic?

    <p>401 Unauthorized</p> Signup and view all the answers

    What is sent in the Authorization header for HTTP Basic authentication?

    <p>User and password encoded in base64</p> Signup and view all the answers

    What is a primary vulnerability of HTTP Basic authentication when used without SSL/TLS?

    <p>Unencrypted transmission of user credentials</p> Signup and view all the answers

    What is the main mechanism behind HTTP Digest authentication?

    <p>Challenge-response mechanism</p> Signup and view all the answers

    What does HA1 represent in the context of HTTP Digest authentication?

    <p>MD5 hash of username, realm, and password</p> Signup and view all the answers

    Which of the following is NOT a feature of HTTP Digest authentication?

    <p>User credentials sent as plain text</p> Signup and view all the answers

    What is a limitation of HTTP Digest authentication?

    <p>It does not prevent security downgrading</p> Signup and view all the answers

    What does HMAC stand for in the context of authentication?

    <p>Hash-based Message Authentication Code</p> Signup and view all the answers

    What is the purpose of including the body in HMAC authentication?

    <p>To ensure data integrity and prevent data tampering</p> Signup and view all the answers

    In token authentication, what does the client need to do before receiving a token?

    <p>Authenticate using a secret/password</p> Signup and view all the answers

    What format does a JSON Web Token (JWT) represent?

    <p>A set of claims as a JSON object</p> Signup and view all the answers

    How can a client renew a token in token authentication?

    <p>Using a refresh token</p> Signup and view all the answers

    What does JSON Web Signature (JWS) secure?

    <p>Content secured with digital signatures or MACs</p> Signup and view all the answers

    What is included in the Authorization header when using a Bearer token?

    <p>The access token</p> Signup and view all the answers

    What is the role of the hashing algorithm in HMAC authentication?

    <p>To generate a fixed-size hash for data verification</p> Signup and view all the answers

    Which of the following best describes a characteristic of token authentication?

    <p>Tokens can be revoked if necessary</p> Signup and view all the answers

    What is the primary purpose of JSON Web Encryption (JWE)?

    <p>To encrypt data end-to-end</p> Signup and view all the answers

    Which role is NOT part of the OAuth2 framework?

    <p>Service provider</p> Signup and view all the answers

    What does the Client Credentials Grant imply?

    <p>The client acts as the resource owner.</p> Signup and view all the answers

    What is a consequence of not using a JWT for authorization?

    <p>The Resource Server must look up token details.</p> Signup and view all the answers

    Which of the OAuth2 grant types is specifically for server applications?

    <p>Authorization Code Grant</p> Signup and view all the answers

    Which statement accurately reflects the role of JSON Web Key (JWK)?

    <p>It provides a JSON representation of a cryptographic web key.</p> Signup and view all the answers

    What is a primary feature of OAuth2's authorization process?

    <p>It enables resource access on behalf of a resource owner.</p> Signup and view all the answers

    What is a notable aspect of using a JWT for authorization?

    <p>It reduces server load for token verification.</p> Signup and view all the answers

    What type of application typically utilizes the Implicit Grant in OAuth2?

    <p>Client applications using JavaScript</p> Signup and view all the answers

    Which of the following statements about multi-factor authentication is true?

    <p>It enhances security by requiring multiple forms of identification.</p> Signup and view all the answers

    What is the primary purpose of the WebAuthn API?

    <p>To authenticate using public key cryptography.</p> Signup and view all the answers

    What does OpenID Connect provide when used with OAuth 2.0?

    <p>Single-sign-on capabilities.</p> Signup and view all the answers

    Which of the following is a characteristic feature of the Universal 2nd Factor (U2F)?

    <p>It interfaces with USB and NFC tokens.</p> Signup and view all the answers

    How does OpenID differ from OpenID Connect?

    <p>OpenID Connect incorporates REST principles, whereas OpenID does not.</p> Signup and view all the answers

    Which statement is correct regarding refresh tokens in the Implicit Grant type of OAuth2?

    <p>They are not used in the Implicit Grant.</p> Signup and view all the answers

    What is an important benefit of using Single Sign-On (SSO)?

    <p>It streamlines the login process across various sites.</p> Signup and view all the answers

    Study Notes

    Web Authentication

    • Web Authentication is the process of verifying a user's identity.
      • Authentication verifies who the user is.
      • Authorization defines what actions a user is permitted to take.
    • Authentication vs Authorization
      • Authentication determines if the user is who they claim to be.
      • Authentication controls access based on rules and permissions.
    • Cryptographic Primitives
      • Hashing is used for integrity, not authentication or non-repudiation.
      • MACs (Message Authentication Codes) provide integrity and authentication, using symmetric keys.
      • Digital signatures offer integrity, authentication, and non-repudiation, relying on asymmetric keys.

    HTTP Basic Authentication

    • Simplest method, but vulnerable to eavesdropping.
    • Server responds with "401 Unauthorized" and requests authentication.
    • Client includes a base64-encoded username and password in the header.
    • Browser handles this method natively and does not provide customization options.
    • Passwords are not encrypted in transit; use SSL/TLS to protect.

    HTTP Digest Authentication

    • More secure than HTTP Basic.
    • Server provides a "nonce" (random value) and a challenge.
    • Client computes a response digest based on the server's challenge, including the nonce.
    • More complex than HTTP Basic, handled by most modern browsers.

    HTTP Digest II

    • Simplifies the digest calculation.
    • HA1: derived from username, realm, and password using MD5 hash.
    • HA2: derived from method and URI.
    • Response is based on HA1, nonce, and HA2 (using MD5).
    • Bit outdated due to being defined before HMAC.

    HMAC Authentication

    • Uses a secret key shared between client and server.
    • Creates a message authentication code (digest) for the data.
    • Allows checking for any data tampering in transit.
    • Cryptographic hash algorithm, like SHA-256, is used; and data is encoded.

    Token Authentication

    • Represents a user's authenticated status.
    • Client requests a token after authentication.
    • Subsequent requests include the token.
    • Can be short- or long-lived.
    • Refresh tokens allow renewing a token.
    • Revocability is often implemented.
    • Authenticates via header field (e.g. "Bearer").

    JSON Web Token (JWT)

    • A set of claims (information about a user or object) encoded in a JSON payload within a specialized format (JWS or JWE).
    • JWT comprises a header, payload, and signature/MAC.
    • Simplifies authentication across applications/systems, as it only requires sending the user's token.

    JSON Web Signature (JWS)

    • Represents digitally signed content.
    • Consists of a JOSE header, payload, and signature.
    • Signatures provide content integrity and authenticity.
    • Uses Base64Url encoding.

    base64url Encoding

    • Variant of Base64, using URL-safe characters.
    • Replaces '+' and '/' with '-' and '_'.
    • May omit padding ('=').

    JWE, JWK

    • JWE: JSON Web Encryption, comparable to JWS but encrypts the data.
    • JWK: JSON Web Key, a JSON representation of cryptographic keys, for JWE.
    • Enables end-to-end encryption, regardless of transport-layer security (TLS/SSL).

    OAuth2 I & II

    • Open standard for authorization (allowing one application to access resources for another user).
    • Supports delegated access (one user allowing resources to be accessed by another party).
    • Different grant types allow for varied use cases (e.g. client credentials, implicit).

    Multi-factor Authentication

    • Incorporates multiple authentication methods (e.g., something you know, are, or have) for enhanced security.

    WebAuthn (Web Authentication)

    • Browser API for public-key authentication.
    • Leverages security devices like USB tokens or smart cards.

    OpenID Connect

    • Adds identity verification capabilities on top of OAuth 2.0.
    • Enables single sign-on across multiple sites.
    • Verifies the user's identity and provides profile information.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Web Authentication (PDF) - SA 2024

    Description

    Test your knowledge on key concepts of cryptography, focusing on authentication and authorization methods. This quiz covers various cryptographic primitives, digital signatures, and multi-factor authentication. Challenge yourself to understand the nuances between different authentication techniques and their applications.

    More Like This

    Chapter 13 Digital Signatures
    18 questions

    Chapter 13 Digital Signatures

    WellBalancedBinary avatar
    WellBalancedBinary
    Authentication Servers and Session Keys
    10 questions

    Authentication Servers and Session Keys

    AccurateVeena avatar
    AccurateVeena
    Authentication Protocols: Secret Keys and Distributed Systems
    10 questions

    Authentication Protocols: Secret Keys and Distributed Systems

    LionheartedGlockenspiel avatar
    LionheartedGlockenspiel
    Authentication and Cryptography Concepts
    48 questions

    Authentication and Cryptography Concepts

    UnaffectedSitar1811 avatar
    UnaffectedSitar1811
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser