Key Space, Digital Certificates, Biometrics

• Study guide covers topics for multiple-choice and true/false questions.

Key Space

• Key Space Definition: The range of all possible values of keys in a cryptographic system.
• Significance: A larger key space increases the difficulty for attackers to brute-force a key due to higher computational expense.
• Example: A 128-bit key has 2^128 possible values.
• Symmetric and Asymmetric keys can vary in bit length, but more bits always equate to a larger key space.

Digital Certificates

• Uses Asymmetric Keys for Validation.
• Components: Digital certificates include a public (asymmetric) key and information about the certificate holder's identity like name and organization.
• Validation: A Certificate Authority (CA) signs the certificate using its private key, and verification is done using the CA's public key.

FRR, FAR (Biometrics)

• FRR Definition: False Rejection Rate is the rate at which authorized users are incorrectly rejected.
• FAR Definition: False Acceptance Rate is the rate at which unauthorized users are incorrectly accepted.
• Application: Commonly used in biometric security to assess accuracy and balance user convenience with security.

Private Key Usage

• A private key can decrypt data encrypted with the corresponding public key in asymmetric cryptography.
• Private keys are also used to create digital signatures.
• While private keys can perform both roles (decrypting and signing), they are typically used for signing or decryption rather than encrypting for confidentiality.

Asymmetric vs. Symmetric Cryptography Speed

• Symmetric cryptography is generally faster than asymmetric cryptography.
• Asymmetric cryptography is slower because of complex math operations like large prime factorization.
• A common practice uses asymmetric cryptography to securely exchange a session key, then switches to symmetric cryptography for bulk data encryption.

PKI Keys

• Public Key Infrastructure (PKI): A framework for managing keys and certificates, including Certificate Authorities (CAs), Registration Authorities (RAs), and certificate databases.
• PKI ensures users and devices can trust that a public key belongs to its claimed owner.

Data Integrity

• Typically ensured by hashing (e.g., SHA-256) or other integrity checks such as checksums or message authentication codes.
• Data Integrity is the "I" in CIA (Confidentiality, Integrity, Availability).
• Digital signatures also assure integrity as signature verification fails if data is modified.

Authentication Factors

• Three main factors:
  • Something you know (password, PIN)
  • Something you have (smart card, token, phone)
  • Something you are (biometrics: fingerprint, face recognition)
• Additional factors includes:
  • Something you do (behavioral biometrics like keystroke dynamics)
  • Somewhere you are (location-based).

Cryptanalysis

• Cryptanalysis Definition: The study of finding weaknesses in cryptographic algorithms or implementations.
• Goal: Break encryption, find collisions, or deduce keys using methods like brute force, known-plaintext attacks, and chosen-plaintext attacks.

Bell-LaPadula Model

• Key focus is enforcing confidentiality in access control.
• Key rules:
  • No Read Up: A subject cannot read data at a higher security level.
  • No Write Down: A subject cannot write data to a lower security level.
• Often used in military or government contexts with strict classification levels.

Worm Software

• Worm Definition: A malicious program that can replicate itself across computers and networks.
• Key Difference from a virus: Worms propagate independently and don't require a host file or program to spread.

Multi-Factor Authentication

• You Have: token, smartphone, etc.
• You Are: biometric fingerprint, iris, etc.
• You Do: dynamic signature, voice pattern, keystroke pattern.

Purpose of PKI

• Enable secure, detectable, and reliable communication.
• Provides a structure to manage:
  • Key generation
  • Distribution
  • Revocation (if compromised)
  • Trust (via CA signatures)

Access Token

• Physical access token example: smart card, USB security key, or badge.
• Use: Proves physical or logical access rights.

Social Engineering

• Social Engineering Definition: Manipulating people into divulging confidential information through phishing, pretexting, tailgating, or baiting.
• Prevention: Training, awareness, and strict policies on information disclosure.

Certificate Authority (CA)

• Certificate Authority: Issues and signs digital certificates using its private key.
• Recipients verify a certificate by checking the CA’s public key.

Digital Signatures

• Digital Signatures Use Asymmetric Keys.
  • The private key signs the data.
  • The public key verifies the signature.
• Ensures authenticity and integrity.

Organizational Levels

• Policy: High-level statement of management intent (broad rules and principles).
• Procedure: Detailed, step-by-step instructions to implement a policy.
• Guideline: Suggested best practices; more flexible than procedures or policies.

Root CA Compromise

• The consequences of Root CA Private Key Compromise:
  • Security breach risk.
  • All certificates issued by that CA become untrustworthy.
  • Attackers could forge certificates that appear valid.
• Resolution: Requires revoking and reissuing new certificates under a new root authority.

Hashing

• Hashing is Irreversible
• Hash function: Maps data to a fixed-length value (the “digest”).
• Purpose: Designed so you cannot feasibly retrieve the original data from the hash.
• Example: SHA-256, SHA-3

PKI

• PKI = Public Key Infrastructure
• It’s the framework for managing public key certificates and encryption.

Local Area Network

• Within a LAN, devices use MAC (Media Access Control) addresses to forward frames at the data‐link layer.
• The LAN switch/hub typically uses MAC addresses to deliver data.
• IP addresses are used at higher layers, but at the local link layer, MAC is key.

TCP vs UDP Speed

• UDP is generally faster with less overhead (no connection setup, no reliability checks).
• TCP is connection-oriented with acknowledgments and retransmissions, and is more reliable.
• UDP is preferred for time-sensitive data like gaming and streaming.

Digital Certificate Structure

• Document that binds an identity (user, device) and a public key (associated with that identity).
• Signed by a CA, it proves "this public key belongs to this individual or organization."

Security Goals

• Non-repudiation: The sender cannot deny having sent the message (digital signatures help).
• Integrity: Ensures the message was not altered (hashing plus signatures help).

DHCP

• DHCP (Dynamic Host Configuration Protocol)
• Automatically assigns IP addresses and other network configuration parameters to devices on a network.
• Simplifies management of multiple devices.

Single Sign-On (SSO)

• A user logs in once and gains access to multiple systems or resources without reauthenticating.
• Enhances convenience, but if compromised, an attacker might gain wide access.

Security Properties

• CIA:
  • Confidentiality: Preventing unauthorized disclosure of information.
  • Integrity: Preventing unauthorized alteration or destruction of information.
  • Availability: Ensuring timely, reliable access to information.

Two-Factor Authentication

• Combines 2 of these:
  • Something you know (password)
  • Something you have (phone, token)
  • Something you are (biometric)

Encryption

• Plain Text → Cipher Text
• Encryption transforms readable data (plaintext) into unreadable data (ciphertext) via an algorithm and a key.
• Decryption reverts ciphertext back to plaintext (with the correct key).

AAA

AAA stands for Authentication, Authorization, and Accounting (sometimes also "Auditing").

• Authorization: Determines what an authenticated user is allowed to do or access.

Internet Package Delivery

• Router: Forwards data packets between different networks (based on IP addresses) at the network layer (Layer 3 in the OSI model).

Network Classifications

• Difference Between Class A, B, and C Network
• Class A: 0.0.0.0–127.255.255.255 (very large networks, many hosts)
• Class B: 128.0.0.0–191.255.255.255 (medium networks)
• Class C: 192.0.0.0–223.255.255.255 (smaller networks)

Network Topologies

• Star: All nodes connect to a central device (switch/hub); easier to troubleshoot but depends on the central device.
• Bus: All nodes share a single communication line; failure of the line breaks the network.

Packets

• ICMP: Internet Control Message Protocol, used for diagnostic messages.
• Usually the most lightweight, with no connection overhead.

Shoulder Surfing Prevention

• Observing someone’s screen or keyboard to obtain sensitive information like passwords or PINs.
• Prevention: Privacy screens, awareness, physical environment considerations.

TCP vs UDP

• TCP: Connection-oriented, reliable, uses three-way handshake (SYN, SYN-ACK, ACK); guarantees data delivery (retransmissions).
• UDP: Connectionless, no handshake, no reliability checks; lower overhead, faster.

Network Types

• LAN: Local Area Network, covers a small geographic area (single building, campus); typically under one organization’s control.
• WAN: Wide Area Network, spans broader geographic distance (e.g., connecting multiple LANs across cities or countries).

PKI

• CA Validates Identity.
• Ensures that public key truly belongs to the named entity.

RA Task

• Registration Authority.
• RA Collects and verifies identity information from the certificate requestor.
• It does not sign the certificate.

HMAC vs Digital Signature

• Uses a symmetric key plus a hashing function.
• Protects message integrity and authenticity for parties who share the secret key.
• Uses an asymmetric key pair (private key to sign, public key to verify).
• Proves authenticity and integrity to anyone with the public key (not just secret key holders).

Data Integrity

• Verified by Hashing.
• Hash functions generates a fixed‐length output from an input of any length.
• Any change in the input produces a completely different hash (high sensitivity to changes).

Hashing Property

• Hashing Is One-Way, Irreversible.
• There is no such thing as “two‐way hashing.”
• Once data is hashed, you cannot reconstitute the original data from the hash alone.

Study guide covering key space in cryptography, digital certificates and biometrics. Key space refers to the range of possible values for cryptographic keys, with larger key spaces increasing security. Digital certificates use asymmetric keys for validation, signed by a Certificate Authority.