Scribd Logo
Upload

Welcome to Scribd!

  • 33 views

    CISSP Domain 3 - 46 60

    Uploaded by

    Arifur Rahman
    The document discusses Diffie-Hellman key exchange, which is an asymmetric algorithm that allows two parties to establish a shared secret over an insecure channel without pre-shared secrets. It uses discrete logarithms in a finite field. Elliptic curve cryptography is also discussed, which provides stronger security than discrete logarithms for a given key size and is often used in low-power devices due to its efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CISSP Domain 3 - 46 60

    Uploaded by

    Arifur Rahman
    33 views15 pages
    The document discusses Diffie-Hellman key exchange, which is an asymmetric algorithm that allows two parties to establish a shared secret over an insecure channel without pre-shared secrets. It uses discrete logarithms in a finite field. Elliptic curve cryptography is also discussed, which provides stronger security than discrete logarithms for a given key size and is often used in low-power devices due to its efficiency.

    Original Title

    CISSP-Domain-3_46-60

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses Diffie-Hellman key exchange, which is an asymmetric algorithm that allows two parties to establish a shared secret over an insecure channel without pre-shared secrets. It uses discrete logarithms in a finite field. Elliptic curve cryptography is also discussed, which provides stronger security than discrete logarithms for a given key size and is often used in low-power devices due to its efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    33 views15 pages

    CISSP Domain 3 - 46 60

    Uploaded by

    Arifur Rahman
    The document discusses Diffie-Hellman key exchange, which is an asymmetric algorithm that allows two parties to establish a shared secret over an insecure channel without pre-shared secrets. It uses discrete logarithms in a finite field. Elliptic curve cryptography is also discussed, which provides stronger security than discrete logarithms for a given key size and is often used in low-power devices due to its efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 15

    DIFFIE-HELLMAN

    • The first asymmetric algorithm

    • Secure key-agreement without pre-shared secrets

    • Based on discrete logarithms in a finite field


    DIFFIE HELLMAN KEY AGREEMENT
    ECC (ELLIPTICAL CURVE CRYPTOGRAPHY)
    • Based upon plotting points upon a curve

    • Frequently used for handheld devices due to their limited processing capability

    • One-way function that uses discrete logarithms as applied to elliptic curves

    • Solving this problem is harder than solving discrete logarithms, so algorithms based on Elliptic Curve
    Cryptography (ECC) are much stronger per bit than systems using discrete logarithms (and also stronger than
    factoring prime numbers)

    • Requires less computational resources because shorter keys can be used compared to other asymmetric
    methods

    • Often used in lower power devicesCryptosystem Key length

    • RSA 1,024 bits, DSA 1,024 bits, Elliptic curve 160 bits
    REVIEW SYMMETRIC VS. ASYMMETRIC
    Symmetric:

    • Fast
    • Out of band key exchange
    • No integrity, authenticity or authenticity
    • Not Scalable

    Asymmetric:

    • Slow
    • Scales to large organizations well
    • Provides non-repudiation
    • Key exchange does not require exchange of any secret information
    SSL/TLS HYBRID CRYPTOGRAPHY
    INTEGRITY

    • Data gets modified

    • Accidentally through corruption

    • Intentionally through malicious alteration

    • Hash: only good for accidental modification

    • MAC: Provides reasonable authenticity and integrity not strong enough to be non-repudiation
    (because it uses a symmetric key)

    • Digital Signatures: Can detect both malicious and accidental modification, but requires an overhead.
    Provides true non-repudiation
    HASHING
    • Hashing is the Digital representation of the contents of the file

    • If the file changes, the hash will change

    Five basic requirements for a

    • The input can be of any length.


    • The output has a fixed length.
    • The hash function is relatively easy to compute for any input.
    • The hash function is one-way (meaning that it is extremely hard to
    • determine the input when provided with the output).

    • When two different documents produce the same hash it is called a collision

    • A birthday attack is an attempt to cause collisions. It is based on the idea that it is easier to find two
    hashes that happen to match than to produce a specific hash.
    HASHING ALGORITHMS

    • Variable length message, fixed length has

    • MD-5 used to be the standard with a 128 bit hash

    • SHA-256 is becoming very frequently used

    • RipeMD, Tiger, Whirlpool, HAVAL are lesser known hashing algorithms

    • Older hash functions include Secure Hash Algorithm 1 (SHA-1), which creates a 160-bit hash and
    Message Digest 5 (MD5), which creates a 128-bit hash

    • Newer alternatives such as SHA-2 are recommended


    MD5 & Secure Hash Algorithm (SHA)

    MD5
    • Message Digest algorithm 5, created by Ronald Rivest
    • Creates a 128-bit hash value based on any input length
    • Weaknesses have been discovered where collisions could be found in a practical amount of time
    • MD6 is the newest version of the MD family of hash algorithms, first published in 2008

    Secure Hash Algorithm (SHA)


    • Name of a series of hash algorithms
    • SHA-1 was announced in 1993 in the United States Federal Information
    • SHA-1 creates a 160-bit hash value
    • SHA-2 is recommended over SHA-1 or MD5
    SALTING THE PASSWORD
    Salting Saves Passwords

    • The cryptographic salt is a random value that is added to the end of the password before the operating
    system hashes the password. The salt is then stored in the password file along with the hash.

    • When the operating system wishes to compare a user’s proffered password to the password file, it first
    retrieves the salt and appends it to the password.

    • It feeds the concatenated value to the hash function and compares the resulting hash with the one
    stored in the password file.

    • Specialized password hashing functions, such as PBKDF2, bcrypt and scrypt allow for the creation of
    hashes using salts

    • The use of salting dramatically increases the difficulty of brute-force attacks.


    DIGITAL SIGNATURE

    • Provide nonrepudiation, which includes authentication of the identity of the signer, and proof of
    the document’s integrity (proving the document did not change)

    • Digital signatures provide authentication and integrity, which forms nonrepudiation. They do not
    provide confidentiality: the plaintext remains unencrypted.

    • Message is hashed.

    • Hash is encrypted by Sender’s Private Key.

    • SHA-1 is generally used for the hash

    • RSA is the asymmetric encryption algorithm that encrypts the hash with the sender’s private key.
    DIGITAL SIGNATURE
    WHAT PREVENTS MITM ATTACKS

    • Authentication

    • Remember Encryption can NOT thwart a MITM attack

    • Authentication is what prevents MITM


    HMAC
    • Combines symmetric encryption with hashing

    • Similar to a digital signature, except that it uses symmetric encryption instead of


    asymmetric

    • HMACs are used by Ipsec

    • Two parties must preshared secret key (such as a DES key). Once shared, the sender may
    generate a HMAC by hashing the message with an algorithm such as MD5 or SHA-1, and
    then encrypting the hash with the preshared key via symmetric cipher such as DES

    • The receiver hashes the plaintext locally and also decrypts the HMAC with his/her copy of
    the private key, recovering the sender’s hash. If the two hashes match, the sender is
    authenticated, and the message’s integrity is assured.
    PKI (PUBLIC KEY INFRASTRUCTURE)

    • Leverages all three forms of encryption to provide and manage digital


    certificates

    • A digital certificate is a public key signed with a digital signature

    • Digital certificates may be server-based

    • If the two are used together, they provide mutual authentication and
    encryption.

    • The standard digital certificate format is X.509.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy