Involves systematically trying all possible keys or passwords until the
correct one is found.
Safeguards and Countermeasures:
* Use long, complex keys and passwords.
* Implement account lockout policies after a certain number of failed attempts.
* Cryptographic salt
* Use key stretching techniques
Brute Force
is a method used by hackers to crack passwords by systematically trying all
the words in a dictionary or word list.
Safeguards and Countermeasures:
* Password complexity requirements
* Account lockouts
* Cryptographic salts and strong hashing
* Multi-factor authentication
* Password blacklists that prohibit the use of common or previously compromised passwords.
Dictionary Attacks
combines brute-force and dictionary attacks. It starts with a dictionary attack and then applies brute force techniques to create variations of the words in the dictionary.
Hybrid Attack
the attacker has access to a collection of ciphertexts but does not know the corresponding
plaintexts. The goal is to deduce the key or plaintext by analyzing the ciphertext.
Safeguards and Countermeasures:
* Use strong, modern encryption algorithms like AES
* Ensure proper key management and secure key storage
* Use encryption modes that provide semantic security, such as CBC or CTR
Ciphertext Only
The attacker has access to both the plaintext and its corresponding ciphertext. This information
is used to deduce the encryption key.
Known plaintext
is used to break classical ciphers by studying the frequency of letters or
groups of letters in the ciphertext. This technique exploits the statistical properties of the
plaintext language.
Safeguards and Countermeasures:
* Use modern encryption algorithms instead of classical ciphers.
* Apply padding or randomization techniques to the plaintext before encryption.
* Use encryption modes that provide semantic security.
Frequency analysis
The attacker can choose specific ciphertexts and obtain their corresponding plaintexts. This
attack is used to gain information about the encryption key or algorithm.
Safeguards and Countermeasures:
* Use encryption algorithms that are resistant to chosen-ciphertext attacks, like AES.
* Implement proper padding schemes and integrity checks.
* Use authenticated encryption modes, such as GCM or CCM
Chosen ciphertext
exploit weaknesses in the implementation of cryptographic algorithms or protocols, rather than the underlying mathematics.
Safeguards and Countermeasures:
* Regularly update and patch cryptographic libraries and software.
* Use well-vetted, open-source cryptographic implementations.
* Perform thorough security testing and code reviews.
Implementation attacks
attacks exploit the unintentional information leakage from the physical implementation
of a cryptographic system, such as timing, power consumption, or electromagnetic
emissions. The attacker gains information from the physical implementation of a computer
system, rather than exploiting software vulnerabilities.
Safeguards and Countermeasures:
* Use hardware-based encryption modules with physical tamper resistance.
* Apply techniques like blinding or masking to reduce information leakage.
Side-channel Attack
the attacker intercepts and possibly alters the communication between two parties without their
knowledge, allowing them to eavesdrop or manipulate the data.
Safeguards and Countermeasures:
* Use secure communication protocols like TLS or SSH
* Implement mutual authentication between communicating parties
* Use digital signatures or message authentication codes to ensure data integrity
Man in the Middle Attack
is a specific type of chosen plaintext attack that works by examining how changes in the plaintext affect the ciphertext.
Differential cryptanalysis
hardware modules that were developed to be resistant to hardware tampering and have a limited interface making it easier to verify the integrity and secure operation of the code running on it.
Cryptoprocessors
Basic capacity with a single path for power and cooling and no redundant systems. This tier offers the lowest level of uptime guarantee.
Tier 1 Uptime Institute
Redundant capacity components, offering some redundancy in power and cooling systems, but still with a single path for critical infrastructure.
Tier 2 Uptime Institute
Concurrently maintainable, with multiple active power and cooling paths, allowing for maintenance and upgrades without disrupting operations.
Tier 3 Uptime Institute
Fault tolerant, with fully redundant systems and the highest level of uptime guarantee, able to withstand any single failure without downtime.
Tier 4 Uptime Institute
is a system that manages digital certificates and public key
(asymmetric) encryption to secure communications over networks.
Public Key Infrastructure
Certificate Authorities (CAs)
Registration Authorities (RAs)
Digital certificates
Certificate revocation
Components of PKI
Trusted entities that issue, sign, and revoke digital certificates
Certificate Authorities (CAs)
Entities responsible for verifying the identity of certificate
requesters and forwarding requests to CAs
Registration Authorities (RAs)
Electronic documents that bind a public key to an identity, signed by a trusted CA.
Digital certificates
The process of invalidating a digital certificate before its expiration date due to compromise or change in circumstances
Certificate revocation
is the foundation of a PKI hierarchy. It is self-signed,
meaning it verifies its own public key. This self-signed certificate is trusted by users and devices. It is a single server responsible for issuing certificates to intermediate
CAs.
Root CA
is a CA that derives its trust from the root CA. It is issued a certificate by the root CA, which establishes its authority to issue certificates. They are often used to manage
specific domains or groups within a larger organization.
Intermediate/Subordinate CA.
