L6 - Cryptography

Question 1

Cryptographic failures

Answer 1

• Not properly protecting sensitive data.
  – Example
  1. No appropriate encryption or hashing for credit cards
  and authentication credentials.
  2. No SSL to protect sensitive data in transit.
  3. Password database uses unsalted hashes to store
  passwords.

Question 2

Impact of cryptographic failures

Answer 2

– Compromises of all data that should be protected

Question 3

Commo probelms

Answer 3

– Not encrypting sensitive data.
– Using home grown algorithms.
– Insecure use of strong algorithms.
– Continued use of proven weak algorithms.
– Hard coding keys, and storing keys in unprotected stores.

Question 4

Sensitive data exposure prevention

Answer 4

• Store as little sensitive information as possible.
• Ensure appropriate strong cryptographic algorithms and strong keys are used.
• Ensure proper key management is in place.
• Ensure passwords are hashed with a strong hash algorithm and an appropriate salt is used.
• Disable autocomplete on forms and caches for pages that contain sensitive data.

Question 5

Cryptographic algorithm type classes

Answer 5

– SymmetricAlgorithm
– AsymmetrickAlogorithm
– HashAlgorithm

Question 6

Symmetric Alogrithms

Answer 6

• Encryption and decryption use the same secret key
• Primary attack is “brute force” key search –(try every possible key)
• Key distribution and storage is difficult
• Relatively fast
• Advanced Encryption Standard (AES)
  – US government standard since 2001 (replaced DES)
  – Rijndael algorithm (with 128 bit block size)

Question 7

Types of symmetric algorithms

Answer 7

• Stream Algorithms (Stream Ciphers) operate directly on a stream of bytes and encrypt the bits of information one bit or 1 byte at a time. These algorithms are faster than block ciphers.
• Block Algorithms (Block Ciphers) encrypt information by breaking it down in fixed-length groups-blocks of bits (usually 64 bits) and encrypting one block at a time. Block algorithms are most commonly used in the IT world today.

Question 8

Symmetric algorithms classes

Answer 8

DES, TripleDES, RC2, Rijndael, AES

Question 9

Encryption/Decryption using Symmetric Algorithm

Answer 9

Encrypt
* Generate Random Key
* Generate Initialization Vector (IV)
* Use CreateEncryptor() to produce ciphertext
* Store both the Key and IV into DB
Decrypt
* Retrieve Key and IV from DB
* Use CreateDecryptor() to produce plaintext

Question 10

Asymmetric Algorithm

Answer 10

– Is also known as public key cryptography.
– Uses two keys instead of one.
– Public key systems typically work using difficult math problems known as trapdoor functions
- Generally 100-1000 times slower than symmetric algorithms

Question 11

Asymmetric Algorithm classes

Answer 11

RSA, DSA

Question 12

Encryption and decryption using RSA Algorithm

Answer 12

– Create instance of RSA CSP (new keys generated by default).
– Import keys (if required)
– Convert input string to byte[]
– Encrypt
– Resulting byte[] is cipher text

– Create instance of RSA CSP (new keys generated by default).
– Import keys (private)
– Decrypt
– Resulting byte[] is plain text
- Convert to string

Question 13

Problems of symmetric algorithm and asymmetric algorithm

Answer 13

• Symmetric algorithm has problem of key distribution.
• Asymmetric is computationally expensive. (slow)
  – As asymmetric algorithms are inherently blocking ciphers (RSA), implementations can only encrypt block by block.

Question 14

Symmetric algorithm vs asymmetric algorithm

Answer 14

Symmetric
◼ Uses ONE key to:
❑ Encrypt data
❑ Decrypt data
◼ Is fast & efficient

Asymmetric
◼ Uses TWO related keys:
❑ Public key to encrypt data
❑ Private key to decrypt data
❑ OR vice versa
◼ Is more secure than symmetric encryption
◼ Is slower than symmetric encryption

Question 15

Hashing

Answer 15

A hash is a special mathematical function that performs one-way [encryption].
- Creates digest
- Irreversible

Question 16

Common uses of hasing

Answer 16

–storing users’ passwords
* hackers can decrypt the passwords
–ensuring message integrity.
* To verify if message or file remains original and not edited

Question 17

Hash Algorithm classes

Answer 17

SHA1, SHA256, SHA384, SHA512, MD5, KeyedHashAlgorithm

Question 18

Hashing in .NET

Answer 18

1. Convert string to byte []
2. Create hash algorithm object
3. Call ComputeHash

Question 19

Use salted passwords

Answer 19

• RNGCryptoServiceProvider generates high- quality random numbers. With it, we use an RNG (random number generator) that is as random as possible. This helps in applications where random numbers must be completely random.
• Caution:RNGCryptoServiceProvider has a cost:
  it reduces performance over the Random type.

Question 20

Signing Hash

Answer 20

• RSA algorithm can be used in conjunction with a
  hash algorithm to sign a piece of information.
  – Using SignHash method in the RSACryptoServiceProvider.

Question 21

Verify Hash

Answer 21

• VerifyHash method in RSACryptoServiceProvider.
  – Verifies the specified signature data by comparing it to the
  signature computed for the specified hash value.