Melbourne COMP90043 - Cryptography and Security Flashcards

Question 1

What is Cryptography?

Accepted Answer

Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behavior. It involves methods for protecting information and communications through the use of codes, so that only those for whom the information is intended can read and process it.

Question 2

What is Symmetric Encryption?

Accepted Answer

Symmetric encryption (or secret-key encryption) uses a single, shared secret key for both encrypting plaintext into ciphertext and decrypting ciphertext back into plaintext. Both the sender and receiver must possess this same key.

Question 3

Give an example of a Symmetric Encryption algorithm.

Accepted Answer

The Advanced Encryption Standard (`AES`) is a widely used and highly secure symmetric encryption algorithm. Other examples include `DES` (now considered insecure) and `Triple DES` (`3DES`).

Question 4

What is Asymmetric Encryption?

Accepted Answer

Asymmetric encryption (or public-key encryption) uses a pair of mathematically related keys: a public key and a private key. The public key can be shared widely, while the private key must be kept secret. Data encrypted with one key can only be decrypted with the other.

Question 5

Give an example of an Asymmetric Encryption algorithm.

Accepted Answer

The `RSA` (Rivest–Shamir–Adleman) algorithm is a prominent example of asymmetric encryption, commonly used for secure data transmission and digital signatures. Other examples include `ECC` (Elliptic Curve Cryptography).

Question 6

What is the main difference between Symmetric and Asymmetric Encryption?

Accepted Answer

Symmetric encryption uses a single shared secret key for both encryption and decryption, offering high speed. Asymmetric encryption uses a public/private key pair, providing secure key exchange and digital signatures, but is computationally slower.

Question 7

What is a Hashing Algorithm?

Accepted Answer

A hashing algorithm is a mathematical function that takes an input (or 'message') and returns a fixed-size alphanumeric string, called a hash value, message digest, or simply hash. Cryptographic hash functions are designed to be one-way (irreversible) and collision-resistant.

Question 8

What are the key properties of a cryptographic hash function?

Accepted Answer

Key properties include:
1.  **Deterministic**: The same input always produces the same output.
2.  **One-way (Preimage Resistance)**: Computationally infeasible to reverse the hash to find the original input.
3.  **Collision Resistance**: Computationally infeasible to find two different inputs that produce the same hash output.
4.  **Avalanche Effect**: A small change in input produces a significantly different hash output.

Question 9

Explain `SHA-256`.

Accepted Answer

`SHA-256` (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces a 256-bit (32-byte) hash value. It is part of the `SHA-2` family and is widely used in security applications, including `SSL/TLS`, cryptocurrencies (like Bitcoin), and digital signatures, due to its strong collision resistance.

Question 10

Explain `MD5` and its current status.

Accepted Answer

`MD5` (Message-Digest Algorithm 5) is a cryptographic hash function that produces a 128-bit hash value. While once widely used, `MD5` is now considered cryptographically broken due to the discovery of practical collision attacks, making it unsuitable for applications requiring strong collision resistance (e.g., digital signatures, SSL certificates). It may still be used for integrity checks where security is not paramount.

Question 11

What is a Digital Signature?

Accepted Answer

A digital signature is a mathematical scheme for verifying the authenticity and integrity of digital messages or documents. It provides assurance to the recipient that the message was created by a known sender (authenticity), and that it has not been altered in transit (integrity), and offers non-repudiation.

Question 12

How does a Digital Signature work?

Accepted Answer

The sender hashes the document, then encrypts the hash with their *private key*. The recipient uses the sender's *public key* to decrypt the hash, then independently hashes the received document. If the two hash values match, the signature is valid, confirming authenticity and integrity.

Question 13

What is Public Key Infrastructure (PKI)?

Accepted Answer

PKI is a system of hardware, software, policies, and procedures required to create, manage, distribute, use, store, and revoke digital certificates. It establishes and maintains a trustworthy environment for the use of public-key cryptography, primarily by binding public keys to identities.

Question 14

What is the role of a Certificate Authority (CA) in PKI?

Accepted Answer

A Certificate Authority (`CA`) is a trusted third party in a PKI system that issues and manages digital certificates. The `CA` verifies the identity of individuals or organizations and then binds their public key to that identity by issuing a digitally signed certificate.

Question 15

What is a Digital Certificate?

Accepted Answer

A digital certificate (e.g., `X.509` certificate) is an electronic document used to prove the ownership of a public key. It contains information about the key owner, the public key itself, the issuer (`CA`), and a digital signature from the `CA` to verify its authenticity.

Question 16

What is Phishing?

Accepted Answer

Phishing is a type of social engineering attack where attackers attempt to trick individuals into revealing sensitive information (like usernames, passwords, credit card details) or installing malware, often by impersonating a trustworthy entity in an electronic communication (e.g., email, text message, fake website).

Question 17

What is a Distributed Denial of Service (DDoS) attack?

Accepted Answer

A `DDoS` attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised computer systems (a 'botnet'). This renders the service unavailable to legitimate users.

Question 18

How does a `SQL Injection` attack work?

Accepted Answer

A `SQL Injection` attack occurs when an attacker inserts or 'injects' malicious `SQL` code into an input field of a web application. If the application's backend database query is not properly sanitized, the injected code can be executed, allowing the attacker to bypass authentication, retrieve, modify, or delete data, or even execute arbitrary commands.

Question 19

What is Cross-Site Scripting (XSS)?

Accepted Answer

`XSS` is a type of security vulnerability typically found in web applications. `XSS` attacks enable attackers to inject client-side scripts (e.g., JavaScript) into web pages viewed by other users. This can allow attackers to bypass access controls, steal cookies, session tokens, or other sensitive information, or deface websites.

Question 20

What is a Man-in-the-Middle (MitM) attack?

Accepted Answer

A `MitM` attack is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. The attacker intercepts the communication, reads it, and then re-encrypts and sends it on, making both parties believe they are talking directly.

Question 21

What is a Brute-Force Attack?

Accepted Answer

A brute-force attack is a trial-and-error method used to obtain information such as user passwords or encryption keys. It involves systematically checking all possible combinations until the correct one is found. These attacks can be very time-consuming but are guaranteed to succeed eventually if given enough time and computational power.

Question 22

What is a Salt (in password hashing)?

Accepted Answer

A salt is a unique, random string of data added to a password before it is hashed. The purpose of salting is to defend against rainbow table attacks and to ensure that two identical passwords stored in a database will have different hash values, even if they are the same plaintext password.

Question 23

What is `TLS/SSL` and its purpose?

Accepted Answer

`TLS` (Transport Layer Security) and its predecessor `SSL` (Secure Sockets Layer) are cryptographic protocols designed to provide communication security over a computer network. They are widely used for securing web browsing (`HTTPS`), email, and other data transfers by encrypting the connection, authenticating the server (and optionally the client), and ensuring data integrity.

Question 24

What is a Firewall?

Accepted Answer

A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. It acts as a barrier between a trusted internal network and untrusted external networks (like the internet), preventing unauthorized access and malicious traffic.

Question 25

What is Non-repudiation in security?

Accepted Answer

Non-repudiation is a service that provides undeniable proof of the origin and integrity of data. It ensures that a party cannot falsely deny having sent a message or having performed an action. Digital signatures are a primary mechanism for achieving non-repudiation.

Melbourne COMP90043 - Cryptography and Security

Cards in this deck

Related Flashcard Sets

HSK 2 - Intermediate Chinese Vocabulary & Grammar

Genetics - Mendelian Inheritance & Population Genetics

USMLE Step 1 - General Principles of Pharmacology

JLPT N5 - Essential Japanese Vocabulary & Grammar