Cybersecurity Cryptography Syllabus

Why does 3DES use Encrypt-Decrypt-Encrypt (EDE) rather than Encrypt-Encrypt-Encrypt?

EDE provides backward compatibility: setting all three keys equal ($k_1=k_2=k_3$) makes 3DES reduce to single DES ($E(D(E(P))) = E(P)$), so it can interoperate with legacy DES systems.

What is AES, and what block/key sizes does it support?

AES (Advanced Encryption Standard) is the current symmetric block-cipher standard (Rijndael). It has a fixed 128-bit block and supports key sizes of 128, 192, or 256 bits, using 10, 12, or 14 rounds respectively.

AES is based on which cipher structure, and name its main round operations.

AES uses a substitution-permutation network (SPN), not a Feistel network. Each round performs SubBytes (S-box substitution), ShiftRows (row permutation), MixColumns (column mixing), and AddRoundKey (XOR with round key); the final round omits MixColumns.

Why do block ciphers need a "mode of operation"?

A block cipher only encrypts a single fixed-size block. A mode of operation defines how to securely encrypt messages longer than one block, chaining or combining block operations while preventing patterns and enabling features like randomization.

What is ECB mode and why is it insecure?

Electronic Codebook (ECB) mode encrypts each block independently with the same key. It is insecure because identical plaintext blocks yield identical ciphertext blocks, leaking patterns (e.g. the famous encrypted-penguin image).

Describe CBC mode and the role of the IV.

Cipher Block Chaining (CBC) XORs each plaintext block with the previous ciphertext block before encryption: $C_i = E_k(P_i \oplus C_{i-1})$, with $C_0$ being a random Initialization Vector (IV). The IV randomizes the first block so identical plaintexts produce different ciphertexts.

How do CTR (Counter) mode and GCM differ from CBC, and why is GCM popular?

CTR mode turns a block cipher into a stream cipher by encrypting successive counter values and XOR-ing with plaintext, enabling parallelism and random access. GCM (Galois/Counter Mode) adds authentication (an integrity tag) to CTR, providing authenticated encryption (AEAD), which is why it is widely preferred.

What is authenticated encryption (AEAD) and why is it recommended?

AEAD (Authenticated Encryption with Associated Data) simultaneously provides confidentiality and integrity/authenticity, producing an authentication tag over ciphertext (and optional unencrypted associated data). It is recommended because encryption alone doesn't prevent tampering. Examples: AES-GCM, ChaCha20-Poly1305.

In public-key cryptography, which key encrypts and which decrypts for (a) confidentiality and (b) digital signatures?

For confidentiality, the sender encrypts with the recipient's public key and the recipient decrypts with their private key. For a digital signature, the signer encrypts/signs with their own private key and anyone verifies with the signer's public key.

What mathematical property makes a public/private key pair secure (a trapdoor function)?

They rely on a one-way (trapdoor) function: easy to compute in one direction but computationally infeasible to reverse without the private key (the trapdoor). E.g. multiplying primes is easy but factoring their product is hard.

Outline the RSA key-generation steps.

1) Choose two large primes $p,q$ and compute $n = pq$. 2) Compute $\phi(n) = (p-1)(q-1)$. 3) Choose public exponent $e$ with $1 < e < \phi(n)$ and $\gcd(e,\phi(n))=1$. 4) Compute private exponent $d \equiv e^{-1} \pmod{\phi(n)}$. Public key is $(n,e)$; private key is $(n,d)$.

State the RSA encryption and decryption formulas.

Encryption: $C = M^{e} \bmod n$. Decryption: $M = C^{d} \bmod n$, where $(n,e)$ is the public key and $d$ the private key.

On what hard mathematical problem does RSA's security rest?

The integer factorization problem: given $n = pq$, it is computationally infeasible to factor large $n$ into its prime factors $p$ and $q$, which would reveal $\phi(n)$ and hence the private exponent $d$.

What is the purpose of the Diffie-Hellman key exchange?

It allows two parties to establish a shared secret key over an insecure public channel without ever transmitting the secret itself, enabling subsequent symmetric encryption. It provides key agreement, not encryption of messages.

Walk through the Diffie-Hellman key-exchange math.

Public parameters: prime $p$ and generator $g$. Alice picks secret $a$, sends $A = g^{a} \bmod p$. Bob picks secret $b$, sends $B = g^{b} \bmod p$. Both compute the shared secret $s = B^{a} = A^{b} = g^{ab} \bmod p$.

What hard problem underlies Diffie-Hellman's security, and what attack is it vulnerable to without authentication?

It relies on the discrete logarithm problem (recovering $a$ from $g^{a} \bmod p$ is infeasible). Without authentication of the exchanged values, it is vulnerable to a man-in-the-middle attack.

What is Elliptic Curve Cryptography (ECC), and what is its main advantage over RSA?

ECC is public-key cryptography based on the algebra of points on an elliptic curve over a finite field. Its main advantage is much smaller keys for equivalent security, giving faster computation and lower memory/bandwidth use.

Give the general equation of an elliptic curve used in ECC and the hard problem it relies on.

The curve is $y^{2} = x^{3} + ax + b$ over a finite field. Security rests on the Elliptic Curve Discrete Logarithm Problem (ECDLP): given points $P$ and $Q = kP$, finding the scalar $k$ is infeasible.

Roughly, how do ECC and RSA key sizes compare for equivalent security?

ECC keys are far smaller: a 256-bit ECC key gives roughly the same security as a 3072-bit RSA key, and a 128-bit symmetric equivalent. Smaller keys mean less computation and storage.

What is a cryptographic hash function and what are its key properties?

A hash function maps arbitrary-length input to a fixed-length digest. Properties: deterministic, fast to compute, preimage resistance (can't invert), second-preimage resistance, collision resistance, and the avalanche effect (small input change flips ~half the output bits).

Define preimage resistance, second-preimage resistance, and collision resistance.

Preimage resistance: given hash $h$, infeasible to find any $m$ with $H(m)=h$. Second-preimage resistance: given $m_1$, infeasible to find $m_2 \neq m_1$ with $H(m_2)=H(m_1)$. Collision resistance: infeasible to find any pair $m_1 \neq m_2$ with $H(m_1)=H(m_2)$.

Compare MD5, SHA-1, and the SHA-2 family in terms of digest size and security status.

MD5 produces a 128-bit digest and is broken (collisions trivial). SHA-1 produces 160 bits and is broken (collisions found, deprecated). SHA-2 (e.g. SHA-256, SHA-512) produces 256/512-bit digests and remains secure and recommended.

What is a Message Authentication Code (MAC), and what does it provide that a plain hash does not?

A MAC is a keyed checksum computed over a message with a shared secret key. Unlike a plain (keyless) hash, it provides integrity AND authentication, since only holders of the secret key can generate or verify a valid tag.

What is HMAC and why can't an attacker simply forge it by appending data (length-extension)?

HMAC is a hash-based MAC defined as $\text{HMAC}(K,m) = H\big((K \oplus opad)\,\|\,H((K \oplus ipad)\,\|\,m)\big)$. Its nested structure with inner and outer keyed hashing prevents length-extension attacks that affect naively-keyed hashes like $H(K\|m)$.

Why should passwords be stored hashed rather than encrypted or in plaintext?

Hashing is one-way, so even if the database is breached the original passwords aren't directly recoverable. Encryption is reversible (a leaked key exposes all passwords) and plaintext exposes them immediately. Passwords should be hashed with a slow, salted algorithm.

What is salting, and what attack does it defend against?

A salt is a unique random value added to each password before hashing: $H(\text{salt}\,\|\,\text{password})$. It ensures identical passwords produce different hashes, defeating precomputed rainbow-table attacks and preventing detection of duplicate passwords.

What is peppering, and how does it differ from salting?

A pepper is a secret value added to passwords before hashing, but unlike a salt it is the same for all users and stored separately from the database (e.g. in code or an HSM), not alongside the hash. It adds a layer that remains secret even if the database leaks.

What is key stretching, and name common algorithms used for it.

Key stretching deliberately makes password hashing slow and resource-intensive (many iterations / high memory) to slow brute-force and dictionary attacks. Common algorithms: PBKDF2, bcrypt, scrypt, and Argon2 (the modern recommendation).

What is the birthday attack, and how many hash operations are needed to find a collision in an $n$-bit hash?

The birthday attack exploits the birthday paradox to find hash collisions faster than brute force. For an $n$-bit output, a collision is expected after roughly $2^{n/2}$ operations, not $2^{n}$, which halves the effective security against collisions.

What is a digital certificate, and what standard format is most commonly used?

A digital certificate binds a public key to an identity (e.g. a domain or organization) and is digitally signed by a trusted Certificate Authority. The most common format is X.509, containing fields like subject, issuer, public key, validity period, serial number, and the CA's signature.

What is a Certificate Authority (CA) and how does the chain of trust work?

A CA is a trusted entity that issues and signs digital certificates. The chain of trust links an end-entity certificate to intermediate CA certificates up to a self-signed root CA certificate that is pre-installed in the client's trust store; each certificate is validated by verifying the signature of the one above it until a trusted root is reached.