1 Cryptography Foundations and Security Goals Free Online FlashCards

What does confidentiality protect?

Confidentiality prevents unauthorized people or systems from learning information. Encryption may not protect data while an authorized application has decrypted it.

What does integrity mean in cryptography?

Integrity means detecting or preventing unauthorized changes. A hash helps only if the expected hash is trustworthy; a MAC or authenticated encryption can protect integrity against an attacker without the secret key.

What can a valid digital signature establish?

Authentication establishes or verifies an identity, message source, or possession of a key. A valid digital signature indicates that the message was signed by the holder of a particular private key.

What does availability mean?

Availability means authorized users can access a service or data when needed. Cryptography alone cannot prevent an attacker from deleting encrypted files or taking a service offline.

What is a threat model?

A threat model describes what needs protection, from whom, and under what assumptions. It guides the choice of controls by relating them to actual risks.

What should a threat model specify about adversaries?

A useful threat model identifies what an attacker can observe, alter, or control, as well as assets, trust boundaries, security goals, constraints, assumptions, and residual risks.

Why might database encryption not protect documents from a compromised application?

Encrypting a database backup may limit harm if the backup is stolen without its key. It may not protect documents from an attacker who compromises the running application that can access both data and keys.

How does hashing differ from encryption?

A hash is a fixed-length digest computed from data; it is not encryption and cannot be decrypted to recover the original data.

What does a salt do when hashing passwords?

A salt is a non-secret, usually unique value added when hashing a password. It makes identical passwords produce different stored results and frustrates precomputed lookup attacks, but does not strengthen a weak password.

What is a nonce or initialization vector?

A nonce or initialization vector is a value used by some encryption schemes. It often need not be secret, but must meet the algorithm's requirements; reuse with the same key may be forbidden.

What does an authentication tag help verify?

An authentication tag is a short value produced by authenticated encryption or a MAC. Verification should fail if protected data or associated metadata has been altered.

What does a certificate bind, and what does it not prove?

A certificate is a digitally signed document that binds a public key to an identity or name under an issuing authority's rules. It does not prove that a particular person controls the key at the moment of use.