EC-Council CBP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Collision resistance

Property that makes it computationally infeasible to find two different inputs producing the same hash output. It underpins block linking and Merkle commitments, because a collision would let an attacker substitute data without changing the digest.

Merkle root

The single hash at the top of a Merkle tree that commits to every transaction in a block. Changing any transaction changes the root, so the block header alone proves the transaction set is intact.

Digital signature

A cryptographic value produced with a private key that anyone can verify with the matching public key. It provides authentication, integrity, and non-repudiation, but it does not hide the message contents.

ECDSA secp256k1

The elliptic-curve signature scheme used by Bitcoin and Ethereum. Security depends on nonce uniqueness: reusing or leaking the per-signature nonce k allows an attacker to compute the private key directly.

Hash versus HMAC

A plain hash detects accidental corruption only, while an HMAC mixes in a shared secret key so only key holders can produce a valid tag. HMAC proves authenticity between two parties but not non-repudiation.

Avalanche effect

The property that a one-bit change in input produces an unpredictable output differing in roughly half its bits. It prevents attackers from guessing inputs that yield similar digests or gradually approaching a target hash.

Proof-of-work nonce

A variable field in the block header that miners increment so the resulting block hash falls below the network target. Finding it requires brute force, but verifying it takes a single hash computation.

Public key derivation

Public keys are computed from private keys by one-way elliptic-curve multiplication, so publishing a public key or address does not reveal the private key. The reverse direction is computationally infeasible.

Block header fields

The header contains the previous block hash, Merkle root, timestamp, nonce, and difficulty target. Hashing the header links blocks, and altering any field invalidates all subsequent blocks in the chain.

Soft fork versus hard fork

A soft fork tightens consensus rules and remains compatible with unupgraded nodes. A hard fork relaxes or changes rules so old nodes reject new blocks, potentially splitting the network into two chains.

BFT fault tolerance

Byzantine fault tolerant consensus such as PBFT tolerates f faulty or malicious nodes among 3f+1 total validators. It gives deterministic finality but scales poorly as validator count grows.

UTXO model

Bitcoin's accounting model where coins exist as unspent transaction outputs that must be consumed whole and recreated as new outputs. Change is returned to the sender as an additional output.

Account model

Ethereum's model tracking balances, storage, and a per-account nonce that prevents replay. It simplifies state queries but makes parallel transaction execution harder than the UTXO approach.

Gas and gas price

Gas measures computational effort; total fee equals gas used multiplied by gas price. Users set a price to prioritize inclusion, and block gas limits cap how much work fits per block.

Optimistic versus zk rollups

Optimistic rollups assume validity and rely on fraud proofs during a challenge window. zk rollups submit cryptographic validity proofs immediately, giving faster finality at higher proving cost.

Consortium blockchain

A permissioned chain governed by a known group of organizations rather than open participation. It suits enterprise consortia needing privacy, predictable throughput, and membership control among business partners.

Light client

A node that stores only block headers and requests Merkle proofs for specific transactions. It verifies inclusion without full state, trading some trust assumptions for low resource use.

Bridge risk concentration

Cross-chain bridges lock or burn assets on one chain and mint on another, so the bridge contract and its validators become the primary attack surface rather than either underlying blockchain.

51% attack capability

A majority hash-power holder can double-spend and reorganize recent blocks. It cannot forge signatures, steal coins from wallets, or cheaply rewrite deeply confirmed history on a large network.

Reentrancy

An attack where a contract calls an external address that re-enters the original function before state is updated, draining funds. Mitigation is checks-effects-interactions plus a reentrancy guard.

Oracle manipulation

Attackers distort an on-chain price feed, often via flash loans against a thin liquidity pool, to trigger unfair liquidations or trades. Time-weighted averages and multiple feeds reduce exposure.

Multisignature wallet

A wallet requiring m of n private keys to authorize a transaction. It removes single-key failure and is standard for treasury custody, but signer collusion or compromised devices remain risks.

Token approval abuse

Users grant contracts an allowance to spend their tokens; a malicious or compromised contract can later drain that allowance. Periodic review and revocation of approvals limits the exposure window.

Cold storage

Keeping private keys offline on air-gapped hardware so remote attackers cannot reach them. It addresses network compromise but not physical theft, loss, or signing-device supply-chain tampering.

Smart contract audit limits

Audits combine static analysis, fuzzing, and manual review to find defects before deployment. They reduce risk but cannot prove absence of bugs or cover future economic and governance attacks.

Travel rule

An AML requirement that virtual asset service providers share originator and beneficiary information on transfers above a threshold. It drives identity collection and counterparty data exchange.

Blockchain fit criteria

A use case fits when multiple distrusting parties share write access, need tamper-evident audit trails, and have modest transaction volume. Single-owner high-volume systems fit a normal database better.

Supply chain provenance

Recording custody and transformation events on a shared ledger gives tamper-evident traceability across parties. Trustworthiness depends on the integrity of off-chain sensors and data-entry controls.

Self-sovereign identity

An identity model where users hold decentralized identifiers and verifiable credentials in their own wallet. They present selective attributes to verifiers without a central identity provider mediating each exchange.

Asset tokenization

Issuing a token representing a claim on an off-chain asset. Legal enforceability, custody, and redemption rights must exist off-chain; the token itself does not confer ownership automatically.

Trade finance automation

Smart contracts check documents and milestones among banks and traders, releasing payment when conditions verify. Consortium deployment shortens letter-of-credit settlement from days to hours.

On-chain health data

Storing raw personal health records on a public ledger conflicts with privacy regulation. Designs instead put hashes or pointers on-chain and keep the records in controlled off-chain storage.