EC-Council Certified Encryption Specialist flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Kerckhoffs's principle

A cryptographic system should remain secure even if everything about it except the key is public knowledge; security rests on the secrecy of the key, not the algorithm.

Steganography

The practice of hiding the existence of a message within another medium, such as embedding data in image pixels, rather than concealing the content through encryption.

One-time pad

A cipher that XORs plaintext with a truly random key as long as the message, used only once; it is information-theoretically secure when the key remains secret.

Transposition cipher

A cipher that rearranges the positions of plaintext characters without substituting them, preserving letter frequencies; examples include rail fence and columnar transposition.

Frequency analysis

A cryptanalytic technique that exploits the uneven distribution of letters in natural language to break monoalphabetic substitution ciphers by matching ciphertext frequencies to expected plaintext frequencies.

Feistel network

A block cipher structure that splits the block into halves, applies a round function to one half, and XORs the result into the other, enabling decryption with the same structure; DES uses it.

AES key sizes

AES is a 128-bit block cipher supporting 128-, 192-, and 256-bit keys, with 10, 12, and 14 rounds respectively; it is a substitution-permutation network.

ECB mode weakness

Electronic Codebook encrypts each block independently with the same key, so identical plaintext blocks produce identical ciphertext blocks, revealing patterns; it is not recommended for real data.

CBC initialization vector

Cipher Block Chaining XORs each plaintext block with the previous ciphertext block, starting with an initialization vector; the IV must be unpredictable and unique per key.

HMAC

A keyed hash construction that combines a cryptographic hash with a secret key to provide message authentication and integrity, distinct from a digital signature because it is symmetric.

Collision resistance

A hash property ensuring it is computationally infeasible to find two different inputs producing the same digest; for an n-bit hash, collisions require about 2^(n/2) work by the birthday bound.

Stream cipher

A cipher that generates a pseudorandom keystream and XORs it with plaintext one bit or byte at a time; examples include RC4 and ChaCha20, and it requires a unique nonce per key.

Euler's totient function

φ(n) counts integers from 1 to n that are coprime to n; for a prime p, φ(p)=p−1, and for n=pq, φ(n)=(p−1)(q−1), which underpins RSA key generation.

RSA key generation

Choose primes p and q, compute n=pq and φ(n)=(p−1)(q−1), select e coprime to φ(n), and compute d as the modular inverse of e modulo φ(n); public key is (e,n).

Diffie-Hellman key exchange

A protocol allowing two parties to agree on a shared secret over an insecure channel using modular exponentiation; its security relies on the discrete logarithm problem and it provides no authentication by itself.

Elliptic curve cryptography

An asymmetric scheme based on the elliptic curve discrete logarithm problem; it achieves security comparable to RSA with much smaller keys, such as 256-bit ECC approximating 3072-bit RSA.

Digital signature

A cryptographic value produced by signing a message hash with the sender's private key and verified with the sender's public key, providing integrity, authentication, and non-repudiation.

Hybrid encryption

A scheme where asymmetric cryptography encrypts a randomly generated symmetric session key, and the symmetric cipher encrypts the bulk data, combining key distribution convenience with symmetric speed.

Modular inverse

An integer d such that a·d ≡ 1 (mod n), existing when gcd(a,n)=1; it is computed with the extended Euclidean algorithm and is central to RSA private exponent derivation.

X.509 certificate

A digitally signed structure binding a public key to an identity, issued by a certificate authority; it includes validity dates, issuer, subject, and extensions, and is used in TLS and PKI.

Certificate revocation

The process of invalidating a certificate before expiration; CRLs are signed lists of revoked serial numbers, while OCSP queries the CA for real-time status of a specific certificate.

TLS handshake

The negotiation phase of TLS where peers authenticate, often with certificates, and agree on a symmetric session key using asymmetric key exchange; subsequent records are symmetrically encrypted.

S/MIME

A standard for public-key encryption and digital signing of email messages, using X.509 certificates; it provides end-to-end confidentiality and sender authentication for email content.

Full-disk encryption

Encryption of an entire storage volume, such as BitLocker, FileVault, or VeraCrypt, protecting data at rest if the device is lost or stolen, but not data while the system is unlocked.

Code signing

Applying a digital signature to software so users can verify its integrity and publisher identity before execution, helping prevent tampering and distribution of malicious modified binaries.

Known-plaintext attack

A cryptanalytic scenario where the attacker possesses both ciphertext and its corresponding plaintext, using the pair to deduce key information or cipher weaknesses.

Birthday attack

An attack exploiting the birthday paradox to find hash collisions in about 2^(n/2) operations for an n-bit hash, reducing effective collision resistance by half.

Meet-in-the-middle attack

An attack on multiple-encryption schemes that stores intermediate values to reduce the search effort; against two-key 3DES it lowers effective security to about 2^112 operations.

Padding oracle attack

An attack that exploits distinguishable responses to invalid padding in CBC decryption to recover plaintext; it is prevented by using authenticated encryption such as AES-GCM.

Shor's algorithm

A quantum algorithm that factors integers and solves discrete logarithms in polynomial time, threatening RSA, Diffie-Hellman, and elliptic curve cryptography once large enough quantum computers exist.

Grover's algorithm

A quantum search algorithm providing a quadratic speedup, effectively halving symmetric key strength; AES-128 gives roughly 64-bit security, so AES-256 is recommended for quantum resistance.

Harvest-now-decrypt-later

A threat model where adversaries record encrypted traffic today intending to decrypt it after quantum computers become capable, motivating early migration to post-quantum cryptography.