EC-Council Certified Encryption Specialist key terms

The practice of securing information by transforming it so that only intended recipients can read it, using mathematical techniques for confidentiality, integrity, authentication, and non-repudiation.

The study of breaking or weakening cryptographic systems without the key, using mathematics, logic, implementation flaws, or side-channel observations to recover plaintext or keys.

The original readable message or data before any encryption transformation is applied. It is the input to an encryption algorithm and the desired output of decryption.

The scrambled, unreadable output produced when plaintext is processed by an encryption algorithm with a key. It should reveal nothing useful about the original message without the key.

A specific algorithm or method that converts plaintext into ciphertext and back again. Examples include AES, RSA, and the historical Caesar cipher.

A secret value used with a cryptographic algorithm to control encryption and decryption. Security depends on keeping the key secret, not on keeping the algorithm secret.

The rule that a cryptosystem should remain secure even if everything about it except the key is public knowledge. Security rests on the secrecy of the key alone.

Relying on hidden design, secret algorithms, or concealed implementation details for protection. It is considered weak because secrecy tends to leak and does not withstand skilled analysis.

Encryption in which the same secret key is used for both encryption and decryption. It is fast and suited to bulk data, but both parties must share the key securely.

Encryption using a mathematically related key pair: a public key for encryption or verification and a private key for decryption or signing. It solves key distribution but is slower than symmetric methods.

A symmetric cipher that processes fixed-size chunks of data, such as 128 bits, applying the same keyed transformation to each block. AES and DES are common examples.

A symmetric cipher that encrypts data one bit or byte at a time by combining it with a key-generated pseudorandom keystream. It suits continuous or real-time data flows.

A defined method for applying a block cipher to data longer than one block, such as ECB, CBC, CTR, or GCM. The mode determines error propagation, parallelism, and authentication properties.

A non-secret value used with a cipher mode to randomize encryption so that identical plaintexts produce different ciphertexts. It must be unique per encryption operation.

A value used only once in a cryptographic operation, such as an initialization vector or authentication challenge, to prevent replay and ensure uniqueness of outputs.

The current symmetric block cipher standard, operating on 128-bit blocks with key sizes of 128, 192, or 256 bits. It replaced DES and is widely used for bulk encryption.

An early symmetric block cipher using a 56-bit effective key on 64-bit blocks. Its short key made it vulnerable to exhaustive search, so it was superseded by AES.

A symmetric scheme that applies the DES cipher three times with two or three keys to extend the effective key length. It is legacy and being phased out due to small block size and slow speed.

A one-way algorithm that maps any input to a fixed-length digest. It is used for integrity checks, password storage, and digital signatures, and must resist collisions and preimage attacks.

The fixed-length output produced by a hash function, such as 256 bits from SHA-256. Any change to the input should produce a completely different digest.

The property that a tiny change in input, such as flipping one bit, causes a large and unpredictable change in the output of a cipher or hash.

The property that it should be computationally infeasible to find two different inputs producing the same hash output. Broken collision resistance undermines signatures and integrity proofs.

Random data added to a password before hashing so that identical passwords yield different stored values. It defeats precomputed rainbow tables and identical-hash comparisons.

Deliberately making password hashing slow and resource-intensive, often by repeated iterations, to raise the cost of brute-force guessing. PBKDF2, bcrypt, and Argon2 are examples.

The total set of possible keys for an algorithm, determined by key length. A larger key space makes exhaustive search impractical.

The number of bits in a cryptographic key. It determines the size of the key space and thus resistance to brute-force attack, though algorithm strength also matters.

An attack that systematically tries every possible key or password until the correct one is found. Feasibility depends on key space size and available computing power.

A password-guessing attack that tries lists of common words, leaked passwords, and variations rather than all possible combinations. It is far faster than brute force against weak passwords.

A precomputed table mapping hash values to likely passwords, used to reverse unsalted password hashes quickly. Salting and slow hashing render such tables ineffective.

A classical cryptanalysis technique that uses the statistical frequency of letters or symbols in a language to break substitution ciphers. It defeated many historical ciphers.

A cipher that replaces each plaintext symbol with another symbol according to a mapping, such as the Caesar cipher. Simple substitutions are vulnerable to frequency analysis.

A cipher that rearranges the order of plaintext characters without changing them, such as a columnar transposition. It preserves letter frequencies, so it is often combined with substitution.

A historical substitution cipher that shifts each letter by a fixed number of positions in the alphabet. With only 25 possible shifts, it is trivially broken.

A theoretically unbreakable cipher that combines plaintext with a truly random key as long as the message, used once and kept secret. Practical key distribution makes it rare.

The challenge of securely delivering shared secret keys to communicating parties before symmetric encryption can occur. Asymmetric cryptography and key exchange protocols help solve it.

A protocol allowing two parties to agree on a shared secret over an insecure channel without transmitting it directly, based on the difficulty of the discrete logarithm problem.

An asymmetric algorithm whose security relies on the difficulty of factoring large semiprimes. It supports encryption and digital signatures using a public and private key pair.

Asymmetric cryptography based on the algebraic structure of elliptic curves over finite fields. It provides comparable security to RSA with much shorter keys.

The computational difficulty of finding an exponent given a base and its modular power. It underpins Diffie-Hellman and related schemes.

Arithmetic on remainders after division by a modulus, where numbers wrap around at the modulus value. It is foundational to RSA, Diffie-Hellman, and elliptic curve schemes.

The difficulty of decomposing a large composite number into its prime factors. Its presumed hardness is the basis for RSA security.

A cryptographic value created with a private key that lets anyone verify the signer's identity and confirms the data has not changed. It provides authentication and non-repudiation.

A signed electronic document binding a public key to an identity, issued by a certificate authority. It enables trust in public keys used for encryption and signature verification.

A trusted entity that issues, signs, and revokes digital certificates after verifying identity claims. Browsers and systems rely on trusted authorities to validate public keys.

The policies, roles, and systems used to create, distribute, manage, and revoke digital certificates and public keys. It provides the trust framework for secure electronic transactions.

A protocol that secures network communications by combining asymmetric key exchange with symmetric encryption and integrity checks. It protects web traffic via HTTPS.

A scheme that uses asymmetric cryptography to exchange or wrap a symmetric session key, then uses fast symmetric encryption for the bulk data. TLS and S/MIME work this way.

The lifecycle process of generating, distributing, storing, rotating, revoking, and destroying cryptographic keys. Poor key management defeats even strong algorithms.

An attack that extracts secrets by observing physical or timing characteristics of a system, such as power consumption, electromagnetic emissions, or execution time, rather than breaking the math.

An attack where an adversary secretly relays or alters communications between two parties who believe they are talking directly. Authentication and certificate validation help prevent it.

An attack that captures valid messages and retransmits them later to produce unauthorized effects. Nonces, timestamps, and sequence numbers mitigate it.

An attack exploiting the mathematics of collisions, finding two inputs with the same hash far faster than brute force would suggest. It drives minimum hash length choices.

Computing using quantum mechanical phenomena such as superposition and entanglement. Certain algorithms could break widely used public-key cryptography, motivating post-quantum migration.

A quantum algorithm that can efficiently factor large integers and solve discrete logarithms. A sufficiently large quantum computer running it would break RSA, Diffie-Hellman, and ECC.

A quantum search algorithm that provides a quadratic speedup for unstructured search, effectively halving the security level of symmetric keys and hashes against quantum attack.

Cryptographic algorithms designed to resist attacks by both classical and quantum computers, typically based on lattices, codes, or hashes. Standards are being adopted for migration.

The ability of a system to swap cryptographic algorithms, keys, and protocols without major redesign. It is essential for responding to new attacks and quantum threats.