eMAPT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

X.509 TBS portion

The to-be-signed fields of a certificate (version, serial, algorithms, issuer, validity, subject, SPKI, extensions) that the CA signs; the signature itself is excluded.

basicConstraints CA flag

Extension marking a certificate as a CA (CA:TRUE) and optionally capping subordinate CA depth via pathLenConstraint; absent or FALSE means the cert cannot issue certificates.

KeyUsage keyCertSign

Bit that permits a CA certificate's key to sign other certificates; without it, a CA-flagged cert must not be used to issue or validate subordinate certificates.

ExtendedKeyUsage serverAuth

EKU OID 1.3.6.1.5.5.7.3.1 indicating the certificate may authenticate a TLS server; clientAuth is .2 and codeSigning is .3.

OCSP stapling

Server presents a CA-signed, time-stamped OCSP response during the TLS handshake, letting clients check revocation without contacting the responder directly and improving privacy and latency.

CRL distribution point

Certificate extension giving the URL of the CRL where revocation status for that certificate is published; clients download and verify the CRL's signature and validity.

Name constraints

CA certificate extension listing permitted and excluded subject name subtrees (DNS, email, IP); a subordinate certificate outside the permitted set fails path validation.

SPKI pinning

Trust-on-first-use or configured check comparing the hash of a server's SubjectPublicKeyInfo against a stored set, surviving certificate renewal when the key is unchanged.

Path length constraint

pathLenConstraint in basicConstraints limits how many non-self-issued intermediate CA certificates may follow this certificate in a valid chain.

Self-signed certificate

Certificate whose issuer and subject are identical and whose signature verifies with its own public key; trusted only if explicitly installed as a trust anchor.

Certificate transparency SCT

Signed Certificate Timestamp is a promise from a log that a certificate was submitted; embedded in the cert or TLS extension, it enables public auditing of issuance.

TLS 1.3 1-RTT handshake

ClientHello with key_share, ServerHello with key_share and cipher suite, then encrypted extensions, certificate, CertificateVerify, and Finished; application keys derive from ECDHE and transcript hash.

TLS 1.3 0-RTT replay

Early data sent with a resumed PSK before the handshake completes; it is replayable by an attacker, so only idempotent requests should use it.

Downgrade sentinel

TLS 1.3 servers place a fixed value in the last bytes of ServerHello.random when negotiating TLS 1.2 or below, letting clients detect version rollback attacks.

TLS_FALLBACK_SCSV

Cipher suite value a client includes when intentionally retrying at a lower TLS version; a capable server rejects the handshake, preventing forced downgrade.

CertificateVerify message

TLS 1.3 handshake message where the server signs the transcript hash with its certificate private key, proving possession and binding the identity to the handshake.

SNI

Server Name Indication extension in ClientHello carrying the target hostname so a server can select the correct certificate; encrypted in TLS 1.3 with ECH.

ALPN

Application-Layer Protocol Negotiation extension lets client and server agree on a protocol (h2, http/1.1) during the TLS handshake without extra round trips.

AEAD cipher

Authenticated encryption with associated data (AES-GCM, ChaCha20-Poly1305) provides confidentiality and integrity in one pass; nonce reuse with the same key is catastrophic.

Incomplete certificate chain

Server sends leaf but omits intermediate CA certificates; clients that lack the intermediate cannot build a path to a trusted root and report an unknown-issuer error.

Session resumption PSK

TLS 1.3 mechanism where a prior session's ticket and PSK let client and server skip full key exchange; binders authenticate the client's PSK identity.

Hostname verification

Client check that the server certificate's subjectAltName (DNS or IP) matches the requested host; CN fallback is deprecated and SAN is authoritative.

HSTS

HTTP Strict-Transport-Security header instructs browsers to use HTTPS only for a host for a set max-age, optionally including subdomains and preload lists.

AES-GCM nonce

96-bit value unique per key for AES-GCM; reuse leaks plaintext relationships and forges tags, so counters or random nonces with key rotation are used.

RSA-OAEP

RSA encryption padding with a hash-based Feistel structure providing semantic security; preferred over PKCS#1 v1.5, which is vulnerable to padding-oracle attacks.

RSA-PSS

Probabilistic RSA signature scheme with salt and mask generation; standardized and preferred over PKCS#1 v1.5 signatures for new deployments.

HKDF

HMAC-based key derivation: Extract(salt, input key material) produces a pseudorandom key, then Expand(info, length) yields domain-separated output keys.

Argon2id

Memory-hard password hashing function combining data-independent and data-dependent passes; winner of the Password Hashing Competition, recommended with per-user salt.

ECDSA nonce reuse

Signing two messages with the same ECDSA nonce k reveals the private key algebraically; deterministic nonces (RFC 6979) or a CSPRNG prevent this.

Encrypt-then-MAC

Composition where ciphertext is authenticated with a MAC over ciphertext and associated data; prevents padding-oracle and chosen-ciphertext attacks better than MAC-then-encrypt.

Forward secrecy

Property where compromise of long-term keys does not reveal past session keys; achieved with ephemeral ECDHE/DHE key exchange and deletion of ephemeral secrets.

JWT alg confusion

Attack exploiting a verifier that trusts the token's alg header, e.g., switching RS256 to HS256 so the public key is used as an HMAC secret; fix by allowlisting algorithms.