EECC cheat sheet

Kerckhoffs's principle: security must rest on the key alone; the algorithm is assumed public.

Confidentiality, integrity, authentication, and non-repudiation are the four standard security goals; encryption alone delivers only confidentiality.

Classical substitution (monoalphabetic) preserves letter frequency; frequency analysis breaks it. Vigenère (polyalphabetic) resists simple frequency counting but falls to Kasiski examination and index of coincidence.

One-time pad is information-theoretically secure (Shannon) only if the key is truly random, as long as the message, used once, and kept secret; it provides no integrity.

Product vs. super-encryption: applying two ciphers in sequence is not automatically stronger; meet-in-the-middle shows double encryption with an n-bit key gives about n+1 bits of strength.

Encoding is not encryption: Base64 and hex are reversible without a key and provide no confidentiality.

Cryptographic primitives map to goals: block ciphers/stream ciphers to confidentiality, hashes and MACs to integrity, signatures to authentication and non-repudiation.

Shannon's confusion and diffusion: confusion obscures the key-ciphertext relationship (substitution), diffusion spreads plaintext influence across ciphertext (permutation).

AES: 128-bit block, key sizes 128/192/256, 10/12/14 rounds; each round has SubBytes, ShiftRows, MixColumns, AddRoundKey (final round omits MixColumns).

DES: 64-bit block, 56-bit effective key, 16 Feistel rounds; 3DES uses EDE with 2 or 3 keys giving 112 or 168 bits of strength (2-key 3DES ~112).

Modes: ECB leaks patterns (never use for multi-block data); CBC needs a random IV and is sequential; CTR turns a block cipher into a stream cipher and allows parallelism.

AEAD modes (GCM, CCM, ChaCha20-Poly1305) provide confidentiality plus integrity in one pass; GCM must never reuse a nonce with the same key, or both confidentiality and the authentication key are broken.

Padding oracle attacks (POODLE-style, CBC padding) exploit distinguishable padding errors; use encrypt-then-MAC or an AEAD mode to avoid them.

Stream ciphers XOR a keystream with plaintext; keystream reuse across two messages reveals the XOR of the plaintexts. RC4 is deprecated due to keystream biases.

Key distribution problem: symmetric ciphers need a shared secret, so n parties require n(n-1)/2 keys; this motivates asymmetric key exchange.

RSA: n = pq, phi(n) = (p-1)(q-1), ed ≡ 1 mod phi(n); public key (e, n), private key (d, n). Security rests on integer factorization.

RSA encryption of message m: c = m^e mod n; decryption m = c^d mod n. Textbook RSA is deterministic and must be wrapped with OAEP padding.

Diffie-Hellman: public values g, p; shared secret = (g^b)^a = (g^a)^b mod p. Security rests on the discrete logarithm problem; unauthenticated DH is vulnerable to man-in-the-middle.

Elliptic curve cryptography: security based on the elliptic curve discrete log problem; a 256-bit ECC key gives roughly the strength of a 3072-bit RSA key.

Key sizes for ~112-bit security: RSA/DH >= 2048 bits, ECC >= 224 bits, AES >= 128 bits (NIST SP 800-57).

Asymmetric ciphers are slow and size-limited (RSA can encrypt at most k - padding bytes), so they are used for key transport/wrapping, not bulk data.

Hybrid encryption: encrypt a random symmetric session key with the recipient's public key, then encrypt the payload with that session key (TLS, S/MIME, PGP).

Hash properties: preimage resistance, second-preimage resistance, collision resistance; collision resistance is the hardest and determines birthday-bound strength (n/2 bits for an n-bit hash).

SHA-1 produces 160 bits and is broken for collisions (SHAttered); SHA-256/SHA-3 are current. MD5 is collision-broken and must not be used for security.

A hash alone gives integrity only if the digest is protected; an attacker who can alter both message and digest defeats a bare hash. Use a MAC or signature.

HMAC = H((K' XOR opad) || H((K' XOR ipad) || message)); it is a keyed MAC built on any hash and resists length-extension attacks.

Length-extension attack: given H(m), an attacker can compute H(m || padding || x) for Merkle-Damgard hashes without knowing m; HMAC and SHA-3 (sponge) are not vulnerable.

MAC provides integrity and authenticity between parties sharing a key but not non-repudiation, because both parties hold the key.

Password storage: use salted, slow KDFs (bcrypt, scrypt, Argon2, PBKDF2) rather than fast hashes; salts defeat rainbow tables and per-user salts defeat precomputation.

X.509 certificate binds a subject identity to a public key and is signed by a CA; fields include serial number, issuer, validity period, subject, public key, and extensions.

Chain of trust: leaf (end-entity) cert -> intermediate CA(s) -> trusted root in the trust store. Validation checks signature chain, validity dates, name match, and revocation.

Revocation: CRL is a signed list published periodically; OCSP queries status in real time; OCSP stapling embeds a fresh response in the TLS handshake.

Certificate extensions: basicConstraints CA:TRUE marks a CA; keyUsage and extendedKeyUsage restrict purpose; subjectAltName lists DNS names validated by browsers.

CA/Browser Forum Baseline Requirements govern public TLS certs: maximum validity has been progressively reduced (currently 398 days for publicly trusted TLS certificates).

Cross-certification and bridge CAs link separate hierarchies; a compromised intermediate can issue trusted certs until revoked, so pinning and CT logs add defense.

Certificate Transparency: public append-only logs of issued certs let domain owners detect mis-issuance; SCTs may be required by browsers.

A signature is produced with the signer's private key and verified with the public key; it provides integrity, authenticity, and non-repudiation but not confidentiality.

RSA signatures use PKCS#1 v1.5 or PSS padding; ECDSA and EdDSA (Ed25519) are elliptic-curve schemes. ECDSA requires a unique, unpredictable nonce k; reuse leaks the private key.

Sign-then-hash: sign H(message), not the raw message, for efficiency and to avoid forgery pitfalls of raw RSA signing.

Key management lifecycle: generation, distribution, storage, rotation, archival, and destruction. Private keys should be stored in HSMs or TPMs and never exported in plaintext.

Key escrow (recovery) lets a third party recover keys; key recovery vs. key backup differ in who can access the key and under what authority.

Forward secrecy (ephemeral DH/ECDHE) ensures compromise of a long-term key does not decrypt past sessions; static RSA key transport lacks it.

Separation of duties: the same key should not be used for both signing and encryption; use distinct key pairs and enforce via keyUsage.

TLS 1.3 handshake: ClientHello with key_share -> ServerHello with key_share -> finished; uses (EC)DHE for forward secrecy, AEAD ciphers only, and encrypts the certificate; removes RSA key transport and CBC modes.

TLS 1.2 vs 1.3: 1.2 allows RSA key exchange and CBC; 1.3 mandates (EC)DHE and AEAD (AES-GCM, ChaCha20-Poly1305), reducing legacy attack surface.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity. IKE negotiates SAs; transport mode protects host-to-host, tunnel mode gateway-to-gateway.

SSH uses Diffie-Hellman key exchange, host keys for server authentication, and per-session symmetric keys; known_hosts pins server keys against MITM.

S/MIME and PGP provide email confidentiality and signatures; neither protects the envelope (From/To/Subject) unless the message body is fully encrypted.

Kerberos: symmetric ticket-based authentication with a KDC; tickets are time-limited and encrypted; clock skew and KDC compromise are key risks.

Wireless: WPA2 uses AES-CCMP with a 4-way handshake; WPA3 uses SAE to resist offline dictionary attacks on captured handshakes.

Attack classes by access: ciphertext-only < known-plaintext < chosen-plaintext < chosen-ciphertext; each stronger access lowers the effort needed.

Brute force on an n-bit key costs about 2^(n-1) expected trials; birthday attack finds a collision in an n-bit hash in about 2^(n/2) work.

Side-channel attacks exploit timing, power, cache, or electromagnetic leakage rather than algorithm weakness; constant-time implementations and blinding mitigate them.

Fault attacks induce errors during computation (e.g., RSA-CRT) to recover keys; countermeasures include result verification and redundancy.

Padding oracle (Vaudenay) and Bleichenbacher attacks exploit distinguishable error responses; uniform error handling and AEAD mitigate them.

Meet-in-the-middle reduces double encryption from 2^(2n) to about 2^(n+1); triple encryption with independent keys restores ~2n-bit strength.

Social/implementation attacks (phishing, keylogging, misconfigured storage, default keys) often bypass cryptography entirely; threat models must include them.

FIPS 140-2/140-3 validates cryptographic modules at security levels 1-4; FIPS 197 defines AES, FIPS 180-4 defines SHA-1/SHA-2, FIPS 186-5 defines DSA/ECDSA/RSA signatures.

NIST SP 800-57 governs key management and cryptoperiods; SP 800-131A defines algorithm transitions (e.g., disallowing SHA-1 for signatures, restricting 1024-bit RSA/DH).

PCI DSS requires strong cryptography for cardholder data in transit and at rest, key management procedures, and prohibits deprecated algorithms (SSL, early TLS, WEP).

GDPR and HIPAA do not mandate specific algorithms but require appropriate technical measures; encryption is often cited as a safe-harbor for breach notification.

Common Criteria (ISO/IEC 15408) and FIPS 140 are distinct: CC evaluates a target of evaluation against a protection profile; FIPS validates the module's cryptographic implementation.

Post-quantum guidance: NIST selected ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205); hybrid classical/PQ deployment is the recommended transition path.

Crypto agility: design systems to swap algorithms and key sizes without redesign, since standards and deprecation timelines change over time.