Cryptographic Protocols and Applications
Cryptographic Protocols and Applications
This domain tests how primitives are composed into protocols, and which version fixes which weakness.
Protocols to know
- TLS. TLS 1.2 offers RSA key transport or (EC)DHE, with CBC or GCM suites. TLS 1.3 removed static RSA and static DH key exchange, removed CBC and RC4, kept only AEAD, and cut the handshake to one round trip with forward secrecy by default.
- IPSec. AH provides integrity and authentication but no confidentiality; ESP provides confidentiality plus optional integrity. Transport mode protects host-to-host payloads; tunnel mode protects whole packets between gateways. IKEv2 negotiates security associations.
- Kerberos. A KDC issues a TGT, then service tickets. It relies on synchronized clocks and symmetric keys derived from passwords.
- Email and messaging. S/MIME and PGP combine symmetric encryption of the body with asymmetric protection of the session key. Signal's Double Ratchet provides forward secrecy and post-compromise security.
- Wireless. WEP (RC4 + CRC32) is broken; WPA2 uses the 4-way handshake with CCMP/AES; WPA3 replaces the PSK handshake with SAE to resist offline dictionary attacks.
Worked example
A client opens a TLS 1.3 connection. It sends a ClientHello with a key_share for a DHE group. The server replies with its key_share and certificate; both sides run HKDF over the shared secret to derive handshake keys. The server's Finished message is already encrypted and integrity-protected. Because the exchange used ephemeral DH, a later compromise of the server's private key does not decrypt recorded sessions.
Traps
- Believing TLS protects data at rest; it protects data in transit.
- Assuming IPSec AH encrypts payloads.
- Supposing a strong cipher rescues a broken handshake (WEP, FREAK, Logjam).
- Forgetting that Kerberos fails when clocks drift beyond the skew tolerance.
- Mixing up transport and tunnel mode.