Information Security
This domain tests confidentiality, integrity, authentication, and availability controls, together with the cryptographic primitives and protocols that implement them. Expect conceptual questions plus small RSA or key-management calculations.
Core rules
- Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) solves key distribution and supports signatures but is slower.
- RSA: choose primes p and q, n = pq, φ(n) = (p−1)(q−1), public exponent e coprime to φ(n), private exponent d with ed ≡ 1 mod φ(n). Encryption is c = m^e mod n; decryption is m = c^d mod n.
- Hashes (SHA-256) provide integrity checks but no key; HMAC adds a shared secret. Digital signatures use the signer's private key and are verified with the public key.
- PKI binds public keys to identities through certificates issued by a certificate authority.
- TLS 1.3 uses ephemeral Diffie–Hellman key exchange for forward secrecy and authenticates the server with a certificate; it removed static RSA key exchange.
- Common attacks include phishing, man-in-the-middle, replay, SQL injection, and credential stuffing. Defence includes least privilege, patching, segmentation, and logging.
Worked example
Let p = 5 and q = 11. Then n = 55 and φ(n) = 4 × 10 = 40. Choose e = 3, which is coprime to 40. Find d: 3 × 27 = 81 = 2 × 40 + 1, so d = 27. Encrypt m = 7: c = 7³ mod 55 = 343 mod 55 = 13, since 55 × 6 = 330. The ciphertext is 13. The private exponent must be kept secret; publishing d would break the scheme.
Traps
- Encrypting with the private key and calling it confidential encryption; that provides signing, not secrecy.
- Confusing a hash with encryption or with a MAC.
- Using a digital signature for confidentiality rather than authenticity and integrity.
- Forgetting that TLS 1.3 dropped RSA key transport.
- Treating a certificate as proof of good behaviour rather than identity binding.