EUC-EO cheat sheet

Confidentiality, integrity, authentication, and non-repudiation are the four core security services; encryption primarily delivers confidentiality.

Kerckhoffs's principle: security must rest on the secrecy of the key, not the secrecy of the algorithm.

Classical substitution preserves frequency patterns; polyalphabetic ciphers (Vigenère) flatten them, and one-time pads are unbreakable only if truly random, as long as the message, and never reused.

Symmetric cryptography uses one shared secret key and scales as n(n-1)/2 keys for n parties; asymmetric cryptography uses key pairs and scales as 2n keys.

Confusion obscures the relationship between key and ciphertext; diffusion spreads plaintext influence across the ciphertext. Substitution gives confusion, permutation gives diffusion.

Cryptographic primitives map to goals: ciphers for confidentiality, hashes for integrity, MACs for integrity plus authentication, signatures for authentication plus non-repudiation.

Stream ciphers XOR a keystream with plaintext bit by bit; reusing a keystream across two messages leaks the XOR of the plaintexts.

Work factor measures the effort to break a system; a cipher is computationally secure when that effort exceeds the attacker's resources.

DES uses a 64-bit block and 56-bit effective key; 3DES with three independent keys gives about 112 bits of strength against meet-in-the-middle.

AES is a 128-bit block cipher with 128, 192, or 256-bit keys; 10, 12, and 14 rounds respectively.

ECB is deterministic and leaks plaintext patterns; it is unsuitable for data longer than one block or for structured data.

CBC requires a unique unpredictable IV and chains ciphertext blocks; errors propagate to one block plus the next.

CTR turns a block cipher into a stream cipher; the counter must never repeat under the same key, and no padding is needed.

GCM provides authenticated encryption with associated data; nonce reuse under one key destroys both confidentiality and integrity.

Padding oracle attacks (POODLE, Lucky13) exploit distinguishable error responses to CBC padding; encrypt-then-MAC or AEAD prevents them.

Meet-in-the-middle on double encryption costs roughly 2^(k+1) time and memory, so 2DES adds little over single DES.

RSA security rests on integer factorization; key size recommendations start at 2048 bits, with 3072 bits for longer horizons.

ECC achieves comparable strength with far smaller keys: a 256-bit curve is roughly equivalent to a 3072-bit RSA key.

Diffie-Hellman and ECDH provide key agreement only; they give no authentication unless bound to identities via certificates or signatures.

Encrypt with the recipient's public key, sign with the sender's private key; the reverse operations are wrong and give no security.

A PKI hierarchy runs root CA, intermediate CA, and end entity; a root is trusted because it is in the trust store, not because it is self-signed alone.

Certificate fields include subject, issuer, validity period, public key, serial number, and extensions such as key usage and basic constraints.

Certificate revocation uses CRLs (periodic, bulky) or OCSP (online, real time); OCSP stapling lets the server supply a signed response.

RSA must use padding such as OAEP for encryption and PSS for signatures; textbook RSA is deterministic and malleable.

A cryptographic hash is one-way, collision resistant, and preimage resistant, and maps arbitrary input to a fixed-length digest.

SHA-256 outputs 256 bits; SHA-1 and MD5 are broken for collision resistance and must not be used for signatures or integrity.

Birthday bound: collisions in an n-bit hash are expected near 2^(n/2) attempts, so 128-bit digests give about 64-bit collision resistance.

A MAC combines a key and a message hash; HMAC is the standard construction and resists length-extension attacks that plain hash(key||message) allows.

Hashes provide integrity evidence but not authentication on their own; an attacker who can alter the message can also recompute the digest.

Salting defeats precomputed rainbow tables; it does not slow guessing, so password storage also needs a slow KDF such as bcrypt, scrypt, or Argon2.

Length-extension attacks affect Merkle-Damgård hashes (MD5, SHA-1, SHA-256); SHA-3 uses a sponge construction and is not vulnerable.

Comparing digests or MACs must be constant-time to avoid timing side channels that leak byte-by-byte matches.

A signature is produced by hashing the message and encrypting or transforming the digest with the signer's private key; verification uses the public key.

Signatures give integrity, authentication, and non-repudiation; they do not by themselves provide confidentiality.

DSA and ECDSA require a fresh random nonce k per signature; reusing k across two signatures reveals the private key, as in the Sony PS3 and Bitcoin wallet failures.

EdDSA (Ed25519) is deterministic and avoids the nonce-reuse pitfall while providing strong performance.

X.509 v3 is the dominant certificate format; chain validation checks signatures, validity dates, key usage, basic constraints, and revocation.

Certificate pinning restricts which keys or CAs are acceptable for a host, reducing exposure to rogue or compromised CAs.

A CSR carries the subject public key and requested attributes and is signed by the corresponding private key to prove possession.

Code signing and document signing bind an identity to a hash of the artifact; any change to the artifact invalidates the signature.

Key lifecycle phases: generation, distribution, storage, use, rotation, archival, and destruction, each with its own controls.

Keys must be generated from a cryptographically secure random number generator; predictable seeds collapse effective key strength.

Key wrapping encrypts a data key under a key-encryption key; envelope encryption limits how much data sits under one root key.

Perfect forward secrecy requires ephemeral key agreement per session; compromise of the long-term key then does not expose past sessions.

HSMs and TPMs protect keys so they never appear in ordinary memory; key custodians and split knowledge implement dual control.

Key escrow and recovery conflict with non-repudiation and must be scoped carefully to avoid weakening the whole system.

Zeroization must overwrite or destroy key material; deleting a file pointer does not erase key bytes from storage media.

Deriving keys from passwords requires a salt and a slow KDF; a single fast hash is insufficient against offline guessing.

TLS 1.3 removes RSA key transport and static DH, mandates forward secrecy, and cuts the handshake to one round trip.

TLS handshake: negotiate parameters, authenticate the server via certificate, derive session keys, then exchange encrypted records.

IPSec uses IKE for key exchange and AH for integrity or ESP for encryption plus integrity; transport mode protects payloads, tunnel mode protects whole packets.

SSH host keys authenticate the server, user keys or passwords authenticate the client, and the session runs over an encrypted channel after key exchange.

S/MIME uses X.509 certificates and a PKI hierarchy; PGP uses a web of trust and bundles public keys with user IDs and signatures.

Both S/MIME and PGP encrypt with a symmetric session key and encrypt that key with the recipient's public key, a hybrid scheme.

Downgrade attacks such as POODLE exploit fallback to weaker versions; disabling legacy protocols and using strict version negotiation mitigates them.

STARTTLS upgrades a plaintext channel in place and is vulnerable to stripping if the client does not enforce TLS.

Steganography hides the existence of a message; cryptography hides its content. Combining both hides content and presence.

Common carriers are image LSBs, audio samples, video frames, and whitespace or metadata in text and file formats.

LSB embedding changes the least significant bit of carrier values; it survives casual inspection but not compression or resizing.

Capacity, imperceptibility, and robustness trade off; higher payloads increase detectable distortion.

Steganalysis detects hidden payloads via statistical anomalies, chi-square tests on LSB distributions, and compression history.

Watermarking and fingerprinting embed ownership or tracing marks; they prioritize robustness over secrecy of the mark's existence.

JPEG re-encoding destroys fragile LSB payloads, so robust schemes use transform-domain coefficients such as DCT.

Covert channels exploit protocol or timing behavior rather than file content and are harder to detect than payload embedding.

Ciphertext-only, known-plaintext, chosen-plaintext, and chosen-ciphertext attacks differ in what the attacker controls; modern proofs assume chosen-input attacks.

Brute force cost scales with key space; a 128-bit key is infeasible, while 56-bit DES is exhaustible with specialized hardware.

Side-channel attacks observe timing, power, cache, or electromagnetic leakage rather than breaking the math; constant-time code and blinding mitigate them.

Fault injection and differential fault analysis force erroneous computation to extract keys; redundancy checks and hardware shielding mitigate them.

Padding oracles and Bleichenbacher-style attacks exploit error differences in RSA or CBC padding; uniform errors and AEAD close them.

Man-in-the-middle attacks intercept key exchange; certificate validation and authenticated key agreement prevent them.

Replay attacks resend captured valid messages; nonces, timestamps, and sequence numbers provide freshness.

Weak randomness, reused nonces, and hard-coded keys are the most common real-world failures, more often than mathematical breaks.