Security and Cryptography
Security and Cryptography tests threat modeling and primitives: confidentiality, integrity, authentication, and the protocols that combine them.
Core rules
- CIA triad: confidentiality, integrity, availability; add authentication and nonrepudiation where relevant.
- Symmetric encryption (AES) is fast but needs key distribution. Asymmetric encryption (RSA, ECC) solves distribution but is slow; it typically wraps a symmetric session key.
- Cryptographic hashes are one-way and collision-resistant (SHA-256); a MAC (HMAC) adds a shared key for integrity and authenticity. Digital signatures use a private key and are verified with the public key.
- Never use ECB for multi-block data; it leaks patterns. Use authenticated modes such as GCM or encrypt-then-MAC.
- PKI binds identities to public keys via certificates signed by a CA. TLS combines key exchange, certificates, and authenticated encryption.
- Access control models: DAC, MAC, RBAC, ABAC.
Worked example
RSA with p=61, q=53 gives n=3233 and φ(n)=60×52=3120. Choose e=17 (coprime to 3120). Find d with 17d ≡ 1 mod 3120; d=2753 because 17×2753=46801=15×3120+1. Encrypt m=65: c=65^17 mod 3233=2790. Decrypt: 2790^2753 mod 3233=65. This toy key is insecure; real RSA uses 2048+ bits and padding.
Hash example: a server stores SHA-256(password + salt). A stolen database does not reveal passwords directly, but fast hashes are vulnerable to GPU guessing; use a memory-hard password hash (Argon2, scrypt, bcrypt).
Traps
- Treating encryption as integrity protection.
- Reusing IVs/nonces in stream or GCM modes.
- Confusing digital signatures with MACs (signature gives public verifiability).
- Assuming HTTPS alone prevents XSS.