Cyberstudy
PDF p.221 In progress

Cryptographic Vulnerabilities

Open PDF at p.221 22 flashcards

Summary

PDF p.221

Cryptographic vulnerabilities are weaknesses in cryptographic systems, protocols, or algorithms that can be exploited to compromise data. These vulnerabilities are critical because cryptography is essential for secure communication and data protection.

In plain words

Supplementary — not from your PDF

Cryptography fails through weak algorithms or keys (DES's 56-bit key; 3DES and the Sweet32 attack), flawed implementations (Heartbleed in OpenSSL), protocol weaknesses (KRACK in WPA2), outdated cipher suites (BEAST, POODLE against old SSL/TLS), and poor key handling. Kerckhoffs's principle says a system should stay secure even if everything except the key is public, so protecting keys is everything: generate them properly, store them in an HSM or KMS, restrict access, and rotate them.

Detailed explanation

PDF p.221
  • Definition
    • Cryptographic Vulnerabilities: Weaknesses in cryptographic systems, protocols, or algorithms.
    • Impact: Can compromise data security, leading to unauthorized access and data breaches.
  • Examples
    • Heartbleed: Exploited a flaw in the OpenSSL cryptographic library, allowing attackers to read secure communication.
    • KRACK: A vulnerability in the WPA2 protocol that protects Wi-Fi traffic, allowing attackers to intercept and decrypt network traffic.
  • Symmetric and Asymmetric Encryption
    • Symmetric Encryption: Vulnerable to weak keys.
      • Example: DES (Data Encryption Standard) was vulnerable to brute force attacks due to its 56-bit key size.
      • Triple DES (3DES): Initially more secure than DES but later found vulnerable to the "Sweet32" birthday attack.
    • Asymmetric Encryption: Vulnerable if small key sizes are used or if random number generation is weak.
      • Example: RSA can be compromised if the same key pair is used for an extended period.
  • Cipher Suites
    • Definition: Combinations of encryption algorithms used in protocols like SSL/TLS.
    • Examples of Attacks
      • BEAST: Targeted weaknesses in SSL/TLS cipher suites.
      • POODLE: Exploited flaws in SSL and early versions of TLS.
  • Protecting Cryptographic Keys
    • Kerckhoffs's Principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
    • Key Generation: Use industry best practices to ensure keys cannot be guessed or brute-forced.
    • Key Protection: Implement security measures to safeguard keys from unauthorized access.
      • Secure Key Storage: Use hardware security modules (HSMs) or key management systems (KMS).
      • Access Controls: Implement proper access controls and authentication mechanisms.
      • Key Rotation: Periodically change cryptographic keys to combat risks associated with key breaches.

Important terms

taken from the text above
Cryptographic Vulnerabilities
Weaknesses in cryptographic systems, protocols, or algorithms.
Heartbleed
Exploited a flaw in the OpenSSL cryptographic library, allowing attackers to read secure communication.
KRACK
A vulnerability in the WPA2 protocol that protects Wi-Fi traffic, allowing attackers to intercept and decrypt network traffic.
Symmetric Encryption
Vulnerable to weak keys.
Triple DES (3DES)
Initially more secure than DES but later found vulnerable to the "Sweet32" birthday attack.
Asymmetric Encryption
Vulnerable if small key sizes are used or if random number generation is weak.
Cipher Suites
Combinations of encryption algorithms used in protocols like SSL/TLS.
BEAST
Targeted weaknesses in SSL/TLS cipher suites.
POODLE
Exploited flaws in SSL and early versions of TLS.
Kerckhoffs's Principle
A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
Key Generation
Use industry best practices to ensure keys cannot be guessed or brute-forced.
Key Protection
Implement security measures to safeguard keys from unauthorized access.
Secure Key Storage
Use hardware security modules (HSMs) or key management systems (KMS).
Access Controls
Implement proper access controls and authentication mechanisms.
Key Rotation
Periodically change cryptographic keys to combat risks associated with key breaches.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Disabling SSL 3.0 and TLS 1.0 on a web server.
  • Storing signing keys in a hardware security module.
  • Rotating API keys on a regular schedule.

Scenario

A server still offers old cipher suites for compatibility. A configuration review removes them and allows only TLS 1.2 or 1.3 with strong ciphers, closing off downgrade-style weaknesses.

Common mistakes

Supplementary — not from your PDF
  • Relying on secrecy of the algorithm instead of protecting the key (against Kerckhoffs's principle).
  • Using the same key pair indefinitely with no rotation.

Practical skills

Supplementary — not from your PDF
  • Review a server's TLS settings and recommend which protocols and ciphers to disable.

What I should remember

Key Points PDF p.221
  • Definition
    • Cryptographic Vulnerabilities: Weaknesses in cryptographic systems.
    • Impact: Compromise data security.
  • Examples
    • Heartbleed: OpenSSL flaw.
    • KRACK: WPA2 protocol vulnerability.
  • Symmetric and Asymmetric Encryption
    • Symmetric: Weak keys (e.g., DES, 3DES).
    • Asymmetric: Small key sizes, weak random number generation (e.g., RSA).
  • Cipher Suites
    • SSL/TLS Vulnerabilities: BEAST, POODLE.
  • Protecting Cryptographic Keys
    • Kerckhoffs's Principle: Security even if system details are public.
    • Key Generation: Best practices.
    • Key Protection: Secure storage, access controls, key rotation.