- So welcome to Lesson 4 Deep Dive Quiz.
And lesson four was all about explaining the importance
of appropriate cryptographic solutions,
and we did six lessons together.
We did cryptographic primer.
We talked about encryption, symmetric and asymmetric.
We looked at hashing for integrity
and digital signatures for non-repudiation.
Then we looked at where those keys come from
and how we authenticate someone by looking at
and understanding how digital certificates work.
Then we looked at emerging cryptography,
some of which is above our pay grade.
And then we wrapped up talking about steganography.
So now we're gonna do a 10 question quiz together.
Are you ready?
All right, let's get started.
Our first question is a matching question
and it's match the cryptographic techniques and use cases.
Now remember, put me on pause whenever you want.
So when you're ready to answer a question,
put me on pause, work it through.
Hopefully you have a pen and paper together
and, you know, write down your notes
and then come on back
and we'll go through the answers.
So we're gonna match the cryptographic techniques
and use cases.
On the left hand side, we have hashing,
digital certificate, digital signature, and encryption.
Those were the techniques we talked about.
On the right we have authentication, non-repudiation,
integrity, and confidentiality.
Those are our use cases.
So let's match 'em up.
Starting with hashing.
Hashing was, do you recall?
Hashing was integrity.
Next we have our digital certificates.
Remember, that's where we get our keys from
and that's where we say who we are, right?
And our certificate authority verifies that.
So that's gonna be authentication.
Next one, digital signatures.
Remember a digital signature is when we encrypt
a hash with our private key, and that proves
that that message came from us or me in this case.
So it would be non-repudiation.
And that leaves us with the one we knew right away anyway,
which is encryption for confidentiality.
So hashing for integrity,
digital certificates for authentication,
digital signatures for non-repudiation,
and encryption for confidentiality.
Is that what you had?
Do you agree?
Let's check it out and it's correct.
Awesome, let's move on.
The AES algorithm requires this number of keys
to encrypt and decrypt a message block.
Two, four, one, or three.
So what did you need to know in this question?
Well, you needed to know what type
of algorithm, symmetric or asymmetric, AES was.
And I'll give you a hint.
Okay, AES is a block cipher
and it is a current U.S. government standard.
Nah, but I'm not telling you for which.
So symmetric or asymmetric, once you recall that,
then you'll know the right number of keys.
Are you ready for an answer?
All right, I'm gonna choose one
because AES also known as Rijndael,
is the U.S. government standard for symmetric encryption.
And for symmetric encryption, we only use one key,
the same key to lock and unlock
encrypt and decrypt and encrypt and decrypt back and forth,
the same key.
Let's check.
And there we go, we are correct.
All right, moving on to question three.
Mary wants to securely transmit a session key to Bob.
What type of algorithm and cryptovariable should she use?
So she wants to get a session key to Bob.
She wants to securely transmit it.
She wants to make sure, right, that only Bob,
only Bob will be able to get that session key.
So what type of algorithm is she gonna use
and what cryptovariable is she gonna use?
Should she use Bob's public key and a asymmetric algorithm,
Mary's private key and a symmetric algorithm,
Mary's public key and an asymmetric algorithm,
or Bob's private key and symmetric algorithm?
Now some of these you should be able to
just use a process of elimination and just get rid of,
'cause we know that asymmetric requires two keys
and symmetric requires just one key.
This is a good one to put me on pause,
read through these again, and tell me what type of algorithm
and cryptovariable she should use of the choices given.
Well, I like the first one.
So she can use Bob's public key and an asymmetric algorithm.
Remember asymmetric, it says we're gonna have
two keys mathematically related.
Now, why is she gonna use Bob's public key?
Because what's the corresponding key to Bob's public key?
Well, Bob's private key.
And who should have a copy of Bob's private key?
Only Bob.
So when Bob got that session key, encrypted session key,
Bob would be the only one who could decrypt it.
Why wouldn't she use her private key
in a symmetric algorithm?
Well, symmetric says we only use one key,
so that answer doesn't make any sense.
Why not use her public key and an asymmetric algorithm?
Because that means the corresponding key
would be her private key
and Bob should never have Mary's private key.
And why wouldn't she use Bob's private key
in a symmetric algorithm?
Again, symmetric only means one key,
so you wouldn't have two.
But she also would never have Bob's private key.
So the answer we're looking for is Bob's public key
and an asymmetric algorithm.
You like it?
Let's check it out.
And it is correct.
Question four, this term applied to a weak crypto component.
Exploitable, deprecated,
broken, or downgraded.
So it's a weak crypto component.
Is this exploitable, deprecated, broken or downgraded?
Go ahead, make your choice.
So it's a weak component.
I'm gonna choose deprecated.
Deprecated means that it is weak, that it carries risk.
Broken means it has been exploited, right?
Exploitable also means it's been exploited.
And downgraded isn't really a term
that we would apply to a weak crypto component.
So deprecated is my choice.
Is it yours?
All right, let's check.
And that is correct.
Question five, which statement is not true,
so not is the important word here,
not true about a hash message authentication code
or an HMAC?
And HMAC cannot be reproduced without knowing the key.
An HMAC provides integrity and origin authentication.
An HMAC is used by TLS and IPsec.
And the input for an HMAC is a concatenated message
and an asymmetric key.
Three of those statements are true and one is not.
And it's really important, again,
when you're reading your questions
to look for words like best and least and most likely
and true and false and not, right?
If you read this too quickly said, which is true
and then just chose the first answer, you came to,
well you'd have the wrong answer.
So we're asking you which one is not true.
Go ahead put me on pause
if you wanna read through those again.
Well, let's talk through these.
An HMAC cannot be reproduced without knowing the key.
That's true, because an HMAC, right,
is going to be the message and a symmetric key,
so you have to know the key.
An HMAC provides integrity, which it does, right.
Hashing provides integrity and origin authentication,
it does because of the symmetric key that we're inserting.
An HMAC is used by TLS and IPsec.
That's also true.
Our last choice, the input for an HMAC
is a concatenated message and an asymmetric key.
And that's gonna be our false one.
That's the one that's not true.
We use a symmetric key.
So that's the one I'm gonna choose.
Do you agree?
Let's check it out.
And that is correct.
Question six, we're doing great here.
Which authority issues and revokes digital certificates?
Which authority issues and revokes digital certificate?
Is this an issuing authority, a registration authority,
a validation authority, or a certificate authority?
Now two of these answers are absolutely made up names.
So hopefully you recognize those
and just scratch 'em right out.
But two are authorities that are used
in digital certificates, but for different reasons.
I wanna know which one issues
and revokes digital certificates: an issuing,
a registration, a validation, or a certificate.
Put me on pause if you wanna think about it.
Well, I'm gonna choose our CA, our certificate authority.
Issuing authority, I think it's a made up term.
Registration authority does the administrative work
on behalf of a certificate authority.
Validation authority, that's another made up term.
Certificate Authority is the one who issues
and revokes our digital certificates.
Let's check it out.
And that is correct.
Question seven, which protocol should be used
to verify the status of an extended validation certificate?
OSPF, OCSP,
CRL, or CRC.
So you will need to know abbreviations
and acronyms for the exam.
So once again, OSPF, OCSP, CRL, or CRC.
You might wanna use the process of elimination,
if you know what some of the other ones are
and you're not sure what the right answer is.
I'm gonna choose OCSP.
Do you agree?
Let's check.
And that is correct.
Question eight, we have a matching.
Oh, this one is about
our emerging cryptographic applications and descriptions.
On the right hand side
we have homomorphic, quantum, and lightweight.
On the right hand side our descriptions are:
supports low power devices
with low latency and high resiliency requirements,
or requires immense computing power to
solve mathematical problems,
or allows data being processed to remain encrypted.
So we need to match them up.
Well, let's start on the right hand side this time.
Supports low powered devices with low latency
and high resiliency.
Homomorphic, quantum or lightweight?
Ah, I think it's lightweight also.
Allows data being processed to remain encrypted.
Homomorphic or quantum?
I'm going with homomorphic,
and that just leaves my last choice,
requires immense computing power
to solve mathematical problems.
That's gonna be quantum.
So homomorphic allows data being processed
to remain encrypted.
Quantum requires immense computing power
to solve mathematical problems.
And lightweight supports low power devices
with low latency and high resiliency requirements.
Do you agree?
All right, we'll check and it is correct.
Number nine, I want you to choose the attributes
that apply to symmetric encryption.
So all these attributes, which there's a whole list here,
some of them apply to symmetric.
I want you to choose which ones
and you can choose as many as you think apply.
Single key, secure key exchange,
scalable, U.S. government standard is ECC,
U.S. government standard is AES, processor intensive,
mathematically related keys, or a session key.
So which one of these attributes apply to symmetric?
This is definitely a great place to put me on pause,
read through them,
choose as many as you think are right.
All right, let's go through them.
Well, I'm gonna choose single key
because symmetric uses one key.
Remember the same key to lock and unlock,
encrypt and decrypt.
We know that one of the problems
with symmetric is the key exchange is not secure.
I have to find a way to get you the key.
It's not scalable
because I have to have a different key
with everyone I'm communicating with.
The U.S. government standard is ECC.
Well that ECC is
the U.S. government standard for asymmetric.
The U.S. government standard is AES.
I'm going to choose that one
because the U.S. government standard
for symmetric encryption is AES, also known as Rijndael.
It's not processor intensive.
We don't have mathematically related keys
'cause we only have one key for symmetric.
And if we're using that key just one time for one session,
it is referred to as a session key.
So I chose three of them.
The single key, U.S. government standard is AES,
and a session key.
The other one, secure key exchange, scalable,
ECC, processor intensive,
and mathematically related keys
all describe asymmetric encryption.
Let's check it out,
and that's correct.
All right, we're gonna move on to our last question.
What is the most likely non-cryptographic data control
associated with this image?
Steganography, encryption, hashing or abstraction?
So right away you should be able to eliminate two answers
because the question I asked you
was a non-cryptographic data control
and you know that two of those are cryptographic.
So right away you should have been able to scratch two out
and then you have two left.
And I want you to make your choice.
We have a picture here, right?
What is the most likely non-cryptographic data control
associated with this image?
I'm gonna choose steganography.
Remember, steganography is where we hide a message
and we can hide a message
in a graphic or a picture like we're seeing here.
We can hide it in audio, we can hide it in video,
we can even hide it inside other text.
And that's the example I gave you yesterday
of where we actually added a little text file
into a picture.
Do you like it?
All right, let's check.
And that would be correct.
Well, fantastic.
You did a great job.
10 questions, we got right through them.
I hope you enjoyed doing this.
That's a good review for you.
So what's up next?
Well, we're going right into
Module 2 Threats, Vulnerabilities, and Mitigation,
starting with Lesson 5.1 Threat Actors and Attributes.
I'll see you there.