Nonce

https://en.wikipedia.org/wiki/Cryptographic_nonce

A nonce is an arbitrary number that can be used just once in a cryptographic communication. It is

similar in spirit to a nonce word, hence the name. It is often a random or pseudo-random number

issued in an authentication protocol to ensure that old communications cannot be reused in replay

attacks.

IPSec has two different modes: transport mode and tunnel mode.

Only the tunnel mode can be used

https://en.wikipedia.org/wiki/IPsec

In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a

new IP packet with a new IP header. Tunnel mode is used to create virtual private networks for

network-to-network communications (e.g. between routers to link sites), host-to-network

communications (e.g. remote user access) and host-to-host communications (e.g. private chat).

Incorrect answers:

Encapsulating Security Payload (ESP) authentication must be used. ESP in transport mode does not

provide integrity and authentication for the entire IP packet. However, in Tunnel Mode, where the

entire original IP packet is encapsulated with a new packet header added, ESP protection is afforded

to the whole inner IP packet (including the inner header) while the outer header (including any outer

IPv4 options or IPv6 extension headers) remains unprotected.

IPSec does not involve gateways. Wrong.

Only transport mode can be used. Transport mode, the default mode for IPSec, provides for end-to-

end security. It can secure communications between a client and a server. When using the transport

mode, only the IP payload is encrypted.

Hash

https://en.wikipedia.org/wiki/Hash_function

A hash function is any function that can be used to map data of arbitrary size to fixed-size values.

VeraCrypt

https://en.wikipedia.org/wiki/VeraCrypt

VeraCrypt is a source-available freeware utility used for on-the-fly encryption (OTFE). It can create a

virtual encrypted disk within a file or encrypt a partition or (in Windows) the entire storage device

with pre-boot authentication.

Incorrect answers:

PGP - designed by Phil Zimmerman as a freeware e-mail security program and was released in 1991.

It was the first widespread public key encryption program.

VPN - A virtual private network (VPN) extends a private network across a public network and enables

users to send and receive data across shared or public networks as if their computing devices were

directly connected to the private network. Applications running across a VPN may therefore benefit

from the functionality, security, and management of the private network. Encryption is a common,

although not an inherent, part of a VPN connection

Cryptool - an open-source project that focuses on the free e-learning software CrypTool illustrating

cryptographic and cryptanalytic concepts. According to "Hakin9", CrypTool is worldwide the most

widespread e-learning software in the field of cryptology.

Finding any method that is more efficient than brute force.

https://en.wikipedia.org/wiki/Cryptanalysis

Bruce Schneier notes that even computationally impractical attacks can be considered breaks:

"Breaking a cipher simply means finding a weakness in the cipher that can be exploited with a

complexity less than brute force. Never mind that brute-force might require 2^128 encryptions; an

attack requiring 2^110 encryptions would be considered a break...simply put, a break can just be a

certificational weakness: evidence that the cipher does not perform as advertised."

IV

https://en.wikipedia.org/wiki/Initialization_vector

In cryptography, an initialization vector (IV) or starting variable (SV) is a fixed-size input to a

cryptographic primitive that is typically required to be random or pseudorandom. Randomization is

crucial for encryption schemes to achieve semantic security, a property whereby repeated usage of

the scheme under the same key does not allow an attacker to infer relationships between segments

of the encrypted message. For block ciphers, the use of an IV is described by the modes of operation.

Randomization is also required for other primitives, such as universal hash functions and message

authentication codes based thereon.

Incorrect answers:

L2TP - PPTP combined with L2F (Layer 2 Forwarding) (Cisco proprietary protocol) - Uses EAP, CHAP,

MS-CHAP, PAP, or S-PAP for authentication. IPSec is used to provide encryption.

Salt - random bits of data intermixed with the message that is to be hashed.

Nonce - an arbitrary number that can be used just once in a cryptographic communication. It is

similar in spirit to a nonce word, hence the name. It is often a random or pseudo-random number

issued in an authentication protocol to ensure that old communications cannot be reused in replay

attacks. They can also be useful as initialization vectors and in cryptographic hash functions.

Correct answers: One-way, Fixed length output

https://en.wikipedia.org/wiki/Cryptographic_hash_function

A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size (often

called the "message") to a bit array of a fixed size (the "hash value", "hash", or "message digest"). It

is a one-way function, that is, a function which is practically infeasible to invert.

Incorrect answers:

Symmetric. Cryptographic algorithms can be categorized into three classes: Hash functions,

Symmetric and Asymmetric algorithms. Differences: purpose and main fields of application.

Requires a key. Well, technically, this is the correct answer. But in the hash-function, “key” is input

data.

Fast. Fast or slow is a subjective characteristic, there are many different algorithms, and here it is

impossible to say this unambiguously like "Symmetric encryption is generally faster than asymmetric

encryption."

X.509 https://en.wikipedia.org/wiki/X.509 In cryptography, X.509 is a standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secure protocol for browsing the web. They are also used in offline applications, like electronic signatures. An X.509 certificate contains a public key and an identity (a hostname, or an organization, or an individual), and is either signed by a certificate authority or self-signed. When a certificate is signed by a trusted certificate authority, or validated by other means, someone holding that certificate can rely on the public key it contains to establish secure communications with another party, or validate documents digitally signed by the corresponding private key. Incorrect answers: RSA - (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data transmission. ElGamal - asymmetric key encryption algorithm for public-key cryptography which is based on the Diffie–Hellman key exchange. It was described by Taher Elgamal in 1985. PAP - used to authenticate users, but is no longer used because the information was sent in cleartext.

CRL

https://ru.wikipedia.org/wiki/Certificate_Revocation_List

Certificate Revocation List (or CRL) is "a list of digital certificates that have been revoked by the

issuing certificate authority (CA) before their scheduled expiration date and should no longer be

trusted".

Incorrect answers:

RA - Used to proxy the certificate requests on behalf of the user and validate whether or not they are

legitimate instead of having the user go directly to the CA. The RA talks to the subordinate CA on

behalf of the user, which makes it harder for the actor to get directly to the certificate authority and

do harm.

RFC – Request for Comments (RFC) is a publication from the Internet Society (ISOC) and its

associated bodies, most prominently the Internet Engineering Task Force (IETF), the principal

technical development and standards-setting bodies for the Internet.

CA - certificate authority or certification authority is an entity that issues digital certificates

WPA2

https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access

WPA (sometimes referred to as the draft IEEE 802.11i standard) became available in 2003. The Wi-Fi

Alliance intended it as an intermediate measure in anticipation of the availability of the more secure

and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE

802.11i (or IEEE 802.11i-2004) standard.