Learn How To Speak Like a Cryptographer

CyberStart Essentials Glossary

We’re moving! Come and find us on www.cyberstart.com/blog where you will find even more tips, tricks and industry support. See you there!

All professions have their own termoniolgy and acronyms. Sometimes, it can be daunting to try and understand what feels like a whole new language (no pun intended). Cyber security is no different, so we’ve put together a series of glossaries to help you get to grips with the phrases and words you’ll need to know to get ahead.

Here are the terms, phrases, and words you’ll hear when learning about Cryptography. There’s a lot to learn, but bear with us and by the end of the glossary, you’ll be able to speak like a pro!

AES: Advanced Encryption Standard, a popular symmetric encryption algorithm. The algorithm was selected from several entries in a competition run by the U.S government and is now called AES, however, the actual name for it is Rijndael. Usually when any product boasts “military grade encryption”, they just mean AES which is the standard for symmetric encryption across most of the world.

Algorithm: A process or set of rules to be followed in order to solve a problem. In the context of cryptography, an encryption algorithm is a process by which a piece of data can be encrypted.

Asymmetric Encryption: A form of encryption whereby two keys are used. One key is used to encrypt a piece of data and a different but paired key is used to decrypt the data. This often takes the form of a public and private key where the public key is shared with the public and only the matching private key can decrypt data encrypted with the public key.

Back Door: A design fault in an encryption algorithm which has been purposely left in order to allow anyone who knows about it to read encrypted data. The danger is that anyone who knows about or discovers the flaw could use the back door, not just authorised parties (after all the algorithm is just maths, it doesn’t care who you are).

Brute Force Attack: A brute force attack is performed in order to guess a password or encryption key by running through combinations of numbers, letters and symbols until the right password or key is found. A strong password or a key with a large key space makes this attack unfeasible.

Dictionary Attack: A dictionary attack is performed in order to guess a password given a password hash. A dictionary attack is performed by hashing a list of possible passwords and comparing the hash to the provided hash to find a match. This is faster than a brute force attack but is limited to finding passwords which are in the dictionary used by the attacker.

Encryption: The process of converting data into a format which can only be read by the intended parties, usually though possession of a key.

Hash: A hash is a form of irreversible encryption often used for fingerprinting data. The idea being that the same data put through a hashing algorithm will always produce the same result. Hashes are often used to store passwords without having to store the plaintext. Any submitted password can be hashed and compared with the stored hash.

HTTPS: Hyper Text Transfer Protocol Secure, a protocol for encrypted web browsing. It actually uses two separate protocols, HTTP and TLS.

Key: A piece of data which when combined with an encryption algorithm can either encrypt or decrypt a piece of data.

Key Space: All possible values for an encryption key.

PRNG: Pseudo-random number generator. Computers are incapable of producing true randomness, any algorithm that can generate ‘random’ numbers is actually a means of predicting the next value, so although algorithms exist that can make predicting the next value difficult it is not truly random. We call these algorithms pseudo-random and they are heavily used in encryption.

Rainbow Table: A store of hashes and their plaintext equivalents. Knowing a hash, the matching plaintext can be looked up faster than generating a hash for every possible plaintext. This kind of pre-computation attack is defeated by using a salt.

RSA: A popular asymmetric encryption algorithm named after the initials of the inventors of the algorithm, Rivest, Shamir, and Adelman.

Salt: A value which is added to a password before it is hashed. The salt is unique to a user and stored in plaintext next to the hash. A submitted password has the salt added to it and is then hashed and compared to the stored hash. A salt is used to defeat pre-computation attacks whereby all possible passwords are hashed and stored in a ‘rainbow table’.

Seed: A numerical value which is used by a pseudo-random number generator to generate seemingly random data, an important task in cryptography. The seed is often generated using hardware sources as input, such as the movement of the mouse pointer.

SHA256: A hashing algorithm which is the standard today, succeeding SHA1 and MD5 which are both now largely considered unsafe.

SSL: Secure Sockets Layer, a cryptographic protocol that was predominantly used for web browsing (HTTPS). It has now been superseded by TLS, although most people still refer to TLS as SSL out of habit.

Symmetric Encryption: A form of encryption whereby the same key is used to both encrypt and decrypt a piece of data. All parties who are authorised to decrypt the data must share the same key.

TLS: Transport Layer Security, a cryptographic protocol widely used predominantly for web browsing (HTTPS). It is the successor to SSL.

Interested in our programmes? Check out where you can build your cyber security knowledge for free!

UK 13–18-year-old student programme: Cyber Discovery https://cyberdisc.io/medium

USA 13–18 year-old girls student programme: Girls Go CyberStart https://ggcs.online/medium

USA 18–year-old and above college student programme: Cyber FastTrack https://cyberft.io/medium