Systems Security BIC3263

Chapter 3
Cryptography
Introduction
The study of cryptographic algorithms is called cryptography .
The study of how to break cryptographic algorithms is called
cryptanalysis .
The two subjects taken together are generally referred to as
cryptology .

BIC3263 Systems Security 2

Terminology
Cryptography: is the practice and study of hiding information.
It is used in e-commerce and with passwords.
Most commonly, encryption is used to hide information and make
it secret.
Encryption: is the process of changing information using an
algorithm (or cipher) into another form that is unreadable by others
unless they possess the key to that data.
Encryption is used to secure communications and to protect data
as it is transferred from one place to another.
The reverse, decryption, can be accomplished in two ways: First,
by using the proper key to unlock the data, and second, by
cracking the original encryption key.
Encryption enforces confidentiality of data.

BIC3263 Systems Security 3

Terminology
A cipher is an algorithm that can perform encryption or decryption.
A basic example would be to take the plaintext word code and
encrypt it as a ciphertext using a specific algorithm.
The end result could be anything depending on the algorithm used,
but, e.g., lets say the end result was the ciphertext zlab.
Algorithms are well-defined instructions that describe computations
from their initial state to their final state .
Message in human readable form is referred to in cryptographic
terms as plaintext/cleartext.
Process of disguising a message in such a way as to hide its
substance is called encryption/enciphering and resulting message
is referred to as ciphertext .
Reverse process decryption/deciphering ,takes ciphertext as
input and restores original plaintext.
BIC3263 Systems Security 4
Terminology
The key: is the essential piece of information that determines the
output of a cipher.
It is indispensable; without it there would be no result to the cipher
computation.
A person cant unlock a lock without the proper key, a computer cant
decrypt information without the proper key (using normal methods).
The only way to provide security is if the key is kept secretor in the
case that there are multiple keys, if one of them is kept secret.
The terms key and cipher are sometimes used interchangeably, but
you should remember that the key is the vital portion of the cipher
that determines its output.
The length of the key determines its strength.
Shorter, weaker keys are desirable to hackers attempting to access
encrypted data.
BIC3263 Systems Security 5
Historical Cryptography
Historical methods of cryptography predate the modern computer
age.
These methods did not depend on mathematics, as many modern
methods do, but rather on some technique for scrambling the text.
Ciphering is the process of using a cipher to encode a message.
The two primary types of nonmathematical cryptography, or ciphering
methods, are substitution and transposition.

BIC3263 Systems Security 6

Substitution cipher
Substitution cipher: type of coding or ciphering system that
changes one character or symbol into another.
Character substitution can be easy method of encrypting information.
One of the oldest known substitution ciphers is called the Caesar
cipher.
It was purportedly used by Julius Caesar.
The system involves simply shifting all letters a certain number of
spaces in the alphabet.
Julius Caesar used a shift of 3 to the right.
He was working in Latin, but the same thing can be done with any
language.

BIC3263 Systems Security 7

Substitution cipher (cont.)
E.g.:
I will pass the Security plus test.
If you shift each letter three to the right, you get the following:
L zloo sdvv wkh Vhfxulwb soxv whvw.
The Caesar cipher is one of many, among them Atbash, PlayFair,
and Scytale.
Visit www.cryptocorner.com to know more.

BIC3263 Systems Security 8

Substitution cipher (cont.)
Note:
Substitution ciphers are not adequate for modern uses, and a
computer would crack one almost instantly.
The issue involved is letter and word frequency.
All languages have certain words and letter combinations that appear
more often than others.
In English, if you see a three-letter word, it is most likely to be the or
and .
If you see a single-letter word, it is most likely to be I or a .
So using this information, you can guess that the first L is really an I, that
the wkh is actually the word the , and then use that information to
decrypt the rest of the message.
The more ciphertext you have to work with, the easier it is to decrypt.

BIC3263 Systems Security 9

Multi-Alphabet Substitution
One of the problems with substitution ciphers is that they did not
change the letter and word frequency of the text.
One way to combat this was to have multiple substitutions.
E.g., you might shift the 1st letter by 3 to the right, the 2nd letter by 2
to the right, and the 3rd letter by 1 to the left, then repeat this formula
with the next three letters.
The famous example of a multi-alphabet substitution was the
Vigenre cipher .
It used a keyword to look up the cipher text in a table.
The user would take the 1st letter in the text they wanted to encrypt,
go to the Vigenre table, and match that with the letter from the
keyword in order to find the ciphertext letter.
This would be repeated until the entire message was encrypted.
Each letter in the keyword generated a different substitution
alphabet.. BIC3263 Systems Security 10
Transposition Ciphers
Transposition cipher: involves transposing or scrambling the letters
in a certain manner.
A message is broken into blocks of equal size, and each block is then
scrambled.
In the example shown in Figure below, the characters are transposed
by changing the order of the group.
In this case, the letters are rotated three places in the message.
You could change the way Block 1 is transposed from Block 2 and
make it a little more difficult, but it would still be relatively easy to
decrypt.
The Rail Fence Cipher is a example of a transposition cipher.
With this cipher, you write message letters out diagonally over a
number of rows and then read off cipher row by row.

BIC3263 Systems Security 11

Transposition Ciphers(cont.)
E.g., you write the message out as:
mematrhtgpry
etefeteoaat
yielding the ciphertext:
MEMATRHTGPRYETEFETEOAAT
You can also see an example of a transposition cipher in Figure
below

BIC3263 Systems Security 12

Working with rot13
One of the oldest known encoding algorithms is Rot13.
This algorithm rotates every letter 13 places in the alphabet.
A becomes an N , a B becomes an O , etc.
The same rotation of 13 letters that is used to encrypt the message is
also used to decrypt the message.
Many newsgroups offer a ROT13 option that allows you to encrypt or
decrypt postings.

Exercise: Solve these encryptions:

1. Neg snve qrohgf urer Fngheqnl.
2. Gevcyr pbhcbaf ng Xebtre!
3. Gel lbhe unaq ng chmmyrf.

BIC3263 Systems Security 13

The Enigma Machine
The Enigma machine was a typewriter that implemented a multi-
alphabet substitution cipher.
When each key was hit, a different substitution alphabet was used.
The Enigma machine used 26 different substitution alphabets.
Prior to computers, this was extremely hard to break.

BIC3263 Systems Security 14

Steganography
Steganography is the process of hiding a message in a medium
such as a digital image, audio file, or other file.
Doing this prevents analysts from detecting the real message.
You could encode your message in another file or message and use
that file to hide your message.
The most common way this is done is called the least significant
bit (lsb) method.
If you changed the very last bit (the lsb in each byte), then that would
not make a noticeable change in the image,ie,In other words, you
could not tell that anything had been changed.
Using this fact, you can store data by putting it in the least significant
bits of an image file.
Someone observing the image would see nothing out of the ordinary.

BIC3263 Systems Security 15

Steganography(cont.)
It is also possible to hide data in audio files, video files, or literally any
digital file type.
There are even programs available on the Web for doing
steganography.
QuickStego (http://quickcrypto.com) is a free and easy-to-use
program.
Invisible Secrets (www.invisiblesecrets.com) is fairly inexpensive
and quite robust.

BIC3263 Systems Security 16

Transport Encryption

Encryption can be done in either tunneling or transport mode.

In tunneling mode, the data or payload and message headers are
encrypted.
Transport mode encrypts only the payload.

BIC3263 Systems Security 17

Modern Cryptography
With the arrival of computers, older methods of cryptography are no
longer viable.
A computer can quickly and easily crack substitution and
transposition ciphers.
Modern cryptography is divided into three major areas:
symmetric cryptography,
asymmetric cryptography, and
hashing algorithms

BIC3263 Systems Security 18

Working with Symmetric Algorithms
Symmetric algorithms require both ends of an encrypted message
to have the same key and processing algorithms.
Symmetric algorithms generate a secret key that must be protected.
A symmetric key/ a secret key/ private key , is a key that isnt
disclosed to people who arent authorized to use the encryption
system.
The disclosure of a private key breaches the security of the
encryption system.
If a key is lost or stolen, the entire process is breached.
These types of systems are common, but the keys require special
handling.
Figure below illustrates a symmetric encryption system; in this
example, the keys are the same on each end.

BIC3263 Systems Security 19

Symmetric Algorithms(cont.)

Symmetric encryption system

BIC3263 Systems Security 20

Symmetric Algorithms(cont.)
The other issue surrounding symmetric cryptography is key
distribution.
If you wish to encrypt messages with a friend in another city, how do you
exchange keys?
Symmetric methods use either a block or stream cipher.
Block cipher: the algorithm works on chunks of dataencrypting
one and then moving to the next.
Stream cipher: the data is encrypted one bit, or byte, at a time.
Several successful encryption systems use symmetric algorithms.
A strong algorithm can be difficult to break.
Here are some of the common standards that use symmetric
algorithms:

BIC3263 Systems Security 21

Symmetric Algorithms(cont.)
The Data Encryption Standard (DES) has been used since the mid-
1970s.
It was the primary standard used in government and industry until
it was replaced by AES.
Its based on a 56-bit key and has several modes that offer
security and integrity.
It is now considered insecure because of the small key size.
Triple-DES (3DES) is a technological upgrade of DES.
3DES is still used, even though AES is the preferred choice for
government applications.
3DES is harder to break than many other systems, and its more
secure than DES.
It increases the key length to 168 bits (using three 56-bit DES
keys).
BIC3263 Systems Security 22
Symmetric Algorithms(cont.)
Advanced Encryption Standard (AES) has replaced DES as the
current standard, and it uses the Rijndael algorithm.
It was developed by Joan Daemen and Vincent Rijmen.
AES is the current product used by U.S. governmental agencies.
It supports key sizes of 128, 192, and 256 bits, with 128 bits being
the default.
AES256/ AES-256 uses 256 bits instead of 128.
This qualifies for U.S. government classification as Top Secret.
CAST is an algorithm developed by Carlisle Adams and Stafford
Tavares.
Its used in some products offered by Microsoft and IBM.
CAST uses a 40-bit to 128-bit key, and its very fast and efficient.
Two additional versions, CAST-128 and CAST-256, also exist.

BIC3263 Systems Security 23

Symmetric Algorithms(cont.)
Rons Cipher/ RC is an encryption family produced by RSA
laboratories.
RC stands for Rons Cipher or Rons Code.
(Ron Rivest is the author of this algorithm.)
The current levels are RC4, RC5, and RC6.
RC5 uses a key size of up to 2048 bits. Its considered to be a
strong system.
RC4 is popular with wireless and WEP/WPA encryption.
It is a streaming cipher that works with key sizes between 40 and
2048 bits, and it is used in SSL and TLS.
It is also used with utilities used for downloading BitTorrent files
since many providers limit the download of these, and by using
RC4 to obscure the header and the stream, it makes it more
difficult for the service provider to realize that they are indeed
BitTorrent files being moved about.
BIC3263 Systems Security 24
Symmetric Algorithms(cont.)
Blowfish and Twofish
Blowfish is an encryption system invented by a team led by Bruce
Schneier that performs a 64-bit block cipher at very fast speeds.
It is a symmetric block cipher that can use variable-length keys
(from 32 bits to 448 bits).
Twofish is similar and works on 128-bit blocks.
It has a complex key schedule.

BIC3263 Systems Security 25

Symmetric Algorithms(cont.)
International Data Encryption Algorithm (IDEA) was developed
by a Swiss consortium.
Its an algorithm that uses a 128-bit key.
This product is similar in speed and capability to DES, but its
more secure.
IDEA is used in Pretty Good Privacy (PGP), a public domain
encryption system used by many for email.
Currently, Ascom AG holds the right to market IDEA.

BIC3263 Systems Security 26

Symmetric Algorithms(cont.)
One-time pads are the truly completely secure cryptographic
implementations.
They are so secure for two reasons.
1st , they use a key that is as long as a plaintext message.
That means there is no pattern in the key application for an
attacker to use.
2nd , one-time pad keys are used only once and then discarded.
So even if you could break a one-time pad cipher, that same
key would never be used again, so knowledge of the key
would be useless.

BIC3263 Systems Security 27

Key Exchange
Key exchange is an important topic in relation to symmetric
cryptography.
There are two approaches to key exchange:
1. In-band key exchange: the key is exchanged within the same
communications channel that is going to be encrypted.
IPSec, uses in-band key exchange.
2. Out-of-band key exchange: some other channel, other than the
one that is going to be secured, is used to exchange the key.
Forward secrecy is a property of any key exchange system, which
ensures that if one key is compromised, subsequent keys will not
also be compromised.
Perfect forward secrecy occurs when this process is
unbreakable.
A common approach uses ephemeral keys.
BIC3263 Systems Security 28
Working with Asymmetric
Algorithms
Asymmetric algorithms use two keys to encrypt and decrypt data.
These asymmetric keys are referred to as the public key and the
private key .
The sender uses the public key to encrypt a message, and the
receiver uses the private key to decrypt the message; what one key
does, the other one undoes.
As you may recall, symmetrical systems require the key to be private
between the two parties.
With asymmetric systems, each circuit has one key.

BIC3263 Systems Security 29

Asymmetric Algorithms(cont.)
The public key may be truly public or it may be a secret between the
two parties.
The private key is kept private, and only the owner (receiver) knows
it.
If someone wants to send you an encrypted message, they can use
your public key to encrypt the message and then send you the
message.
You can use your private key to decrypt the message.
The private key is always kept protected.
If both keys become available to a third party, the encryption system
wont protect the privacy of the message.

BIC3263 Systems Security 30

Asymmetric Algorithms(cont.)
The real magic of these systems is that the public key cannot be
used to decrypt a message.
If Bob sends Alice a message encrypted with Alices public key, it
does not matter if everyone else on Earth has Alices public key,
which cannot decrypt the message.
Only Alices private key can do that, as illustrated in Figure below.
All asymmetric algorithms are based on number theory.

A two-
key
system
in use

BIC3263 Systems Security 31

Asymmetric Algorithms(cont.)
Four popular asymmetric systems are in use today:

1. RSA is named after its inventors Ron Rivest, Adi Shamir, and
Leonard Adleman.
The RSA algorithm is an early public-key encryption system that
uses large integers as the basis for the process.
Its widely implemented, and it has become a de facto standard.
RSA works with both encryption and digital signatures.
RSA is used in many environments, including Secure Sockets
Layer (SSL), and it can be used for key exchange.

BIC3263 Systems Security 32

Asymmetric Algorithms(cont.)
Key generation:

1. Generate two large random primes, p and q , of approximately equal

size such that their product, n = pq , is of the required bit length (such as
2048 bits, 4096 bits, and so forth).
Let n = pq
Let m = (p-1)(q-1)
2. Choose a small number e , co-prime to m (note: Two numbers are co-
prime if they have no common factors).
3. Find d , such that
de % m = 1

BIC3263 Systems Security 33

Asymmetric Algorithms(cont.)
4. Publish e and n as the public key.
Keep d and n as the secret key. Encrypt as follows:
C= Me % n
or, put another way, compute the ciphertext:
c = me mod n
5. Decrypt as follows:
P = Cd % n,
or, put another way, use this private key ( d , n ) to compute:
m = cd mod n

BIC3263 Systems Security 34

Asymmetric Algorithms(cont.)
2. Diffie-Hellman Whitfield Diffie and Martin Hellman conceptualized
the Diffie-Hellman key exchange .
They are considered the founders of the public/private key concept;
their original work envisioned splitting the key into two parts.
This algorithm is used primarily to send keys across public networks.
The process isnt used to encrypt or decrypt messages; its used
merely for the creation of a symmetric key between two parties.
An interesting twist is that the method had actually been developed a
few years earlier by Malcolm J. Williamson of the British Intelligence
Service, but it was classified.

BIC3263 Systems Security 35

Asymmetric Algorithms(cont.)
3. Elliptic Curve Cryptography (ECC) provides similar functionality
to RSA but uses smaller key sizes to obtain the same level of
security.
ECC encryption systems are based on the idea of using points on a
curve combined with a point at infinity and the difficulty of solving
discrete logarithm problems.
Many vendors have implemented, or are implementing, the ECC
system for security.
The National Security Agency has also recommended several
implementations of ECC.
You can expect that ECC will be commonly implemented in cellular
devices in the near future.
There are many variations of Elliptic Curve, such as:
Elliptic Curve Diffie-Hellman (ECC-DH)
Elliptic Curve DigitalBIC3263
Signature Algorithm (ECC-DSA)
Systems Security 36
Asymmetric Algorithms(cont.)
5. ElGamal was developed by Taher Elgamal in 1984.
It is an asymmetric algorithm, and several variations of ElGamal have
been created, including Elliptic Curve ElGamal.
ElGamal and related algorithms use what is called an ephemeral key.
An ephemeral key is a key that exists only for that session.
The algorithm creates a key to use for that single communication
session and it is not used again.

BIC3263 Systems Security 37

Hashing Algorithms
The hashes used to store data, such as hash tables, are very
different from cryptographic hashes.
In cryptography, a hash function must have three characteristics:
1. It must be one-way .
This means that it is not reversible.
Once you hash something, you cannot unhash it.
2. Variable-length input produces fixed-length output .
This means that whether you hash two characters or two million,
the hash size is the same.
3. The algorithm must have few or no collisions .
This means that hashing two different inputs does not give the
same output.

BIC3263 Systems Security 38

Hashing Algorithms(cont.)
List of hashing algorithms
1. The Secure Hash Algorithm (SHA) was designed to ensure the
integrity of a message.
SHA is a one-way hash that provides a hash value that can be
used with an encryption protocol.
This algorithm produces a 160-bit hash value.
SHA-2 has several sizes: 224, 256, 334, and 512 bit.
SHA-2 is the most widely used, but SHA-3 has been released.
Although SHA3 is now a standard, there are no known issues with
SHA2, so it is still the most widely used and recommended
hashing algorithm.
The algorithm was originally named Keccak and designed by
Guido Bertoni, Joan Daemen, Michal Peeters, and Gilles Van
Assche.
BIC3263 Systems Security 39
Hashing Algorithms(cont.)
2.The Message Digest Algorithm (MD) also creates a hash value
and uses a one-way hash.
The hash value is used to maintain integrity.
The common versions of MD are MD5, MD4, and MD2.
MD4 was used by NTLM to compute the NT Hash.
MD5 is the newest version of the algorithm.
It produces a 128-bit hash, but the algorithm is more complex
than its predecessors and offers greater security.
Its biggest weakness is that it does not have strong collision
resistance, and thus it is no longer recommended for use.
SHA (1 or 2) are the recommended alternatives.

BIC3263 Systems Security 40

Hashing Algorithms(cont.)
3. The RACE Integrity Primitives Evaluation Message Digest
(RIPEMD) algorithm was based on MD4.
There were questions regarding its security, and it has been
replaced by RIPEMD-160, which uses 160 bits.
Versions in existence that use 256 and 320 bits (RIPEMD-256
and RIPEMD-320, respectively), but all versions of RIPEMD
remain.
4. GOST is a symmetric cipher developed in the old Soviet
Union that has been modified to work as a hash function.
GOST processes a variable-length message into a fixed-length output of
256 bits.

BIC3263 Systems Security 41

Hashing Algorithms(cont.)
5. LANMAN Prior to the release of Windows NT, Microsofts OSs
used the LANMAN protocol for authentication.
While functioning only as an authentication protocol, LANMAN used LM
Hash and two DES keys.
It was replaced by the NT LAN Manager (NTLM) with the release of
Windows NT.
6. NTLM Microsoft replaced the LANMAN protocol with NTLM (NT
LAN Manager) with the release of Windows NT.
NTLM uses MD4/MD5 hashing algorithms.
Versions of this protocol exist (NTLMv1, NTLMv2), and it is still in use
despite the fact that Microsoft has pointed to Kerberos as being its
preferred authentication protocol.
Although LANMAN and NTLM both employ hashing, they are used
primarily for the purpose of authentication.

BIC3263 Systems Security 42

Rainbow Tables and Salt
A hashing algorithm is not reversible, so you might think it is
impossible to break a hash, but there are methods to do so.
This is important since passwords are often stored as a hash.
Rainbow tables are one such method.
With a rainbow table, all of the possible hashes are computed in
advance.
I.e., you create a series of tables; each has all the possible two-letter,
three-letter, four-letter, and so forth combinations and the hash of that
combination, using a known hashing algorithm like SHA-2.
If you search the table for a given hash, the letter combination in the
table that produced the hash must be the password you are seeking.

BIC3263 Systems Security 43

Rainbow Tables and Salt(cont.)
Password cracking tools, such as OphCrack, use rainbow tables.
A countermeasure, called Salt , refers to the addition of bits at key
locations, either before or after the hash.
So if you type in the password letmein, bits are added by the OS
before it is hashed.
Using Salt, should someone apply a rainbow table attack, the hash
they search for will yield a letter combination other than what you
actually typed in.

BIC3263 Systems Security 44

Key Stretching
Key stretching refers to processes used to take a key that might be
a bit weak and make it stronger, usually by making it longer.
The key (or password/passphrase) is input into an algorithm that
will strengthen the key and make it longer, thus less susceptible to
brute-force attacks.
Two methods of doing are discussed below:
1. PBKDF2 (Password-Based Key Derivation Function 2) is part
of PKCS #5 v. 2.01.
It applies some function (like a hash or HMAC) to the password or
passphrase along with Salt to produce a derived key.
2. Bcrypt is used with passwords, and it uses a derivation of the
Blowfish algorithm, converted to a hashing algorithm, to hash a
password and add Salt to it.

BIC3263 Systems Security 45

Quantum Cryptography
Quantum cryptography is a new method of encryption.
Its application was limited to laboratory work and possibly to
secret governmental applications.
This method is based on the characteristics of the smallest
particles known.
Although there are many theoretical uses for quantum
cryptography, the only method currently practical is quantum key
exchange (QKE).
The process is dependent on quantum physics.

BIC3263 Systems Security 46

Cryptanalysis Methods
If time has taught us anything, it is that people frequently do things
that other people thought were impossible.
Every time a new code or process is invented that is thought to be
unbreakable, someone comes up with a method of breaking it.
The following list includes some common code-breaking techniques:

BIC3263 Systems Security 47

Cryptanalysis Methods
1. Frequency analysis: involves looking at blocks of an encrypted
message to determine if any common patterns exist.
The analyst doesnt try to break the code but looks at the patterns in
the message.
In the English language, the letters e and t and words like the, and,
that, it, and is are very common.
Single letters that stand alone in a sentence are usually limited to a
and I.
A determined cryptanalyst looks for these types of patterns and, over
time, may be able to deduce the method used to encrypt the data.
This process can sometimes be simple, or it may take a lot of effort.
This method works only on the historical ciphers, it does not work on
modern algorithms.

BIC3263 Systems Security 48

Cryptanalysis Methods(cont.)
2. Chosen Plaintext: In this attack, the attacker obtains the
ciphertexts corresponding to a set of plaintexts of their own choosing.
This allows the attacker to attempt to derive the key used and
thus decrypt other messages encrypted with that key.
This can be difficult, but it is not impossible.
Advanced methods such as differential cryptanalysis are chosen
plaintext attacks.
3. Related Key Attack: This is like a chosen-plaintext attack, except
the attacker can obtain ciphertexts encrypted under two different
keys.
This is a very useful attack if you can obtain the plaintext and
matching ciphertext.

BIC3263 Systems Security 49

Cryptanalysis Methods(cont.)
4. Brute-force attacks can be accomplished by applying every
possible combination of characters that could be the key.
E.g., if you know that the key is three characters long, then you also
know that there is a finite number of possibilities of what the key
could be.
Although it may take a long time to find the key, it can be found.

BIC3263 Systems Security 50

Cryptanalysis Methods(cont.)
5. Exploiting Human Error : Human error is one of the major
causes of encryption vulnerabilities.
If an email is sent using an encryption scheme, someone else may
send it in the clear (unencrypted).
If a cryptanalyst gets ahold of both messages, the process of
decoding future messages will be considerably simplified.
A code key might wind up in the wrong hands, giving insights into
what the key consists of.
Many systems have been broken into as a result of these types of
accidents.

BIC3263 Systems Security 51

Cryptanalysis Methods(cont.)
A classic example involved the transmission of a sensitive military-
related message using an encryption system.
Most messages have a preamble that informs the receiver who the
message is for, who sent it, how many characters are in the
message, the date and time it was sent, and other pertinent
information.
In this case, the preamble was sent in cleartext, and this information
was also encrypted and put into the message.
As a result, the cryptanalysts gained a key insight into the message
contents.
They were given approximately 50 characters that were repeated in
the message in code.
This error caused a relatively secure system to be compromised.

BIC3263 Systems Security 52

Wi-Fi Encryption
In Wifi encryption, the clients and the access point share the same
key, using symmetric encryption, and RC4.
Since all of the clients and the access point share the same key, this
is known as a preshared key.
WEP (Wired Equivalent Privacy) encryption was an attempt to add
security, but it fell short because of weaknesses in the way the
encryption algorithms are employed.
The Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2
(WPA2) technologies were designed to address the core problems
with WEP.
WPA couples the RC4 encryption algorithm with TKIP, whereas
WPA2 favors Counter Mode with Cipher Block Chaining Message
Authentication Code Protocol (CCMP).
CCMP uses 128-bit AES.
BIC3263 Systems Security 53