Technical Dictionary

0-9

2FA
Abbreviation for "two-factor authentication".
3DES
Pronounced "triple DES". Application of the DES standard where three keys are used in succession to provide additional security.

ACL
Access control list. A method for limiting the use of a specific resource to authorized users.
AES
Advanced Encryption Standard. A symmetric key encryption technique that provides strong encryption in various environments: standard software platforms, limited space environments, and hardware implementations.
Alice
The name given to 'person A' when describing a conversation.
API
Application Programming Interface
ASN.1
Abstract Syntax Notation One. An ITU notation used to define the syntax of information data. It defines a number of simple data types and specifies a notation for identifying these types and for specifying values of these types. These notations can be used to define the abstract syntax of information independent of how the information is encoded for transmission.
Asymmetric Encryption
In an asymmetric encryption system different keys are used for encrypting and decrypting a message or a document, which means that the communicating parties need not "share a secret". Instead, the asymmetric system uses a key pair, a public and a private key, which is applicable in processes that require a high level of security.
Authentication
The process of establishing that an entity - whether human or machine - is who or what they say they are.

B

BER
Basic Encoding Rules. A set of rules specified in for encoding data units described in ASN.1.
Bit
Short for binary digit, is a digit in the binary numeral system which consists of base 2 digits, where the value for each digit will either be a 0 or a 1.
Block
A fixed-length group of bits.
Block Cipher
A symmetric key cipher which operates on fixed length groups of bits.
Bob
The name given to 'person B' when describing a conversation.

C

CA
Abbreviation of Certification Authority.
Certificate Authority
See Certification Authority below.
Certification Authority (CA)
A Certification Authority (CA) is an enabling service that issues, manages and revokes certificates of users, service providers, applications and appliances. A certificate is signed by the CA, which guarantees the identity of the certificate owner.
CA Server
The server component in a public key infrastructure which handles, stores and issues digital certificates.
Certificate
A digital certificate is an electronic document which links a public key to a person or a company in a public key infrastructure enabling the user(s) to send encrypted and digitally signed electronic messages. The certificate identifies the user and is required to verify his digital signature. The certificate contains information about the identity and public key of the person/company as well as the certificate's expiry date. The certificate may also contain information about its usage.
Cipher
An algorithm for performing encryption and decryption.
Cipher Text
Encrypted information.
CRL
Certificate Revocation List. A list of certificates that have been revoked by the Certification Authority. The CRL can be compared to a blacklist containing the certificates which are no longer valid.
Cryptanalysis
Or 'code breaking' is the study of methods for obtaining the meaning of encrypted information. It is also used to refer to any attempt to get around the security of other types of cryptographic algorithms and protocols in general.
Cryptography
The study of message secrecy.
Cryptology
An umbrella term for cryptography and cryptanalysis.
Cryptosystem
A suite of algorithms, typically three - one for key generation, one for encryption and one for decryption.

D

DDA
Dynamic Data Authentication
Decryption
The process of converting an encrypted text back to a plain and meaningful text.
DER
Distinguished Encoding Rules. A set of encoding rules which are part of ASN.1.
DES
Data Encryption Standard. An encryption block cipher developed in 1977 by IBM. It applies a 56-bit key to each 64-bit block of data. It provides strong encryption based on symmetric cryptography, i.e. both the sender and receiver must know the same secret key. This key is used for both encryption and decryption. DES is sometimes used with 3 keys known as "triple DES" or 3DES. The Data Encryption Standard was replaced in 2000 by the Advanced Encryption Standard (AES).
Digital Certificate
See 'Certificate'.
Digital Signature
A digital signature is the electronic equivalent of a person's handwritten signature to guarantee the identity of the sender of an electronic message. The use of a digital signature is as legally binding as a physical signature as it fulfills three vital security needs: authenticity, non-repudiation and integrity.
Digital Time Stamp
A time code that can form part of a digital signature which proves the existence of the signed document or content at a given time.
DRM
Digital Rights Management
DSA
Digital Signature Algorithm. A public key algorithm that is used as part of the Digital Signature Standard (DSS). DSA was developed by the U.S. National Security Agency to generate a digital signature for the authentication of electronic documents. It cannot be used for encryption, only for digital signatures. The algorithm produces a pair of large numbers that enable the authentication of the signatory, and consequently, the integrity of the data attached. DSA is used both in generating and verifying digital signatures.
DSS
Digital Signature Standard. Recommended as a standard in 1994 by NIST and has become the United States government standard for authentication of electronic documents, specified in Federal Information Processing Standard (FIPS) 186. It uses the Digital Signature Algorithm (DSA) to create digital signatures for the authentication of electronic documents.

E

ECC
Elliptic Curve Cryptography. A technique that uses elliptic curves for cryptography. The advantage of using elliptic curves is that they are particularly well-suited for applications involving chip cards with limited computational power, for example, mobile communication.
ECDSA
The Elliptic Curve Digital Signature Algorithm (ECDSA) is the elliptic curve analogue of the DSA standard. The advantages of ECDSA compared to RSA-like schemes are shorter key lengths and faster signing and decryption. For example, a 160 (210) bit ECC key is expected to give the same security as a 1024 (2048) bit RSA key, and the advantage increases as the level of security is raised.
Elliptic Curve
In mathematics: an algebraic curve defined by an equation in the form y2 = x3 + ax + b.
EMV
A standard for interoperation of chip cards for authenticating credit and debit card payments. The name comes from Europay, MasterCard and Visa - the three companies who cooperated to develop the standard.

F

Factor
A method used in authentication.
FIPS
Federal Information Processing Standards is a set of standards that describe the handling and processing of information within governmental agencies.

H

Hash Function
An algorithm that transforms a string of characters into a (usually) shorter value of a fixed length or a 'fingerprint' that represents the original value.
Hash Value
The value calculated by a hash function, e.g. the message digest that is created as part of a digital signature.
HSM
Hardware security module.
HTTP
Hypertext transfer protocol.

I

IEEE
The Institute of Electrical and Electronics Engineers

IPK An IPK is a digital certificate on an issuer's RSA public key (IPK), which is signed by a Certificate Authority (CA).

ISO
International Organization for Standardization
ITU
The International Telecommunication Union, formerly known as CCITT. The organization, which includes governments and the private sector, handles the coordination of telecommunication technology and is a leading publisher of standards and regulatory information.

JCE
Java Cryptography Extension. A framework for the implementation of encryption, key generation, key agreement and message authentication code algorithms in the Java language.

K

Key
A key specifies the particular transformation of plain text into cipher text during encryption and vice-versa during decryption.
Key Generation
The process of generating keys.
Key Length
Encryption systems are only as strong as the length of the encryption key and depend on which type of mathematical equation - i.e. algorithm - the system employs. A long key makes it more difficult to break the cryptosystem - but the longer the key, the more time it takes to encrypt and decrypt messages.
Key Management
Key management includes all of the provisions made in a cryptosystem design, including cryptographic protocols, user procedures, etc, which are related to generation, exchange, storage, safeguarding, use, vetting, and replacement of keys.
Key Pair
A corresponding public and private key.

L

LRA
Local Registration Authority. The LRA is responsible for registering and managing the users' identities in a Public Key Infrastructure (PKI). Based on this information the CA issues the digital certificates.

M

MAC
Message Authentication Code. MACs are used to validate information transmitted between two parties that share a secret key.
Man-in-the-Middle
An attack in which an attacker is able to read, insert and modify at will, messages between two parties without either party knowing that the link between them has been compromised.
MD2
A message-digest hash function optimized for 8-bit machines.
MD4
A message-digest hash function that is several times faster than MD2 and optimized for 32-bit machines.
MD5
A one-way message-digest hash function with a 128-bit hash value. The algorithm processes input text and creates a 128-bit message digest which is unique to the message and can be used to verify data integrity. MD5 was developed by Ron Rivest in 1991 to replace MD4.
MDC
Modification Detection Code. A hash function that produces a 128-bit output from block ciphers. IBM has named their hash functions: MDC-1, MDC-2 and MDC-4.
Message Digest
The fixed-length output from a hash function, e.g. the MD5 algorithm.
MIME
Multipurpose Internet Mail Extensions. A set of specifications for the interchange of text in languages with different character sets. MIME is also used to attach multimedia and rich text elements to e-mail that may be transmitted among different computer systems using Internet mail standards. The specifications define Content-Types and other conventions for the formatting of e-mail messages. S/MIME is a later standard that adds security to e-mail communication by allowing signing and encryption of messages.

N

NIST
National Institute of Standards and Technology, formerly known as the National Bureau of Standards. A unit of the US Commerce Department which promotes open standards and interoperability in computer-based industries.

O

One-time Password (OTP)
A password that is used only once, often abbreviated to OTP. One-time passwords are used to make it more difficult to gain unauthorized access to, for example, an online bank account. Traditional static passwords have proved to be more easily accessible by an attacker, but by using a password that is altered constantly, as is done with a one-time password, this greatly reduces the risk of unauthorized access being gained. There are three types of one-time password:
the first uses a mathematical algorithm to generate a new password based on the previous password
the second is time-based - the authentication server and the client providing the password aresynchronized
the third is based on a challenge (e.g. a random number chosen by the authentication server or transaction details) and a counter instead of being based on the previous password.

P

Phishing
An attempt to fraudulently acquire sensitive information such as usernames and passwords via an email sent by the attacker appearing to come from the recipient's bank. It contains a link that leads the recipient to a convincing web page, at which point he is tricked into entering his details.
Pharming
An attack that re-directs traffic to a website to another bogus website.
PIN
Personal Identification Number.
PKCS
A set of Public Key Cryptography Standards devised by RSA Laboratories in 1991 which are widely used in public key cryptography systems.
PKCS#1 - RSA Cryptography Standard
Defines the format of RSA encryption.
PKCS#2
Withdrawn. Has been incorporated into PKCS#1.
PKCS#3 - Diffie-Hellman Key Agreement Standard
A protocol that allows two parties unknown to each other to jointly establish a shared secret key over an insecure communications channel.
PKCS#4
Withdrawn. Has been incorporated into PKCS#1.
PKCS#5 - Password-based Encryption Standard
PKCS#6 - Extended-Certificate Syntax Standard
Defines extensions to the old v1 X.509 certificate specification.
PKCS#7 - Cryptographic Message Syntax Standard
Used to sign and/or encrypt messages under a PKI.
PKCS#8 - Private-Key Information Syntax Standard
PKCS#9 - Selected Attribute Types
Defines selected attribute types for use in PKCS#6, PKCS#7, PKCS#8 and PKCS#10.
PKCS#10 - Certificate Request Standard
Specifies a standard syntax for requesting certification of a public key from a certification authority.
PKCS#11 - Cryptographic Token Interface
A technology-independent programming interface for cryptographic devices such as smart cards.
PKCS#12 - Personal Information Exchange Syntax Standard
Specifies a portable format for storing or transporting a user's private keys and certificates, protected with a password-based symmetric key.
PKCS#13 - Elliptic Curve Cryptography Standard
Under development.
PKCS#14 - Pseudo-random Number Generation
Under development.
PKCS#15 - Cryptographic Token Information Format Standard
Defines a standard allowing users of cryptographic tokens to identify themselves to applications, independent of the application's Cryptoki implementation (PKCS#11) or other API.
Prime Number
A number that is only divisible by itself and 1.
Private Key
Also known as a decryption key that is kept secret and used to decrypt data encrypted by its corresponding public key.
Public Key
Also known as an encryption key that can be widely distributed to encrypt data.

R

Rijndael
The algorithm that was chosen by NIST to become the Advanced Encryption Standard (AES). It was developed by Vincent Rijmen and Joan Daemen. It has a block size of 128-bit and supports keys of at least 128 bits.
RIPEMD-160
A 160-bit hash function that offers a higher degree of security than 128-bit hash functions such as MD4 and MD5.
RSA
A public key cryptographic algorithm named after its inventors (Rivest, Shamir, and Adelman). It is used for encryption and digital signatures. RSA was developed in 1977 and is today the most commonly used encryption and authentication algorithm.

S

SDA
Static Data Authentication.
Session Key
A session key is a key used for encrypting one message or a group of messages in a communication session.
SHA Hash Functions
The SHA (Secure Hash Algorithm) hash functions refer to five FIPS approved algorithms denoted SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512, designed by the National Security Agency (NSA) and published by the NIST as a US government standard. The latter four variants are sometimes collectively referred to as SHA-2.
SHA-1 is employed in several widely used security applications and protocols, including TLS and SSL, PGP, SSH, S/MIME, and IPsec. It was considered to be the successor to MD5, an earlier, widely-used hash function.
The security of SHA-1 has been somewhat compromised, but the newer SHA-2 algorithms are not believed to be subject to the same vulnerabilities.
S/MIME
A standard that extends the MIME (Multipurpose Internet Mail Extensions) specifications to support the signing and encryption of e-mail transmitted across the Internet.
Symmetric Encryption
In a symmetric encryption system, a message or a document is encrypted and decrypted with the same key. The message is encrypted with the sender's key and the recipient decrypts the message by use of the same key.
SSL
Secure Sockets Layer. A technology used on the Internet to secure web pages and transactions by means of public key cryptography.
Stream Cipher
A stream cipher (also known as a state cipher) is a symmetric cipher in which the plaintext digits are encrypted one at a time, and in which the transformation of successive digits varies during the encryption. In practice, the digits are typically single bits or bytes.

T

Time Stamp
A time stamp can refer to a time code or to a digitally signed timestamp whose signer vouches for the existence of the signed document or content at the time given as part of the digital signature. Time stamps are used, for example, on contracts or medical records.
Time Stamping Authority
A trusted third party who issues a time stamp to prove the existence of certain data before a certain point in time without the possibility that the owner can backdate the timestamps.
TLS
Transport Layer Security. A protocol intended to secure and authenticate communications across a public networks by using data encryption. TLS is designed as a successor to SSL and uses the same cryptographic methods but supports more cryptographic algorithms.
Two-factor Authentication
A more secure means of authenticating a user based on something they know (static password) and something they have in their possession (one-time password).
TPM
Trusted Platform Management.
Trojan Horse
Malicious computer software that looks harmless to the user but contains a virus or spyware. Named after the Trojan Horse in Greek mythology.

V

Virtual Private Network (VPN)
A virtual private network (VPN) is a private communications network often used by companies or organizations, to communicate confidentially over a public network (e.g. the Internet) on top of standard protocols, or over a service provider's private network with a defined Service Level Agreement (SLA) between the VPN customer and the VPN service provider. A VPN can send data (e.g., voice, data or video, or a combination of these media) across secured and encrypted private channels between two points.

X

X.500
X.500 is a series of computer networking standards covering electronic directory services. The X.500 series was developed by the International Telecommunications Union (ITU). ISO was a partner in developing the standards, incorporating them into the Open Systems Interconnection suite of protocols. ISO/IEC 9594 is the corresponding ISO identification. The directory services were developed in order to support the requirements of X.400 electronic mail exchange and name lookup.
X.509
Public key certificate standard. Used for secure management and distribution of digitally signed certificates across secure Internet networks.
X.509v3
Version 3 of the X.509 certificate standard includes extended data structures for storing and retrieving information on certificate application, certificate distribution, certificate revocation, policies and digital signatures. X.509v3 maintains time-stamped CRLs for all certificates, making it possible for the application to check the validity of the certificate.