IT Security Glossary

Advanced Encryption Standard (AES)

An encryption standard developed by NIST, intended to specify an unclassified, publicly-disclosed, symmetric encryption algorithm. AES is now the de facto standard for encrypting all forms of electronic information, replacing DES. AES-encrypted data is unbreakable in the sense that no known cryptanalysis attack can decrypt the AES cipher text without using a brute-force search through all possible 256-bit keys. On October 2, 2000, NIST announced that Rijndael had been selected as the proposed standard. On December 6, 2001, the Secretary of Commerce officially approved Federal Information Processing Standard (FIPS) 197, which specifies that all sensitive, unclassified documents will use Rijndael as the Advanced Encryption Standard.

Authentication

Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. Strong authentication will require at least two of authentication factors – e.g “something you know”, a password, and “something you have”, a smart card or USB token.

Back door

A back door is a hole in the security of an encryption program or a computer system deliberately left in place by developers. The presence of a back door greatly reduces the reliability of the implementation of an encryption algorithm.

Backup

The activity of copying files or databases so that they will be preserved in case of equipment failure or other catastrophe. Ideally the backup copies should be kept at a different site or in a fire safe.

Block Cipher

An algorithm that encrypts data in blocks. So that identical blocks of text do not get encrypted the same way in a message (which might make it easier to decipher the ciphertext), it is common to apply the ciphertext from the previous encrypted block to the next block in a sequence.

Brute Force

A cryptanalysis technique or other kind of attack method involving an exhaustive procedure that tries all possibilities, one-by-one. Brute force cracking is a trial and error method used to decode encrypted data such as passwords or Data Encryption Standard keys, through exhaustive effort rather than employing intellectual strategies.

Cipher

The the generic term used to describe means of encryption and decryption. A cipher transforms regular plaintext data into a coded set of data that is not decrypted without a key. For example, AES and DES are examples of symmetric block ciphers.

Cryptanalysis

The mathematical science that deals with analysis of a cryptographic system in order to gain knowledge needed to break the protection that the system is designed to provide.When new encryption algorithms are introduced, cryptanalysis determines how hard it is to break the code. Cryptanalysis often is used by governments in military and diplomatic surveillance, by enterprises in testing the strength of security procedures, and by malicious hackers in exploiting weaknesses in systmes.

Cryptography

The art of science concerning the principles, means, and methods for scrambling plain text into cipher text (a process called encryption), then back again (known as decryption). Individuals who practice this field are known as cryptographers.

The encryption algorithm uses a "key," which is a binary number that is typically from 40 to 256 bits in length. The greater the number of bits in the key (cipher strength), the more possible key combinations and the longer it would take to break the code.