Skip to content
academia.sh
tr
Log in

Course Intermediate

Identity, Access and Cryptography

Published Updated

By the end of this course

Start course

01

Cryptography Fundamentals

Measuring cryptographic operations in terms of trust root and breaking point: the number of items hashing, encryption, and encoding each need for reversal, measuring collision resistance against the birthday bound, the work factor's cost curve, and how many rainbow-table items a salt renders useless, the key distribution arithmetic of symmetric encryption, which direction the public and private key each perform their operation, producing a shared secret over an insecure channel, and the items a signature proves and does not prove.

  1. 01 Hashing, Encryption, and Encoding Separating three operations in terms of reversibility: the encoded, encrypted, and hashed form of the same meter reading, the number of secret items needed for reversal being 0, 2, and none respectively, only four of the twelve matches between four fields and three operations coming out appropriate, and a wrong match destroying the reversal of 24,800 records.
  2. 02 Hash Functions Measuring collision resistance against the birthday bound: fixed output length, a single-bit input change flipping about half the output bits, the first collision in a truncated output being found — averaged over 32 rounds — at 0.97–1.15 times the theoretical bound, and an n-bit output being bounded by 2^(n/2) tying 12,502 of the 25,242 items in the usage set to collision resistance.
  3. 03 Salt and Password Storage Measuring the work factor and salt as two mutually independent factors: unit cost growing within a measured band of up to 16x when N doubles, a rainbow table becoming equal to doing the work from scratch per record at a 9-bit salt threshold, what determines salt length being the birthday bound rather than table size, and neither factor being able to fix the password's unpredictability root.
  4. 04 Symmetric Encryption The shared key's trust root and distribution arithmetic: decryption depending on four items — key, nonce, tag, and body — all being correct at the same time, a per-pair key scheme needing 7.69×10^7 key items at 12,401 endpoints, a star scheme cutting that number to 12,400 while turning the center into a single root, and a single shared key scheme where one item falling brings down every connection.
  5. 05 Asymmetric Encryption The separation of the public and private key's roles: two of four possible key-operation combinations working, one giving secrecy and the other a source claim, a 190-byte upper bound in a 2048-bit modulus, the secret item count dropping from 7.69×10^7 to 12,401 at 12,401 participants and the transported secret item falling to zero, and hybrid use cutting overhead from 38 percent to 7 percent.
  6. 06 Key Exchange Running shared-secret generation over an insecure channel with small parameters: both sides reaching the same shared secret without ever sending their secret exponent, the intersection of the 4 items crossing the channel and the 3 items sufficient for the secret being zero, ephemeral key exchange dropping the number of retroactively opened sessions from 52,560 to 0, and the exchange verifying two of its three items while not verifying the other side's identity.
  7. 07 Digital Signatures The separation of the items a signature proves and does not prove: verification not surviving a single one of 952 attempts when every bit of the 440-bit batch and every bit of the 512-bit signature is flipped one at a time, two of six items being proven and four not, keyed hash narrowing the sender candidate to 2 and a signature narrowing it to 1, and 2,190 past signatures becoming disputed when the signing key leaks.

02

Public Key Infrastructure

What a public key's ownership rests on, and where that foundation breaks: the claim each certificate field proves and the path each field closes when checked, the number of items one root carries in the chain-of-trust graph and the renewal cost of what falls when the root breaks, the learning window of the CRL versus OCSP and the path a failed query opens, which step of the handshake proves which claim, the renewal window and the connections an expired item drops, and who can read the content in end-to-end encryption.

  1. 01 Certificates Certificate fields are measured in terms of the claim they prove: which claim each of the nine fields binds, the eight items that must hold at once for a single leaf item to be usable, and how five checks close eight of thirteen usage attempts while stopping none of the five legitimate ones.
  2. 02 Certificate Authorities and the Chain of Trust The load a single root carries is measured in numbers: 4,397 leaf items and 4,400 trust store copies tied to one root under four intermediate authorities, an intermediate authority breaking drops between 10 and 4,101 items while a root breaking drops 8,802 items and takes 95 workdays of manual touch; a backup root zeroes out the outage but does not change the touch count.
  3. 03 Certificate Revocation The window between the revocation decision and the verifier learning it is measured: 29.5 hours on average and 271,877 accepted connections with daily list publication, 1.5 hours and 13,925 connections with the Online Certificate Status Protocol (OCSP), 0.5 hours and 4,621 connections with server-carried response; narrowing the list's window to two hours raises the daily download from 152 MB to 1,828 MB, and when the query goes unanswered, soft-fail opens 2 paths while hard-fail drops 6,161 legitimate connections.
  4. 04 TLS Handshake The handshake is taken apart along its identity steps: each of six claims ties to a single step, when any of the four identity steps is turned off exactly one more of five fictional presentations gets accepted, and with no identity step at all all five of the five pass; full verification requires 11 items to hold at once, mutual verification requires 15, and at fleet scale it adds 17,552 items.
  5. 05 Certificate Lifecycle Management Measured in terms of the renewal window: manually renewing 4,397 items takes 99 workdays a year, 111 items go unnoticed, and 1,458 connections drop; automation zeroes out all three numbers while adding 5 system items and turning 111 scattered breakage points into a single point that carries 4,397 items at once; shortening lifetime to one day makes the revocation notice unnecessary but raises yearly transactions from 4,397 to 1,604,905 and zeroes out the spare-attempt margin.
  6. 06 End-to-End Encryption Applications What counts is who can read the content: in transport encryption, 10 of 10 layers see the content in the clear; in end-to-end encryption, 2 do. Trusted items required drop from 36 to 4, and records seen in the clear go from 30,930 thousand to 5,460 thousand a day. In exchange, 6 capabilities are lost — 4 have a 16-item edge-side counterpart, 2 do not; keeping the key only at the edge makes 172,200 records a year unrecoverable, and an escrow key that can read the content raises the layer count from 2 to 3.

03

Enterprise Identity

Where the trust root stands at enterprise scale and what it costs when it breaks: the number of systems bound to the central identity repository and the items replication rescues, the ticket flow reduced to the ticket-granting service's key, the paths a fallback behavior opens when the central network authentication service is unreachable, the applications bound to a single identity provider along with the assertion's lifetime and revocation window, the paths each factor type closes and fails to close, the central policy's propagation rounds and the items it never reaches, the count of horizontal and vertical privilege escalation paths, and the paths controls close against credential theft.

  1. 01 Directory Services Measuring the central identity repository as a trust root: 13 of 16 systems being bound to a single repository, the chain from root to login holding 9, 8, or 2 items depending on connection mode, a 12-hour outage stopping 609 account logins across 13 systems, the third replica rescuing no new system, and 646 items needing manual renewal when integrity breaks.
  2. 02 Ticket-Based Authentication Reducing the ticket flow to the ticket-granting service's key: the claims proven across six steps and the key each step rests on, 471 key items dividing across five types, a single root key's compromise dropping all 214 principals and 21 services, and renewal holding to two rounds and a 176-hour window.
  3. 03 Authentication for Network Access Measuring the central network authentication service in terms of access decisions: 80 devices asking a single service, a 6-item chain per device, four fallback behaviors opening between 0 and 1348 paths when the service is unreachable and stopping up to 957 legitimate ends, 436 new paths staying open in today's mix, and renewing the one shared secret meaning manually touching 80 devices.
  4. 04 Single Sign-On Measuring federation along the axis of the assertion: 15 of 18 applications bound to a single provider and 1562 user connections resting on 90 items, the revocation window determined not by the assertion's 5-minute lifetime but by the application's local session reaching 72 hours, and key rotation producing a manual item and an outage in 5 applications.
  5. 05 Multi-Factor Authentication Measuring factor types by the path they close: in a set of 10 paths, no factor type closing more than 6, 4 paths closing with none of the six types, using two factors that close the same path together not increasing the closed path count, and closing costing between 428 and 856 registration items for 214 people, 9 to 31 recovery requests, and up to 41 left-out endpoints.
  6. 06 Group Policies and Authorization Management Measuring central enforcement in terms of propagation: 319 of 325 machines being set to pull policy but only 295 of them being reached within the 24-hour window, first-round coverage staying at 51.4%, 30 machines never receiving the policy at all, and local overrides on 67 machines dropping 5 of 12 settings to open 335 paths.
  7. 07 Privilege Escalation Measuring horizontal and vertical escalation as path counting: finding 37 distinct paths from a limited user to a domain administrator across 9 nodes and 20 edges, 32 paths passing through at least one horizontal edge, a single control closing at most 24 paths, three controls together closing all 37, and one control closing no path at all.
  8. 08 Credential Theft How long verification items stay in memory and the path controls close: 6 of 8 item types can be presented directly without knowing the password, 22 paths and 298,958 machine-hours of exposure, six controls closing 17 paths and dropping exposure to 1%, and the remaining 5 paths not closing under any control.

Final exam

Identity, Access and Cryptography — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close