2Cryptography, authentication & PKI

• 2.1Cryptographic techniques

  Covers when to use common-key (symmetric) cryptography, public-key (asymmetric) cryptography, and hybrid cryptography; the representative public-key schemes RSA and elliptic curve cryptography (ECC/ECDSA); Diffie-Hellman (DH) key exchange and PFS (Perfect Forward Secrecy) for safely sharing keys; and the CRYPTREC Cipher List and SSL/TLS Cipher Suite Configuration Guidelines, which guard against cryptographic compromise (危殆化).

• 2.2Hashing and digital signatures

  Covers hash functions (such as SHA-256) with the properties of one-wayness and collision resistance, MAC/HMAC which uses a shared key and a hash function to detect message tampering, digital signatures, which use public-key cryptography to also guarantee authenticity and non-repudiation, and timestamping, code signing, and XML digital signatures.

• 2.3User authentication and multi-factor authentication

  Covers the three authentication factors—knowledge, possession, and biometric—and multi-factor authentication; one-time passwords, challenge-response authentication, and risk-based authentication; the accuracy metrics of biometric authentication (False Rejection Rate (FRR)/False Acceptance Rate (FAR)); FIDO/WebAuthn, which enables passwordless authentication; and Kerberos and RADIUS.

• 2.4Identity federation and PKI

  Covers SAML and OpenID Connect, which realize SSO; OAuth 2.0, a protocol strictly for authorization (note: not authentication); the Certificate Authority (CA) and Validation Authority (VA) that make up PKI (public-key infrastructure); digital certificates (root/server/client); revocation checking via CRL and OCSP; and GPKI.