Unit-1.pdf notes for operating system lab

TYPE THE SUBJECT NAME HERE
SUBJECT CODE
IV VII
20ITPC701
CRYPTOGRAPHY AND NETWORK SECURITY
(Common to CSE & IT)
UNIT NO 1
INTRODUCTION
● Definition
● Terminology
● Applications

20ITPC701
CRYPTOGRAPHY AND NETWORK SECURITY (Common to CSE & IT)
Introduction to Cryptography

Overview
➢ Introduction
➢ Definition
➢ Terminology
➢ History
➢ Goal and Services
➢ Application
20ITPC701

Introduction
Cryptography: Cryptography is a method of storing and transmitting data in a particular form so that only those
for whom it is intended can read and process it. Cryptography is closely related to the disciplines of cryptology
and cryptanalysis. Cryptography includes techniques such as microdots, merging words with images, and
other ways to hide information in storage or transit.
The art and science of concealing the messages to introduce secrecy in
information security is recognized as cryptography.
20ITPC701

Definition
Cryptography is the science of using mathematics to encrypt and decrypt
data.
Phil Zimmermann
Cryptography is the art and science of keeping messages secure.
Bruce Schneier
20ITPC701

Terminologies
A message is plaintext (sometimes called cleartext). The process of disguising a
message in such a way as to hide its substance is encryption. An encrypted
message is ciphertext. The process of turning ciphertext back into plaintext is
decryption.
A cipher (or cypher) is an algorithm for performing encryption or decryption—a
series of well-defined steps that can be followed as a procedure.
20ITPC701

20ITPC701
Terminology
A cryptosystem is an implementation of cryptographic techniques and their
accompanying infrastructure to provide information security services. A
cryptosystem is also referred to as a cipher system. The various components of a
basic cryptosystem are as follows −
§Plaintext §Encryption Algorithm
§Ciphertext §Decryption Algorithm
§Encryption Key §Decryption Key

Terminology
Plaintext: Message that is going to be transmitted or stored is plain text. Anyone can read plaintext.
Encryption: The method by which we can hide the actual meaning of plaintext is called Encryption.
Cipher text: The result of encryption which results in unreadable gibberish is called Cipher text.
Decryption: The method by which the original meaning of cipher text can be recovered is called
Decryption. Simply the process of converting Cipher text to plaintext is called Decryption.
Key: Key is the secret piece of information which is used for encryption and decryption in Cryptography.
Cryptanalysis: The science of retrieving the plain text from cipher without knowing the key.
Cryptanalysts: The people who practice cryptanalysis are called Cryptanalyst.
Cryptosystem: The combination of algorithm, key, and key management functions used to perform
cryptographic operations.
20ITPC701

Cryptology
While cryptography is the science of securing data, cryptanalysis is
the science of analyzing and breaking secure communication.
Classical cryptanalysis involves an interesting combination of analytical
reasoning, application of mathematical tools, pattern finding, patience,
determination, and luck. Cryptanalysts are also called attackers.
Cryptology embraces both cryptography and cryptanalysis.
20ITPC701

History of Cryptography
➢ As civilizations evolved, human beings got organized in tribes, groups, and
kingdoms. This led to the emergence of ideas such as power, battles,
supremacy, and politics.
➢ These ideas further fueled the natural need of people to communicate
secretly with selective recipient which in turn ensured the continuous
evolution of cryptography as well.
➢ The roots of cryptography are found in Roman and Egyptian civilizations.
20ITPC701

•Hieroglyph
•The first known evidence of cryptography can be traced to the use of ‘hieroglyph’.
Some 4000 years ago, the Egyptians used to communicate by messages written
in hieroglyph.
20ITPC701

Caesar Shift Cipher
➢ Caesar Shift Cipher, relies on shifting the letters
of a message by an agreed number (three was a
common choice), the recipient of this message
would then shift the letters back by the same
number and obtain the original message.
➢ The Caesar cipher is named after Julius Caesar ,
who used it with a shift of three to protect
messages of military significance.
20ITPC701

Caesar Shift Cipher
Encryption Decryption
PLAINTEXT :
CYPHERTEXT :
internet society ghana chapter
lqwhuqhw vrflhwb jkdqd
fkdswhu
20ITPC701

Goal and Services
Goal: The primary goal of cryptography is to secure important data on the hard disk
or as it passes through a medium that may not be secure itself. Usually, that
medium is a computer network.
Services: Cryptography can provide the following services:
•Confidentiality (secrecy)
•Integrity (anti-tampering)
•Authentication
•Non-repudiation.
20ITPC701

Confidentiality (secrecy)
•Ensuring that no one can read the message except the
intended receiver
•Data is kept secret from those without the proper
credentials, even if that data travels through an
insecure medium
Integrity (anti-tampering)
•Assuring the receiver that the received message has
not been altered in any way from the original.
20ITPC701

Authentication
Cryptography can help establish identity for
authentication purposes The process of proving
one's identity. (The primary forms of host-to-host
authentication on the Internet today are name-
based or address-based, both of which are
notoriously weak.)
Non-repudiation
A mechanism to prove that the sender really sent this message
20ITPC701

1. ATM
2. Email-Passwords
3. E-Payment
4. E-Commerce
5. Electronic Voting
6. Defence Services
7. Securing Data
8. Access Control
20ITPC701

Web References:
http://www.cse.iitm.ac.in/~chester/courses/16e_cns/slides/01_Introduction.pdf
Video Link:
https://www.youtube.com/watch?v=IkfggBVUJxY
20ITPC701

SUBJECT CODE
SUBJECT CODE
SUBJECT CODE
IV VII
20ITPC701
CRYPTOGRAPHY AND NETWORK
SECURITY
UNIT NO I
INTRODUCTION
● 1.2.Security Trends

SUBJECT CODE
20ITPC701
INFORMATION TECHNOLOGY
CRYPTOGRAPHY AND NETWORK SECURITY(Common
to CSE & IT)
1.2.SECURITY TRENDS IN CRYPTOGRAPHY
• In 1994, the Internet Architecture Board (IAB) issued a report entitled "Security in the
Internet Architecture" (RFC 1636).The report stated the general consensus that the
Internet needs more and better security, and it identified key areas for security
mechanisms.
Among these were the need
• To secure the network infrastructure from unauthorized monitoring
• To control of network traffic
• To secure end-user-to-end-user traffic using authentication and encryption
mechanisms.
• Consider the trends reported by the Computer Emergency Response Team (CERT)
Coordination Center (CERT/CC).

SUBJECT CODE
20ITPC701
to CSE & IT)
Figure 1.1a. CERT Statistics

SUBJECT CODE
20ITPC701
to CSE & IT)
Figure 1.1a shows the trend in Internet-related vulnerabilities reported to CERT
over a 10-year period. These include security weaknesses in the operating
systems of attached computers (e.g., Windows, Linux) as well as
vulnerabilities in Internet routers and other network devices.
Figure 1.1b shows the number of security-related incidents reported to CERT.
These include
– Denial of service attacks;
– IP spoofing, in which intruders create packets with false IP addresses
and exploit applications that use authentication based on IP;
– Various forms of eavesdropping
– Packet sniffing, in which attackers read transmitted information,
including logon information and database contents.

SUBJECT CODE
20ITPC701
to CSE & IT)
Figure 1.2. Trends in Attack Sophistication and Intruder Knowledge

SUBJECT CODE
20ITPC701
to CSE & IT)
Attacks have become more automated and can cause greater amounts of damage. This
increase in attacks coincides with
(i)an increased use of the Internet and with increases in the complexity of protocols,
applications, and the Internet itself.
(ii)Critical infrastructures increasingly rely on the Internet for operations. Individual users
rely on the security of the Internet, email, the Web, and Web-based applications to a
greater extent than ever.
Thus, a wide range of technologies and tools are needed to counter the growing threat.
(i)At a basic level, cryptographic algorithms for confidentiality and authentication assume
greater importance.
(ii)As well designers need to focus on Internet-based protocols and the vulnerabilities of
attached operating systems and applications.

SUBJECT CODE
CRYPTOGRAPHY AND NETWORK SECURITY ( Common to CSE and IT)
CS8792
CRYPTOGRAPHY AND
SUBJECT CODE
IV VII
20ITPC701
(Common to CSE & IT )
UNIT NO 1
INTRODUCTION
Legal Ethical and Professional aspects of
security

SUBJECT CODE
CS8792
CS8792
Law and Ethics in Information Security
● Laws
○ Rules that mandate or prohibit certain behavior
○ ´ Drawn from ethics
● Ethics
○ Define socially acceptable behaviors
● Key Difference
○ Laws carry the authority of a governing body
○ Ethics do not carry the authority of a governing body
○ Based on cultural mores
■ Fixed Moral attitude or customs
○ Some ethics standards are universal
20ITPC701

SUBJECT CODE
CS8792
CS8792
Organizational Liability and the Need for Counsel
Liability
Legal obligation of organization
Extends beyond criminal or contract law
Include legal obligation to restitution
Employee acting with or without the authorization performs
and illegal or unethical act that causes some degree of harm
Employer can be held financially liable
Due care
Organization makes sure that every employee knows what
is acceptable or unacceptable
Knows the consequences of illegal or unethical actions
20ITPC701

Organizational Liability and the Need for Counsel
Due diligence
Requires
Make a valid effort to protect others
Maintains the effort
Jurisdiction
Court’s right to hear a case if a wrong is committed
Term – long arm
Extends across the country or around the world
20ITPC701

Policy Versus law
Policies
Guidelines that describe acceptable and unacceptable employee
behaviors
Functions as organizational laws
Has penalties, judicial practices, and sanctions
Difference between policy and law
Ignorance of policy is acceptable
Ignorance of law is unacceptable
Keysfor a policy to be enforceable
Dissemination
Review
Comprehension
Compliance
Uniform enforcement
20ITPC701

International Laws and Legal Bodies
Organizations do business on the Internet – they do
business globally
Professionals must be sensitive to the laws and
ethical values of many different cultures, societies,
and countries
Few international laws relating to
privacy and
informational security
International laws are
limited in their enforceablity
20ITPC701

Council of Europe Convention on Cybercrime
Created a international task force to oversee a range of security functions
associated with Internet activities for standardized technology laws
across international borders.
34 countries attended the signing in November 2001, only 29
nations,including the United States, have ratified the Convention as of
April 2010.
Attempts to improve the effectiveness of international
investigations into breaches of technology law. This convention has
been well received by advocates of intellectual property rights because
it emphasizes prosecution for copyright infringement.
Concern raised by those concerned with freedom of
speech and civil liberties
Overall goal
Simplify the acquisition of information for law enforcement
agencies in certain types of international crimes
20ITPC701

Agreement on Trade-Related Aspects of Intellectual Property Rights
Created by the World Trade Organization
Introduced intellectual property rules into the
multilateral trade system
First significant international effort to protect
intellectual property rights
20ITPC701

Covers five issues
How basic principles of the trading system and other
international intellectual property agreements should
be applied
How to give adequate protection to intellectual
property rights
How countries should enforce those rights adequately
in their own territories
How to settle disputes on intellectual property between
members of the WTO
Special transitional arrangements during the period
when the new system is being introduced
Agreement on Trade-Related Aspects of Intellectual Property Rights
20ITPC701

Digital Millennium Copyright Act
The Digital Millennium Copyright Act (DMCA) is the American
contribution to an international effort by the World Intellectual
Properties Organization (WIPO) to reduce the impact of
copyright, trademark, and privacy infringement
This law was created in response to the 1995 adoption of Directive
95/46/EC by the European Union, which added protection for
individuals with regard to the processing of personal data and the
use and movement of such data.
The United Kingdom has implemented a version of this law
called the Database Right, in order to comply with Directive
95/46/EC.
20ITPC701

DMCA Provisions
Prohibits the circumvention protections and
countermeasures implemented by copyright owners to
control access to protected content
Prohibits the manufacture of devices to circumvent
protections and countermeasures that control access to
protected content
Bans trafficking in devices manufactured to circumvent
protections and countermeasures that control access to
protected content
Prohibits the altering of information attached or imbedded
into copyrighted material
Excludes Internet service providers from certain forms of
contributory copyright infringement
20ITPC701

Major IT Professional Organizations
Association of Computing Machinery (ACM)
“World’s first educational and scientific computing society”
Strongly promotes education
Provides discounts for student members
● Ethics of security professionals
International Information Systems Security Certification
Consortium, Inc. (ISC)2
Nonprofit organization
Focuses on the development and implementation of
information security certifications and credentials
Manages a body of knowledge on information security
Administers and evaluated examinations for information
security certifications
20ITPC701

Information Systems Audit and Control Association (ISACA)
Focuses on auditing, control, and security
Membership includes technical and managerial professionals
Does not focus exclusively on information security
Has many information security components
Focus:Tasks and knowledge required of the information systems
audit professional
Information Systems Security Associations (ISSA)
Nonprofit society of information security professionals
Mission – bring together qualified information security practioners
Information exchange
Education development
Focus – “promoting management practices that will ensure the
confidentiality, integrity, and availability of organizational
information resources”
20ITPC701

Systems Administration, Networking, and Security
Institute (SANS)
Professional research and education cooperative
Current membership > 156,000
Security professionals
Auditors
System administrators
Network administrators
Offers set of certifications
Focus:Requires certificants to follow its published code of ethics
20ITPC701

U.S. Federal Agencies
Department of Homeland Security
Five directorates or divisions
Mission – protecting the people as well as the physical and
informational assets of the United States
Directorate of Information and Infrastructure
Creates and enhances resources used to discover and responds
to attacks on national information systems and critical
infrastructure
Directorate of Science and Technology
Research and development activities in support of homeland
defense
Examination of vulnerabilities
Sponsors emerging best practices
20ITPC701

National InfraGard Program
Each FBI office establishes a chapter
Collaborates with public and private organizations and
academia
Serves members in 4 ways
Maintains an intrusion alert network using encrypted e-mail
Maintains a secure Web site for communication about
suspicious
activity or intrusions
Sponsors local chapter activities
Operates a help desk for questions
Contribution – free exchange of information to and from the
private sector in the areas of threats and attacks on
information resources
20ITPC701

National Security Administration (NSA)
“the nation’s cryptologic organization. It coordinates,
directs, and performs highly specialized activities to protect
U.S. information systems and produce foreign intelligence
information… It is also one of the most important centers
of foreign language analysis and research within the
Government.”
U. S. Secret Service
Located in Department of the Treasury
Charged with the detection and arrest of any person
committing a United States federal offense relating to
computer fraud and false identification crimes.
20ITPC701

IV VII
20ITPC701
SECURITY(Common to CSE & IT)
UNIT NO I
INTRODUCTION
1.4 NEED FOR SECURITY AT MULTIPLE LEVELS,
SECURITY POLICIES

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
NEED FOR SECURITY
• Many Initial computer applications had very little security. This continued for a number of years
until the importance of data was truly realized.
• When computer applications were developed to handle financial and personal data, the real need
for security was felt like never before.
• People realized that data on computers is an extremely important aspect of modern life.
Therefore, various areas in security began to gain prominence.
• Two typical examples of such security mechanisms are as follows.
1.Provide a user id and password to every user, and use that information to authenticate a user
2.Encode information stored in the databases in some fashion, so that it is not visible to users
who do not have the right permissions

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
NEED FOR SECURITY
• Organizations employed their own mechanisms in order to provide for these kinds of basic
security mechanisms.
• As technology improved, the communication infrastructure became extremely mature, and newer
applications began to be developed for various demands and needs. Soon, People realized that
the basic security measures were not quite enough.
• Furthermore, the Internet took the word by storm and there were many examples of what could
happen if there was insufficient security built in applications developed for the Internet.

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
NEED FOR SECURITY
Information travelling from a client to a server over the Internet

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
SECURITY POLICIES
Types of Information Security Policies
Information Security Policy
- set of rules for the protection of an organization's information assets.
Types
1. Enterprise Information Security Policies.
- General Security Policies.
2. Issue – Specific Security Policies.
- Specific Technology Policies.
3. System – Specific Security Policies.
- Configurations.

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
SECURITY POLICIES
Enterprise Information Security Policies(EISP)
• Supports the mission, vision, and direction of the organization
• Sets the strategic direction, scope, and tone for all security efforts
• Executive-level document
• Drafted by organization's chief information officer
• Expresses the security philosophy within the IT environment
• Guides the development, implementation, and management of the security program
• Address an organization's need to comply with laws and regulations in two ways:
• General compliance
• Identification of specific penalties and disciplinary actions

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
SECURITY POLICIES
Issue – Specific Security Policies(ISSP)
• Addresses specific areas of technology
• Requires frequent updates
• Contains a statement on the organization's position on a specific issue
• May cover:
• Use of company. owned networks and the Internet
• Use of telecommunications technologies (fax and phone),Use of electronic mail
• Specific minimum configurations of computers to defend against worms and viruses
• Prohibitions against hacking or testing organization security controls
• Home use of company. owned computer equipment
• Use of personal equipment on company networks
• Use of photocopy equipment

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
SECURITY POLICIES
System Specific Security Policies(SSSP)
• Appear with the managerial guidance expected in a policy
• Include detailed technical specifications not usually found in other types of policy documents
• Managerial Guidance SysSPs
• Guide the implementation and configuration of a specific technology
• Technical Specifications SysSPs
• General methods for implementing technical controls

SUBJECT CODE
20ITPC701
INFORMATION
TECHNOLOGY
E
-
SECURITY POLICIES
System Specific Security Policies(SSSP)
• Access control lists-Set of specifications that identifies a piece of technology's authorized users and
details on the rights and privileges those users have on that technology
• Access control matrix
• Combines tables and ACLs
• Configuration rules
• Specific instructions entered into a security system to regulate how it reacts to the data it receives
• Rule-based policies
• More specific to a system's operation than ACLs
• May or may not deal with users directly

SUBJECT CODE
SUBJECT CODE
SUBJECT CODE
IV VII
UNIT NO 1
INTRODUCTION
1.5 Security Policies - Model of Network
Security
20ITPC701

SUBJECT CODE
20ITPC701
MODEL OF NETWORK SECURITY
MODEL FOR NETWORK ACCESS SECURITY
• using this model requires us to:
1.select appropriate gatekeeper functions to identify users
2.implement security controls to ensure only authorised users access designated information or
resources
• trusted computer systems may be useful to help implement this model

SUBJECT CODE
20ITPC701

SUBJECT CODE
20ITPC701
MODEL FOR NETWORK ACCESS SECURITY
• using this model requires us to:
1. design a suitable algorithm for the security transformation
2. generate the secret information (keys) used by the algorithm
3. develop methods to distribute and share the secret information
4. specify a protocol enabling the principals to use the transformation and secret information for a
security service

SUBJECT CODE
20ITPC701
VIDEO LINK
https://www.youtube.com/watch?v=qvhRBbWYg04
QUIZ LINK
https://forms.gle/UcKt8eiB7HLvJKEk7

SUBJECT CODE
IV VII
20ITPC701
SECURITY (Common to CSE & IT)
UNIT NO 1
SECURITY ATTACKS,SERVICES
AND MECHANISMS
● OSI SECURITY ARCHITECHTURE
● SECURITY ATTACKS
● SECURITY SERVICES
● SECURITY MECHANISMS

20ITPC701
CRYPTOGRAPHY AND NETWORK SECURITY(Common to CSE & IT)
•ITU-T X.800 “Security Architecture for OSI” defines a
systematic approach
•The OSI security architecture is useful to managers as a way
of organizing the task of providing security.
•This architecture was developed as an international standard
Computer and Communications vendors have developed security
features for their products and services that relate to this
structured definition of services and mechanisms
OSI SECURITY ARCHITECTURE

20ITPC701
Security attacks, Mechanisms, and Services.
• Security attack: Any action that compromises the security of
information owned by an organization.
•Security mechanism: A process (or a device incorporating such a
process) that is designed to detect, prevent, or recover from a
security attack.
•Security service: A processing or communication service that
enhances the security of the data processing systems and the
information transfers of an organization. The services are intended
to counter security attacks, and they make use of one or more
security mechanisms to provide the service.
THE OSI SECURITY
ARCHITECTURE

20ITPC701
RFC 4949, INTERNET SECURITY
GLOSSARY
THREAT: A potential for violation of security, which exists when
there is a circumstance, capability, action, or event that could
breach security and cause harm. That is, a threat is a possible
danger that might exploit a vulnerability.
ATTACK: An assault on system security that derives from an
intelligent threat; that is, an intelligent act that is a deliberate
attempt (especially in the sense of a method or technique) to
evade security services and violate the security policy of a
system.

20ITPC701
SECURITY ATTACKS
•Passive attacks
•Active attacks
Passive Attacks
A passive attack attempts to learn or make use of information from
the system but does not affect system resources
eg. Eavesdropping on or monitoring of transmissions. The goal
of the opponent is to obtain information that is being transmitted

CS8792
TYPES OF PASSIVE
ATTACKS
1)Release of message contents :Telephone
conversation, an electronic mail message, and a
transferred file may contain sensitive or confidential information.
2)Traffic analysis: The opponent could determine the location and
identity of communicating hosts and could observe the frequency and
length of messages being exchanged. This information might be useful
in guessing the nature of the communication that was taking place.
•Passive attacks are very difficult to detect
•They do not involve any alteration of the data.
•The message traffic is sent and received in an apparently normal
fashion, and neither the sender nor receiver is aware that a third party
has read the messages or observed the traffic pattern.
•However, it is feasible to prevent the success of these attacks, usually
by means of encryption.
•Thus, the emphasis in dealing with passive attacks is on prevention
rather than detection.

20ITPC701
ACTIVE ATTACKS
Active attacks involve some modification of the data stream or the
creation of a false stream .It attempts to alter system resources or affect
their operation.

20ITPC701
TYPES OF ACTIVE ATTACKS
Four categories:
1. Masquerade
2. Replay
3. Modification of messages and
4. Denial of service.
1.Masquerade
•Masquerade takes place when one entity pretends to be a different
entity
For example, Authentication sequences can be captured and replayed
after a valid authentication sequence has taken place, thus enabling
an authorized entity with few privileges to obtain extra privileges by
impersonating an entity that has those privileges.

20ITPC701
2.Replay involves the passive capture of
a data unit and its subsequent retransmission to
produce an unauthorized effect
3.Modification of messages simply means that some portion of a legitimate
message is altered, or that messages are
delayed or reordered, to produce an unauthorized effect (paths 1
and 2 active).
For example, a message meaning “Allow John Smith to read confidential file
accounts” is modified to mean “Allow Fred Brown to read confidential file accounts.”
4.Denial of service prevents or inhibits the normal use or management of
communications facilities (path 3 active). This attack may have a specific target;
Eg-an entity may suppress all messages directed to a particular destination (e.g.,
the security audit service). Another form of service denial is the disruption of an
entire network, either by disabling the network or by overloading it with messages
so as to degrade performance.

20ITPC701
PASSIVE VS ACTIVE ATTACKS
•Active attacks present the opposite characteristics of passive attacks.
Whereas passive attacks are difficult to detect, measures are available to
prevent their success.
•On the other hand, it is quite difficult to prevent active attacks absolutely
because of the wide variety of potential physical, software, and network
vulnerabilities.
•Instead, the goal is to detect active attacks and to recover from any disruption
or delays caused by them. If the detection has a deterrent effect, it may also
contribute to prevention.

20ITPC701
SECURITY SERVICES
X.800 defines a security service as a service that is provided by a protocol
layer of communicating open systems and that ensures adequate security of
the systems or of data transfers.
RFC 4949, provides the following definition: a processing or
communication service that is provided by a system to give a specific kind of
protection to system resources; security services implement security policies
and are implemented by security
mechanisms.
X.800 divides these services into five categories and fourteen specific services
1)Authentication
•The authentication service is concerned with assuring that a communication is
authentic.
•In case of a single message, such as a warning or alarm signal, the function of
the authentication service is to assure the recipient that the message is from
the source that it claims to be from.
•In case of an ongoing interaction, such as the connection of a terminal to a
host, two aspects are involved.

20ITPC701
SECURITY SERVICES-
AUTHENTICATION
1.At the time of connection initiation, the service assures that the two
entities are authentic, that is, that each is the entity that it claims to be.
1.The service must assure that the connection is not interfered with in
such a way that a third party can masquerade as one of the two
legitimate parties for the purposes of unauthorized transmission or
reception.

CS8792
SECURITY SERVICES-
AUTHENTICATION
Two specific authentication services are defined in X.800:
• Peer entity authentication: Provides for the corroboration of the
identity of a peer entity in an association. Two entities are
considered peers if they implement to same protocol in different
systems ;for example two TCP modules in two communicating
systems.
•Data origin authentication: Provides for the corroboration of the
source of a data unit. It does not provide protection against the
duplication or modification of data units. This type of service supports
applications like electronic mail, where there are no prior interactions
between the communicating entities.

CS8792
SECURITY SERVICES

CS8792
SECURITY MECHANISMS
•The mechanisms are divided into those that are implemented in a
specific protocol layer, such as TCP or an application-layer
protocol, and those that are not specific to any particular protocol
layer or security service.
•X.800 distinguishes between reversible encipherment mechanisms
and irreversible encipherment mechanisms.
2)ACCESS CONTROL
•Access control is the ability to limit and control the access to
host systems and applications via communications links.
•To achieve this, each entity trying to gain access must first be
identified, or authenticated, so that access rights can be tailored to
the individual.

CS8792
3)DATA CONFIDENTIALITY
•Confidentiality is the protection of transmitted data from passive
attacks. With respect to the content of a data transmission, several
levels of protection can be identified.
•The broadest service protects all user data transmitted between two
users over a period of time. For example, when a TCP connection is
set up between two systems, this broad protection prevents the
release of any user data transmitted over the TCP connection.
•Narrower forms of this service can also be defined, including the
protection of a single message or even specific fields within a
message.
SECURITY MECHANISMS

CS8792
4)Data Integrity
•As with confidentiality, integrity can apply to a stream of
messages, a single message, or selected fields within a message.
•A connection-oriented integrity service, one that deals with a
stream of messages, assures that messages are received as sent
with no duplication, insertion, modification, reordering, or replays.
The destruction of data is also covered under this service.
•Connection-oriented integrity service addresses both
message stream modification and denial of service.
•Connectionless integrity service, one that deals with individual
messages without regard to any larger context, generally provides
protection against message modification only.
SECURITY MECHANISMS

CS8792
5)Nonrepudiation
Prevents either sender or receiver from denying a transmitted
message. Thus, when a message is sent, the receiver can
prove that the alleged sender in fact sent the message.
Similarly, when a message is received, the sender can prove
that the alleged receiver in fact received the message.
6)Availability
•A system resource being accessible and usable upon
demand by an authorized system entity, according to
performance specifications for the system (i.e., a system is
available if it provides services according to the system
design whenever users request them).
•Protects a system to ensure its availability.
•This service addresses the security concerns raised by
denial-of-service attacks.
SECURITY MECHANISMS

CS8792
SECURITY MECHANISMS
•The mechanisms are divided into those that are implemented in
a specific protocol layer, such as TCP or an application-layer
protocol, and those that are not specific to any particular
protocol layer or security service.
•X.800 distinguishes between reversible encipherment
mechanisms and irreversible encipherment mechanisms.

CS8792
SECURITY MECHANISMS

CS8792
THANK
YOU

SUBJECT CODE
IV VII
20ITPC701
UNIT NO 1

20ITPC701
• Proposed by ITU-T in recommendation X.800 as “Security Architecture for
OSI”
• An international and systematic standard of defining and providing security
requirements. that is used by IT managers and vendors in their products as a
way of organizing the task of providing security.
• Computer and Communications vendors have developed security features for
their products and services that relate to this structured definition of services
and mechanisms.
• OSI Security Architecture helps in assessing effectively the security needs of
an organization and to evaluate and choose various security products and

20ITPC701
The OSI security architecture focuses on
•Security attack: Any action that compromises the security of
information owned by an organization.
• Security mechanism: A process (or a device incorporating such a
process) that is designed to detect, prevent, or recover from a
security attack.
• Security service: A processing or communication service that
enhances the security of the data processing systems and the
information transfers of an organization.
The services are intended to counter security attacks, and they
make use of one or more security mechanisms to provide the
service.
THE OSI SECURITY ARCHITECTURE

20ITPC701
RFC 4949, INTERNET SECURITY GLOSSARY
THREAT:
A potential for violation of security, which exists when there is a
circumstance, capability, action, or event that could breach security
and cause harm. That is, a threat is a possible danger that might
exploit a vulnerability.
ATTACK:
An assault on system security that derives from an intelligent threat;
that is, an intelligent act that is a deliberate attempt (especially in the
sense of a method or technique) to evade security services and
violate the security policy of a system.

20ITPC701
SECURITY ATTACKS
Passive Attacks
A passive attack attempts to learn or make use of information from the
system but does not affect system resources
eg. eavesdropping on or monitoring of transmissions.
The goal of the opponent is to obtain information that is being transmitted

20ITPC701
TYPES OF PASSIVE ATTACKS
1) 1)Release of message contents :
Telephone conversation, an electronic mail message, and a
transferred file may contain sensitive or confidential information.
2)Traffic analysis:
The opponent could determine the location and identity of communicating hosts
and could observe the frequency and length of messages being exchanged. This
information might be useful in guessing the nature of the communication that was
taking place.
Features:
1) Passive attacks are very difficult to detect
2) They do not involve any alteration of the data.
3) However, it is feasible to prevent the success of these attacks, usually by means of
encryption.
■ Thus, the emphasis in dealing with passive attacks is on prevention
rather than detection.

20ITPC701
ACTIVE ATTACKS
Active attacks involve some modification of the data stream or the creation of a
false stream .It attempts to alter system resources or affect their operation

20ITPC701
Four Types of Active Attacks:
● Masquerade
● Replay
● Modification of messages and
● Denial of service.
1.Masquerade
• Masquerade takes place when one entity pretends to be a different
entity
e.g.authentication sequences can be captured and replayed after a valid
authentication sequence has taken place,.
.2.Replay:
Passive capture of a dataunit and its subsequent
retransmission to produce an unauthorized effect

20ITPC701
3.Modification of messages
portion of a legitimate message is altered, or that
messages are delayed or reordered, to produce an
unauthorized effect
e.g., a message meaning “Allow John Smith to read confidential file accounts” is modified
to mean “Allow Fred Brown to read confidential file accounts.”
4.Denial of service
prevents or inhibits the normal use or management of communications facilitie
This attack may have a specific target;
e.g., -an entity may suppress all messages directed to a particular destination (e.g., th
security audit service).
Another form of service denial is the disruption of an entire network, either by disablin
the network or by overloading it with messages so as to degrade performance.

20ITPC701
PASSIVE VS ACTIVE ATTACKS
• Active attacks present the opposite characteristics of passive attacks. s
passive attacks are difficult to detect, measures are available to prevent their
success.
• It is quite difficult to prevent active attacks absolutely because of the wide
variety of potential physical, software, and network vulnerabilities.
• Instead, the goal is to detect active attacks and to recover from any disruption
or delays caused by them. If the detection has a deterrent effect, it may also
contribute to prevention.

Security Mechanisms (X.800)
The mechanisms are divided into those that are implemented in a specific
protocol layer, such as TCP or an application-layer protocol, and those
that are not specific to any particular protocol layer or security service.
⚫Specific Security Mechanisms:
Encipherment, Digital signatures, Access controls, Data integrity,
Authentication exchange, Traffic padding, Routing control, Notarization
⚫Pervasive Security Mechanisms:
Trusted functionality, Security labels, Event detection, Security audit trails,
Security recovery
20ITPC701

Specific Security Mechanisms
1). Encipherment:
The use of mathematical algorithms to transform data into a form that is not
readily intelligible.
The transformation and subsequent recovery of the data depend on an algorithm
and zero or more encryption keys.
X.800 distinguishes between reversible encipherment mechanisms and
irreversible encipherment mechanisms.
A reversible encipherment mechanism is simply an encryption algorithm that
allows data to be encrypted and subsequently decrypted.
Irreversible encipherment mechanisms include hash algorithms and message
authentication codes, which are used in digital signature and message
authentication applications.
20ITPC701

2). Digital Signature:
Data appended to, or a cryptographic transformation of, a data unit that
allows a recipient of the data unit to prove the source and integrity of the data
unit and protect against forgery (e.g., by the recipient).
3) Access Control:
A variety of mechanisms that enforce access rights to resources.
4) Data Integrity:
A variety of mechanisms used to assure the integrity of a data unit or
stream of data units.
5) Authentication Exchange
A mechanism intended to ensure the identity of an entity by means of
information exchange.
20ITPC701

6) Traffic Padding
The insertion of bits into gaps in a data stream to frustrate traffic analysis
attempts.
7). Routing Control
Enables selection of particular physically secure routes for certain data and
allows routing changes, especially when a breach of security is suspected.
8) Notarization
The use of a trusted third party to assure certain properties of a data
exchange.
A variety of mechanisms that enforce access rights to resources.
20ITPC701

Pervasive Security Mechanisms
Mechanisms that are not specific to any particular OSI security service or protocol
layer.
1) Trusted Functionality
. That which is perceived to be correct with respect to some criteria (e.g.,
as established by a security policy).
2). Security Label
The marking bound to a resource (which may be a data unit) that names
or designates the security attributes of that resource.
3) Event Detection
Detection of security-relevant events.
4) Security Audit Trail
Data collected and potentially used to facilitate a security audit, which is
an independent review and examination of system records and activities
5) Security Recovery
Deals with requests from mechanisms, such as event handling and
management functions, and takes recovery action
20ITPC701

20ITPC701
SECURITY SERVICES
X.800 defines a security service as a service that is provided by a protocol
layer of communicating open systems and that ensures adequate security of
the systems or of data transfers.
RFC 2828,, provides the following definition: a processing or
communication service that is provided by a system to give a specific kind of
protection to system resources; security services implement security policies
and are implemented by security mechanisms.
X.800 divides these services into five categories and fourteen specific services

20ITPC701
SECURITY SERVICES-AUTHENTICATION
1)Authentication
•The authentication service is concerned with assuring that a communication is
authentic.
•In case of a single message, such as a warning or alarm signal, the function of the
authentication service is to assure the recipient that the message is from the source
that it claims to be from.
•In case of an ongoing interaction, such as the connection of a terminal to a host, two
aspects are involved.
1.1)At the time of connection initiation, the service assures that the two entities are
authentic, that is, that each is the entity that it claims to be.
2.2)The service must assure that the connection is not interfered with in such a way
that a third party can masquerade as one of the two legitimate parties for the
purposes of unauthorized transmission or reception.

20ITPC701
SECURITY SERVICES-AUTHENTICATION
Two specific authentication services are defined in X.800:
•Peer entity authentication: Provides for the corroboration of the identity of a
peer entity in an association.
•Two entities are considered peers if they implement to same protocol in different
systems ;for example two TCP modules in two communicating systems.
•Data origin authentication: Provides for the corroboration of the source of a data
unit.
•It does not provide protection against the duplication or modification of data units.
•This type of service supports applications like electronic mail, where there are no prior
interactions between the communicating entities.

20ITPC701
SECURITY SERVICES
2)Access Control
• Access control is the ability to limit and control the access to host systems and
applications via communications links.
• To achieve this, each entity trying to gain access must first be identified, or
authenticated, so that access rights can be tailored to the individual.
3)Data Confidentiality
• Confidentiality is the protection of transmitted data from passive attacks.
• The broadest service protects all user data transmitted between two users over
period of time. For example, when a TCP connection is set up between tw
systems, this broad protection prevents the release of any user data transmitte
over the TCP connection.
• Narrower forms of this service can also be defined, including the protection of
single message or even specific fields within a message.

20ITPC701
SECURITY SERVICES
● The other aspect of confidentiality is the protection of traffic flow from analysis. This
requires that an attacker not be able to observe the source and destination, frequency,
length, or other characteristics of the traffic on a communications facility.
Connection Confidentiality
The protection of all user data on a connection
Connectionless Confidentiality.
The protection of all user data in a single data block
Selective-Field Confidentiality
The confidentiality of selected fields within the user data on a connection or
in a single data block.
Traffic Flow Confidentiality
The protection of the information that might be derived from observation of traffic
flows.

20ITPC701
4)Data Integrity
• As with confidentiality, integrity can apply to a stream of messages,
a single message, or selected fields within a message.
• A connection-oriented integrity service, one that deals with a stream
of messages, assures that messages are received as sent with no
duplication, insertion, modification, reordering, or replays. The
destruction of data is also covered under this service.
• Connection-oriented integrity service addresses both message
stream modification and denial of service.
• Connectionless integrity service, one that deals with individual
messages without regard to any larger context, generally provides
protection against message modification only.
SECURITY SERVICES

20ITPC701
• Connection Integrity with Recovery
Provides for the integrity of all user data on a connection and detects
any modification, insertion, deletion, or replay of any data within an
entire data sequence, with recovery attempted
• Connection Integrity without Recovery
provides only detection without recovery
• Selective-Field Connection Integrity
Provides for the integrity of selected fields within the user data of a data
block transferred over a connection and takes the form of determination of
whether the selected fields have been modified, inserted, deleted, or
replayed
• Selective-Field Connectionless Integrity
Provides for the integrity of selected fields within a single connectionless
data block; takes the form of determination of whether the selected fields
have been modified.
SECURITY SERVICES

20ITPC701
5)Nonrepudiation
Prevents either sender or receiver from denying a transmitted message.
when a message is sent, the receiver can prove that the alleged sender in fact
sent the message. similarly, when a message is received, the sender can prove
that the alleged receiver in fact received the message.
Nonrepudiation, Origin
Proof that the message was sent by the specified party.
Nonrepudiation, Destination
Proof that the message was received by the specified party
SECURITY SERVICES

20ITPC701
SECURITY SERVICES
6)Availability:
• A system resource being accessible and usable upon demand by an authorized
system entity, according to performance specifications for the system (i.e., a system
is available if it provides services according to the system design whenever users
request them).
• Protects a system to ensure its availability.
• This service addresses the security concerns raised by denial-of-service attacks.

20ITPC701
Video Links:
https://youtu.be/8McWgtErCQk OSI SECURITY ARCHITECTURE PART - I
https://youtu.be/67MBpoOZpeI OSI SECURITY ARCHITECTURE PART - II1

SUBJECTCODE
IV VII
20ITPC701
CRYPTOGRAPHYAND NETWORK
SECURITY (Common to CSE& IT)
UNIT NO 1
TRANSPOSITION TECHNIQUES
●TRANSPOSITION CIPHERS

Transposition Techniques
20ITPC701

Introduction
 In cryptography, a TRANSPOSITION CIPHER is a method of encryption by which
the positions held by units of plaintext are shifted according to a regular system,
so that the ciphertext constitutes a permutation of the plaintext.
 The order of the units is changed. Mathematically a bijective function is used on
the characters' positions to encrypt and an inverse function to decrypt.
20ITPC701

Transposition Ciphers
 Now consider classical transposition or permutation ciphers
 These hide the message by rearranging the letter order
 Without altering the actual letters used
 Can recognise these since have the same frequency distribution as the
original text
20ITPC701

Transposition Ciphers
Rail Fence cipher
Route cipher
Row Transposition Ciphers
Columnar transposition
Double transposition
Myszkowski transposition
20ITPC701

Rail Fence cipher
● Write message letters out diagonally over a number of rows
● Then read off cipher row by row
● Eg. write message out as:
m e m a t r h t g p r y e t e f e t
e o a a t
● Giving ciphertext
MEMATRHTGPRYETEFETEOAAT
20ITPC701

● Route cipher
20ITPC701

Row Transposition Ciphers
●
●
● A more complex transposition
Write letters of message out in rows over a specified number of columns
Then reorder the columns according to some key before reading off the rows
Key: 3 4 2 1 5 6 7
Plaintext: a t t a c k p
o s t p o n e
d u n t i l t
w o a m x y z
Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ
20ITPC701

Columnar transposition
● ZEBRAS
● 6 3 2 4 1 5
● EVLNA CDTES EAROF ODEECWIREE
20ITPC701

Double transposition
● STRIPE
● "564231
● CAEEN SOIAE DRLEF WEDREEVTOC
20ITPC701

Myszkowski transposition
● TOMATO
● 532164
● TOMATO
● 432143
● ROFOA CDTED SEEEA CWEIV RLENE
20ITPC701

Break Columnar Transposition Cipher
● Cryptanalyst must be aware that he is dealing with cipher
● Frequency of E,T,A,O,I,N,etc
● No of Columns
● Suspect
● Assumption
20ITPC701

Product Ciphers
● Ciphers using substitutions or transpositions are not secure because of
language characteristics
● Hence consider using several ciphers in succession to make harder, but:
○ Two substitutions make a more complex substitution
○ Two transpositions make more complex transposition
○ But a substitution followed by a transposition makes a new much harder
cipher
● This is bridge from classical to modern ciphers
20ITPC701

One-Time Pad
● If a truly random key as long as the message is used, the cipher will be
secure called a One-Time pad
● Is unbreakable since ciphertext bears no statistical relationship to the plaintext
● Since for any plaintext & any ciphertext there exists a key mapping one to
other
● Can only use the key once though problems in generation & safe distribution
of key
20ITPC701

Rotor Machines
● Before modern ciphers, rotor machines were most common complex ciphers in use
widely used in WW2
○ German Enigma, Allied Hagelin, Japanese Purple
● Implemented a very complex, varying substitution cipher
● Used a series of cylinders, each giving one substitution, which rotated and
changed after each letter was encrypted
3
● With 3 cylinders have 26 =17576alphabets
20ITPC701

Hagelin Rotor Machine
20ITPC701

Web Resources
https://www.dcode.fr/transposition-cipher
Video Link
https://nptel.ac.in/courses/106/107/106107155/
https://www.educba.com/transposition-techniques/
20ITPC701

SUBJECT CODE
IV VII
20ITPC701
UNIT NO I INTRODUCTION
1.10.STEGANOGRAPHY

INTRODUCTION
 Derived from the Greek words, Steganos (Covered) & Grapto (Writing)
 It is a method of hiding secret data, by embedding it into an audio, video, image
or text file. It is one of the methods employed to protect secret or sensitive data
from malicious attacks.
 Science of hiding information in such a way that no one suspects the
information exists
 Steganography is usually combined with Cryptography(Encrytion, Decrytion)
 When information or a file is hidden inside a carrier file, the data is
encrypted with a password. Referred as ‘Steganalysis’
20ITPC701

History
Earlier invisible ink was used to write information on pieces of paper
Head of messengers were shaved so, a message could be written on it
Wax tablet was peeled on which message was to be written & refilled
Null cipher sent by the German embassy in World War I
“PRESIDENT'S EMBARGO RULING SHOULDHAVE
IMMEDIATE NOTICE. GRAVE SITUATION AFFECTING
INTERNATIONAL LAW. STATEMENT FORESHADOWS RUIN OF MANY
NEUTRALS. YELLOW JOURNALS UNIFYING NATIONAL
EXCITEMENT IMMENSELY.”
(Taking the first letter in each word of message reveals the hidden text.)
“ PERSHING SAILS FROM NY JUNE 1”
20ITPC701

STEGANOGRAPHY TECHNIQUES
 Character Marking :
Selected letters of printed or typewritten text are overwritten in pencil. The
marks are visible if any bright light is applied to the paper.
 Invisible ink :
A number of substances can be used for writing but leave no visible trace until
heat or some chemical is applied to the paper.
 Pin Punctures :
Small pin punctures on selected letters are ordinarily not visible unless the paper
is held up in front of a light’
 Typewritter correction ribbon :
Used between lines typed with a black ribbon, the results of typing with the
correction tape are visible only under a strong light.
20ITPC701

TYPES OF STEGANOGRAPHY
There are different ways to hide the message, well known are Least Significant bytes
and Injection.
Least Significant bytes :
 When files are created there are usually some bytes in the file that aren't really
needed, or are unimportant. These areas of the file can be replaced with the
information that is to be hidden, with out significantly altering the file or damaging it
 This allows a person to hide information in the file and make sure that no human
could detect the change in the file
 The LSB method works best in Picture files that have a high resolution and
use many different colors, and with Audio files that have different sounds and are
of a high bit rate
 It usually does not increase the file size
20ITPC701

TYPES OF STEGANOGRAPHY
Injection :
 Injection is a relatively simple method than altering the Least
Significant Bit (LSB) technique
 Injection method involves directly injecting the secret information into the
carrier file
 The Payload and Carrier message are directly fed into the specially
designed Stegosystem encoder
 The main problem with this method is that it can significantly increase the
size of the carrier file
20ITPC701

STEGANOGRAPHY TOOLS
• MP3Stego
●Hides information in MP3 files during the compression process. The
●data is first compressed, encrypted and then hidden in the MP3 bit stream
• JPHide and JPSeek
●JPHIDE and JPSEEK are programs which allow you to hide a file in a jpeg visual
image. There are lots of versions of similar programs available on the internet but
JPHIDE and JPSEEK are rather special
• BlindSide Cryptographic Tool
●Secret messages are passed in a form such that one would not suspect the
message that is being transferred. The Blindside utility can hide files of any variety,
within a Windows Bitmap image (BMP file)
20ITPC701

STEGANOGRAPHY TOOLS
• GIFShuffle
● Used to conceal messages in GIF images by shuffling the colourmap, which
leaves the image visibly unchanged. gifshuffle works with all GIF images,
including those with transparency and animation, and in addition provides
compression and encryption of the concealed message
• wbStego
●A tool that hides any type of file in bitmap images, text files, HTML files or Adobe
PDF files. The file in which you hide the data is not optically changed
• StegoVideo
●Allows to hide any file in a video sequence. When the program was created,
different popular codec’s were analyzed and an algorithm was chosen which
provides small data loss after video compression. MSU StegoVideo can be used
as VirtualDub filter or as standalone .exe program, independent from VirtualDub
20ITPC701

STEGANOGRAPHY TOOLS
StegAlyzerAS
●Capability to scan the entire file system, or individual directories, on suspect media
for the presence of Steganography application artifacts. Can perform an automated
or manual search of the Windows Registry to determine whether or not any Registry
keys or values exist that can be associated with a particular Steganography
application
StegAlyzerSS
●Capability to scan every file on the suspect media for the presence of
hexadecimal byte patterns, or signatures, of particular Steganography
applications in the files.
Digital Invisible Ink Toolkit
●Provides a simple Java-based Steganography tool that can hide a message inside
a 24-bit color image so that knowing how it was embedded, or performing
statistical analysis, makes it easy to find the concealed info.
20ITPC701

• Modern Printers
●Steganography is used by leading manufacturers in digital & laser printers,
including HP and Xerox. Here, tiny yellow dots are added to each page. The
dots are barely visible and contain encoded printer serial numbers, as well as
date and time stamps.
• Digital Watermarking
●Steganography is used for digital watermarking, where a message is hidden in
an image so that its source can be tracked or verified.
• E-mail Spam
●e-mail messages is encrypted steganographically. Coupled with the
●"chaffing and winnowing" technique, a sender gets messages out and
● cover their tracks all at once.
20ITPC701
APPLICATIONS OF STEGANOGRAPHY

APPLICATIONS OF STEGANOGRAPHY
• Alleged use by terrorists
●An example showing how terrorists may
●use forum avatars to send hidden messages.
This avatar contains the message "Boss said,
we should blow up the bridge at midnight."
encrypted with http://mozaiq.org/encrypt
using "växjö" as password.
• Alleged use by intelligence services
●In 2010, the FBI revealed that the Russian foreign intelligence service
uses customized steganography software for embedding encrypted text
messages inside image files for communicating with illegal agents
stationed abroad.
20ITPC701

STEGANOGRAPHY VIDEO LINK
https://www.youtube.com/watch?time_continue=8&v=5opGM7jX
vHM&feature=emb_logo
https://www.youtube.com/watch?v=eWYf2YVUsR4
20ITPC701

SUBJECT CODE
IV VII
20ITPC701
CRYPTOGRAPHY AND
NETWORK
SECURITY (Common to CSE
& IT)
UNIT NO 1
INTRODUCTION TO MODERN
CRYPTOGRAPHY
●
●
● SECURITY GOALS
SUBSTITUTION
CIPHER ATTACK
MODELS

UNIT I - Introduction to Modern Cryptography
Encryption
• Much of Security has little to do with Encryption
• Encryption deals with secrecy
• Most real security deals with problems of fraud:
• Message modifications
• Almost invariably, Encryption does not live alone without
some form of authentication
20ITPC701

Definitions:
● Encryption function (& algorithm): E
● Decryption function (& algorithm): D
● Encryption key k1
● Decryption key k2
● Message space (usually binary strings)
● For every message m: D k2(E k1 (m)) = m
20ITPC701

Communication Model
Alice Bob
1. Two parties – Alice and Bob
2. Reliable communication line
3. Shared encryption scheme: E, D, k1, k2
4. Goal: send a message m confidentially
20ITPC701

Threat Model
Alice Bob
4. Goal: send a message m confidentially
Eve
20ITPC701

Security Goals
●
Possibilities:
No adversary can determine m
● No adversary can determine any information about m
● No adversary can determine any meaningful information about m.
20ITPC701

Adversarial model
● Eve attempts to discover information about m
● Eve knows the algorithms E,D
● Eve knows the message space
● Eve has at least partial information about Ek1(m)
● Eve does not know k1, k2
20ITPC701

Examples – bad ciphers
● Shift cipher
● Conclusion – large key space required
● Substitution cipher
● Large key space, still “easy” to break
20ITPC701

Substitution cipher
:Example
plaintext:
ciphertext:
attack at dawn •
waaoq wa vwmk •
Size of key space: 26!=403291461126605635584000000
x 1028 large enough
4 ~
20ITPC701

Additional definitions
● Plaintext – the message prior to
encryption (“attack at dawn”, “sell MSFT
at 57.5”)
● Ciphertext – the message after
encryption (“ ‫כעככאטןכעח‬
‫”כעלחי‬,“jhhfoghjklvhgbljhg” )
● Symmetric key – encryption scheme where
k1=k2
(classical cryptography)
20ITPC701

Perfect Cipher
n
● Plaintext space – {0,1}
● Given a ciphertext C the probability that Dk2(C)=P for any plaintext P is equal
to the apriori probability that P is the plaintext.
In other words:
Pr[plaintext=P|C] = Pr[plaintext=P]
● Probabilities are over the key space and the plaintext space.
20ITPC701

Example – One Time Pad
n
● Plaintext space - {0,1}
n
● Key space - {0,1}
● The scheme is symmetric, key k is chosen at random
● Ek(P) = C = P ⊕ K
● Dk(C) = C ⊕ K = P
20ITPC701

Pros and Cons
● Claim: the one time pad is a perfect cipher.
● Problem: size of key space.
● Theorem (Shannon): A cipher cannot be perfect if its key space is less than
the size of its message space.
● Why??? Argue in class.
20ITPC701

Computational Power
● Time
● Hardware
● Storage
● Theoretical – polynomial time
64 80
● Practical – 2 is feasible, 2 is
infeasible
20ITPC701

Attack Models
● Eavesdropping
● Known plaintext
● Chosen plaintext
● Chosen ciphertext
● Adaptive chosen text attacks
● Physical access
● “Physical” modification of messages
20ITPC701

SUBJECT CODE
IV VII
20ITPC701
SECURITY (Common to CSE& IT)
UNIT NO 1
TRANSPOSITION TECHNIQUES,
CRYPTOSYSTEM & CRYPTANALYSIS
●CRYPTANALYSIS
●CLASSICAL SUBSTITUTION CIPHERS
●TRANSPOSITION CIPHERS
●PRODUCT CIPHERS
●STEGANOGRAPHY

Cryptanalysis
●
● Objective to recover key not just message
General approaches:
○ Cryptanalytic attack
○ Brute-force attack
20ITPC701

Cryptanalytic Attacks
●
●
● Ciphertext only
○ Only know algorithm & ciphertext, is statistical, know or can identify plaintext
● Known plaintext
○ know/suspect plaintext & ciphertext
● Chosen plaintext
○ Select plaintext and obtain ciphertext
Chosen ciphertext
○ Select ciphertext and obtain plaintext
Chosen text
○ Select plaintext or ciphertext to en/decrypt
20ITPC701

More Definitions
● Unconditional security
○ No matter how much computer power or time is available, the cipher cannot be broken
since the ciphertext provides insufficient information to uniquely determine the
corresponding plaintext
● Computational security
○ Given limited computing resources (eg time needed for calculations is greater than age of
universe), the cipher cannot be broken
20ITPC701

Brute Force Search
●
●
● Always possible to simply try every key
Most basic attack, proportional to key size
Assume either know / recognise plaintext
Key Size (bits) Number of Alternative
Keys
Time required at 1
decryption/µs
Time required at 106
decryptions/µs
32 232 = 4.3 × 109 231 µs = 35.8minutes 2.15 milliseconds
56 256 = 7.2 × 1016 255 µs = 1142years 10.01 hours
128 2128 = 3.4 × 1038 2127 µs = 5.4 × 1024 years 5.4 × 1018 years
168 2168 = 3.7 × 1050 2167 µs = 5.9 × 1036 years 5.9 × 1030 years
26 characters
(permutation)
26! = 4 × 1026 2 × 1026 µs = 6.4 × 1012years 6.4 × 106 years
20ITPC701

Classical Substitution Ciphers
● Where letters of plaintext are replaced by other letters or by numbers or
symbols
● Or if plaintext is viewed as a sequence of bits, then substitution involves
replacing plaintext bit patterns with ciphertext bit patterns
20ITPC701

Caesar Cipher
● Earliest known substitution cipher
● By Julius Caesar
● First attested use in military affairs
● Replaces each letter by 3rd letter on
● Example:
meet me after the toga party
PHHW PH DIWHU WKH WRJD SDUWB
20ITPC701

Caesar Cipher
● Can define transformation as:
a b c d e f g h i j k l m n o p q r s t u v w x y z
D E F G H I J K L M N O P Q R S T U V W X Y Z A BC
● Mathematically give each letter a number
a b c d e f g h i j k l m n o p q r s t u v w x y z
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
● Then have Caesar cipher as:
c = E(p) = (p + k) mod (26)
p = D(c) = (c – k) mod (26)
20ITPC701

Cryptanalysis of Caesar Cipher
● Only have 26 possible ciphers
○ A maps to A,B,..Z
● Could simply try each in turn
● A brute force search
● Given ciphertext, just try all shifts of letters
● Do need to recognize when have plaintext
● Eg. break ciphertext "GCUA VQ DTGCM"
20ITPC701

Monoalphabetic Cipher
●
●
●
● Rather than just shifting the alphabet
Could shuffle (jumble) the letters arbitrarily
Each plaintext letter maps to a different random ciphertext letter
Hence key is 26 letters long
Plain: abcdefghijklmnopqrstuvwxyz
Cipher: DKVQFIBJWPESCXHTMYAUOLRGZN
Plaintext: ifwewishtoreplaceletters
Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA
20ITPC701

Monoalphabetic Cipher Security
● Now have a total of 26! = 4 x 1026 keys
● With so many keys, might think is secure
● But would be !!!WRONG!!!
● Problem is language characteristics
20ITPC701

Language Redundancy and Cryptanalysis
● Human languages are redundant
eg "th lrd s m shphrd shll nt wnt"
● Letters are not equally commonly used
● In English E is by far the most common letter
○ followed by T,R,N,I,O,A,S
● Other letters like Z,J,K,Q,X are fairly rare
● Have tables of single, double & triple letter frequencies for various languages
20ITPC701

English Letter Frequencies
20ITPC701

Use in Cryptanalysis
●
●
●
● Key concept - monoalphabetic substitution ciphers do not change relative
letter frequencies
th
● Discovered by Arabian scientists in 9 century
Calculate letter frequencies for ciphertext
Compare counts/plots against known values
If caesar cipher look for common peaks/troughs
○ peaks at: A-E-I triple, NO pair, RST triple
○ troughs at: JK, X-Z
● For monoalphabetic must identify each letter
○ tables of common double/triple letters help
20ITPC701

Example Cryptanalysis
●
●
●
● Given ciphertext:
UZQSOVUOHXMOPVGPOZPEVSGZWSZOPFPESXUDBMETSXAIZ
VUEPHZHMDZSHZOWSFPAPPDTSVPQUZWYMXUZUHSX
EPYEPOPDZSZUFPOMBZWPFUPZHMDJUDTMOHMQ
● Count relative letter frequencies (see text)
Guess P & Z are e and t
Guess ZW is th and hence ZWP is the
Proceeding with trial and error finally get:
it was disclosed yesterday that several informal but
direct contacts have been made with political
representatives of the viet cong in moscow
20ITPC701

Playfair Cipher
● Not even the large number of keys in a monoalphabetic cipher provides
security
● One approach to improving security was to encrypt multiple letters
● The Playfair Cipher is an example
● Invented by Charles Wheatstone in 1854, but named after his friend Baron
Playfair
20ITPC701

Playfair Key Matrix
●
●
●
● A 5X5 matrix of letters based on a keyword
Fill in letters of keyword (sans duplicates)
Fill rest of matrix with other letters
Eg. using the keyword MONARCHY
M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z
20ITPC701

Encrypting and Decrypting
● Plaintext is encrypted two letters at a time
1.
If a pair is a repeated letter, insert filler like 'X’
2.
3.
If both letters fall in the same row, replace each with letter to right (wrapping back to start
from end)
If both letters fall in the same column, replace each with the letter below it (again wrapping to
top from bottom)
4.
Otherwise each letter is replaced by the letter in the same row and in the column of the other
letter of the pair
20ITPC701

Security of Playfair Cipher
● Security much improved over monoalphabetic
● Since have 26 x 26 = 676 digrams
● Would need a 676 entry frequency table to analyse (verses 26 for a
monoalphabetic)
● And correspondingly more ciphertext
● Was widely used for many years
○ eg. by US & British military in WW1
● It can be broken, given a few hundred letters
● Since still has much of plaintext structure
20ITPC701

Polyalphabetic Ciphers
● Polyalphabetic substitution ciphers
● Improve security using multiple cipher alphabets
● Make cryptanalysis harder with more alphabets to guess and flatter frequency
distribution
● Use a key to select which alphabet is used for each letter of the message
● Use each alphabet in turn
● Repeat from start after end of key is reached
20ITPC701

Vigenère Cipher
● Simplest polyalphabetic substitution cipher
● Effectively multiple caesar ciphers
● Key is multiple letters long K = k1 k2 ... kd
th th
● i letter specifies i alphabet to use
● Use each alphabet in turn
● Repeat from start after d letters in message
● Decryption simply works in reverse
20ITPC701

Example of Vigenère Cipher
●
●
●
●
● Write the plaintext out
Write the keyword repeated above it
Use each key letter as a caesar cipher key
Encrypt the corresponding plaintext letter
Eg. using keyword deceptive
key: deceptivedeceptivedeceptive
plaintext: wearediscoveredsaveyourself
ciphertext:ZICVTWQNGRZGVTWAVZHCQYGLMGJ
20ITPC701

Aids
● Simple aids can assist with en/decryption
● A Saint-Cyr Slide is a simple manual aid
○ A slide with repeated alphabet
○ Line up plaintext 'A' with key letter, eg 'C'
○ Then read off any mapping for key letter
● Can bend round into a cipher disk
● Or expand into a Vigenère Tableau
20ITPC701

Security of Vigenère Ciphers
● Have multiple ciphertext letters for each plaintext letter
● Hence letter frequencies are obscured
● But not totally lost
● Start with letter frequencies
○ See if look monoalphabetic or not
● If not, then need to determine number of alphabets, since then can attach
each
20ITPC701

Kasiski Method
● Method developed by Babbage / Kasiski
● Repetitions in ciphertext give clues to period
● So find same plaintext an exact period apart
● Which results in the same ciphertext
● Of course, could also be random fluke
● Eg. repeated “VTW” in previous example
● Suggests size of 3 or 9
● Then attack each monoalphabetic cipher individually using same techniques
as before
20ITPC701

Autokey Cipher
● Ideally want a key as long as the message
● Vigenère proposed the autokey cipher
● With keyword is prefixed to message as key
● Knowing keyword can recover the first few letters
● Use these in turn on the rest of the message
● But still have frequency characteristics to attack
● Eg. given key deceptive
key: deceptivewearediscoveredsav
plaintext: wearediscoveredsaveyourself
ciphertext:ZICVTWQNGKZEIIGASXSTSLVVWLA
20ITPC701

Web References:
Video Links:
20ITPC701

Unit-1.pdf notes for operating system lab

More Related Content

Similar to Unit-1.pdf notes for operating system lab

Recently uploaded

Unit-1.pdf notes for operating system lab