Computer Networks and Security-

18CS2204

1
• Introduction to Security
• Security Goals
• Security Attacks
• Security Services
• Security Mechanisms

2
Security Goals
SECURITY GOALS

INTEGRITY AVAILABILITY
CONFIDENTIALITY

3
Key Security Concepts

Authentication
Non-repudiation
4
Security ATTACKS
Security Attacks

Modification
Snooping
Masquerading
Denial of
Traffic Service
Analysis Replaying

Repudiation

Threat to confidentiality Threat to Integrity Threat to Availability

5
Security Attacks
Attacks Passive/Active Threatening

1. Snooping Passive Confidentiality

2. Traffic Analysis

1. Modification Active Integrity

2. Masquerading
3. Replaying
4. Repudiation

1. Denial of Service Active Availability

Security Attacks

• Passive Attack
• Just to obtain information. Does not Modify or harm the
system.

• Active Attack
• May Change the Data and harm the system.

7
Security Services
Security Services

Data Authentication
Data Integrity Non Repudiation Access Control
Confidentiality

Anti Change Peer Entity Proof of Origin

Anti Replay Data Origin Proof of Delivery

8
Security Mechanisms
Encipherment

Data Integrity
Digital Signature

Authentication Exchange
Security
Traffic Padding
Mechanisms
Routing Control

Notarization

Access Control

9
Relation Between Services and Mechanisms
Security Services Security Mechanism

Data Confidentiality Encipherment, Routing Control

Data Integrity Encipherment, Digital Signature, Data Integrity

Authentication Encipherment, Digital Signature, Authentication

exchanges

Non Repudiation Digital Signature, Data Integrity and Notarization

Access Control Access Control Mechanisms

10
Levels of Impact

We can define 3 levels of impact from a security

attack
Low - The loss is minor
Moderate - The loss is serious
High - The loss severe or catastrophic

11
Three Aspects of Security

• The three aspects of information security are

• security attack
• security mechanism (control)
• security service
• Some terms
• threat – a potential for violation of security
• vulnerability – a way by which loss can happen
• attack – an attempt to avoid security services

12
 1

Model for Network

Security
Model for Network Security

2
Model for Network Security

3
Model for Network Security

4
 Using this model requires us to:
1. Design a suitable algorithm for the security
transformation
2. Generate the secret information (keys) used by the
algorithm
3. Develop methods to distribute and share the secret
information (key)
4. Specify a protocol enabling the sender and receiver
to use the transformation and key for a security
service
Model for Network Access Security

5
 Model for Network Access Security

6
 Using this model requires us to:
1. Select appropriate gatekeeper functions to identify
users
2. Implement security controls to ensure only authorised
users access designated information or resources

 Note that model does not include:

1. monitoring of system for successful penetration
2. monitoring of authorized users for misuse
3. audit logging for forensic uses, etc.
 Classic Encryption Techniques 7

 Plain Text: Original Message

 Encryption/Encipherment: Process of Converting from Plain tect to
Cipher text
 Decryption/Decipherment: Restoring the plaintext from the cip[her
text.
 Cryptography: Many schemes used for encryption.
 Cryptanalysis: Techniques for deciphering a message without any
knowledge of the enciphering details.
 Cryptology: areas of Cryptography and Cryptanalysis together are
called Cryptology
 Classic Encryption Techniques 8

 Encryption Algorithm: Performs various substitution and

transpositions on the palintext.
 Secret Key: Value independent of plain text and the
algorithm.
 Cipher Text: Scrambled Message produced as Output.
 Decryption Algorithm: Encryption Algorithm in reverse.
 Classic Encryption Techniques 9

 Two Requirements of Conventional Algorithm

 Strong Encryption Algorithm: Opponent who knows the

algorithm and have access to one or more Cipher texts
would be unable to decipher the ciphertext and
discovery the key.
 Sender and receiver must have obtained copies of the
secret key in a secure fashion and must keep the key
secure.
 Cryptanalysis

 Objectiveto recover key not just message

 General approaches:
 cryptanalytic attack
 brute-force attack

1
 Cryptanalysis Attacks

Crypt Analysis Attack

Cipher Text Only Known Plain Text Chosen Plain Text Chosen Cipher Text

2
Cipher Text Only Attack

3
Known Plain text Attack

4
Chosen Plain text Attack

5
Chosen Ciphertext Attack

6
Cryptanalytic Attacks

7
 Brute Force Attack
 Try every possible key
Key Size Number of Time required at 1 Time required at 106
(bits) Alternative Keys decryption/µs decryptions/µs
32 232 = 4.3  109 231 µs = 35.8 minutes 2.15 milliseconds

56 256 = 7.2  1016 255 µs = 1142 years 10.01 hours

128 2128 = 3.4  1038 2127 µs = 5.4  1024 5.4  1018 years
years
168 2168 = 3.7  1050 2167 µs = 5.9  1036 5.9  1030 years
years
26 characters 26! = 4  1026 2  1026 µs = 6.4 6.4  106 years
(permutation)  1012 years

8
 Statistical Attack

Cryptanalyst can benefit from some inherent characteristics of the

plain text language to launch a statistical attack.

For Eg: we Know that letter E is the most frequently used letter in
english text. Cryptanalyst finds the most used character in the
cipher text and assumes the corresponding plain text as E.

9
 Pattern Attack

• Some Ciphers may hide the characteristics of Language,

but may create some patterns in the cipher text.

• Cryptanalyst may use a pattern attack to break the

cipher.

10
 Hill Cipher
m successive plaintext letters are substituted by m ciphertext letters.
If, a = 0, b = 1, …, z = 25. For m = 3
c1 = (k11p1 + k12p2 + k13p3) mod 26
c2 = (k21p1 + k22p2 + k23p3) mod 26
c3 = (k31p1 + k32p2 + k33p3) mod 26

1
 Polyalphabetic Ciphers

One plaintext character for its multiple occurrences,

may generate different cipher text characters

2
 Example of Vigenere Cipher
 using keyword deceptive
key: deceptivedeceptivedeceptive
plaintext: wearediscoveredsaveyourself
cipher text: ZICVTWQNGRZGVTWAVZHCQYGLMGJ

3
Vigenere Table or Vigenere Square

4
 Vigenere Encryption using Vigenere Square
Example:
Plain text: SHEISLISTENING
Key : PASCAL

Generate Key Stream such that key size is equal to Plaintext size

Plain text: S HEI SLI ST ENI NG

KEY stream: PASCALPASCAL P A

Refer Plain text letter row and Key letter Column in Vigenere square

Plain text letter S(row)

Keystream letter P(column)

Intersection letter of above row and column is ‘h’

Therefore CT of plain text letter ‘s’ is ‘h’ and so on.
5
 Vigenere Encryption using Vigenere Square

Decryption in Vigenere Cipher using Vigenere Square:

Take Key letter as column (in example P row)

In that key column search for Cipher text letter (in example ‘h’)

Return that ciphertext letter’s row value( in Key letter ‘p’ column) as Plain text letter.

As per example ‘s’

6
 Security of Vigenere Ciphers
 This scheme is vulnerable to cryptanalysis.
Because the key and the plain text share the
same frequency distribution of letters, a
statistical analysis can be applied.

7
 Vernam Cipher

ci = pi Ⓧ ki where,
pi = i th binary digit of plaintext
ki = ith binary digit of key
ci = ith binary digit of ciphertext
Ⓧ = exclusive-or (XOR) operation
pi = ci Ⓧ ki

8
 One-Time Pad

The beauty of one-time pad is, for same ciphertext the plain text is different if key is
different.

ciphertext: ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS
key: pxlmvmsydofuyrvzwc tnlebnecvgdupahfzzlmnyih
plaintext: mr mustard with the candlestick in the hall

ciphertext: ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS
key: mfugpmiydgaxgoufhklllmhsqdqogtewbqfgyovuhwt
plaintext: miss scarlet with the knife in the library

9
Onetime Pad

10
Onetime Pad

11
 Transposition Ciphers
Rail fence technique
The plaintext is written down as a sequence of diagonals and then read as a
sequence of rows.
Example,
Plain text: “meet me after the toga party”

with a rail fence of depth 2, we write the following:

mematrhtgpry
etefeteoaat
 Ciphertext : MEMATRHTGPRYETEFETEOAAT
 The rail fence is trivial to cryptanalyze

12
 Row Transposition Ciphers
Arrange the plain text row by row, and read column by column,
but permute the order of the columns.
The order of the columns then becomes the key.
Plaintext = attackpostponeduntiltwoamxyz
Key: 4312567
Column Out 4 3 1 2 5 6 7
Plaintext: a t t a c k p
o s t p o n e
d u n t i l t
w o a m x y z
Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ

The transposition cipher can be made significantly more secure

by performing more than one stage of transposition.

13
Rotor Machine

14
 Rotor Machines
 The result is that there are 26 * 26 * 26 = 17,576
different substitution alphabets used before the system
repeats. The addition of fourth and fifth rotors results in
periods of 456,976 and 11,881,376 letters, respectively.

15
 Public-Key Cryptography
• In Symmetric key crypto only one secret key between sender and
receiver is used to encrypt/decrypt.
• In Symmetric key crypto maintaining the secret key between two
parties is a challenge.
• The main use of Symmetric key crypto is encryption and decryption
• Public key crypto was invented by Whitfield Diffie & Martin
Hellman at Stanford University in 1976.
• Two keys, (i) private and (ii) public, so called as asymmetric key
crypto.
 Public Key Cryptography
• The main idea of public key crypto is not a substitute, but a
complement to symmetric key crypto.
• The uses of public key crypto can be classified into 3
categories:
• encryption/decryption (provide secrecy)
• digital signatures (provide authentication)
• key exchange (session keys)
Public Key Cryptography
 Public Key Cryptography
 Asymmetric algorithms rely on one key for encryption and a different but related
key for decryption. These algorithms have the following important characteristic.
 Itis computationally infeasible to determine the decryption key given only
knowledge of the cryptographic algorithm and the encryption key.

 In addition, some algorithms, such as RSA, also exhibit the following

characteristic.
 Either of the two related keys can be used for encryption, with the other used
for decryption.

A public-key encryption scheme has six ingredients.

Public-Key Cryptography: Encryption with Public Key
(for secrecy)
Public-Key Cryptosystems for Secrecy
Public-Key Cryptosystems for Secrecy
Public-Key Cryptosystems for Secrecy
Public-Key Cryptography: Encryption with
Private Key for Authentication
Public-Key Cryptosystems for Authentication
& Secrecy
 Public-Key Characteristics
• Public-Key algorithms rely on two keys
• it is computationally infeasible to find decryption key knowing
only algorithm & encryption key
• it is computationally easy to en/decrypt messages when the
relevant (en/decrypt) key is known
• either of the two related keys can be used for encryption, with the
other used for decryption
Difference b/w Conventional &Public-Key Cryptography
 Public-Key Requirements
• Need a trapdoor one-way function
• one-way function has
Y = f(X) easy
X = f–1(Y) infeasible
• a trap-door one-way function has
Y = fk(X) easy, if k and X are known
X = fk–1(Y) easy, if k and Y are known
X = fk–1(Y) infeasible, if Y is known but k not known
• a practical public-key scheme depends on a suitable
trap-door one-way function
RSA
RSA Algorithm
 Example
1. Select primes: p=17 & q=11
2. Calculate n = pq =17 x 11=187
3. Calculate ø(n)=(p–1)(q-1)=16x10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Find d such that de=1 mod 160 and d < 160
Value of d=23 since 23×e=161
6. Publish public key PU={7,187}
7. Keep private key PR={23,187}
Example

given message M = 88, (88<187)

encryption: C = 887 mod 187 = 11
decryption: M = 1123 mod 187 = 88
Exponentiation in Modular Arithmetic
 a fast, efficient algorithm for exponentiation is
repeatedly dividing the exponent to lower powers
and multiplying
 The following property of mod can also be used.
Exponentiation
Exponentiation
RSA Processeing of Multiple Blocks
 Attacks on RSA
• Four Possible Approaches to attack RSA
• Bruteforce attack: Typing of all possible keys.
• Defence-large key space. ‘d’ large number of bits.(p and q Large values may cause to d large value)
• Mathematical Attacks: Factoring the product of two primes.
• A) Factoring n into two prime factors which may lead to know phi(n) and d
• B) Determine phi(n) directly without determining p and q
• C)Determine d directly without determining phi(n).
• To specify the size of n(to avoid factorization) :
• P and q should differ in length by only few digits
• Both (p-1) and (q-1) should contain a large prime factors.
• gcd(p-1,q-1) should be small
• Timing Attacks: running time of the decryption algorithm.
• Chosen Cipher text attack: Type of attack exploits properties of the RSA algorithm.
 RSA Timing Attack
• Paul Kocher demonstrated that a Snooper can determine a private key by keeping track of how
long a computer takes to decipher messages(Cipher text only attack).
• Suppose a target system uses a modular multiplicative function that is very fast in almost all
cases but in few cases takes much more time than an entire average modular exponentiation.
• Attack proceeds bit by bit starting from leftmost bit bk.
• Suppose that the first j bits are known(d value j Bits). Attacker can complete the first j
iterations of the for loop(for given cipher text).
• Operation of subsequent steps depends on the unknown exponent bit.
• If the bit is set d(d*a) mod n will be executed.
• For few values of a & d, the modular multiplication will be extremely slow and the attacker
knows them.
• Eg: if the decryption algorithm is slow it is assumed to be 1 or it is assumed to be 0(fast )
 Counter Measures of RSA timing attack
• Constant Exponential Time: Same amount of time for all exponentiation.
• Random Delay: Add random delay to the exponential algorithm.
• Blinding: Multiply Cipher text by a random number before performing exponentiation to
prevent attacker knowing what the cipher text bits are.

• Blinding Features incorporated in RSA:

• Generate a Secrete random number r between 0 and n-1
• Compute C’=c(re) mod n where e is public
• Compute M’=(C’)d mod n
• M=M’r-1 mod n where r inverse is multiplicative inverse of r mod n
• Correct result can be observed by observing red mod n = r mod n
Chosen Cipher Text Attack(CCA) and Optimal Symmetric
Encryption Padding(RSA)

Takes advantage of the following Property: E(Pu,M1)*E(pu,M2)=E(Pu(M1,M2))

Can decrypt C=Me mod n using CCA as follows

1) Compute X=(C*2e) mod n

2) Submit X as a Choosen C and Receive back Y= (Xd) mod n
3) Note that X= (C mod n)* (2e mod n)
= (Me mod n)* (2e mod n)
=(2M)e mod n
We can Deduce M

To Overcome this attack RSA randomly Pad the Plaintext prior to encryption.
Encrypt the Plain text using a procedure known as “Optimal Assymetric Encryption
Padding(OASP).
Optimal
Asymmetric
Encryption
Padding (OASP)