Department of Computer Technology

Cyber and Information Security

8thSemester C.T.

EXPERIMENT NO:
Date:
AIM: To implement the Substitution Cipher technique.

PROBLEM STATEMENT: Write a program to implement Caesar cipher.

THEORY:

Encryption, is the process of changing information in such a way as to make it readable by anyone
except those possessing special knowledge (usually referred to as a “key”) that allows them to
change the information back to its original, readable form. Encryption is important because it
allows you to securely protect data that you don’t and anyone else to have access to. Businesses
use it to protect corporate secrets, government uses it to secure classified information, and many
individuals use it to protect personal information to guard against things like identity theft.

An original message is known as the plaintext, while the coded message is called the cipher text.
The process of converting from plaintext to cipher text is known as enciphering or encryption;
restoring the plaintext from the cipher text is deciphering or decryption. The two basic building
blocks of all encryption techniques are substitution and Transposition.

Substitution Technique

A substitution technique is one in which the letters of plaintext are replaced by other letters or by
numbers or symbols. If the plaintext is viewed as a sequence of bits, then substitution involves
replacing plaintext bit patterns with cipher text bit.

Caesar cipher

The Caesar cipher is one of the earliest known and simplest ciphers. It is a type of substitution
cipher in which each letter in the plaintext is ‘shifted’ a certain number of places down the
alphabet. For example, with a shift of 1, A would be replaced by B, B would become C, and so on.
The method is named after Julius Caesar, who apparently used it to communicate with his
generals.

More complex encryption schemes such as the Vigenere cipher employ the Caesar cipher as one
element of the encryption process. The widely known ROT13 ‘encryption’ is simply a Caesar
cipher with an offset of 13. The Caesar cipher offers essentially no communication security, and it
will be shown that it can be easily broken even by hand.

Kavikulguru Institute of Technology & Science Page |1

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Example 

To pass an encrypted message from one person to another, it is first necessary that both parties
have the ‘key’ for the cipher, so that the sender may encrypt it and the receiver may decrypt it. For
the Caesar cipher, the key is the number of characters to shift the cipher alphabet.

Here is a quick example of the encryption and decryption steps involved with the Caesar cipher.
The text we will encrypt is 'defend the east wall of the castle', with a shift (key) of 1.

Plain text: defend the east wall of the castle

Cipher text: efgfoe uif fbtu xbmm pg uif dbtumf

It is easy to see how each character in the plaintext is shifted up the alphabet. Decryption is just as
easy, by using an offset of -1.

Plain: abcdefghijklmnopqrstuvwxyz

Cipher: bcdefghijklmnopqrstuvwxyza

Obviously, if a different key is used, the cipher alphabet will be shifted a different amount.

Mathematical Description 

First we translate all of our characters to numbers, ‘a’=0, ‘b’=1, ‘c’=2, ... , ‘z’=25. We can now
represent the Caesar cipher encryption function, e(x), where x is the character we are encrypting,
as:

e ( x )=(x +k )(mod 26)

Where k is the key (the shift) applied to each letter. After applying this function the result is a
number which must then be translated back into a letter. The decryption function is:

e ( x )=( x−k)(mod 26)

CONCLUSION: Students are advised to write conclusion on separate sheet.

Kavikulguru Institute of Technology & Science Page |2
Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

REVIEW QUESTIONS
1. Explain the concept of cryptography.
2. Define the terms plain text, cipher text, encryption and decryption.
3. List and briefly define categories of security mechanisms
4. Differentiate between steganography and cryptography?
5. List and briefly define categories of security services.

EXPERIMENT NO:
Date:

Kavikulguru Institute of Technology & Science Page |3

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

AIM: To implement the Transposition Cipher technique.

PROBLEM STATEMENT: Write a program to implement Railfence cipher.

THEORY:

Rail fence Cipher

A very different kind of mapping is achieved by performing some sort of permutation on the
plaintext letters. This technique is referred to as a transposition cipher. The simplest such cipher is
the rail fence technique, in which the plaintext is written down as a sequence of diagonals and
then read off as a sequence of rows. For example, to encipher the message “meet me after the yoga
class” with a rail fence of depth 2, we write the following:

me m a t r h y g c l s
e t e f e t e o a l s
The encrypted message is this sort of thing would be trivial to cryptanalyze. A more complex
scheme is to write the message in a rectangle, row by row, and read the Message off, column by
column, but permute the order of the columns. The order of the columns then becomes the key to
the algorithm. For example,
Key: 4 3 1 2 5 6 7
Plaintext:
4 3 1 2 5 6 7
a a t a c k p
o s t p o n e
d u n t i l t
w o a m x y Z
Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ

Thus, in this example, the key is 4312567.To encrypt, start with the column thatis labeled 1, in this
case column 3.Write down all the letters in that column. Proceed tocolumn 4, which is labeled 2,
then column 2, then column 1, then columns 5, 6, and 7.

A pure transposition cipher is easily recognized because it has the same letterfrequencies as the
original plaintext. For the type of columnar transposition justshown, cryptanalysis is fairly
straightforward and involves laying out the ciphertext ina matrix and playing around with
column positions. Diagram and trigram frequencytables can be useful.The transposition cipher
can be made significantly more secure by performingmore than one stage of transposition.The

Kavikulguru Institute of Technology & Science Page |4

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

result is a more complex permutation thatis not easily reconstructed. Thus, if the foregoing
message is re-encrypted using thesame algorithm,

Key: 4 3 1 2 5 6 7

Input:

4 3 1 2 5 6 7
t t n a a p t
m t s u o a o
d w c o i x k
n l y p e t z

Output: NSCYAUOPTTWLTMDNAOIEPAXTTOKZ

To visualize the result of this double transposition, designate the letters in the original plaintext
message by the numbers designating their position. Thus, with 28 letters in the message, the
original sequence of letters is

01 02 03 04 05 06 07 08 09 10 11 12 13 14

15 16 17 18 19 20 21 22 23 24 25 26 27 28

After the first transposition, we have

03 10 17 24 04 11 18 25 02 09 16 23 01 08

15 22 05 12 19 26 06 13 20 27 07 14 21 28

Which is somewhat regular structure. But after the second transposition, we have

17 09 05 27 24 16 12 07 10 02 22 20 03 25

15 13 04 23 19 14 11 01 26 21 18 08 06 28

This is a much less structured permutation and is much more difficult to cryptanalyze.

Algorithm:

function Railfence (M[ ], K)

Kavikulguru Institute of Technology & Science Page |5

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

{
M[ ], is the plain text, Cipher[ ] contains result.
K, depth of rail fence.
Cipher[1]=M[1];
for i:=2 to length(M)
do
Cipher[i]=M[i-1+K];
done
Cipher[i]=M[2];
for j:=2 to length(M)
do
Cipher[i+j]=M[j+K];
Done
}

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. Differentiate between mono-alphabetic and poly-alphabetic cipher?
2. Create the cipher text for the following plain text using rail-fence cipher “meet me at the
park”.
3. Distinguish between substitution cipher and transposition cipher.
4. Explain the playfair cipher with an example.
5. What is passive attack and active attack?

EXPERIMENT NO:
Date:

Kavikulguru Institute of Technology & Science Page |6

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

AIM: To implement Block Ciphers technique.

PROBLEM STATEMENT: Write a program to implement DES Algorithm.

THEORY:

Data Encryption Standard (DES) algorithm, adopted by the U.S. government in July 1977. It was
reaffirmed in 1983, 1988, and 1993. DES is a block cipher that transforms 64-bit data blocks under a
56-bit secret key, by means of permutation and substitution. DES is a "symmetrical" encryption
algorithm: same key that is used for encryption is used to decrypt the message.
The DES algorithm is still widely used and is considered reasonably secure. There is no feasible
way to break DES as is using a 64-bit (8 characters) block cipher.  There are 70,000,000,000,000,000
(seventy quadrillion) possible keys of 56 bits. However, due to the advance in the computational
power of super-computers, an exhaustive search of 2^55 steps on average, can retrieve the key
used in the encryption (if the key is changed frequently, the risk of this event is greatly
diminished).  Because of this it is common practice to protect data using Triple-DES. 
Triple-DES is a secure variation of the Data Encryption Standard first developed by IBM, and later
in 1977 adopted by the U.S. government. Triple-DES is a 192 bit (24 characters) cipher that uses
three separate 64 bit keys and encrypts data using the DES algorithm three times.
DES Encryption
The overall scheme for DES encryption is illustrated in Figure 3.1. As with any encryption scheme,
there are two inputs to the encryption function: the plaintext to be encrypted and the key. In this
case, the plaintext must be 64 bits in length and the key is 56 bits in length.
At the left-hand side of the figure, we can see that the processing of the plaintext proceeds in three
phases. First, the 64-bit plaintext passes through an initial permutation (IP) that rearranges the bits
to produce the permuted input. This is followed by a phase consisting of sixteen rounds of the
same function, which involves both permutation and substitution functions. The output of the last
(sixteenth) round consists of 64 bits that are a function of the input plaintext and the key. The left
and right halves of the output are swapped to produce the pre output. Finally, the pre output is
passed through a permutation that is the inverse of the initial permutation function, to produce
the 64-bit cipher text.

Kavikulguru Institute of Technology & Science Page |7

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 3.1: General Depiction of DES Encryption Algorithm

The right-hand portion of Figure 3.1 shows the way in which the 56-bit key is used. Initially, the
key is passed through a permutation function. Then, for each of the sixteen rounds, a sub key (Ki )
is produced by the combination of a left circular shift and a permutation. The permutation
function is the same for each round, but a different sub key is produced because of the repeated
shifts of the key bits.
Initial Permutation: The initial permutation and its inverse are defined by tables, as shown in
Tables 3.1a and 3.1b, respectively.
The input to a table consists of 64 bits numbered from 1 to 64. The 64 entries in the permutation
table contain a permutation of the numbers from 1 to 64. Each entry in the permutation table
indicates the position of a numbered input bit in the output, which also consists of 64 bits.

Kavikulguru Institute of Technology & Science Page |8

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Table 3.1: Permutation tables for DES.

To see that these two permutation functions are indeed the inverse of each other, consider the
following 64-bit input M:
M1 M2 M3 M4 M5 M6 M7 M8
M9 M10 M11 M12 M13 M14 M15 M16

Kavikulguru Institute of Technology & Science Page |9

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

M17 M18 M19 M20 M21 M22 M23 M24

M25 M26 M27 M28 M29 M30 M31 M32
M33 M34 M35 M36 M37 M38 M39 M40
M41 M42 M43 M44 M45 M46 M47 M48
M49 M50 M51 M52 M53 M54 M55 M56
M57 M58 M59 M60 M61 M62 M63 M64
Where Mi is a binary digit. Then the permutation X=IP(M) is as follows:
M58 M50 M42 M34 M26 M18 M10 M2
M60 M52 M44 M36 M28 M20 M12 M4
M62 M54 M46 M38 M30 M22 M14 M6
M64 M56 M48 M40 M32 M24 M16 M
M57 M49 M41 M33 M25 M17 M9 M1
M59 M51 M43 M35 M27 M19 M11 M3
M61 M53 M45 M37 M29 M21 M13 M5
M63 M55 M47 M39 M31 M23 M15 M7
If we then take the inverse permutation Y= IP−1( X )= IP−1(IP ( M ) ), it can be seen that the original
ordering of the bits is restored.
Details of Single round:
The DES single round shown in figure 3.2, the 64-bit is divided into two halves, left 32-bits, and
right 32-bits, right 32-bits goes to left 32-bits of next round. On this right 32-bits, the Expansion /
permutation (E-table) changes to 48-bit,again this will perform exclusive-or with Ki (48-bits), and
S-box compress to 32-bits, after that performing 32-bit permutation, next ex-or with left 32-bit,
then the result becomes right 32-bits of next round. Similarly, all rounds convert 64-bits to other
64-bits. Extend/permutation box shown in Table 3.1 (c), this takes 32-bit as input and converts to
48-bits.

Kavikulguru Institute of Technology & Science P a g e | 10

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 3.2 The single round structure

The Substitution-box contain 8 S-boxes, it takes 48-bits as input and converts into 32-bits. Each S-
box appears like 4 × 16 box shown in figure 3.3.

Kavikulguru Institute of Technology & Science P a g e | 11

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 3.3: 8- S-Boxes.

The Internal structure of S-BOX is shown in figure 3.3. The outer two bits of each group select one
of four possible substitutions (one row of an S-box). Then a 4-bit output value is substituted for the
particular 4-bit input (the middle four input bits). The 32-bit output from the eight S-boxes is then
permuted, so that on the next round, the output from each S-box immediately affects as many
others as possible.

Figure 3.4: Internal Structure of Substitution Box

Key Generation:

In the figure 3.2 the right side part shows the sub-key generation. Each sub-key generation
contains left circular shift for left 28-bits and right 28-bits separately as per shown figure 3.2, the
respected boxes for sub-key generation shown in figure 3.3. To make complexity the key length
must take as 64-bits, select 56-bits from that. Figure 3.4(a) shows the no. of bits we need to shift per
each round. Figure 3.4(b) shows the 64-bit input key.

Figure 3.4 (a): Schedule of Left Shifts

Kavikulguru Institute of Technology & Science P a g e | 12

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 3.4 (b): Input Key

Figure 3.4 (c): Permuted Choice One (PC-1)

Figure 3.4 (d): Permuted Choice Two (PC-2)

Similarly, the decryption is also same as encryption but the keys are in reverse order.

Example:

For this example, the plaintext is a hexadecimal palindrome. The plaintext, key, and resulting
cipher text are as follows:

Key: 0f1571c947d9e859

Plaintext: 02468aceeca86420

Cipher text: da02ce3a89ecac3b

Algorithm:

Kavikulguru Institute of Technology & Science P a g e | 13

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Function DES (msg[ ], key[ ])

msg[ ]- original data contains 64-bits.

key[ ]- contains 64-bits.

K1 is 56-bits taken from 64-bits.

L[ ] contains left 32-bits of original message, R[ ] contains right 32-bits of original message.

temp[ ] contains

{
Temp=IP (msg).//initial permutation applied to message.

for i:=1 to 16

for j=1 to 32

temp[j]=R[j];

Perform F(R[ ],Ki) the result is 32-bits, which is stored in array X.

for j=1 to 32

R[i]=L[i]^X[i];

for j=1 to 32

L[j]=temp[j];

}}

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. Distinguish between stream ciphers and block ciphers.
2. What is the block size in Data Encryption Standard (DES)? What is the cipher key size in
DES?
3. What is the round key size in DES? How many rounds are there in DES?
4. Explain the concept of triple DES. Explain the DES function briefly.
5. Write about S-box operation in DES.

EXPERIMENT NO:
Date:

Kavikulguru Institute of Technology & Science P a g e | 14

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

AIM: To implement the Key Management technique.

PROBLEM STATEMENT: Write a program to implement the Diffie-Hellman algorithm.

THEORY:

One of the major roles of public-key encryption has been to address the problem of key
distribution. There are actually two distinct aspects to the use of public-key cryptography in this
regard: The distribution of public keys and the use of public-key encryption to distribute secret
keys
Distribution of Public Keys: Several techniques have been proposed for the distribution of public
keys. Virtually all these proposals can be grouped into the following:

 general schemes
 Public announcement
 Publicly available directory
 Public-key authority
 Public-key certificates

Diffie-Hellman Key Exchange: The first published public-key algorithm appeared in the seminal
paper by Diffie and Hellman that defined public-key cryptography and is generally referred to as
Diffie-Hellman key exchange.

A number of commercial products employ this key exchange technique. The purpose of the
algorithm is to enable two users to securely exchange a key that can then be used for subsequent
encryption of messages. The algorithm itself is limited to the exchange of secret values.

The Diffie-Hellman algorithm depends for its effectiveness on the difficulty of computing discrete
logarithms. Briefly, we can define the discrete logarithm in the following way. First, we define a
primitive root of a prime number p as one whose powers modulo p generate all the integers from
1 to p1. That is, if a is a primitive root of the prime number p, then the numbers a mod p,

a 2 mod p , … … , a p 1 modpare distinct and consist of the integers from 1 through p1 in some
permutation.

For any integer b and a primitive root a of prime number p, we can find a unique exponent i such
that a ≡ ai mod p where0 ≤ i≤p1
Algorithm:

Kavikulguru Institute of Technology & Science P a g e | 15

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

For this scheme, there are two publicly known numbers: a prime number q and an integer that is a
primitive root of q. Suppose the users A and B wish to exchange a key. User A selects a random
integer XA <q and computes YA=a XA modq . Similarly, user B independently selects a random

integer XB< qand computes YB=a XB modq.

Each side keeps the X value private and makes the Y value available publicly to the other side.

User A computes the key as K=(YB)XA modq and user B computes the key K=(YA) XB modq. These
two calculations produce identical results. The following figurec4.1 explains the algorithm.

Figure 4.1: Diffie-Hellman logic

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. What are two different uses of public-key cryptography related to key distribution?
2. List four general categories of schemes for the distribution of public keys.
3. What are essential ingredients of a public key directory?
4. Consider a Diffie-Hellman scheme with a common prime p=11 and a primitive root a=2
a. If user A has public key YA=9, what is A’s private key XA
b. If user B has public key YB=3, what is the shared secret key K, shared with A
5. What is Elliptic Curve Cryptography?

EXPERIMENT NO:

Kavikulguru Institute of Technology & Science P a g e | 16

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Date:
AIM: To implement Stream Ciphers technique.

PROBLEM STATEMENT: Write a program to implement RC4 algorithm.

THEORY:

RC4 is a stream cipher designed in 1987 by Ron Rivest for RSA Security. It is a variable key size
stream cipher with byte-oriented operations. The algorithm is based on the use of a random
permutation. Analysis shows that the period of the cipher is overwhelmingly likely to be greater
than [ROBS95a]. Eight to sixteen machine operations are required per output byte, and the cipher
can be expected to run very quickly in software.RC4 is used in the Secure Sockets
Layer/Transport Layer Security(SSL/TLS) standards that have been defined for communication
between web browsers and servers. It is also used in the Wired Equivalent Privacy (WEP) protocol
and the newer Wi-Fi Protected Access (WPA) protocol that are part of the IEEE802.11 wireless
LAN standard. RC4 was kept as a trade secret by RSA Security. In September 1994, the RC4
algorithm was anonymously posted on the Internet on the Cypher punks anonymous remailers
list. The RC4 algorithm is remarkably simple and quite easy to explain. A variable-length key of
from 1 to 256 bytes (8 to 2048 bits) is used to initialize a 256-bytestate vector S, with elements s[0],
s[1], s[2]…..s[125] . At all times, contains a permutation of all 8-bit numbers from 0 through 255.
For encryption and decryption, a byte is generated from S by selecting one of the 255 entries in a
systematic fashion. As each value of is generated, the entries in S are once again permuted.

Initialization of S

To begin, the entries of are set equal to the values from 0 through 255 in ascending order; that is,
S [ 0 ] =0 , s [ 1 ] =1, … . , S [ 255 ]=255.A temporary vector, T, is alsocreated. If the length of the key is
256 bytes, then is transferred to T. Otherwise,for a key of length keylen bytes, the first keylen
elements of T are copied from K, and then K is repeated as many times as necessary to fill out T.
These preliminary operations can be summarized as
/* Initialization */
for i = 0 to 255 do
S[i] = i;
T[i] = K[i mod keylen];
Next we use with T to produce the initial permutation of S. This involves starting with S[0] and
going through S[125] to , and for each s[i], swapping s[i] with another byte in according to a
scheme dictated by T[i]:

Kavikulguru Institute of Technology & Science P a g e | 17

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

/* Initial Permutation of S */
j = 0;
for i = 0 to 255
j = (j + S[i] + T[i]) mod 256;
Swap (S[i], S[j]);
Because the only operation on S is a swap, the only effect is a permutation. S still contains all the
numbers from 0 through 255.

Stream Generation

Once the S vector is initialized, the input key is no longer used. Stream generation involves cycling
through all the elements of S[i] , and for each S[i] , swapping S[i] with another byte in S according
to a scheme dictated by the current configuration of S. After S[255] is reached, the process
continues, starting over again at S[0] :
/* Stream Generation */
i, j = 0;
while (true)
i = (i + 1) mod 256;
j = (j + S[i]) mod 256;
Swap (S[i], S[j]);
t = (S[i] + S[j]) mod 256;
k = S[t];
To encrypt, XOR the value with the next byte of plain text. To decrypt, XOR the value with the
next byte of cipher text.
Strength of RC4
A number of papers have been published analyzing methods of attacking RC4. None of these
approaches is practical against RC4 with a reasonable key length, such as 128 bits. A more serious
problem is reported in [FLUH01]. The authors demonstrate that the WEP protocol, intended to
provide confidentiality on 802.11 wireless LAN networks, is vulnerable to a particular attack
approach.

Kavikulguru Institute of Technology & Science P a g e | 18

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 5.1: RC4 logic

In essence, the problem is not with RC4itself but the way in which keys are generated for use as
input to RC4.This particular problem does not appear to be relevant to other applications using
RC4 and can be remedied in WEP by changing the way in which keys are generated. This problem
points out the difficulty in designing a secure system that involves both cryptographic functions
and protocols that make use of them.

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. What is stream cipher?
2. What is RC4? Explain it briefly.
3. What are the features of RC4 algorithm?
4. Where are the different applications of RC4?
5. Distinguish between RC4 and RC5.

Kavikulguru Institute of Technology & Science P a g e | 19

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

EXPERIMENT NO:
Date:
AIM: To implement Public Key Encryption technique.

PROBLEM STATEMENT: Write a program to implement RSA Algorithm.

THEORY:

The pioneering paper by Diffie and Hellman introduced a new approach to cryptography and, in
effect, challenged cryptologists to come up with a cryptographic algorithm that met the
requirements for public-key systems. A number of algorithms have been proposed for public-key
cryptography. Some of these, though initially promising, turned out to be breakable. One of the
first successful responses to the challenge was developed in 1977 by Ron Rivest, Adi Shamir, and
Len Adleman at MIT and first published in 1978. The Rivest-Shamir-Adleman (RSA) scheme has
since that time reigned supreme as the most widely accepted and implemented general-purpose
approach to public-key encryption. The RSA scheme is a block cipher in which the plaintext and
cipher text are integers between 0 and n-1 for some n. A typical size for n is 1024 bits, or 309
decimal digits. That is, n is less than21024.
Description of the Algorithm
RSA makes use of an expression with exponentials. Plaintext is encrypted in blocks, with each
block having a binary value less than some number n. That is, the block size must be less than or

equal to log 2 ( n ) +1 in practice, the block size is I bits, where 2i <n ≤ 2i+1. Encryption and
decryption are of the following form, for some plaintext block M and cipher text block C.

C=M e mod n
M = C dd mod n = ( M ¿¿ e)¿d mod n = M ed mod n
Both sender and receiver must know the value of n. The sender knows the value of e, and only the
receiver knows the value of d. Thus, this is a public-key encryption algorithm with a public key of
PU = {e, n} and a private key of PR = {d, n}.
For this algorithm to be satisfactory for public-key encryption, the following requirements must be
met.3
1. It is possible to find values of e, d, n such that Med mod n = M for all M < n.
2. It is relatively easy to calculate Me mod n and Cd mod n for all values of M < n.
3. It is infeasible to determine d given e and n.
For now, we focus on the first requirement and consider the other questions later. We need to find
a relationship of the form

Kavikulguru Institute of Technology & Science P a g e | 20

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Med mod n = M
The preceding relationship holds if e and d are multiplicative inverses modulo f(n), where f(n) is
the Euler totient function and for p, q prime, f (pq) = (p - 1)(q - 1). The relationship between e and
d can be expressed as:
ed mod Ø (n)=1
This is equivalent to saying:
ed ≡1 modØ ( n)
d ≡e−1 mod Ø (n)d
That is, e and d are multiplicative inverses mod Ø(n). Note that, according to the rules of modular
arithmetic, this is true only if d (and therefore e) is relatively prime to Ø(n). Equivalently,
gcd(Ø(n), d) = 1.
We are now ready to state the RSA scheme. The ingredients are the following:
p, q, two prime numbers (private, chosen)
n = pq (public, calculated)
e, with gcd(Ø(n), e) = 1; 1 < e < Ø(n) (public, chosen)
d ≡ e−1 (mod Ø(n)) (private, calculated)
The private key consists of {d, n} and the public key consists of {e, n}. Suppose that user A has
published its public key and that user B wishes to send the message M to A. Then B calculates C =

M e mod n and transmits C. On receipt of this ciphertext, user A decrypts by calculating M = C d

mod n.
Alice generates a public/private key pair; Bob encrypts using Alice’s public key; and Alice
decrypts using her private key. For this example, the keys were generated as follows.
1. Select two prime numbers, p = 17 and q = 11.
2. Calculate n = pq = 17 × 11 = 187.
3. Calculate f(n) = (p - 1)(q - 1) = 16 × 10 = 160.
4. Select e such that e is relatively prime to Ø(n) = 160 and less than Ø(n); we choose e = 7.
5. Determine d such that de ≡ 1 (mod 160) and d < 160.The correct value is d = 23, because 23
× 7 = 161 = (1 × 160) + 1; d can be calculated using the extended Euclid’s algorithm. The
resulting keys are public key PU = {7, 187} and private key PR = {23, 187}.
The example shows the use of these keys for a plaintext input of M= 88. For encryption, we need
to calculate C = 887 mod 187. Exploiting the properties of modular arithmetic, we can do this as
follows.

887 mod 187 = [(88 4 mod 187) × (882 mod 187)× (881 mod 187)] mod 187
881 mod 187 = 88

Kavikulguru Institute of Technology & Science P a g e | 21

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

882 mod 187 = 7744 mod 187 = 77

88 4 mod 187 = 59,969,536 mod 187 = 132
887 mod 187 = (88 × 77 × 132) mod 187 = 894,432 mod 187 = 11

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. Explain the public key cryptography.
2. What are the applications of public key cryptography?
3. Explain RSA algorithm with example.
4. Perform encryption and decryption using RSA, where p = 3, q = 11, e = 7, M = 5.
5. Write the possible attacks on RSA algorithm.

EXPERIMENT NO:
Date:

Kavikulguru Institute of Technology & Science P a g e | 22

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

AIM: To implement Euclidean algorithm.

PROBLEM STATEMENT: To find Greatest Common Divisor using Euclidean algorithm.

THEORY:

Division Algorithm
Definition: - An integer b is said to be divisible by an integer a ≠ o , in symbolsa∨b, if there exists
some integer c such thatb=ac .
Thus for example, −12is divisible by4 , since−12=4(−3). However, 10 is not divisible by3; for no
integer c which makes the statement 10=3 c true.
Greatest Common Divisor
Definition:- Let a and b be given integers, with at least one of them different from zero. The
greatest common divisor of a and b , denoted by gcd (a , b) , is the positive integers d satisfying
1. d∨a and d∨b
2. if c∨a and c∨b, then c ≤ d
Example:- The positive divisor of −12 are 1 ,2 , 3 , 4 ,6 , 12, while those of 30 are
1 ,2 , 3 , 5 ,6 ,10 , 15 ,30 ; hence the positive common divisor of -12 and 30 are 1 ,2 , 3 , 6. Sincd 6 is
the largest of these integers, it follows that gcd (−12,30)=6 .
The next theorem indicates that gcd (a , b) can be represented as a linear combination of a and b
(by a linear combination of a and b, we mean an expression of the form ax +by , where x and y are
integers). This is illustrated by, say,
gcd (−12,30)=6=(−12)2+ 30.1
gcd (−8 ,−36)=4=(−8)4+(−36)(−1)
Theorem:- Given integers a and b , not both of which are zero, there exist integers x and y such
that gcd (a , b)=ax+by .
Euclidean Algorithm
The greatest common divisor of two integers can, of course be found by listing all their positive
divisors and picking out the largest one common to each but this is cumbersome for large
numbers. A more efficient process, involving repeated application of the Division Algorithm.
Although there is historical evidence that this method predates Euclid, it is today referred to as the
Euclidean Algorithm.
The Euclidean Algorithm may be describe as follows:
Let a and b be two integers whose greatest common divisor is desired. Since gcd ¿ , there is no
harm in assuming that a ≥ b>0 . The first step is to apply the Division Algorithm to a and b to get
a=q 1 b+ r 1 0 ≤ r 1< b.

Kavikulguru Institute of Technology & Science P a g e | 23

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

If r 2=0, then we stop; otherwise, proceed as before to obtain

r 1=q2 r 2+ r 3 0 ≤ r 3 <r 2
The division process continues until some zero remainder appears, say at the (n+1)th stage where
r n−1 is divided by r n (a zero remainder occurs soon or later since the decreasing sequence
b> r 1> r 2> ⋯ ≥ 0 can not contain more than b integers.
The result is the following system of equations:
a=q 1 b+ r 1 , 0<r 1<b
b=q 2 r 1+r 2 ,0< r 2 <b
r 1=q3 r 2+ r 3 ,0< r 3 <r 2
⋮
¿ q n r n−1 +r n , 0<r n< r n−1
r n−1=qn +1 r n +0
We argue that r n, the last nonzero remainder which appears in this manner, is equal to gcd (a , b).
Example:
Let us see how the Euclidean Algorithm works in a concrete case by calculating, say,
gcd (12378,3054)
12378=4 ⋅3054 +162,
3054=18 ⋅ 162+ 138 ,
162=1 ⋅138+24 ,
138=5⋅ 24 +18 ,
24=1 ⋅18+6 ,
18=3⋅ 6+0.
Our previous discussion tells us that the last nonzero remainder appearing above, namely the
integer 6 , is the greatest common divisor of 12378 and 3054 .
6=gcd ( 12378,3054 )
In order to represent 6 as a linear combination of the integers 12378 and 3054 , we start with the
next-to-last of the displayed equations and successively eliminate the remainders 18 , 24 , 138 and
162:
6=24−18
¿ 24−( 138−5 ⋅24 )
¿ 6 ⋅24−138
¿ 6 ( 162−138 ) −138
¿ 6 ⋅162−7 ⋅ 138

Kavikulguru Institute of Technology & Science P a g e | 24

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

¿ 6 ⋅162−7 (3054−18⋅162)
¿ 132⋅162−7 ⋅3054
¿ 132 (12378−4 ⋅ 3054 )−7 ⋅ 3054
¿ 132⋅12378+ (−535 ) 3054
Thus, we have
6=gcd (12378,3054)=12378 x+3054 y ,
Where x=132 and y=−535. It might be well to record that this is not the only way to express the
integer 6 as a linear combination 12378 and 3054 ; among other possibilities, one could add and
subtract 3054 ⋅12378 to get
6=( 132+ 3054 ) 12378+ (−535−12378 ) 3054 ¿
¿ 3186 ⋅12378+ (−12913 ) 3054

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. Find the gcd (143,227) and gcd (306,657).
2. Use Euclidean Algorithm to obtain integer x and y satisfying
a. gcd(56,72) = 56x+72y
b. gcd(119,272)=119x+272y
c. gcd(1769,2378)=1769x+2378y

EXPERIMENT NO:
Date:

Kavikulguru Institute of Technology & Science P a g e | 25

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

AIM: To implement Message Digest technique.

PROBLEM STATEMENT: Write a program to implement Message Digest 5 algorithm.

THEORY:
MD5 (Message-Digest 5): It is a widely used cryptographic function with a 128-bit hash value.
MD5 has been employed in a wide variety of security applications, and is also commonly
used to check the integrity of files. An MD5 hash is typically expressed as a 32-digit hexadecimal
number.
Pros:
1. It is easy to compute the hash value for any given message,
2. It is infeasible to find a message that has a given hash,
3. It is infeasible to modify a message without changing its hash,
4. It is infeasible to find two different messages with the same hash.
Cons:
1. The security of the MD5 hash function is severely compromised.
2. A collision attack exists that can find collisions within seconds on a computer with a
2.6 Ghz Pentium4 processor (complexity of 224.1).
3. A number of projects have published MD5 rainbow tables online, that can be used to
reverse many MD5 hashes into strings that collide with the original input, usually for the
purposes of password cracking.

Algorithm:
Step 1: The input message is broken up into chunks of 512-bit blocks (sixteen 32-bit little
endian integers), the message is padded so that its length is divisible by 512.
Step 2: The padding works as follows: first a single bit, 1, is appended to the end of the message.
Step 3: This is followed by as many zeros as are required to bring the length of the message up to
64 bits, less than a multiple of 512.
Step 4: The remaining bits are filled up with a 64-bit integer representing the length of the
original message, in bits.
Step 5: The MD5 algorithm uses 4 state variables, each of which is a 32 bit integer (an unsigned
long on most systems). These variables are sliced and diced and are (eventually) the
message digest.
The variables are initialized as follows:
A = 0x67452301

Kavikulguru Institute of Technology & Science P a g e | 26

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

B = 0xEFCDAB89
C = 0x98BADCFE
D = 0x10325476.
Step 6: The main part of the algorithm uses four functions to thoroughly goober the above state
variables.
Those functions are as follows:
F(X,Y,Z) = (X & Y) | (~(X) & Z)
G(X,Y,Z) = (X & Z) | (Y & ~(Z))
H(X,Y,Z) = X ^ Y ^ Z
I(X,Y,Z) = Y ^ (X | ~(Z))
Where &, |, ^, and ~ are the bit-wise AND, OR, XOR, and NOT operators
Step 7: These functions, using the state variables and the message as input, are used to transform
the state variables from their initial state into what will become the message digest. For
each 512 bits of the message, the rounds performed (this is only pseudo-code, don’t try to
compile it). After this step, the message digest is stored in the state variables (A, B, C, and
D). To get it into the hexadecimal form you are used to seeing, output the hex values of
each the state variables, least significant byte first.
For example, if after the digest:
A = 0x01234567
B = 0x89ABCDEF
C = 0x1337D00D
D = 0xA5510101
Then the message digest would be:
67452301EFCDAB890DD03713010151A5 (required hash value of the input value).

EXAMPLE:
MD5 ("The quick brown fox jumps over the lazy dog")
= 9e107d9d372bb6826bd81d3542a419d6

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. What is a hash function?
2. Define a cryptographic hash function.
3. Define an iterated cryptographic hash function.

Kavikulguru Institute of Technology & Science P a g e | 27

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

4. List the features of MD5 algorithm

5. Compare MD5 with MD4.

EXPERIMENT NO:
Date:
AIM: To implement Buffer Overflow attack.

PROBLEM STATEMENT: Write a program to implement Buffer Overflow attack.

THEORY:

Kavikulguru Institute of Technology & Science P a g e | 28

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a
buffer, overruns the buffer's boundary and overwrites adjacent memory locations. This can occur
when copying data from one buffer to another without first checking that the data fits within the
destination buffer. This is a special case of the violation of memory safety.

Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the
program operates. This may result in erratic program behavior, including memory access errors,
incorrect results, a crash, or a breach of system security. Thus, they are the basis of many software
vulnerabilities and can be maliciously exploited.

Programming languages commonly associated with buffer overflows include C and C++, which
provide no built-in protection against accessing or overwriting data in any part of memory and do
not automatically check that data written to an array (the built-in buffer type) is within the
boundaries of that array.

Example:
A program has two data items which are adjacent in memory: an 8-byte-long string buffer, A, and
a two-byte integer, B.
char a[8] = “”;
unsigned short B = 1979;
Initially, A contains nothing but zero bytes, and B contains the number 1979.
Variable name A B
Value [null string] 1979
Hex value 00 00 00 00 00 00 00 00 07 BB
Now, the program attempts to store the null-terminated string “excessive” with ASCII encoding in
the A buffer.

“Excessive” is 9 characters long and encodes to 10 bytes including the terminator, but A can take
only 8 bytes. By failing to check the length of the string, it also overwrites the value of B:

Variable name A B
Value ‘e’ ‘x’ ‘c’ ‘e’ ‘s’ ‘s’ ‘i’ ‘v’ 25856
Hex value 65 78 63 65 73 73 69 76 65 00

B's value has now been inadvertently replaced by a number formed from part of the character
string. In this example "e" followed by a zero byte would become 25856.

Writing data past the end of allocated memory can sometimes be detected by the operating system
to generate a segmentation fault error that terminates the process.

Kavikulguru Institute of Technology & Science P a g e | 29

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

To prevent the buffer overflow from happening in this example, the call to strcpy could be
replaced with strncpy, which takes the maximum capacity of A as an additional parameter and
ensures that no more than this amount of data is written to A.

Buffer Overflow
prog1.c:
void sub(char *ptr_to_Buffer1)
{
printf("\n Inside sub() function:\n");
char Buffer2[12]="AAAAAAAAAAA\0";
printf("Buffer2 = %s \n", Buffer2);
strcpy(Buffer2, ptr_to_Buffer1);
printf("Buffer2 = %s \n", Buffer2);
}
int main()
{
char Buffer1[]= "HELLO WORLD";
printf("\n Inside main() function: \n");
printf("Buffer1 = %s \n", Buffer1);
sub(Buffer1);
printf("\n Returned to main()\n");
return 0; }

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS

1. What is buffer overflow?

2. Give the different types of buffer overflow attacks.

3. Explain the ways of protection against buffer overflow.

4. Explain the use of strcpy(), strncpy() and free().

5. What is segmentation fault?

Kavikulguru Institute of Technology & Science P a g e | 30

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

EXPERIMENT NO:
Date:
AIM: To implement SQL Injection attack.

PROBLEM STATEMENT: Design of the database and queries to implement SQL Injection attack.

THEORY:

Databases are fundamental components of Web applications. Databases enable Web applications
to store data, preferences and content elements. Using SQL, Web applications interact with
databases to dynamically build customized data views for each user.

Kavikulguru Institute of Technology & Science P a g e | 31

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

SQL injection is a code injection technique, used to attack data-driven applications, in which
malicious SQL statements are inserted into an entry field for execution. SQL injection is mostly
known as an attack vector for websites but can be used to attack any type of SQL database.

When SQL is used to display data on a web page, it is common to let web users input their own
SQL commands into an SQL statement, via web page input. Since SQL statements are text only, it
is easy, with a little piece of computer code, to dynamically change SQL statements to provide the
user with selected data. Injected SQL commands can alter SQL statement and compromise the
security of a web application.

SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause
repudiation issues such as voiding transactions or changing balances, allow the complete
disclosure of all data on the system, destroy the data or make it otherwise unavailable, and
become administrators of the database server.

Types of SQL Injection attacks: There are four main categories of SQL Injection attacks against
databases:
1. SQL Manipulation: SQL manipulation typically involves modifying the SQL statement through
set operations (e.g., UNION) or altering the WHERE clause to return a different result. Many
documented SQL injection attacks are of this type. The most well-known attack is to modify the
WHERE clause of the user authentication statement so the WHERE clause always results in
TRUE.
2. Code Injection: Code injection is when an attacker inserts new SQL statements or database
commands into the SQL statement. The classic code injection attack is to append a SQL Server
EXECUTE command to the vulnerable SQL statement. Code injection only works when
multiple SQL statements per database request are supported.
3. Function Call Injection: Function call injection is the insertion of Oracle database functions or
custom functions into a vulnerable SQL statement. These function calls can be used to make
operating system calls or manipulate data in the database.
4. Buffer Overflows: SQL injection of buffer overflows is a subset of function call injection. In
several commercial and open-source databases, vulnerabilities exist in a few database functions
that may result in a buffer overflow. Patches are available for most of these vulnerabilities, but
many production databases remain un-patched.

Mitigation Techniques:

Kavikulguru Institute of Technology & Science P a g e | 32

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

1. Bind Variables: The most powerful protection against SQL injection attacks is the use of
bind variables. Using bind variables will also improve application performance.
Application coding standards should require the use of bind variables in all SQL
statements. No SQL statement should be created by concatenating together strings and
passed parameters. Bind variables should be used for every SQL statement regardless
of when or where the SQL statement is executed.
2. Input Validation: Every passed string parameter should be validated. Many web applications
use hidden fields and other techniques, which also must be validated. If a bind variable is not
being used, special database characters must be removed or escaped.
3. Function Security: Standard and custom database functions can be exploited in SQL injection
attacks. Many of these functions can be used effectively in an attack. The application may have
additional functions which perform operations like changing passwords or creating users that
could be exploited. All functions that are not absolutely necessary to the application should be
restricted.
4. Error Messages: If an attacker cannot obtain the source code for an application, error messages
become critically important for a successful attack. Many Java applications do not return
detailed error messages, but testing and analysis should be performed to determine if the
application returns detailed error messages. Rather than returning detailed database error
messages to the user, this information should be written to a log file.

Design:

1. Create a table “users” as given with the design below.

USERS (eid varchar2(25), fname varchar2(25), lname varchar2(25), usid varchar2(25), pass
varchar2(25), mob number(10), email varchar2(25))

2. Insert at least five tuples in the table with the specified fields.

SQL Injection Queries:

1. SQL Injection Based on 1=1.
2. SQL Injection Based on “”=””.
3. Batch statements execution.
4. Guessing field names of the table.

Kavikulguru Institute of Technology & Science P a g e | 33

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

5. Finding users information from the table.

6. Adding a new member to the table.
7. Finding the number of columns of the tables.
8. Displaying the hostname of the machine.
9. Displaying version of the database on the machine.
10. Displaying the content of the file from the system on the console.

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS

1. What is SQL Injection Attack?

2. Explain the ways of protection against SQL Injection Attack.

3. What is Cross Site Scripting attack?

4. What is segmentation fault?

EXPERIMENT NO:
Date:
AIM: Demonstration of Digital Certificate generation tool.

PROBLEM STATEMENT: Installation and demonstration of Digital Certificate generation tool.

THEORY:

Certificates

One of the most common forms of cryptography today is public-key cryptography. Public-key
cryptography utilizes a public key and a private key. The system works by encrypting information
using the public key. The information can then only be decrypted using the private key.

Kavikulguru Institute of Technology & Science P a g e | 34

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

A common use for public-key cryptography is encrypting application traffic using a Secure Socket
Layer (SSL) or Transport Layer Security (TLS) connection. For example, configuring Apache to
provide HTTPS, the HTTP protocol over SSL. This allows a way to encrypt traffic using a protocol
that does not itself provide encryption.

A Certificate is a method used to distribute a public key and other information about a server and
the organization who is responsible for it. Certificates can be digitally signed by a Certification
Authority or CA. A CA is a trusted third party that has confirmed that the information contained
in the certificate is accurate.

Types of Certificates
To set up a secure server using public-key cryptography, in most cases, you send your certificate
request (including your public key), proof of your company's identity, and payment to a CA. The
CA verifies the certificate request and your identity, and then sends back a certificate for your
secure server. Alternatively, you can create your own self-signed certificate.
Continuing the HTTPS example, a CA-signed certificate provides two important capabilities that a
self-signed certificate does not:
1. Browsers (usually) automatically recognize the certificate and allow a secure connection to
be made without prompting the user.
2. When a CA issues a signed certificate, it is guaranteeing the identity of the organization that
is providing the web pages to the browser.

Most Web browsers, and computers, that support SSL have a list of CAs whose certificates they
automatically accept. If a browser encounters a certificate whose authorizing CA is not in the list,
the browser asks the user to either accept or decline the connection. Also, other applications may
generate an error message when using a self-singed certificate.
The process of getting a certificate from a CA is fairly easy.
A quick overview is as follows:
1. Create a private and public encryption key pair.
2. Create a certificate request based on the public key. The certificate request contains
information about your server and the company hosting it.
3. Send the certificate request, along with documents proving your identity, to a CA. We
cannot tell you which certificate authority to choose. Your decision may be based on your
past experiences, or on the experiences of your friends or colleagues, or purely on monetary

Kavikulguru Institute of Technology & Science P a g e | 35

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

factors. Once you have decided upon a CA, you need to follow the instructions they provide
on how to obtain a certificate from them.
4. When the CA is satisfied that you are indeed who you claim to be, they send you a digital
certificate.
5. Install this certificate on your secure server, and configure the appropriate applications to
use the certificate.

Generating a Certificate Signing Request (CSR)

Whether you are getting a certificate from a CA or generating your own self-signed certificate, the
first step is to generate a key.
If the certificate will be used by service daemons, such as Apache, Postfix, Dovecot, etc. a key
without a passphrase is often appropriate. Not having a passphrase allows the services to start
without manual intervention, usually the preferred way to start a daemon.
This section will cover generating a key with a passphrase, and one without. The non-passphrase
key will then be used to generate a certificate that can be used with various service daemons.
To generate the keys for the Certificate Signing Request (CSR) run the following command from a
terminal prompt:

openssl genrsa -des3 -out server.key 2048

Generating RSA private key, 2048 bit long modulus

..........................++++++

.......++++++

e is 65537 (0x10001)

Enter pass phrase for server.key:

You can now enter your passphrase. For best security, it should at least contain eight characters.
The minimum length when specifying -des3 is four characters. It should include numbers and/or
punctuation and not be a word in a dictionary. Also remember that your passphrase is case-
sensitive.

Re-type the passphrase to verify. Once you have re-typed it correctly, the server key is generated
and stored in the server.key file.

Now create the insecure key, the one without a passphrase, and shuffle the key names:

Kavikulguru Institute of Technology & Science P a g e | 36

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

openssl rsa -in server.key -out server.key.insecure

mv server.key server.key.secure

mv server.key.insecure server.key

The insecure key is now named server.key, and you can use this file to generate the CSR without
passphrase.

To create the CSR, run the following command at a terminal prompt:

openssl req -new -key server.key -out server.csr

It will prompt you enter the passphrase. If you enter the correct passphrase, it will prompt you to
enter Company Name, Site Name, Email Id, etc. Once you enter all these details, your CSR will be
created and it will be stored in the server.csr file.

You can now submit this CSR file to a CA for processing. The CA will use this CSR file and issue
the certificate. On the other hand, you can create self-signed certificate using this CSR.

Creating a Self-Signed Certificate

To create the self-signed certificate, run the following command at a terminal prompt:
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
The above command will prompt you to enter the passphrase. Once you enter the correct
passphrase, your certificate will be created and it will be stored in the server.crtfile.

Installing the Certificate

You can install the key file server.key and certificate file server.crt, or the certificate file
issued by your CA, by running following commands at a terminal prompt:
sudo cp server.crt /etc/ssl/certs
sudo cp server.key /etc/ssl/private
Now simply configure any applications, with the ability to use public-key cryptography,
to use the certificate and key files. For example, Apache can provide HTTPS, Dovecot can
provide IMAPS and POP3S, etc.

Certification Authority
If the services on your network require more than a few self-signed certificates it may be
worth the additional effort to setup your own internal Certification Authority (CA). Using

Kavikulguru Institute of Technology & Science P a g e | 37

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

certificates signed by your own CA, allows the various services using the certificates to
easily trust other services using certificates issued from the same CA.
1. First, create the directories to hold the CA certificate and related files:
sudo mkdir /etc/ssl/CA
sudo mkdir /etc/ssl/newcerts
2. The CA needs a few additional files to operate, one to keep track of the last serial
number used by the CA, each certificate must have a unique serial number, and
another file to record which certificates have been issued:
sudo sh -c "echo '01' > /etc/ssl/CA/serial"
sudo touch /etc/ssl/CA/index.txt
3. The third file is a CA configuration file. Though not strictly necessary, it is very
convenient when issuing multiple certificates. Edit /etc/ssl/openssl.cnf, and in the
[ CA_default ] change:
dir = /etc/ssl/ # Where everything is kept
database = $dir/CA/index.txt # database index file.
certificate = $dir/certs/cacert.pem # The CA certificate
serial = $dir/CA/serial # The current serial number
private_key = $dir/private/cakey.pem # The private key
4. Next, create the self-singed root certificate:
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem - out cacert .pem -days 3650
You will then be asked to enter the details about the certificate.
5. Now install the root certificate and key:
sudo mv cakey.pem /etc/ssl/private/
sudo mv cacert.pem /etc/ssl/certs/
6. You are now ready to start signing certificates. The first item needed is a Certificate Signing
Request (CSR), once you have a CSR, enter the following to generate a certificate signed by the
CA:
sudo openssl ca -in server.csr -config /etc/ssl/openssl.cnf
After entering the password for the CA key, you will be prompted to sign the certificate, and
again to commit the new certificate. You should then see a somewhat large amount of output
related to the certificate creation.
7. There should now be a new file, /etc/ssl/newcerts/01.pem, containing the same output. Copy
and paste everything beginning with the line: -----BEGIN CERTIFICATE----- and continuing

Kavikulguru Institute of Technology & Science P a g e | 38

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

through the line: ----END CERTIFICATE-----lines to a file named after the hostname of the
server where the certificate will be installed. For example mail.example.com.crt, is a nice
descriptive name. Subsequent certificates will be named 02.pem, 03.pem, etc.
8. Finally, copy the new certificate to the host that needs it, and configure the appropriate
applications to use it. The default location to install certificates is /etc/ssl/certs. This enables
multiple services to use the same certificate without overly complicated file permissions. For
applications that can be configured to use a CA certificate, you should also copy the
/etc/ssl/certs/cacert.pem file to the /etc/ssl/certs/ directory on each server.

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. What are the typical contents of a digital certificate?
2. What is the role of a CA and a RA?
3. Why is a self-signed certificate needed?
4. List the common causes for revoking a digital certificate.
5. Give different tools for digital certificate generation.

EXPERIMENT NO:
Date:
AIM: Demonstration of WIRESHARK tool.

PROBLEM STATEMENT: Installation and demonstration of the commands of WIRESHARK tool.

THEORY:
WireShark is a free and open-source network protocol analyzer that runs on various operating
systems including Linux, Unix, Mac, and Windows. WireShark (previously called Ethereal) is one
of the most widely used network protocol analyzer. It passively sniffs packets that are sent from or
received by a designated network interface, but never sends packets itself. It receives a copy of
packets that are sent from or received by the applications and protocols executing on the end-
system (e.g., your computer). WireShark also has a graphical front-end to display the packets that
it sniffs.

Kavikulguru Institute of Technology & Science P a g e | 39

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 12.1: Network protocol analyzer structure

Fig. 12.1 shows the structure of a network protocol analyzer. At the right of the figure shows the
protocol stack and applications (such as a web browser or an FTP client) that normally run on
your computer. The network protocol analyzer, shown within the dashed rectangle, has two parts,
the packet capture and the packet analyzer. The packet capture library receives a copy of every
link-layer frame that is sent from or received by a designated network interface. Recall that
messages exchanged by higher layer protocols such as HTTP, FTP, TCP, UDP, DNS, or IP all are
eventually encapsulated in link-layer frames that are transmitted over physical media such as an
Ethernet cable. In Fig. 12.1, the assumed physical media is an Ethernet, and so all upper layer
protocols’ headers are eventually encapsulated within an Ethernet frame. Capturing all link-layer
frames thus gives you all messages sent from or received by all protocols and applications
executing in your computer.
The second component is the packet analyzer, which displays the contents of all fields within a
link-layer frame. In order to do so, the packet analyzer must understand the structure of messages
exchanged by the protocols. For example, we are interested in displaying the various fields in
messages exchanged by the HTTP protocol in Fig. 12.1. The packet analyzer understands the
format of Ethernet frames, and so it can identify the IP datagram within an Ethernet frame. It also
understands the IP datagram format, so it can extract the TCP segment within the IP datagram. It
understands the TCP segment structure, so it can extract the HTTP message contained in the TCP
segment. Finally, it understands the HTTP protocol, so it knows that an HTTP message may
contain the string of “GET”, “POST”, or “HEAD”.
Networking Commands
1. ping: The ping program in the source host sends a packet to the target IP address. If the
target is alive, the ping program in the target host responds by sending a packet back to the
source host. Both of these ping packets carry ICMP messages. Try “ping --help” to find out
its usage.

Kavikulguru Institute of Technology & Science P a g e | 40

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

2. ifconfig: ifconfig is a tool to configure a network interface, for instance, setting an

interface’s IP address and netmask, disabling or enabling a given interface. Try “ifconfig
--help” to find out its usage.
3. netstat: netstat is a tool that displays network connections, routing tables, and network
interface statistics. It is used for finding problems in the network and to determine the
amount of traffic on the network as a performance measurement. Try “netstat --help” to
find its usage.
4. wget: wget is a command-line program that let you fetch a URL. Unlike a web browser,
which fetches and executes the entire pages, wget gives you the control on which URLs you
fetch and when you fetch them. wget has many options (try “wget --help” to see them) but
a URL can be fetched simply with “wget URL”.

Getting familiar with WireShark

When you run WireShark, you will see the graphical user interface (GUI) as shown in following
figure 12.2 there are four main fields as follows.
1. Filter field: It is used to filter out uninterested packets with the entered specifications, so
you can choose which packets should (not) be shown on the screen.
2. Captured packets: It lists the packets captured by the selected interface.
3. Details of selected packet: It lists the information about the packet that is selected in the
captured packets window.
4. Content of packet in hex/ASCII: It displays the content of the captured packet, in hex and
ASCII.
Capture Trace
Use the following procedure to capture the trace.
1. Pick a URL and fetch it by wget. For example, open a console, type “wget
http://www.google.com”, and you will obtain the fetched resource written in a file. A
successful example is shown in Figure 12.3. The expected response is “200 OK”.

Kavikulguru Institute of Technology & Science P a g e | 41

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 12.2: GUI of Wireshark

Kavikulguru Institute of Technology & Science P a g e | 42

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

Figure 12.3: wget URL

2. Close web browser(s). Closing the browser(s) can stop your computer from fetching
unnecessary web content, and avoid incidental traffic in the trace.
3. Launch WireShark. Choose the network interface that we would like to capture the packets
on. To do this, select “Capture ) Options” from the command menu. A window similar to
the one shown in Figure 12.4 should pop up. Select the interface you are using. Uncheck
“Capturepackets in promiscuous mode”. This mode is useful to overhear packets sent
to/from other computers on broadcast networks. We only want to record packets sent
to/from your computer. Use capture filter “tcp port 80”. This filter will record only
standard web traffic and not other kinds of packets that your computer may send. Click
“Start” to start the packet capture process.

Figure 12.4: Capture Options Window

4. When the capture is started, repeat the web fetch using wget above. This time, the packets
will be recorded by WireShark as the content is transferred.
5. After the fetch is successful, return to WireShark and use the menus or buttons to stop the
trace (“Capture) Stop”). If you have succeeded, the upper WireShark window will show
multiple packets. How many packets being captured will depend on the size of the web
page, but there should be at least 8 packets in the trace. An example is shown in Fig. 12.5.

Figure 12.5: Packet Trace

Kavikulguru Institute of Technology & Science P a g e | 43

Ramtek - 441106
 Department of Computer Technology
Cyber and Information Security
8thSemester C.T.

CONCLUSION: Students are advised to write conclusion on separate sheet.

REVIEW QUESTIONS
1. What is Wireshark? What are the advantages of Wireshark?
2. Enlist different tools similar to Wireshark.
3. Which Wireshark filter can be used to check all incoming request to a HTTP Web server?
4. Which Wireshark filter can be used to monitor outgoing packets from a specific system on
the network?
5. How to use Wireshark to find a password in your network?

Kavikulguru Institute of Technology & Science P a g e | 44

Ramtek - 441106