Chapter Two

2. Brief Overview of Commercial Issues

2.1. Cryptography
Cryptography is technique of securing information and communications through use of
codes so that only those person for whom the information is intended can understand it and
process it.
Thus, preventing unauthorized access to information. The prefix “crypt” means “ hidden”
and suffix “graphy” means “writing”. In Cryptography the techniques which are use to
protect information are obtained from mathematical concepts and a set of rule-based
calculations known as algorithms to convert messages in ways that make it hard to decode
it.
These algorithms are used for cryptographic key generation, digital signing, verification to
protect data privacy, web browsing on internet and to protect confidential transactions such
as credit card and debit card transactions.
Techniques used For Cryptography:
In today’s age of computers cryptography is often associated with the process where an
ordinary plain text is converted to cipher text which is the text made such that intended
receiver of the text can only decode it and hence this process is known as encryption. The
process of conversion of cipher text to plain text this is known as decryption.
Features Of Cryptography are as follows:
1. Confidentiality: Information can only be accessed by the person for whom it is
intended and no other person except him can access it.
2. Integrity: Information cannot be modified in storage or transition between
sender and intended receiver without any addition to information being detected.
3. Non-repudiation: The creator/sender of information cannot deny his intention
to send information at later stage.
4. Authentication: The identities of sender and receiver are confirmed. As well as
destination/origin of information is confirmed.
Types Of Cryptography: In general, there are three types of cryptography:
1. Symmetric Key Cryptography: It is an encryption system where the sender
and receiver of message use a single common key to encrypt and decrypt
messages. Symmetric Key Systems are faster and simpler but the problem is that
sender and receiver have to somehow exchange key in a secure manner. The
most popular symmetric key cryptography system are Data Encryption System
(DES) and Advanced Encryption System (AES).
2. Hash Functions: There is no usage of any key in this algorithm. A hash value with
fixed length is calculated as per the plain text which makes it impossible for contents
of plain text to be recovered. Many operating systems use hash functions to encrypt
passwords.
3. Asymmetric Key Cryptography: Under this system a pair of keys is used to
encrypt and decrypt information. A receiver’s public key is used for encryption and a

1
 receiver’s private key is used for decryption. Public key and Private Key are
different. Even if the public key is known by everyone the intended receiver can only
decode it because he alone knows his private key. The most popular asymmetric key
cryptography algorithm is Rivest Shamir Adleman (RSA) algorithm.

Applications Of Cryptography:

1. Computer passwords: Cryptography is widely utilized in computer security,

particularly when creating and maintaining passwords. When a user logs in, their
password is hashed and compared to the hash that was previously stored.
Passwords are hashed and encrypted before being stored. In this technique, the
passwords are encrypted so that even if a hacker gains access to the password
database, they cannot read the passwords.
2. Digital Currencies: To safeguard transactions and prevent fraud, digital
currencies like Bitcoin also use cryptography. Complex algorithms and
cryptographic keys are used to safeguard transactions, making it nearly hard to
tamper with or forge the transactions.
3. Secure web browsing: Online browsing security is provided by the use of
cryptography, which shields users from eavesdropping and man-in-the-middle
assaults. Public key cryptography is used by the Secure Sockets Layer (SSL) and
Transport Layer Security (TLS) protocols to encrypt data sent between the web
server and the client, establishing a secure channel for communication.
4. Electronic signatures: Electronic signatures serve as the digital equivalent of a
handwritten signature and are used to sign documents. Digital signatures are
created using cryptography and can be validated using public key cryptography.
In many nations, electronic signatures are enforceable by law, and their use is
expanding quickly.
5. Authentication: Cryptography is used for authentication in many different
situations, such as when accessing a bank account, logging into a computer, or
using a secure network. Cryptographic methods are employed by authentication
protocols to confirm the user’s identity and confirm that they have the required
access rights to the resource.
6. Cryptocurrencies: Cryptography is heavily used by cryptocurrencies like
Bitcoin and Ethereum to safeguard transactions, thwart fraud, and maintain the
network’s integrity. Complex algorithms and cryptographic keys are used to
safeguard transactions, making it nearly hard to tamper with or forge the
transactions.
7. End-to-End Encryption: End-to-end encryption is used to protect two-way
communications like video conversations, instant messages, and email. Even if
the message is encrypted, it assures that only the intended receivers can read the
message. End-to-end encryption is widely used in communication apps like
WhatsApp and Signal, and it provides a high level of security and privacy for
users.

Advantages

1. Access Control: Cryptography can be used for access control to ensure that only
parties with the proper permissions have access to a resource. Only those with
the correct decryption key can access the resource thanks to encryption.
2
 2. Secure Communication: For secure online communication, cryptography is
crucial. It offers secure mechanisms for transmitting private information like
passwords, bank account numbers, and other sensitive data over the internet.
3. Protection against attacks: Cryptography aids in the defence against various
types of assaults, including replay and man-in-the-middle attacks. It offers
strategies for spotting and stopping these assaults.
4. Compliance with legal requirements: Cryptography can assist firms in
meeting a variety of legal requirements, including data protection and privacy
legislation.
Cryptography and Network Security Principles:
In present day scenario security of the system is the sole priority of any organisation. The
main aim of any organisation is to protect their data from attackers.
In Cryptography, attacks are of two types such as Passive attacks and Active attacks
Passive attacks are those that retrieve information from the system without affecting the
system resources while active attacks are those that retrieve system information and make
changes to the system resources and their operations.

The Principles of Security can be classified as follows:

1. Confidentiality:
The degree of confidentiality determines the secrecy of the information. The
principle specifies that only the sender and receiver will be able to access the
information shared between them. Confidentiality compromises if an
unauthorized person is able to access a message.

For example, let us consider sender A wants to share some confidential

information with receiver B and the information gets intercepted by the attacker
C. Now the confidential information is in the hands of an intruder C.
2. Authentication:
Authentication is the mechanism to identify the user or system or the entity. It
ensures the identity of the person trying to access the information. The
authentication is mostly secured by using username and password. The
authorized person whose identity is preregistered can prove his/her identity and
can access the sensitive information.
3. Integrity:
Integrity gives the assurance that the information received is exact and accurate.
If the content of the message is changed after the sender sends it but before
reaching the intended receiver, then it is said that the integrity of the message is
lost.
 System Integrity: System Integrity assures that a system performs its intended
function in an unimpaired manner, free from deliberate or inadvertent
unauthorized manipulation of the system.
 Data Integrity: Data Integrity assures that information (both stored and in
transmitted packets) and programs are changed only in a specified and
authorized manner.

3
 4. Non-Repudiation:
Non-repudiation is a mechanism that prevents the denial of the message content
sent through a network. In some cases, the sender sends the message and later
denies it. But the non-repudiation does not allow the sender to refuse the
receiver.
5. Access control:
The principle of access control is determined by role management and rule
management. Role management determines who should access the data while rule
management determines up to what extent one can access the data. The information
displayed is dependent on the person who is accessing it.

6. Availability:
The principle of availability states that the resources will be available to authorize
party at all times. Information will not be useful if it is not available to be accessed.
Systems should have sufficient availability of information to satisfy the user request.

2.2 Web Services Security

Web security refers to protecting networks, servers, and computer systems from damage to
or the theft of software, hardware, or data. It includes protecting computer systems from
misdirecting or disrupting the services they are designed to provide.
Web security is synonymous with cybersecurity and also covers website security, which
involves protecting websites from attacks.

Cybersecurity:
“Anything connected to the internet needs cybersecurity. This includes the computers and
mobile devices you use to do every day work and involves applications that need to access
the internet to function.
In addition, cybersecurity can protect the infrastructure of your network by safeguarding
servers, routers, access points, and switches from invasive programs and hackers.

A complete cybersecurity solution often incorporates multiple layers of protection. These can
be configured to support each other and unite to form a more solid barrier against internet
threats.”

It includes cloud security and web application security which defend cloud services and web-
based applications, respectively.
Website protection technology has enabled enhanced protection mechanisms, such as the
protection of a virtual private network (VPN), which also falls under the web security
umbrella.
Web security is crucial to the smooth operation of any business that uses computers. If a
website is hacked or hackers are able to manipulate your systems or software, your website—
and even your entire network—can be brought down, halting business operations. Businesses
need to account for the factors that go into web security and threat prevention.

4
Technologies for web security
Various technologies are available to help companies to achieve web security,
including
 web application firewalls (WAFs),
 security or vulnerability scanners
 password-cracking tools
 fuzzing tools
 black box testing tools, and
 white box testing tools.

2.3. Convergence
2.3.1. Communications and Information
Communication is a process involving two or more users. They exchange data, messages and
adopt the position of sender and receiver alternately.
Information is the set of data that has been previously prepared to configure a message.
Wired/Wireless PKI (Public Key Infrastructure)

2.3.2. Wired/Wireless PKI (Public Key Infrastructure)

Public key infrastructure (PKI) refers to tools used to create and manage public keys
for encryption, which is a common method of securing data transfers on the internet.

PKI is built into all web browsers used today, and it helps secure public internet traffic.
Organizations can use it to secure the communications they send back and forth internally
and also to make sure connected devices can connect securely.

The most important concept associated with PKI is the cryptographic keys that are part of the
encryption process and serve to authenticate different people or devices attempting to
communicate with the network.

PKI works through the implementation of two technologies: certificates and keys. A key is a
long number used to encrypt data. Each element of a message gets encrypted using the key
formula.

For example, if you want to write a message where every letter is replaced by the letter after
it, then A will become B, C will be D, etc. If someone is to have this key, they will get what
will look like a nonsensical message and decrypt it.

With PKI, the key involves advanced mathematical concepts that are much more
complicated. With the alphabetic example above, there is one key, and if the recipient has it,

5
they can easily decrypt the message. With PKI, on the other hand, there are two keys: a
private and a public one.

The public key is available to anyone who wants it and is used to encode a message that
someone sends to you. A private key is what you use to decrypt the message after you get it.
The keys are connected using a complex mathematical equation.

Even though the private and public keys are connected, the connection is facilitated by this
complex equation. It is therefore extremely difficult to ascertain the private key by using data
from the public key.

Certificates, which are issued by a certificate authority (CA), let you know the person or
device you want to communicate with is actually who they claim to be. When the correct
certificate is associated with a device, the device is considered authentic.

The validity of the certificate can be authenticated through a system that checks whether it is
real or not.

2.3.3. Internet: Protocol versions 4/6

Internet Protocol Version 4

IP stands for Internet Protocol and v4 stands for Version Four (IPv4). IPv4 was the
primary version brought into action for production within the ARPANET in 1983.

IP version four addresses are 32-bit integers which will be expressed in decimal notation.
Example- 192.0.2.126 could be an IPv4 address.
Parts of IPv4
 Network part:
The network part indicates the distinctive variety that’s appointed to the
network. The network part conjointly identifies the category of the network
that’s assigned.
 Host Part:
The host part uniquely identifies the machine on your network. This part of the
IPv4 address is assigned to every host.
For each host on the network, the network part is the same, however, the host
half must vary.
 Subnet number:
This is the no obligatory part of IPv4. Local networks that have massive
numbers of hosts are divided into subnets and subnet numbers are appointed to
that.
Characteristics of IPv4
 IPv4 could be a 32-Bit IP Address.
 IPv4 could be a numeric address, and its bits are separated by a dot.
 The number of header fields is twelve and the length of the header field is
twenty.
 It has Unicast, broadcast, and multicast style of addresses.
 IPv4 supports VLSM (Virtual Length Subnet Mask).

6
  IPv4 uses the Post Address Resolution Protocol to map to the MAC address.
 RIP may be a routing protocol supported by the routed daemon.
 Networks ought to be designed either manually or with DHCP.
 Packet fragmentation permits from routers and causing host.

Internet Protocol Version 6

IP address is your digital identity. It’s a network address for your computer so the
Internet knows where to send you emails, data, etc.
IP address determines who and where you are in the network of billions of digital
devices that are connected to the Internet.

IPv6 or Internet Protocol Version 6 is a network layer protocol that allows

communication to take place over the network.

IPv6 was designed by Internet Engineering Task Force (IETF) in December 1998
with the purpose of superseding the IPv4 due to the global exponentially growing
internet users.
An IPv6 address consists of eight groups of four hexadecimal digits. Here’s an example
IPv6 address:
3001:0da8:75a3:0000:0000:8a2e: 0370:7334

This new IP address version is being deployed to fulfil the need for more Internet
addresses. It was aimed to resolve issues which are associated with IPv4. With 128-
bit address space, it allows 340 undecillion unique address space. IPv6 also called
IPng (Internet Protocol next generation)

2.3.5. Intrusion Detection System/Prevention (IDS/IPS): Overview

IDS/IPC systems may be supplied as one combined solution, also known as IDPS security
solution, or as two separate systems focused on their own specific goals. Today, IDS/IPS
functionally mostly comes as part of other solutions, such as network traffic analysis
or network detection and response

Th difference between: IDS and IPS

Intrusion detection systems (IDS) work as monitoring solutions designed to search for signs
of network intrusion. If the IDS system discovers the intrusion, it sends a notification to
information security professionals.

Intrusion prevention systems (IPS) include functionality for taking action on the discovered
threat by blocking or remediating it. So, the main difference between IDS and IPS is that IPS
allows you to automate the process of responding to detected threats, while IDS requires you
to address attacks in manual mode.

7
Why IDS and IPS is important?

Both intrusion detection systems and intrusion prevention systems provide an extra layer of
security to networks by monitoring and analyzing traffic for malicious activity. They can
detect known and unknown threats, allowing organizations to respond to potential attacks
before they cause damage.

How do IDS and IPS work?

Intrusion detection and prevention systems monitor suspicious activities or patterns, such as
port scans or unauthorized access attempts. IDS/IPS systems may look for signatures of
known attacks or deviations in network traffic. Intrusion detection and prevention systems
may come as software applications or cloud-based solutions.

When an IDS/IPS detects suspicious activity, it can take different actions depending on the
type of attack detected. These actions may include logging the event in a security audit log,
alerting administrators, blocking the offending IP address from accessing the network, and
even resetting the connection if necessary.

Keep On
Your Eye

Cryptography is a mechanism to ensure data security in transit or at rest. Organizations are
investing heavily in encryption solutions to protect their data with the rise in cybersecurity
breaches. However, hackers, too, are proving equal to the task by evolving advanced
techniques to target cryptographic solutions.
What is cryptography?
Cryptography is a security mechanism for storing and transmitting sensitive data such that
only the sender and the intended receiver can read or understand it. Key(s) are used to encode
(at the sender's end) and decode (at the receiver's end) the data.

Encryption is the process of converting plaintext or data into ciphertext or encoded data (that
is not readable to everyone). Converting the ciphertext or encrypted data to a readable form
or decoded version is called decryption.
What are cryptography attacks?
A cryptographic attack is a method used by hackers to target cryptographic solutions like
ciphertext, encryption keys, etc. These attacks aim to retrieve the plaintext from the
ciphertext or decode the encrypted data.

8
 Hackers may attempt to bypass the security of a cryptographic system by discovering
weaknesses and flaws in cryptography techniques, cryptographic protocol, encryption
algorithms, or key management strategy.
Passive and active attacks
A cryptography attack can be either passive or active.
 Passive attacks:

Passive cryptography attacks intend to obtain unauthorized access to sensitive data or

information by intercepting or eavesdropping on general communication. In this
situation, the data and the communication remain intact and are not tampered with.
The attacker only gains access to the data.

 Active attacks: On the other hand, active cryptography attacks

involve some kind of modification of the data or communication. In this case, the
attacker not only gains access to the data but also tampers with it.

Types of cryptography attacks

Depending on the type of cryptographic system in place and the information available to the
attacker, these attacks can be broadly classified into six types:
1. Brute force attack

Public and private keys play a significant role in encrypting and decrypting the data in
a cryptographic system. In a brute force attack, the cybercriminal tries various private
keys to decipher an encrypted message or data. If the key size is 8-bit, the possible
keys will be 256 (i.e., 28). The cybercriminal must know the algorithm (usually found
as open-source programs) to try all the 256 possible keys in this attack technique.

2. Ciphertext-only attack

In this attack vector, the attacker gains access to a collection of ciphertext. Although
the attacker cannot access the plaintext, they can successfully determine the ciphertext
from the collection. Through this attack technique, the attacker can occasionally
determine the key.

3. Chosen plaintext attack

In this attack model, the cybercriminal can choose arbitrary plaintext data to obtain
the ciphertext. It simplifies the attacker's task of resolving the encryption key. One
well-known example of this type of attack is the differential cryptanalysis performed
on block ciphers.

4. Chosen ciphertext attack

In this attack model, the cybercriminal analyzes a chosen ciphertext corresponding to

its plaintext. The attacker tries to obtain a secret key or the details about the system.

9
 By analyzing the chosen ciphertext and relating it to the plaintext, the attacker
attempts to guess the key. Older versions of RSA encryption were prone to this attack.

5. Known plaintext attack

In this attack technique, the cybercriminal finds or knows the plaintext of some
portions of the ciphertext using information gathering techniques. Linear
cryptanalysis in block cipher is one such example.

6. Key and algorithm attack

Here, the attacker tries to recover the key used to encrypt or decrypt the data by
analyzing the cryptographic algorithm.

Preventing cryptography attacks

To prevent cryptography attacks, it is essential to have a strong cryptographic system in
place. Some of the ways to achieve this are:
 Regularly update the cryptographic algorithms and protocols to ensure they are not
obsolete.
 Ensure that the data is appropriately encrypted so that even if it falls into the wrong
hands, it will be unreadable.
 Use strong and unique keys for encryption.
 Store the keys in a secure location.
 Ensure that the cryptographic system is implemented correctly.
 Regularly test the system for vulnerabilities.
 Educate employees about cryptography attacks and how to prevent them.
Final thoughts
The investments in cryptographic solutions are already on the rise; Technavio says the
encryption management solutions market will rise by US$ 6.07 billion between 2020 and
2025 at an accelerated CAGR of 17 percent.

Cryptography attacks are a serious threat to the security of any organization. Organizations
can protect their data and communication from being compromised by understanding the
various types of attacks and taking steps to prevent them.

The End
10