Network Security

Computer Security Concept

Computer security focuses on protecting individual computer systems,
including hardware, software, and data, from unauthorized access, attacks,
and other threats. It involves measures such as implementing rewalls,
antivirus software, encryption, access controls, and regular security updates
to prevent intrusions and data breaches.
Computer network security consists of measures taken by business
or some organizations to monitor and prevent unauthorized access from the
outside attackers.
Di erent approaches to computer network security management
have di erent requirements depending on the size of the computer network.
For example, a home o ce requires basic network security while large
businesses require high maintenance to prevent the network from malicious
attacks.

Aspects of Network Security

Following are the desirable properties to achieve secure communication:

Privacy: Privacy means both the sender and the receiver expects
con dentiality. The transmitted message should be sent only to the intended
receiver while the message should be opaque for other users. Only the
sender and receiver should be able to understand the transmitted message
as eavesdroppers can intercept the message. Therefore, there is a
requirement to encrypt the message so that the message cannot be
intercepted. This aspect of con dentiality is commonly used to achieve
secure communication.

Message Integrity: Data integrity means that the data must arrive at the
receiver exactly as it was sent. There must be no change in the data content
during transmission, either maliciously or accident, in a transit. As there are
more and more monetary exchanges over the internet, data integrity is more
crucial. The data integrity must be preserved for secure communication.
1
fi
ff
ff
ffi
fi
fi
 End-point authentication:Authentication means that the receiver is sure of
the sender’s identity, i.e., no imposter has sent the message.

Non-Repudiation: Non-Repudiation means that the receiver must be able to

prove that the received message has come from a speci c sender. The
sender must not deny sending a message that he or she send. The burden of
proving the identity comes on the receiver. For example, if a customer sends
a request to transfer the money from one account to another account, then
the bank must have a proof that the customer has requested for the
transaction.

OSI Security Architecture (Open Systems Interconnection)

The OSI (Open Systems Interconnection) Security Architecture de nes a
systematic approach to providing security at each layer. It de nes security
services and security mechanisms that can be used at each of the seven
layers of the OSI model to provide security for data transmitted over a
network. These security services and mechanisms help to ensure the
con dentiality, integrity, and availability of the data. OSI architecture is
internationally acceptable as it lays the ow of providing safety in an
organization. OSI security architecture focuses on these concepts:
1. Security Attacks
2. Security mechanism: A security mechanism is a means of protecting a
system, network, or
device against unauthorized access, tampering, or other security threats.
3. Security Service

OSI security Architecture is categorized into three broad categories namely

Security Attacks, Security mechanisms, and Security services.

1. Security Attacks

2
fi
fl
fi
fi
fi
 A security attack is an attempt by a person or entity to gain
unauthorized access to disrupt or compromise the security of a
system, network, or device. These are defined as the actions that
put at risk an organization’s safety. They are further classified into 2
sub-categories:
Passive Attack:
Attacks in which a third-party intruder tries to access the message/ content/
data being shared by the sender and receiver by keeping a close watch on
the transmission or eave-dropping the transmission is called Passive
Attacks. These types of attacks involve the attacker observing or monitoring
system, network, or device activity without actively disrupting or altering it.
Passive attacks are typically focused on gathering information or
intelligence, rather than causing damage or disruption. Here, both the sender
and receiver have no clue that their message/ data is accessible to some
third-party intruder. One way to prevent attacks is to encrypt the message/
data that needs to be transmitted; this will prevent third party intruders to
use the information though it would be accessible to them.
Passive attacks are further divided into two parts based on their behavior:
Eavesdropping, Tra c Analysis.

Active Attacks:
Active attacks refer to types of attacks that involve the attacker actively
disrupting or altering system, network, or device activity. Active attacks are
typically focused on causing damage or disruption, rather than gathering
information or intelligence. Here, both the sender and receiver have no clue
that their message/ data is modi ed by some third-party intruder. The
message/ data transmitted doesn’t remain in its usual form and shows
deviation from its usual behavior. This makes active attacks dangerous as
there is no information provided of the attack happening in the
communication process and the receiver is not aware that the data/
message received is not from the sender.
Active attacks are further divided into four parts based on their behavior:
• Masquerade is a type of attack in which the attacker pretends to be an
authentic sender in order to gain unauthorized access to a system.
• Replay is a type of active attack in which the attacker intercepts a
transmitted message through a passive channel and then maliciously
or fraudulently replays or delays it at a later time.

• Modi cation of Message involves the attacker modifying the

transmitted message and making the nal message received by the
receiver look like it’s not safe or non-meaningful.
• Denial of service (DoS) attacks involve the attacker sending a large
volume of tra c to a system, network, or device in an attempt to
overwhelm it and make it unavailable to legitimate users.
3
fi
ffi
ffi
fi
fi
 2. Security Mechanism
The mechanism that is built to identify any breach of security or
attack on the organization, is called a security mechanism. Security
Mechanisms are also responsible for protecting a system, network,
or device against unauthorized access, tampering, or other security
threats. Security mechanisms can be implemented at various levels
within a system or network and can be used to provide different
types of security, such as confidentiality, integrity, or availability.
Some examples of security mechanisms include:
• Encipherment (Encryption) involves the use of algorithms to transform data
into a form that can only be read by someone with the appropriate
decryption key. Encryption can be used to protect data it is transmitted
over a network, or to protect data when it is stored on a device

• Digital signature is a security mechanism that involves the use of

cryptographic techniques to create a unique, veri able identi er for a
digital document or message, which can be used to ensure the
authenticity and integrity of the document or message.

• Tra c padding is a technique used to add extra data to a network

tra c stream in an attempt to obscure the true content of the tra c
and make it more di cult to analyze.

• Routing control allows the selection of speci c physically secure routes

for speci c data transmission and enables routing changes, particularly
when a gap in security is suspected.

3. Security Services:
Security services refer to the different services available for
maintaining the security and safety of an organization. They help in
preventing any potential risks to security. Security services are
divided into 5 types:
• Authentication is the process of verifying the identity of a user or
device in order to grant or deny access to a system or device.
• Access control involves the use of policies and procedures to
determine who is allowed to access speci c resources within a
system.

• Data Con dentiality is responsible for the protection of information

from being accessed or disclosed to unauthorized parties.

4
ffi
ffi
fi
fi
ffi
fi
fi
fi
fi
ffi
 • Data integrity is a security mechanism that involves the use of
techniques to ensure that data has not been tampered with or altered
in any way during transmission or storage.

• Non- repudiation involves the use of techniques to create a veri able

record of the origin and transmission of a message, Which can be used
to prevent the sender from denying that they sent the message.

Bene ts of OSI Architecture:

Below listed are the bene ts of OSI Architecture in an organization:
1. Providing Security:
• OSI Architecture in an organization provides the needed security and
safety, preventing potential threats and risks.
• Managers can easily take care of the security and there is hassle-free
security maintenance done through OSI Architecture.
2. Organising Task:
• The OSI architecture makes it easy for managers to build a security
model for the organization based on strong security principles.

3. Meets International Standards:

• Security services are de ned and recognized internationally meeting
international standards.

• The standard de nition of requirements de ned using OSI Architecture

is globally accepted.

Model For Network Security

A Network Security Model exhibits how the security service has been
designed over the network to prevent the opponent from causing a threat to
the con dentiality or authenticity of the information that is being transmitted
through the network.

5
fi
fi
fi
fi
fi
fi
fi
 The network security model presents the two communicating parties sender
and receiver who mutually agrees to exchange the information. The sender
has information to share with the receiver.
But sender cannot send the message on the information cannel in the
readable form as it will have a threat of being attacked by the opponent. So,
before sending the message through the information channel, it should be
transformed into an unreadable format.

Secret information is used while transforming the message which will also be
required when the message will be retransformed at the recipient side. That’s
why a trusted third party is required which would take the responsibility of
distributing this secret information to both the parties involved in
communication.

So, considering this general model of network security, one must consider
the following four tasks while designing the security model.
1. To transform a readable message at the sender side into an unreadable
format, an appropriate algorithm should be designed such that it should be
di cult for an opponent to crack that security algorithm.
2. Next, the network security model designer is concerned about the
generation of the secret information which is known as a key.
This secret information is used in conjunction with the security algorithm in
order to transform the message.
3. Now, the secret information is required at both the ends, sender’s end and
receiver’s end. At sender’s end, it is used to encrypt or transform the
message into unreadable form and at the receiver’s end, it is used to decrypt
or retransform the message into readable form.So, there must be a trusted
third party.
4.trusted third party which will distribute the secret information to both
sender and receiver. While designing the network security model designer
must also concentrate on developing the methods to distribute the key to
the sender and receiver.

Challenges of computer Security

Computer and network security is both fascinating and complex. Some of
the reasons include:
1. Security is not as simple as it might rst appear to the novice. The
requirements seem to be straightforward; indeed, most of the major
requirements for security services can be given self-explanatory, one-word
labels: con dentiality, authentication, nonrepudiation, and integrity. But the
mechanisms used to meet those requirements can be quite complex, and
understanding them may involve rather subtle reasoning.
2. In developing a particular security mechanism or algorithm, one must
always consider potential attacks on those security features. In many cases,
successful attacks are designed by looking at the problem in a completely
6
ffi
fi
fi
 di erent way, therefore exploiting an unexpected weakness in the
mechanism.
3. Computer and network security is essentially a battle of wits between a
perpetrator who tries to nd holes and the designer or administrator who
tries to close them. The great advantage that the attacker has is that he or
she need only nd a single weakness, while the designer must nd and
eliminate all weaknesses to achieve perfect security.
4. There is a natural tendency on the part of users and system managers to
perceive little bene t from security investment until a security failure occurs.
5.Security requires regular, even constant, monitoring, and this is di cult in
today's short-term, overloaded environment.
6.Security is still too often an afterthought to be incorporated into a system
after the design is complete rather than being an integral part of the design
process.

Classical Cryptography Approaches

Classical cryptography refers to encryption methods that were used before
the advent of computers and modern cryptographic techniques. These
methods often relied on mathematical principles and were implemented
manually or with simple mechanical devices. Here are a few key classical
cryptography approaches:
1. Substitution Ciphers: In a substitution cipher, each letter in the plaintext
is replaced with another letter or symbol according to a xed system.
One common example is the Caesar cipher, where each letter is shifted
a certain number of positions in the alphabet.
2. Transposition Ciphers: Transposition ciphers involve rearranging the
order of the letters in the plaintext to form the ciphertext. This can be
done using various techniques such as columnar transposition or rail
fence cipher.
3. Vigenère Cipher: The Vigenère cipher is a form of polyalphabetic
substitution cipher, where multiple Caesar ciphers are used in sequence
with di erent shift values determined by a keyword.
4. One-Time Pad: The one-time pad is a method of encryption where each
character in the plaintext is combined with a character from a random
key stream using modular addition. If implemented correctly with truly
random keys that are as long as the message and never reused, it
provides perfect secrecy.
5. Playfair Cipher: The Playfair cipher is a symmetric encryption technique
that uses a 5x5 grid of letters (excluding duplicates) to encrypt pairs of
letters in the plaintext.

7
ff
ff
fi
fi
fi
fi
fi
ffi
 Symmetric Encryption and Message Con dentiality

Symmetric Encryption Principles

Symmetric encryption is a cryptographic technique where the same key is
used for both encryption and decryption of the message. This means that
both the sender and the recipient must have access to the same secret key.
Symmetric encryption relies on a few key principles to ensure secure
communication:
1. Shared Secret Key: Symmetric encryption requires both the sender and
the receiver to share a secret key. This key is used for both encryption
and decryption of the message. It's crucial that this key remains
con dential and is only known to the authorized parties.
2. Encryption Algorithm: Symmetric encryption algorithms are mathematical
functions that transform plaintext into ciphertext using the shared secret
key. These algorithms are designed to be computationally e cient while
providing strong encryption. Examples include AES (Advanced
Encryption Standard), DES (Data Encryption Standard), and Blow sh.
3. Decryption Algorithm: The decryption algorithm is the inverse of the
encryption algorithm. It takes the ciphertext and the shared secret key as
input and produces the original plaintext message. It's essential that the
decryption algorithm accurately reverses the encryption process to
ensure the integrity of the communication.
4. Con dentiality: Symmetric encryption ensures con dentiality by
obscuring the content of the message from unauthorized parties. Without
knowledge of the secret key, an attacker should not be able to decipher
the ciphertext and extract the original plaintext.
5. Key Management: Secure key management is crucial in symmetric
encryption. Key distribution and storage must be handled securely to
prevent unauthorized access to the secret key. Techniques such as key
exchange protocols, key rotation, and key generation using secure
random number generators are employed to manage keys securely.
6. Authentication and Integrity: While symmetric encryption primarily
focuses on con dentiality, additional mechanisms such as message
authentication codes (MACs) or digital signatures can be used to verify
the authenticity and integrity of the message. These mechanisms ensure
that the message has not been tampered with during transmission and
that it originated from the expected sender.

Symmetric encryption algorithm

Symmetric encryption algorithms are cryptographic techniques that use the
same key for both encryption and decryption of data. Here are some
commonly used symmetric encryption algorithms:
- Advanced Encryption Standard (AES):
• AES is a symmetric encryption algorithm adopted by the U.S.
government as a standard for encrypting sensitive information.
8
fi
fi
fi
fi
fi
ffi
fi
 • It operates on blocks of data, with a xed block size of 128 bits, and
supports key lengths of 128, 192, or 256 bits.
• AES consists of a series of substitution-permutation network (SPN)
rounds, where each round applies a set of transformations to the data
based on the encryption key.
• It o ers a high level of security and e ciency, making it suitable for a
wide range of applications, including securing communications,
encrypting les, and protecting data at rest.
2. Data Encryption Standard (DES):
• DES was developed in the 1970s and was widely used as a symmetric
encryption algorithm until the late 1990s.
• It operates on 64-bit blocks of data using a 56-bit key, which is
considered small by modern standards.
• DES uses a Feistel network structure, where the input is divided into two
halves, and a series of rounds are applied to each half using subkeys
derived from the main key.
• Due to its small key size, DES is vulnerable to brute-force attacks, and it
has largely been replaced by more secure algorithms like AES.
• 3.Triple DES (3DES):
• 3DES is a variant of DES that applies the DES encryption algorithm three
times in succession, using two or three di erent keys.
• It operates on 64-bit blocks of data, similar to DES, but provides
increased security by e ectively using longer key lengths (112 or 168 bits)
compared to DES.
• 3DES is backward compatible with DES, making it suitable for systems
that still rely on DES encryption but require higher security.
• However, 3DES is slower and less e cient than AES and has largely been
deprecated in favor of AES in modern cryptographic applications.

Cipher Block Modes of Operation

In cryptography, a block cipher is a deterministic algorithm operating on
xed-length groups of bits, called blocks, with an unvarying transformation
that is speci ed by a symmetric key. A block cipher algorithm is a basic
building block for providing data security. To apply a block cipher in a variety
of applications, ve “modes of operations” are de ned by NIST they are:-

1. Electronic Codebook (ECB):

In ECB mode, each block of plaintext is encrypted independently using the
same key. This means that identical plaintext blocks will result in identical
ciphertext blocks, which can lead to vulnerabilities, especially when
encrypting images or other structured data. ECB mode does not provide any
di usion or mixing of the plaintext, making it susceptible to certain
cryptographic attacks, and it is generally not recommended for secure
communications.

9
fi
ff
ff
fi
fi
fi
ff
ffi
fi
ffi
ff
fi
2. Cipher Block Chaining (CBC):
In CBC mode, each plaintext block is XORed with the ciphertext of the
previous block before encryption. This ensures that each ciphertext block
depends on all previous plaintext blocks, providing di usion and making it
more resistant to certain attacks compared to ECB mode.
CBC mode requires an initialization vector (IV) to XOR with the rst
block of plaintext. The IV should be unique for each encryption operation to
prevent certain cryptographic attacks. CBC mode is widely used in secure
communications protocols such as TLS (Transport Layer Security) and IPsec
(Internet Protocol Security).

3. Cipher Feedback (CFB):

In CFB mode, the block cipher operates as a stream cipher, generating a
keystream that is XORed with the plaintext to produce the ciphertext. The
feedback mechanism involves encrypting the previous ciphertext block to
generate the keystream for the next block.
CFB mode allows for the encryption of individual bits or bytes of plaintext,
providing exibility in handling variable-length input.
CFB mode is less commonly used than CBC and other modes due to its
complexity and performance overhead. Block size n is predetermine by the
underlying cipher ; for example , for DES n = 64
for AES n =128

4. Output Feedback (OFB):

OFB mode is similar to CFB mode but operates at the block level instead of
the bit level. It generates a key stream independently of the plaintext, which
is then XORed with the plaintext to produce the ciphe rtext. Unlike CFB
mode, the same key stream can be reused for encryption and decryption,
making OFB mode suitable for applications that require random access to
encrypted data.
However, OFB mode does not provide cipher text integrity checking,
so additional mechanisms such as a message authentication code (MAC)
may be necessary to ensure data integrity. If an error occur in transmission ,
it does not a ect the bits that follow.Note that , like cipher feedback mode ,
both the sender and the receiver use the encryption algorithm.

5. Counter Mode (CTR):

In CTR mode, a unique counter value is encrypted with the block cipher to
produce a key stream, which is then XORed with the plaintext to produce the
cipher text. CTR mode is highly parallelizable and can e ciently encrypt and
decrypt data in parallel, making it suitable for high-performance applications.
CTR mode also provides random access to encrypted data, similar to OFB
mode, and does not require padding for input data shorter than the block
size. Provides true random access to cipher text blocks .
10
fl
ff
ff
ffi
fi
 Initialization vector
An initialization vector (IV) or starting variable is a block of bits that is used
by several modes to randomize the encryption and hence to produce distinct
cipher texts even if the same plain text is encrypted multiple times, without
the need for a slower re-keying process. An initialization vector has di erent
security requirements than a key, so the IV usually does not need to be
secret. However, in most cases, it is important that an initialization vector is
never reused under the same key.
For CBC and CFB, reusing an IV leaks some information about the rst
block of plaintext, and about any common pre x shared by the two
messages.
For OFB and CTR, reusing an IV completely destroys security. This can
be seen because both modes e ectively create a bit stream that is XORed
with the plaintext, and this bit stream is dependent on the password and IV
only. Reusing a bit stream destroys security.
In CBC mode, the IV must, in addition, be unpredictable at encryption time;
in particular, the (previously) common practice of re-using the last cipher text
block of a message as the IV for the next message is insecure.

Public Key Cryptography And Message Digest

Hash Function
Hash functions are extremely useful and appear in almost all information
security applications. A hash function is a mathematical function that
converts a numerical input value into another compressed numerical value.
The input to the hash function is of arbitrary length but output is always of
xed length. Values returned by a hash function are called message digest or
simply hash values.
Features of Hash Functions
The typical features of hash functions are −
Fixed Length Output (Hash Value)
o Hash function coverts data of arbitrary length to a xed length. This
process is often referred to as hashing the data.
o In general, the hash is much smaller than the input data, hence hash
functions are sometimes called compression functions.
o Since a hash is a smaller representation of a larger data, it Is also referred
to as a digest.
o Hash function with n bit output is referred to as an n-bit hash function.
Popular hash functions generate values between 160 and 512 bits.
• E ciency of Operation
o Generally for any hash function within put x, computation of h(x) is a
fast operation.
11
fi
ffi
ff
fi
fi
ff
fi
 o Computationally hash functions are much faster than a symmetric
encryption.

Properties of Hash Functions

In order to be an e ective cryptographic tool, the hash function is desired to
possess following properties −
• Pre-Image Resistance
o This property means that it should be computationally hard to
reverse a hash function.
o In other words, if a hash function produced a hash value z,then it
should be a di cult process to nd any input value x that hashes to z.
o This property protects against an attacker who only has a hash
value and is trying to nd the input.

• Second Pre-Image Resistance

o This property means given an input and its hash, it should be hard
to nd a di erent input with the same hash.
o In other words, if a hash function h for an input x produces hash
value h(x), then it should be di cult to nd any other input value y
such that h(y) = h(x).
o This property of hash function protects against an attacker who has
an input value and its hash, and wants to substitute di erent value as
legitimate value in place of original input value.

• Collision Resistance
o This property means it should be hard to nd two di erent inputs of
any length that result in the same hash. This property is also referred
to as collision free hash function.
o In other words, for a hash function h, it is hard to nd any two
di erent inputs x and y such that h(x) = h(y).
o Since, hash function is compressing function with xed hash length,
it is impossible for a hash function not to have collisions. This property
of collision free only con rms that these collisions should be hard to
nd.

Hash Functions
Let us brie y see some popular hash functions −

Message Digest (MD)

MD5 was most popular and widely used hash function for quite some years.
• The MD family comprises of hash functions MD2, MD4, MD5 and MD6.
It was adopted as Internet Standard RFC 1321. It is a 128-bit hash
function.

12
fi
ff
fi
fl
ff
ffi
ff
fi
fi
fi
ffi
fi
fi
fi
ff
ff
fi
 • MD5 digests have been widely used in the software world to provide
assurance about integrity of transferred le. For example, le servers
often provide a pre-computed MD5 checksum for the les, so that a
user can compare the checksum of the downloaded le to it.

• In 2004, collisions were found in MD5. An analytical attack was

reported to be successful only in an hour by using computer cluster.
This collision attack resulted in compromised MD5 and hence it is no
longer recommended for use.

Secure Hash Function (SHA)

Family of SHA comprise of four SHA algorithms; SHA-0, SHA-1, SHA-2, and
SHA-3. Though from same family, there are structurally di erent.

• The original version is SHA-0, a 160-bit hash function, was published

by the National Institute of Standards and Technology (NIST) in 1993. It
had few weaknesses and did not become very popular. Later in 1995,
SHA-1 was designed to correct alleged weaknesses of SHA-0.

• SHA-1 is the most widely used of the existing SHA hash functions. It is
employed in several widely used applications and protocols including
Secure Socket Layer (SSL) security.

• In 2005, a method was found for uncovering collisions for SHA-1

within practical time frame making long-term employability of SHA-1
doubtful.

• SHA-2 family has four further SHA variants, SHA-224, SHA-256, SHA-
384, and SHA-512 depending up on number of bits in their hash value.
No successful attacks have yet been reported on SHA-2 hash function.

• Though SHA-2 is a strong hash function. Though signi cantly di erent,

its basic design is still follows design of SHA-1. Hence, NIST called for
new competitive hash function designs.

• In October 2012, the NIST chose the Keccak algorithm as the new
SHA-3 standard. Keccak o ers many bene ts, such as e cient
performance and good resistance for attacks.

RIPEMD
The RIPEMD is an acronym for RACE Integrity Primitives Evaluation
Message Digest. This set of hash functions was designed by open research
community and generally known as a family of European hash functions.

13
ff
fi
fi
fi
fi
fi
ff
fi
ff
ffi
 • The set includes RIPEMD, RIPEMD-128, and RIPEMD-160. There also
exist 256, and 320-bit versions of this algorithm.

• Original RIPEMD (128 bit) is based upon the design principles used in
MD4 and found to provide questionable security. RIPEMD 128-bit
version came as a quick x replacement to overcome vulnerabilities on
the original RIPEMD.

• RIPEMD-160 is an improved version and the most widely used version

in the family. The 256 and 320-bit versions reduce the chance of
accidental collision, but do not have higher levels of security as
compared to RIPEMD-128 and RIPEMD-160 respectively.
Whirlpool
This is a 512-bit hash function.

• It is derived from the modi ed version of Advanced Encryption

Standard (AES). One of the designer was Vincent Rijmen, a co-creator
of the AES.

• Three versions of Whirlpool have been released; namely WHIRLPOOL-

0, WHIRLPOOL-T, and WHIRLPOOL.

Hash Function Requirement

The purpose of a hash function is to produce a " ngerprint" of a le,
message, or other block of data. To be useful for message authentication, a
hash function H must have the following properties:
1. H can be applied to a block of data of any size.
2. H produces a xed-length output.
3. H(x) is relatively easy to compute for any given x, making both hardware
and software implementations practical.
4. For any given code h, it is computationally infeasible to nd x such that
H(x) = h. A hash function with this property is referred to as one-way or
pre image resistant.
5. For any given block x, it is computationally infeasible to nd y # x with
Hy) = H(x). A hash function with this property is referred to as second
pre-image resistant. This is sometimes referred to as weak collision resistant.
6. It is computationally infeasible to nd any pair (x, y) such that H(x) = H(y).
A hash function with this property is referred to as collision resistant. This is
sometimes referred to as strong collision resistant.

Public Key Cryptography

public key cryptography is a class of cryptographic protocols based on
algorithms. This method of cryptography requires two separate keys, one
that is private or secret, and one that is public. Public key cryptography uses

14
fi
fi
fi
fi
fi
fi
fi
fi
 a pair of keys to encrypt and decrypt data to protect it against unauthorized
access or use.

Public key encryption algorithm:

Public Key encryption algorithm is also called the Asymmetric algorithm.
Asymmetric algorithms are those algorithms in which sender and receiver
use di erent keys for encryption and decryption. Each sender is assigned a
pair of keys:
o Public key
o Private key
The Public key is used for encryption, and the Private Key is used for
decryption. Decryption cannot be done using a public key. The two keys are
linked, but the private key cannot be derived from the public key. The public
key is well known, but the private key is secret and it is known only to the
user who owns the key. It means that everybody can send a message to the
user using user's public key. But only the user can decrypt the message
using his private key.

The Public key algorithm operates in the following manner:

• The data to be sent is encrypted by sender A using the public key of the
intended receiver
• B decrypts the received ciphertext using its private key, which is known
only to B. B replies to A encrypting its message using A's public key.
• A decrypts the received ciphertext using its private key, which is known
only to him.

Applications for Public-Key Cryptosystems

Before proceeding, we need to clarify one aspect of public-key
cryptosystems that is otherwise likely to lead to confusion. Public-key
systems are characterized by the use of a cryptographic type of algorithm
with two keys, one held private and one available publicly. Depending on the
application, the sender uses either the sender's private key, the receiver's
15
ff
 public key, or both to perform some type of cryptographic function. In broad
terms, we can classify the use of public-key crypto-systems into three
categories:
• Encryption/decryption: The sender encrypts a message with the recipient's
public key.
• Digital signature: The sender "signs" a message with its private key.
Signing is achieved by a cryptographic algorithm applied to the message
or to a small block of data that is a function of the message.
• Key exchange: Two sides cooperate to exchange a session key. Several
di erent approaches are possible, involving the private keys) of one or both
parties.
Some algorithms are suitable for all three applications, whereas others can
be used only for one or two of these applications.
One general observation can be made at this point. Public-key algorithms
require considerably more computation than symmetric algorithms for
comparable security and a comparable plaintext length. Accordingly, public-
key algorithms are used only for short messages or data blocks, such as to
encrypt a secret key or PIN.

Requirements for Public-Key Cryptography

The cryptosystem depends on a cryptographic algorithm based on two

related keys. Di e and Hellman postulated this system without
demonstrating that such algorithms exist. However, they did lay out the
conditions that such algorithms must ful ll:
1. It is computationally easy for a party B to generate a pair (public key PUb,
private key PRb).
2. It is computationally easy for a sender A, knowing the public key and the
message to be encrypted, M, to generate the corresponding ciphertext:
C= E(PUb, M)
3. It is computationally easy for the receiver B to decrypt the resulting cipher-
text using the private key to recover the original message:
M = D(PRb C) = D[PRb E(PUb, M)]
4. It is computationally infeasible for an opponent, knowing the public key,
PUb, to determine the private key, PRb.
5. It is computationally infeasible for an opponent, knowing the public key,
PUb, and a ciphertext, C, to recover the original message, M.
public-key applications.

We can add a sixth requirement that, although useful, is not necessary for all
1. Either of the two related keys can be used for encryption, with the other
used for decryption.
M = D[PUb E(PRb, M)] = D[PRb, E(PUb, M)]

16
ff
ffi
fi
RSA encryption algorithm:
RSA is the most common public-key algorithm, named after its inventors
Rivest, Shamir, and Adelman (RSA).

RSA algorithm uses the following procedure to generate public and private
keys:
• Select two large prime numbers, p and q.
Multiply these numbers to nd n = p x q, where n is called the modulus
for encryption and decryption.
• Choose a number e less than n, such that n is relatively prime to (p - 1) x
(q -1).It means thateand(p - 1) x (q - 1)have no common factor

except 1. Choose "e" such that 1<e < φ (n), e is prime to φ (n),
gcd (e,d(n)) =1
• Ifn = p x q,then the public key is <e, n>. A plaintext messagemis
encrypted using public key <e, n>. To nd ciphertext from the plain text
e
following formula is used to get ciphertext C. C = m mod n
• Here, m must be less than n. A larger message (>n) is treated as a
concatenation of messages, each of which is encrypted separately.
• To determine the private key, we use the following formula to calculate the
d such that:
De mod {(p - 1) x (q - 1)} = 1
Or
De mod φ (n) = 1
• The private key is <d, n>. A ciphertext message c is decrypted using
private key <d, n>. To calculate plain text m from the ciphertext c following
formula is used to get plain text m. m = cd mod n
For example,
1. Select two prime numbers, p = 17 and q = 11.
2. Calculate n = pq = 17 × 11 = 187.
3. Calculate (n) = (p - 1)(9 - 1) = 16 × 10 = 160.
17
fi
fi
 4. Select e such that e is relatively prime to (n) = 160 and less than (n); we
choose e = 7.
5. Determine d such that de mod 160 = 1 and d < 160. The correct value is
d = 23, because 23 × 7 = 161 = (1 × 160) + 1.
The resulting keys are public key PU = (7,187) and private key PR = (23, 187).
The example shows the use of these keys for a plaintext input of M = 88.

Di e-hellman Key Exchange Algorithm

Di e Hellman (DH) key exchange algorithm is a method for securely
exchanging cryptographic keys over a public communications channel. Keys
are not actually exchanged – they are jointly derived. It is named after their
inventors Whit eld Di e and Martin Hellman.
Algorithm
1. key =(YA)XBmod q -> this is the same as calculated by B

2. Global Public Elements

• q: q is a prime number
• a: a < q and α is the primitive root of q

3. Key generation for user A

• Select a Private key XsmallA Here, XsmallA <q
Now, Calculation of Public key YsmallA YsmallA = aXA mod q

4. Key generation for user B

• Select a Private key XsmallB Here, XsmallB <q
• Now, Calculation of Public key YB YB = a^Xb mod q

5. Calculation of Secret Key by A

• key =(YB)^XA mod q

6. Calculation of Secret Key by B

• key =(YA)^XB mod q

Example
1. Alice and Bob both use public numbers P = 23, G = 5
2. Alice selected private key a = 4, and Bob selected b = 3 as the private key
3. Both Alice and bob now calculate the value of x and y as follows:
• Alice: x = (5^4 mod 23) = 4
• Bob: y = (5^3 mod 23) = 10
4. Now, both Alice and Bob exchange public numbers with each other.
5. Alice and Bob now calculate the symmetric keys
• Alice: ksmalla = y^a mod p = 10^4 mod 23 = 18
• Bob: ksmallb = x^b mod p = 4^3 mod 23 = 18
6. 18 is the shared secret key.

18
ffi
ffi
fi
ffi
 DIGITAL SIGNATURE
Digital signatures are the public-key primitives of message authentication. In
the physical world, it is common to use handwritten signatures on
handwritten or typed messages. They are used to bind signatory to the
message. Similarly, a digital signature is a technique that binds a person/
entity to the digital data. This binding can be independently veri ed by
receiver as well as any third party. Digital signature is a cryptographic value
that is calculated from the data and a secret key known only by the signer.

Model of Digital Signature

As mentioned earlier, the digital signature scheme is based on public key
cryptography. The model of digital signature scheme is depicted in the
following illustration −

The following points explain the entire process in detail −

• Each person adopting this scheme has a public-private key pair.

• Generally, the key pairs used for encryption/decryption and signing/

verifying are di erent. The private key used for signing is referred to as
the signature key and the public key as the veri cation
key.

• Signer feeds data to the hash function and generates hash of data.

• Hash value and signature key are then fed to the signature algorithm
which produces the digital signature on given hash. Signature is
appended to the data and then both are sent to the veri er.

• Veri er feeds the digital signature and the veri cation key into the
veri cation algorithm. The veri cation algorithm gives some value as
output.

19
fi
fi
ff
fi
fi
fi
fi
fi
 • Veri er also runs same hash function on received data to generate
hash
value.

• For veri cation, this hash value and output of veri cation algorithm are
compared. Based on the comparison result, veri er decides whether
the digital signature is valid.

Importance of Digital Signature

Out of all cryptographic primitives, the digital signature using public key
cryptography is considered as very important and useful tool to achieve
information security.
Apart from ability to provide non-repudiation of message, the digital
signature also provides message authentication and data integrity. Let us
brie y see how this is achieved by the digital signature −
• Message authentication− When the veri er validates the digital signature
using public key of a sender, he is assured that signature has been
created only by sender who possess the corresponding secret private
key and no one else.

• Data Integrity − In case an attacker has access to the data and modi es
it, the digital signature veri cation at receiver end fails. The hash of
modi ed data and the output provided by the veri cation algorithm will
not match. Hence, receiver can safely deny the message assuming
that data integrity has been breached.

• Non-repudiation − Since it is assumed that only the signer has the

knowledge of the signature key, he can only create unique signature on
a given data. Thus the receiver can present data and the digital
signature to a third party as evidence if any dispute arises in the future.

Digital Signature Algorithm

The Digital Signature Algorithm (DSA) is a public-key technique (i.e.,
assymetric cryptography) and it is used to provide only the digital signature
function, and it cannot be used for encryption or key exchange.
The Steps to perform the Digital Signature Algorithm can be broadly divided
into:
•
1. Global Public-Key Components
There are three parameters that are public and can be shared to a set of
users.

• A prime number p is chosen with a length between 512 and 1024 bits such
that q divides (p – 1). So, p is prime number where 2L-1 < p <2L for 512<=

20
fi
fl
fi
fi
fi
fi
fi
fi
fi
fi
 L<=1024 and L is a multiple of 64; i.e., bit length of between 512 and 1024
bits in increments of 64 bits.
• Next, an N-bit prime number q is selected. So, q is prime divisor of (p – 1),
where 2N-1 < q < 2N i.e., bit length of N bits.
• Finally, g is selected to be of the form h(p-1)/q mod p, where h is an integer
between 1 and (p – 1) with the limitation that g must be greater than 1. So,
g is = h(p – 1)/q mod p, where h is any integer with 1 < h < (p – 1) such that
h(p-1)/q mod p > 1.
If a user has these numbers, then it can selects a private key and generates
a public key.

2. User’s Private Key

The private key x should be chosen randomly or pseudorandomly and it
must be a number from 1 to (q – 1), so x is random or pseudorandom integer
with 0 < x < q.

3. User’s Public Key

The public key is computed from the private key as y = gx mod p. The
computation of y given x is simple. But, given the public key y, it is believed
to be computationally infeasible to choose x, which is the discrete logarithm
of y to the base g, mod p.

4. Signing
If a user want to develop a signature, a user needs to calculates two
quantities, r and s, that are functions of the public key components (p, q, g),
the hash code of the message H(M, the user’s private key (x), and an integer
k that must be generated randomly or pseudorandomly and be unique for
each signing. k is generated randomly or pseudorandomly integer such that
0<k < q.

5. Veri cation
Let M, r′, and s′ be the received versions of M, r, and s, respectively.
Veri cation is performed using the formulas shown in below:
• w = (s′)-1 mod q
• u1 = [H(M′)w] mod q
• u2 = (r′)w mod q
• v = [(gu1 yu2) mod p] mod q
The receiver needs to generate a quantity v that is a function of the public
key components, the sender’s public key, and the hash code of the
message. If this value matches the r value of the signature, then the
signature is considered as valid.
TEST: v = r′
Now, at the end it will test on the value r, and it does not
depend on the message or plaintext as, r is the function of k and the three
global public-key components as mentioned above.
21
fi
fi
 Network Security Algorithm

Public Key Infrastructure

Public key infrastructure as the set of hardware, software, people, policies,
and procedures needed to create, manage, store, distribute, and revoke
digital certi cates based on asymmetric cryptography. The Principle
objectives for developing a PKI is to enable secure, convenient, and e cient
acquisition of public keys.

Function of Public key Infrastructure

Public Key Infrastructure (PKI) serves as a framework of policies and
procedures for managing digital certi cates and keys. Its functions include:
1. Authentication: PKI enables the authentication of entities in a
networked environment, ensuring that users, devices, and services are
who or what they claim to be.
2. Data integrity: PKI ensures the integrity of data by providing
mechanisms to detect any unauthorized changes to information during
transmission or storage.
3. Con dentiality: PKI facilitates secure communication by encrypting
data using public and private keys, ensuring that only authorized
parties can access sensitive information.
4. Non-repudiation: PKI supports non-repudiation by providing evidence
that a message or transaction has been sent or received by a speci c
party, thus preventing individuals from denying their actions.
5. Key management: PKI manages the lifecycle of cryptographic keys,
including generation, distribution, storage, and revocation, to ensure
the security and reliability of the system.
6. Certi cate authority (CA): PKI establishes trust through CAs, which
issue digital certi cates that bind public keys to entities, verifying their
identity and providing a means for others to verify their authenticity.
7. Secure communications: PKI enables secure communication
channels through protocols like SSL/TLS, allowing for encrypted data
exchange over networks such as the internet.
8. Digital signatures: PKI enables the creation and veri cation of digital
signatures, allowing users to sign documents or messages with their
private keys to prove authenticity and integrity.

What is a Certi cate Authority (CA)?

Digital signatures rely on public and private keys. Those keys have to be
protected in order to ensure safety and to avoid forgery or malicious use.
When you send or sign a document, you need assurance that the documents
and the keys are created securely and that they are using valid keys.
Certi cate Authorities (CAs), a type of Trust Service Provider, are
organizations that have been widely accepted as reliable for ensuring key
22
fi
fi
fi
fi
fi
fi
fi
fi
fi
ffi
 security and that can provide the necessary digital certi cates. Both the
entity sending the document and the recipient signing it must agree to use a
given CA.
DocuSign is a CA. This means you can always send a document with a
digital signature by using DocuSign as the Certi cate Authority. Alternatively,
you can use a 3rd party Certi cate Authority and still access the rich features
of DocuSign cloud services for transaction management. Some
organizations or regions rely on other prominent CAs, and the DocuSign
platform supports them, as well. These include OpenTrust, which is widely
used in European Union countries, and SAFE-BioPharma, which is an
identity credential that life science organizations may elect to use.

Why would I use a digital signature?

Many industries and geographical regions have established eSignature
standards that are based on digital signature technology, as well as speci c
certi ed CAs, for business documents. Following these local standards
based on PKI technology and working with a trusted certi cate authority can
ensure the enforceability and acceptance of an e-signature solution in each
local market. By using the PKI methodology, digital signatures utilize an
international, well-understood, standards-based technology that also helps
to prevent forgery or changes to the document after signing.

What is a digital certi cate?

A digital certi cate is an electronic document issued by a Certi cate
Authority (CA). It contains the public key for a digital signature and speci es
the identity associated with the key, such as the name of an organization.
The certi cate is used to con rm that the public key belongs to the speci c
organization. The CA acts as the guarantor. Digital certi cates must be
issued by a trusted authority and are only valid for a speci ed time. They are
required in order to create a digital signature.

What Are The Components Of Public Key Infrastructure?

So how does PKI authentication work? There are three key components:
digital certi cates, certi cate authority, and registration authority.

By hosting these elements on a secure framework, a Public Key

Infrastructure can protect the identities involved as well as the private
information used in situations where digital security is necessary, such as
smart card logins, SSL signatures, encrypted documents, and more. These
elements are vital in securing and communicating digital information and
electronic transactions. We go over these elements in more detail below.
1. Digital Certi cates
PKI functions because of digital certi cates. A digital certi cate is like a
drivers license—it’s a form of electronic identi cation for websites and
organizations. Secure connections between two communicating machines
23
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
 are made available through PKI because the identities of the two parties can
be veri ed by way of certi cates.
So how do devices get these certi cates? You can create your own
certi cates for internal communications. If you would like certi cates for a
commercial site or something of a larger scale, you can obtain a PKI digital
certi cate through a trusted third party issuer, called a Certi cate Authority.
2. Certi cate Authority
A Certi cate Authority (CA) is used to authenticate the digital identities of the
users, which can range from individuals to computer systems to servers.
Certi cate Authorities prevent falsi ed entities and manage the life cycle of
any given number of digital certi cates within the system.
Much like the state government issuing you a license, certi cate authorities
vet the organizations seeking certi cates and issue one based on their
ndings. Just as someone trusts the validity of your license based on the
authority of the government, devices trust digital certi cates based on the
authority of the issuing certi cate authorities. This process is similar to how
code signing works to verify programs and downloads.
3. Registration Authority
Registration Authority (RA), which is authorized by the Certi cate Authority to
provide digital certi cates to users on a case-by-case basis. All of the
certi cates that are requested, received, and revoked by both the Certi cate
Authority and the Registration Authority are stored in an encrypted certi cate
database.
Certi cate history and information is also kept on what is called a certi cate
store, which is usually grounded on a speci c computer and acts as a
storage space for all memory relevant to the certi cate history, including
issued certi cates and private encryption keys. Google Wallet is a great
example of this.

Public Key Infrastructure Model

the key elements of the PKIX model. These elements are
• End entity: A generic term used to denote end users, devices (e.g., servers,
routers), or any other entity that can be identi ed in the subject eld of a
public key certi cate. End entities typically consume and/or support PKI-
related services.
• Certi cation authority (CA): The issuer of certi cates and (usually) certi cate
revocation lists (CRLs). It may also support a variety of administrative
functions, although these are often delegated to one or more registration
authorities.
• Registration authority (RA): An optional component that can assume a
number of administrative functions from the CA. The RA is often
associated with the end entity registration process, but can assist in a
number of other areas as well.

24
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
 CRL issuer : An optional component that a CA can delegate to publish CRLs.
Repository : A generic term used to denote any method for storing
certi cates and CRLs so that they can be retrieved by end entities.

Transport Layer Security

Transport Layer Security (TLS) is an Internet Engineering Task Force (IETF)
standard protocol that provides authentication, privacy and data integrity
between two communicating computer applications. It's the most widely
deployed security protocol in use today and is best suited for web browsers
and other applications that require data to be securely exchanged over a
network.

How does Transport Layer Security work?

TLS uses a client-server handshake mechanism to establish an encrypted
and secure connection and to ensure the authenticity of the communication.
Here's a breakdown of the process:
1. Communicating devices exchange encryption capabilities.
2. An authentication process occurs using digital certi cates to help prove
the server is the entity it claims to be.
3. A session key exchange occurs. During this process, clients and servers
must agree on a key to establish the fact that the secure session is indeed
25
fi
fi
between the client and server -- and not something in the middle attempting
to hijack the conversation.

Secure Sockets Layer (SSL)

Secure Sockets Layer (SSL) is a standard technique for transmitting
documents securely across a network. SSL technology, created by
Netscape, establishes a secure connection between a Web server and a
browser, ensuring private and secure data transmission. SSL communicates
using the Transport Control Protocol (TCP).
The term "socket" in SSL refers to the method of sending data via a network
between a client and a server.

Objectives of SSL
The goals of SSL are as follows −
• Data integrity − Information is safe from tampering. The SSL Record
Protocol, SSL Handshake Protocol, SSL Change CipherSpec Protocol,
and SSL Alert Protocol maintain data privacy.
• Client-server authentication − The SSL protocol authenticates the
client and server using standard cryptographic procedures.
• SSL is the forerunner of Transport Layer Security (TLS), a
cryptographic technology for secure data transfer over the Internet.

How does SSL/TLS work?

• In order to provide a high degree of privacy, SSL encrypts data that is
transmitted across the web. This means that anyone who tries to
intercept this data will only see a garbled mix of characters that is
nearly impossible to decrypt.
• SSL initiates an authentication process called a handshake between
two communicating devices to ensure that both devices are really who
they claim to be.
• SSL also digitally signs data in order to provide data integrity, verifying
that the data is not tampered with before reaching its intended
recipient.
There have been several iterations of SSL, each more secure than the last.

HTTPS
Hypertext transfer protocol secure (HTTPS) is the secure version of HTTP,
which is the primary protocol used to send data between a web browser and
a website. HTTPS is encrypted in order to increase security of data transfer.
This is particularly important when users transmit sensitive data, such as by
logging into a bank account, email service, or health insurance provider.
How does HTTPS work?
HTTPS uses an encryption protocol to encrypt communications. The
protocol is called Transport Layer Security (TLS), although formerly it was
known as Secure Sockets Layer (SSL). This protocol secures
26
communications by using what’s known as an asymmetric public key
infrastructure. This type of security system uses two di erent keys to encrypt
communications between two parties:
• The private key - this key is controlled by the owner of a website and
it’s kept, as the reader may have speculated, private. This key lives on a
web server and is used to decrypt information encrypted by the public
key.
• The public key - this key is available to everyone who wants to interact
with the server in a way that’s secure. Information that’s encrypted by
the public key can only be decrypted by the private key.

Secure Shell (SSH) protocol

The Secure Shell (SSH) protocol is a method for securely sending commands
to a computer over an unsecured network. SSH uses cryptography to
authenticate and encrypt connections between devices. SSH also allows for
tunneling, or port forwarding, which is when data packets are able to cross
networks that they would not otherwise be able to cross. SSH is often used
for controlling servers remotely, for managing infrastructure, and for
transferring les.
When traveling, the owner of a store might give their employees instructions
from afar to ensure the store runs smoothly while they are gone. Similarly,
SSH allows administrators to manage servers and devices from afar.
What is SSH used for?
Technically, SSH can transmit any arbitrary data over a network, and SSH
tunneling can be set up for a myriad of purposes. However, the most
common SSH use cases are:
• Remotely managing servers, infrastructure, and employee computers
• Securely transferring les (SSH is more secure than unencrypted
protocols like FTP)
• Accessing services in the cloud without exposing a local machine's
ports to the Internet
• Connecting remotely to services in a private network
• Bypassing rewall restrictions.

TSL SSL
More secure in comparison to SSL.
Less secure in comparison to TLS.

TLS 1.0 and 1.1 are currently

deprecated but All the SSL versions are deprecated
TLS 1.2 and TLS 1.3 are actively now.
used as of 2022.

27
fi
fi
fi
ff
 TSL SSL
Provides more alert messages than
SSL. Less alert messages in comparison
to TLS.

Provides support to the alert

messages generated by SSL. No support provided for the alert
messages.

Uses HMAC for data integrity. TLS

1.3 uses AEAD for both encryption Uses MD5 and SHAl based on a
and authentication. MAC.

Client sends an insecure Hello

request and once secure connection An explicit secure connection is
is made communication switches to a made at a port. For example explicit
port like 443 in case of HTTPS. HTTPS connection is made at port
443.

Wireless Security Protocol

Wireless security protocols encrypt data transmitted over wireless networks
to prevent unauthorized access and eavesdropping. They also provide
authentication mechanisms to verify the identity of users and devices
attempting to access the network.
To achieve various security levels, di erent password encryptions are used.
So what are these Wireless Security Protocols? These Wireless Security
Protocols are WEP, WPA, WPA2 and WPA3.
▪ WEP (Wired Equivalent Privacy)
▪ WPA (Wi-Fi Protected Access)
▪ WPA2 (Wi-Fi Protected Access 2)
▪ WPA3 (Wi-Fi Protected Access 3)

WEP (Wired Equivalent Privacy)

WEP (Wired Equivalent Privacy) is the rst of Wireless Security Protocols. It
has developed at 1999. It was developed to protect the wireless data
between Clients and Access Points (APs) towards hackers.
At the beginning maximum 64-bit encryption was allowed in US. So, WEP
was using 64-bit encryption. After the restrictions, 128-bit and 256-bit WEP
has developed. WEP was widely used but it has too vulnerable to
the password hacks. Cybersecurity experts detect many vulnerabilities of
this rst Wireless Security Protocol. So, Wi-Fi Alliance retired it o cally at
28
fi
ff
fi
ffi
2004. For today’s World WEP (Wired Equivalent Privacy) is not a secure
protocol and it is outdated.

WPA (Wi-Fi Protected Access 1)

Wi-Fi Protected Access (WPA) was developed at 2003 by Wi-Fi Alliance.
Because of the vulnerabilities of WEP, a new protocol must be developed. It
is done with Wi-Fi Protected Access (WPA). WPA was using 256-bit WPA-
PSK (Pre-Shared Key).
Even though WPA is considered an interim security algorithm, it is an
improvement over WEP. It has discrete modes for personal and business use
for improved security. In personal mode, preshared keys are used to make it
easier to implement and manage the network among employees and
consumers. Business or enterprise mode requires an administrator to
authenticate a device before it can access the network. This allows larger
companies to have more control over who has access to the data.
WPA is based on the RC4 cipher like its predecessor WEP, only it uses TKIP
(temporal key integrity protocol) to boost wireless security. This includes,
• Using 256-bit keys to reduce keys being reused
• Generating a unique key for a packet by key mixing per packet
• Automatically broadcasting updated keys and usage
• Integrity checks of the system
• IV size increased to 48 bits

Wi-Fi Protected Access 2 (WPA2)

The replacement for the interim WPA, the IEEE released WPA2 in 2004. There
are still some security vulnerabilities with WPA2, but it is still considered one
of the most secure wireless network protocols available for personal and
business use.
While like WPA, it also o ers users personal and enterprise/business modes.
WPA2 also has several security improvements. These include,
• Replacing TKIP and the RC4 cipher with stronger authentication and
encryption mechanisms – CCMP (Cipher Block Chaining Message
Authentication Code Protocol) and AES (Advanced Encryption
Standard). If your device cannot support CCMP, the security algorithm
is still compatible with TKIP. This helps to ensure that WPA2 is
compatible with all devices and wireless networks.
• AES was originally developed by the United States government to
protect classi ed data from foreign and domestic hackers. It uses three
symmetric block ciphers with each one encrypting and decrypting
incoming and outgoing data using 128, 192, and 256-bit keys. This
security protocol for wireless networks does use more power but
technical improvements have lessened any concerns about
performance.

29
fi
ff
 • CCMP prevents everyone except for authorized users to receive data
by using cipher block chaining. This helps to ensure the integrity of the
message.

EMAIL SECURITY

1. Pretty Good Privacy (PGP) :

PGP is an open source software package that is designed for the purpose of
email security. Phil Zimmerman developed it. It provides the basic or
fundamental needs of cryptography. In this multiple steps such are taken to
secure the email, these are,
1. Con dentiality
2. Authentication
3. Compression
4. Resemble
5. Segmentation
6. E-mail compatibility

2. Secure/Multipurpose Internet Mail Extension (S/MIME) :

S/MIME is a security-enhanced version of Multipurpose Internet Mail
Extension (MIME). In this, public key cryptography is used for digital sign,
encrypt or decrypt the email. User acquires a public-private key pair with a
trusted authority and then makes appropriate use of those keys with email
applications.

PGP S/MIME
It is designed for processing the While it is designed to process email
plain texts as well as many multimedia les.
PGP is less costly as compared to S/ While S/MIME is comparatively
MIME expensive.
PGP is good for personal as well as While it is good for industrial use.
o ce use.
PGP is less e cient than S/MIME. While it is more e cient than PGP.
It depends on user key exchange. Whereas it relies on a hierarchically
valid certi cate for key exchange.
P G P i s c o m p a r a t i v e l y l e s s While it is more convenient than PGP
convenient. due to the secure transformation of
all the applications.
PGP uses Di e hellmandigital While it uses Elgamal digital
signature. signature.
30
ffi
fi
fi
ffi
ffi
ffi
fi
Ip Security
The IP security (IPSec) is an Internet Engineering Task Force (IETF) standard
suite of protocols between 2 communication points across the IP network
that provide data authentication, integrity, and con dentiality. It also de nes
the encrypted, decrypted and authenticated packets. The protocols needed
for secure key exchange and key management are de ned in it.

Uses of IP Security –
IPsec can be used to do the following things:
• To encrypt application layer data.
• To provide security for routers sending routing data across the public
internet.
• To provide authentication without encryption, like to authenticate that the
data originates from a known sender.
• To protect network data by setting up circuits using IPsectunneling in which
all data is being sent between the two endpoints is encrypted, as with a
Virtual Private Network(VPN) connection.

Components of IP Security –
It has the following components:

1. Encapsulating Security Payload (ESP) –

It provides data integrity, encryption, authentication and anti replay. It also
provides authentication for payload.

2. Authentication Header (AH) –

It also provides data integrity, authentication and anti replay and it does not
provide encryption. The anti replay protection, protects against unauthorized
transmission of packets. It does not protect data’s con dentiality.

Internet Key Exchange (IKE) –

It is a network security protocol designed to dynamically exchange
encryption keys and nd a way over Security Association (SA) between 2
devices. The Security Association (SA) establishes shared security attributes
between 2 network entities to support secure communication. The Key
Management Protocol (ISAKMP) and Internet Security Association which
provides a framework for authentication and key exchange. ISAKMP tells
how the set up of the Security Associations (SAs) and how direct
connections between two hosts that are using IPsec.
Internet Key Exchange (IKE) provides message content protection and also
an open frame for implementing standard algorithms such as SHA and MD5.
The algorithm’s IP sec users produce a unique identi er for each packet.
This identi er then allows a device to determine whether a packet has been

31
fi
fi
fi
fi
fi
fi
fi
correct or not. Packets which are not authorized are discarded and not given
to receiver.

Working of IP Security –
1. The host checks if the packet should be transmitted using IPsec or not.
These packet tra c triggers the security policy for themselves. This is done
when the system sending the packet apply an appropriate encryption. The
incoming packets are also checked by the host that they are encrypted
properly or not.
2. Then the IKE Phase 1 starts in which the 2 hosts( using IPsec )
authenticate themselves to each other to start a secure channel. It has 2
modes. The Main mode which provides the greater security and
the Aggressive mode which enables the host to establish an IPsec circuit
more quickly.
3. The channel created in the last step is then used to securely negotiate the
way the IP circuit will encrypt data across the IP circuit.
4. Now, the IKE Phase 2 is conducted over the secure channel in which the
two hosts negotiate the type of cryptographic algorithms to use on the
session and agreeing on secret keying material to be used with those
algorithms.
5. Then the data is exchanged across the newly created IPsec encrypted
tunnel. These packets are encrypted and decrypted by the hosts using IPsec
SAs.
6. When the communication between the hosts is completed or the session
times out then the IPsec tunnel is terminated by discarding the keys by both
the hosts.

Unit 5 : System Security

Intruders
One of the two most publicized threats to security is the intruder (the other is
viruses), often referred to as a hacker or cracker. In an important early study
of intrusion, Anderson [ANDE80] identi ed three classes of intruders:

• Masquerader: An individual who is not authorized to use the computer and

who penetrates a system's access controls to exploit a legitimate user's
account.
• Misfeasor: A legitimate user who accesses data, programs, or resources
for which such access is not authorized, or who is authorized for such
access but misuses his or her privileges
• Clandestine user: An individual who seizes supervisory control of the
system and uses this control to evade auditing and access controls or to
suppress audit collection.

32
ffi
fi
 lists the following examples of intrusion:
• Performing a remote root compromise of an e-mail server
• Defacing a Web server
• Guessing and cracking passwords
• Copying a database containing credit card numbers Viewing sensitive data,
including payroll records and medical information, without authorization
• Running a packet sni er on a workstation to capture usernames and
passwords.

Intrusion Detection System (IDS)

An Intrusion Detection System (IDS) is a system that monitors network
tra c for suspicious activity and issues alerts when such activity is
discovered. It is a software application that scans a network or a system for
harmful activity or policy breaching. Any malicious venture or violation is
normally reported either to an administrator or collected centrally using a
security information and event management (SIEM) system. A SIEM system
integrates outputs from multiple sources and uses alarm ltering techniques
to di erentiate malicious activity from false alarms.
Intrusion prevention systems also monitor network packets inbound the
system to check the malicious activities involved in it and at once sends the
warning noti cations.

Classi cation of Intrusion Detection System:

IDS are classi ed into 5 types:

1. Network Intrusion Detection System (NIDS):

Network intrusion detection systems (NIDS) are set up at a planned point
within the network to examine tra c from all devices on the network. It
performs an observation of passing tra c on the entire subnet and matches
the tra c that is passed on the subnets to the collection of known attacks.
Once an attack is identi ed or abnormal behavior is observed, the alert can
be sent to the administrator. An example of an NIDS is installing it on the
subnet where rewalls are located in order to see if someone is trying crack
the rewall.

2. Host Intrusion Detection System (HIDS):

Host intrusion detection systems (HIDS) run on independent hosts or devices
on the network. A HIDS monitors the incoming and outgoing packets from
the device only and will alert the administrator if suspicious or malicious
activity is detected. It takes a snapshot of existing system les and
compares it with the previous snapshot. If the analytical system les were
edited or deleted, an alert is sent to the administrator to investigate. An
example of HIDS usage can be seen on mission critical machines, which are
not expected to change their layout.

33
ffi
fi
ff
fi
ffi
fi
fi
fi
ff
fi
ffi
ffi
fi
fi
fi
 3. Protocol-based Intrusion Detection System (PIDS):
Protocol-based intrusion detection system (PIDS) comprises of a system or
agent that would consistently resides at the front end of a server, controlling
and interpreting the protocol between a user/device and the server. It is
trying to secure the web server by regularly monitoring the HTTPS protocol
stream and accept the related HTTP protocol. As HTTPS is un-encrypted
and before instantly entering its web presentation layer then this system
would need to reside in this interface, between to use the HTTPS.

4. Application Protocol-based Intrusion Detection System (APIDS):

Application Protocol-based Intrusion Detection System (APIDS) is a system
or agent that generally resides within a group of servers. It identi es the
intrusions by monitoring and interpreting the communication on application
speci c protocols. For example, this would monitor the SQL protocol explicit
to the middleware as it transacts with the database in the web server.

5. Hybrid Intrusion Detection System:

Hybrid intrusion detection system is made by the combination of two or
more approaches of the intrusion detection system. In the hybrid intrusion
detection system, host agent or system data is combined with network
information to develop a complete view of the network system. Hybrid
intrusion detection system is more e ective in comparison to the other
intrusion detection system. Prelude is an example of Hybrid IDS.

Detection Method of IDS:

1. Signature-based Method:
Signature-based IDS detects the attacks on the basis of the speci c patterns
such as number of bytes or number of 1’s or number of 0’s in the network
tra c. It also detects on the basis of the already known malicious instruction
sequence that is used by the malware. The detected patterns in the IDS are
known as signatures.
Signature-based IDS can easily detect the attacks whose pattern (signature)
already exists in system but it is quite di cult to detect the new malware
attacks as their pattern (signature) is not known.

2. Anomaly-based Method:
Anomaly-based IDS was introduced to detect the unknown malware attacks
as new malware are developed rapidly. In anomaly-based IDS there is use of
machine learning to create a trustful activity model and anything coming is
compared with that model and it is declared suspicious if it is not found in
model. Machine learning based method has a better generalized property in
comparison to signature-based IDS as these models can be trained
according to the applications and hardware con gurations.

34
ffi
fi
ff
ffi
fi
fi
fi
 Malicious Software

The words “Malicious Software” coin the word “Malware” and the meaning
remains the same. Malicious Software refers to any malicious program that
causes harm to a computer system or network. Malicious Malware Software
attacks a computer or network in the form of viruses, worms, trojans,
spyware, adware or rootkits.
Their mission is often targeted at accomplishing unlawful tasks such as
robbing protected data, deleting con dential documents or add software
without the user consent.

Di erent Types of Malicious Software

Computer Virus
A computer virus is a malicious software which self-replicates and attaches
itself to other les/programs. It is capable of executing secretly when the
host program/ le is activated. The di erent types of Computer virus are
Memory-Resident Virus, Program File Virus, Boot Sector Virus, Stealth Virus,
Macro Virus, and Email Virus.
Worms
A worm is malicious software which similar to that of a computer virus is a
self-replicating program, however, in the case of worms, it automatically
executes itself. Worms spread over a network and are capable of launching a
cumbersome and destructive attack within a short period.
Trojan Horses
Unlike a computer virus or a worm – the trojan horse is a non-replicating
program that appears legitimate. After gaining the trust, it secretly performs
malicious and illicit activities when executed. Hackers make use of trojan
horses to steal a user’s password information, destroy data or programs on
the hard disk. It is hard to detect!
Spyware/Adware
Spyware secretly records information about a user and forwards it to third
parties. The information gathered may cover les accessed on the computer,
a user’s online activities or even user’s keystrokes.
Adware as the name interprets displays advertising banners while a program
is running. Adware can also work like spyware, it is deployed to gather
con dential information. Basically, to spy on and gather information from a
victim’s computer.
Rootkit
A rootkit is malicious software that alters the regular functionality of an OS
on a computer in a stealthy manner. The altering helps the hacker to take full
control of the system and the hacker acts as the system administrator on the
victim’s system. Almost all the rootkits are designed to hide their existence.
35
ff
fi
fi
fi
fi
ff
fi
 Firewall
A rewall can be de ned as a special type of network security device or a
software program that monitors and lters incoming and outgoing network
tra c based on a de ned set of security rules. It acts as a barrier between
internal private networks and external sources (such as the public Internet).
The primary purpose of a rewall is to allow non-threatening tra c and
prevent malicious or unwanted data tra c for protecting the computer from
viruses and attacks. A rewall is a cybersecurity tool that lters network
tra c and helps users block malicious software from accessing
the Internet in infected computers.

How does a rewall work?

A rewall system analyzes network tra c based on pre-de ned rules. It then
lters the tra c and prevents any such tra c coming from unreliable or
suspicious sources. It only allows incoming tra c that is con gured to
accept.
Typically, rewalls intercept network tra c at a computer's entry point,
known as a port. Firewalls perform this task by allowing or blocking speci c
data packets (units of communication transferred over a digital network)
based on pre-de ned security rules. Incoming tra c is allowed only through
trusted IP addresses, or sources.

Functions of Firewall
As stated above, the rewall works as a gatekeeper. It analyzes every
attempt coming to gain access to our operating system and prevents tra c
from unwanted or non-recognized sources.
Since the rewall acts as a barrier or lter between the computer system and
other networks (i.e., the public Internet), we can consider it as a tra c
controller. Therefore, a rewall's primary function is to secure our network
and information by controlling network tra c, preventing unwanted incoming
network tra c, and validating access by assessing network tra c for
malicious things such as hackers and malware.
Generally, most operating systems (for example - Windows OS) and security
software come with built-in rewall support. Therefore, it is a good idea to
ensure that those options are turned on. Additionally, we can con gure the
security settings of the system to be automatically updated whenever
available.

Firewalls have become so powerful, and include a variety of functions and

capabilities with built-in features:
o Network Threat Prevention
o Application and Identity-Based Control
o Hybrid Cloud Support
o Scalable Performance
o Network Tra c Management and Control
36
fi
fi
fi
ffi
ffi
fi
fi
ffi
fi
ffi
ffi
fi
fi
fi
fi
fi
fi
fi
fi
fi
fi
ffi
ffi
ffi
ffi
ffi
ffi
ffi
fi
fi
fi
fi
ffi
ffi
ffi
ffi
fi
 o Access Validation
o Record and Report on Events

Types of Firewall
There are mainly three types of rewalls, such as software rewalls, hardware
rewalls, or both, depending on their structure. Each type of rewall has
di erent functionality but the same purpose. However, it is best practice to
have both to achieve maximum possible protection.
A hardware rewall is a physical device that attaches between a computer
network and a gateway. For example- a broadband router. A hardware
rewall is sometimes referred to as an Appliance Firewall. On the other hand,
a software rewall is a simple program installed on a computer that works
through port numbers and other installed software. This type of rewall is
also called a Host Firewall.
1. Packet Filtering Firewall: Examines each packet of data that enters or
leaves the network and decides whether to allow or block it based on
pre-de ned rules (such as IP addresses, ports, protocols).
2. Stateful Inspection Firewall: Keeps track of the state of active
connections and makes decisions based on the context of the tra c,
rather than just individual packets. This provides better security by
understanding the state of the connection.
3. Proxy Firewall: Acts as an intermediary between internal and external
network tra c. It establishes a connection with the external server on
behalf of the client, which hides the internal network structure and
provides additional security features like content ltering and caching.
4. Application Layer Firewall (also known as Next-Generation Firewall):
Operates at the application layer of the OSI model, allowing it to
inspect and lter tra c based on speci c applications or protocols. It
provides more granular control over network tra c and can identify and
block sophisticated threats.
5. Uni ed Threat Management (UTM) Firewall: Integrates multiple
security features like rewall, intrusion detection/prevention, antivirus,
content ltering, and VPN capabilities into a single platform. This
provides comprehensive security solutions for networks.
6. Cloud Firewall: Provides rewall functionality in the cloud, protecting
cloud-based assets and applications. Cloud rewalls are often highly
scalable and can be managed centrally.

SNMP
SNMP stands for Simple Network Management Protocol. SNMP is a
framework used for managing devices on the internet.It provides a set of
operations for monitoring and managing the internet. SNMP enables network
administrators to remotely monitor the status of network devices, collect
performance data, and even modify con guration settings.

37
fi
fi
ff
fi
fi
fi
ffi
fi
fi
fi
ffi
fi
fi
fi
fi
fi
fi
ffi
fi
fi
fi
fi
ffi
SNMP Concept
SNMP has two components Manager and agent.
• The manager is a host that controls and monitors a set of
agents such as routers.
• It is an application layer protocol in which a few manager
stations can handle a set of agents.
• The protocol designed at the application level can monitor
the devices made by different manufacturers and installed
on different physical networks.
• It is used in a heterogeneous network made of different
LANs and WANs connected by routers or gateways.

Managers & Agents

• A manager is a host that runs the SNMP client program while the agent is a
router that runs the SNMP server program.
• management of the internet is achieved through simple interaction
between a manager and agent.
• The agent is used to keep the information in a database while the manager
is used to access the values in the database. For example, a router can
store the appropriate variables such as a number of packets received and
forwarded while the manager can compare these variables to determine
whether the router is congested or not.
• Agents can also contribute to the management process. A server program
on the agent checks the environment, if something goes wrong, the agent
sends a warning message to the manager.
Management with SNMP has three basic ideas:
• A manager checks the agent by requesting the information that re ects the
behavior of the agent.
• A manager also forces the agent to perform a certain function by resetting
values in the agent database.
• An agent also contributes to the management process by warning the
manager regarding an unusual condition.

Management Components
• Management is not achieved only through the SNMP protocol but also the
use of other protocols that can cooperate with the SNMP protocol.
Management is achieved through the use of the other two protocols: SMI
(Structure of management information) and MIB(management information
base).
• Management is a combination of SMI, MIB, and SNMP. All these three
protocols such as abstract syntax notation 1 (ASN.1) and basic encoding
rules (BER).
38
fl
SMI
The SMI (Structure of management information) is a component used in
network management. Its main function is to de ne the type of data that can
be stored in an object and to show how to encode the data for the
transmission over a network.
MIB
• The MIB (Management information base) is a second component for the
network management.
• Each agent has its own MIB, which is a collection of all the objects that the
manager can manage. MIB is categorized into eight groups: system,
interface, address translation, ip, icmp, tcp, udp, and egp. These groups
are under the mib object.

SNMP
SNMP de nes ve types of messages: GetRequest, GetNextRequest,
SetRequest, GetResponse, and Trap.
GetRequest: The GetRequest message is sent from a manager (client) to the
agent (server) to retrieve the value of a variable.
GetNextRequest: The GetNextRequest message is sent from the manager
to agent to retrieve the value of a variable. This type of message is used to
retrieve the values of the entries in a table. If the manager does not know the
indexes of the entries, then it will not be able to retrieve the values. In such
situations, GetNextRequest message is used to de ne an object.
GetResponse: The GetResponse message is sent from an agent to the
manager in response to the GetRequest and GetNextRequest message. This
message contains the value of a variable requested by the manager.
SetRequest: The SetRequest message is sent from a manager to the agent
to set a value in a variable.
Trap: The Trap message is sent from an agent to the manager to report an
event. For example, if the agent is rebooted, then it informs the manager as
well as sends the time of rebooting.

SNMPv1 and features

SNMPv1, or Simple Network Management Protocol version 1, was the rst
widely adopted version of SNMP. It was de ned in RFC 1157 and introduced
several key features for network management. However, it also had
limitations, particularly in terms of security. Here are the main features of
SNMPv1:
• Manager-Agent Architecture: SNMPv1 operates on a manager-agent
architecture, where managers monitor and control agents on network
devices.
• Managed Objects and MIB: It uses a Management Information Base (MIB)
to organize and de ne accessible data on devices.
• Get and Set Operations: Managers can request information (Get) or modify
settings (Set) on managed devices.
39
fi
fi
fi
fi
fi
fi
fi
• Community-Based Security: Uses community strings for authentication
and access control, but this method is considered weak.
• Trap Noti cations: Allows devices to send unsolicited noti cations (traps)
to managers about signi cant events.
• UDP Transport Protocol: SNMPv1 messages are transmitted over UDP,
providing lightweight communication.

SNMPv3 and Features

SNMPv3, or Simple Network Management Protocol version 3, is an
enhanced version of SNMP designed to address the security limitations of
SNMPv1 and SNMPv2. Here are the key features of SNMPv3:
Sure, here's a concise summary of SNMPv3:
• Enhanced Security: SNMPv3 provides message integrity, authentication,
and encryption to ensure secure communication.
• User-Based Security Model (USM): Introduces ne-grained access control
and authentication for SNMP users.
• View-Based Access Control Model (VACM): Allows administrators to de ne
access policies based on MIB views.
• Strong Authentication: Supports strong authentication mechanisms like
HMAC-SHA and HMAC-MD5.
• Backward Compatibility: Compatible with SNMPv1 and SNMPv2 for
gradual transition to enhanced security.

40
fi
fi
fi
fi
fi