Cryptography and

Network Security
Eighth Edition
by William Stallings

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Chapter 1
Information and Network
Security Concepts

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Cybersecurity
Cybersecurity is the collection of tools, policies, security concepts, security
safeguards, guidelines, risk management approaches, actions, training, best
practices, assurance, and technologies that can be used to protect the cyberspace
environment and organization and users’ assets.

Organization and users’ assets include connected computing devices, personnel,

infrastructure, applications, services, telecommunications systems, and the totality
of transmitted and/or stored information in the cyberspace environment.

Cybersecurity strives to ensure the attainment and maintenance of the security

properties of the organization and users’ assets against relevant security risks in
the cyberspace environment.

The general security objectives comprise the following: availability; integrity, which
may include data authenticity and nonrepudiation; and confidentiality

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Cybersecurity

Information Security Network Security

• This term refers to • This term refers to protection
preservation of of networks and their service
confidentiality, integrity, and from unauthorized
availability of information. In modification, destruction, or
addition, other properties, disclosure, and provision of
such as authenticity, assurance that the network
accountability, performs its critical functions
nonrepudiation, and correctly and there are no
reliability can also be involved harmful side effects

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Security Objectives
• The cybersecurity definition introduces three key
objectives that are at the heart of information and
network security:
• Confidentiality: This term covers two related concepts:
• Data confidentiality: Assures that private or confidential
information is not made available or disclosed to unauthorized
individuals
• Privacy: Assures that individuals control or influence what
information related to them may be collected and stored and
by whom and to whom that information may be disclosed

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Security Objectives
• Integrity: This term covers two related concepts:
• Data integrity: Assures that data and programs are changed
only in a specified and authorized manner. This concept also
encompasses
• data authenticity, which means that a digital object is indeed
what it claims to be or what it is claimed to be
• nonrepudiation, which is assurance that the sender of
information is provided with proof of delivery and the
recipient is provided with proof of the sender’s identity, so
neither can later deny having processed the information
• System integrity: Assures that a system performs its
intended function in an unimpaired (undamaged) manner,
free from deliberate or unintentional unauthorized
manipulation of the system
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Security Objectives
• Availability: Assures that systems work
promptly (on time) and service is not denied to
authorized users

• Authenticity, which means that data is real,

true, genuine and is indeed what it claims to
be or what it is claimed to be

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Computer Security Challenges
• Security is not simple • Security mechanisms typically
involve more than a
• Potential attacks on the particular algorithm or
security features need to be protocol
considered
• Security is essentially a battle
• Procedures used to provide of wits between a
particular services are often perpetrator and the designer
counter-intuitive
• Little benefit from security
• It is necessary to decide investment is perceived until
where to use the various a security failure occurs
security mechanisms
• Strong security is often
• Requires constant monitoring viewed as an impediment to
efficient and user-friendly
• Is too often an afterthought operation

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 OSI Security Architecture
A systematic and standards approach to manage computer security

Security
Security attack Security service
mechanism

A processing or
A process (or a device communication Intended to counter
Any action that security attacks, and
incorporating such a service that enhances
compromises the they make use of one
process) that is the security of the
security of or more security
designed to detect, data processing
information owned mechanisms to
prevent, or recover systems and the
by an organization provide the service
from a security attack information transfers
of an organization

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Threats and Attacks

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Threats and Attacks
Threat: Any circumstance or event with the potential to
adversely impact organizational operations (including mission,
functions, image, or reputation), organizational assets,
individuals, other organizations, or the Nation through an
information system via unauthorized access, destruction,
disclosure, modification of information, and/or denial of
service.

Attack: Any kind of malicious activity that attempts to collect,

disrupt, deny, degrade, or destroy information system
resources or the information itself.

© 2020 Pea Education, Inc.,

Hoboken, NJ. All rights reserved
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Security Attacks

• A means of classifying security attacks, used both in

X.800 and RFC 4949, is in terms of passive attacks and
active attacks

• A passive attack attempts to learn or make use of

information from the system but does not affect
system resources or data

• An active attack attempts to alter system resources or

affect their operation

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Passive Attacks

• Are in the nature of

eavesdropping on, or
monitoring of, transmissions

• Goal of the opponent is to • Two types of passive

obtain information that is
being transmitted
attacks are:
• The release of message
contents
• Traffic analysis

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

Release of Message Content
• The release of message contents is easily
understood.

• A telephone conversation, an electronic mail

message, and a transferred file may contain
sensitive or confidential information.

• We would like to prevent an opponent from

learning the contents of these transmissions.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Traffic analysis
• Suppose that we had a way of masking the contents of messages or
other information traffic so that opponents, even if they captured the
message, could not extract the information from the message.

• The common technique for masking contents is encryption. If we had

encryption protection in place, an opponent might still be able to
observe the pattern of these messages.

• The opponent could determine the location and identity of

communicating hosts and could observe the frequency and length of
messages being exchanged. This information might be useful in
guessing the nature of the communication that was taking place.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Passive Attacks
• Passive attacks are very difficult to detect, because they do
not involve any alteration of the data.

• Typically, the message traffic is sent and received in an

apparently normal fashion, and neither the sender nor
receiver is aware that a third party has read the messages
or observed the traffic pattern.

• However, it is feasible to prevent the success of these

attacks, usually by means of encryption. Thus, the emphasis
in dealing with passive attacks is on prevention rather than
detection.
© 2020 Pearson Education, Inc.,
Hoboken, NJ. All rights reserved
 Active Attacks
• Involve some modification of the
data stream or the creation of a •Takes place when one entity
pretends to be a different entity
false stream Masquerade •Usually includes one of the other
forms of active attack
• Difficult to prevent because of
the wide variety of potential
•Involves the passive capture of a
physical, software, and network data unit and its subsequent
Replay retransmission to produce an
vulnerabilities
unauthorized effect

• Goal is to detect attacks and to

recover from any disruption or •Some portion of a legitimate
Data message is altered, or messages are
delays caused by them
delayed or reordered to produce an
Modification unauthorized effect

Denial of •Prevents or inhibits the normal use

or management of communications
service facilities

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Masquerade
• Can be used to impersonate the two ends of a legitimate
communication. (Fig.1.3c)

• Another form of masquerade is illustrated in Figure 1.3d.

Here, an attacker is able to access server resources by
masquerading as an authorized user.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Data Modification
• may involve a man-in-the middle attack, in which
the attacker selectively modifies communicated
data between a client and server (Figure 1.3c).

• Another form of data modification attack is the

modification of data residing on a serve or other
system after an attacker gains unauthorized access
(Figure 1.3d).

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Replay
• Figure 1.3e illustrates the replay attack. As
in a passive attack, the attacker does not
disturb the information flow between client
and server, but does capture client
message.

• The attacker can then subsequently replay

any client message to the server.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 DoS
• Figure 1.3d also illustrates denial of service
in the context of a client/server environment.

• The denial of service can take two forms: (1)

flooding the server with an overwhelming
amount of data; and (2) triggering some
action on the server that consumes
substantial computing resources.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Security Services
• Authentication

• Access Control

• Data confidentiality

• Data Integrity

• Nonrepudiation

• Availability
© 2020 Pearson Education, Inc.,
Hoboken, NJ. All rights reserved
 Authentication
• Concerned with assuring that a communication is
authentic
• In the case of a single message, assures the recipient
that the message is from the source that it claims to be
from
• In the case of ongoing interaction, assures the two
entities are authentic (each is the entity that it claims to
be) and that the connection is not interfered with in such
a way that a third party can masquerade as one of the
two legitimate parties

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Access Control
• The ability to limit and control the access to host
systems and applications via communications
links

• To achieve this, each entity trying to gain access

must first be identified, or authenticated, so that
access rights can be tailored to the individual

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Data Confidentiality
• The protection of transmitted data from passive
attacks
• Broadest service protects all user data transmitted
between two users over a period of time
• Narrower forms of service includes the protection of a
single message or even specific fields within a message

• The protection of traffic flow from analysis

• This requires that an attacker not be able to observe the
source and destination, frequency, length, or other
characteristics of the traffic on a communications facility

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Data Integrity
Can apply to a stream of messages, a single
message, or selected fields within a message

Connection-oriented integrity service, one that

deals with a stream of messages, assures that
messages are received as sent with no duplication,
insertion, modification, reordering, or replays

A connectionless integrity service, one that deals

with individual messages without regard to any
larger context, generally provides protection
against message modification only

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Nonrepudiation
• Prevents either sender or receiver from
denying a transmitted message

• When a message is sent, the receiver can

prove that the suspected sender in fact sent
the message

• When a message is received, the sender can

prove that the suspected receiver in fact
received the message

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Availability Service
• Availability is the property of a system or a
system resource being accessible and
usable upon demand by an authorized
system entity, according to performance
specifications for the system

• A system is available if it provides services

according to the system design whenever
users request them.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Availability Service

• Protects a system to ensure its availability

• This service addresses the security concerns

raised by denial-of-service attacks

• It depends on proper management and

control of system resources and thus depends
on access control service and other security
services

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Security Mechanisms
• Cryptographic algorithms: We can distinguish between
reversible cryptographic mechanisms and irreversible
cryptographic mechanisms.
• A reversible cryptographic mechanism is simply an
encryption algorithm that allows data to be encrypted
and subsequently decrypted such as DES, AES, RSA.
• Irreversible cryptographic mechanisms include hash
algorithms and message authentication codes (MAC),
which are used in digital signature and message
authentication applications.

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Security Mechanisms
• Data integrity: This category covers a variety
of mechanisms used to assure the integrity of
a data unit or stream of data units.
• Digital signature: Data appended to, or a
cryptographic transformation of, a data unit
that allows a recipient of the data unit to
prove the source and integrity of the data unit
and protect against forgery.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Security Mechanisms
• Authentication exchange: A mechanism intended to
ensure the identity of an entity by means of
information exchange.
• Traffic padding: The insertion of bits into gaps in a
data stream to frustrate traffic analysis attempts.
• Routing control: Enables selection of particular
physically or logically secure routes for certain data
and allows routing changes, especially when a breach
of security is suspected.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Security Mechanisms
• Notarization: The use of a trusted third party
to assure certain properties of a data
exchange
• Access control: A variety of mechanisms that
enforce access rights to resources.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Keyless Algorithms
• Deterministic functions that have certain properties
useful for cryptography
• One type of keyless algorithm is the cryptographic hash
function
• A hash function turns a variable amount of text into a small, fixed-
length value called a hash value, hash code, or digest
• A cryptographic hash function is one that has additional properties
that make it useful as part of another cryptographic algorithm,
such as a message authentication code or a digital signature
• A pseudorandom number generator produces a
deterministic sequence of numbers or bits that has the
appearance of being a truly random sequence
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Single-Key Algorithms
Encryption
algorithms that use a Symmetric
Single-key encryption takes the
cryptographic single key are
referred to as following forms:
algorithms depend
on the use of a symmetric encryption
secret key algorithms
Block cipher
• A block cipher operates on
With symmetric encryption, an data as a sequence of blocks
encryption algorithm takes as •In most versions of the block
input some plain data to be cipher, known as modes of
protected and a secret key and operation, the transformation
produces an unintelligible depends not only on the
transformation on that data current data block and the
secret key but also on the
content of preceding blocks
A corresponding decryption
algorithm takes the
transformed cipher data and
the same secret key and Stream cipher
recovers the original data • A stream cipher operates on data
as a sequence of bits
• As with the block cipher, the
transformation depends on a
secret key
© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved
 Single-Key Algorithms
Another form of single-key cryptographic
algorithm is the message authentication code (MAC)

A MAC is a data element associated with a data block or message

The MAC is generated by a cryptographic transformation involving a secret

key and, typically, a cryptographic hash function of the message

The MAC is designed so that someone in possession of the secret key can
verify the integrity of the message. Thus, the MAC algorithm takes as input a
message and secret key and produces the MAC.

The recipient of the message plus the MAC can perform the same calculation
on the message; if the calculated MAC matches the MAC accompanying the
message, this provides assurance that the message has not been altered

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Asymmetric Algorithms
• Two-key algorithms involve the use of two
related keys.

• A private key is known only to a single user

or entity, whereas the corresponding public
key is made available to a number of users.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Asymmetric Algorithms
• Encryption algorithms that use two-key are
referred to as asymmetric encryption
algorithms. Asymmetric encryption can
work in two ways:

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Asymmetric Algorithms
• An encryption algorithm takes as input some data to
be protected and the private key and produces an
unintelligible transformation on that data.

• A corresponding decryption algorithm takes the

transformed data and the corresponding public key
and recovers the original data.

• In this case, only the possessor of the private key can

have performed the encryption and any possessor of
the public key can perform the decryption.

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Asymmetric Algorithms
• An encryption algorithm takes as input some data to
be protected and a public key and produces an
unintelligible transformation on that data.

• A corresponding decryption algorithm takes the

transformed data and the corresponding private key
and recovers the original data.

• In this case, any possessor of the public key can

have performed the encryption and only the
possessor of the private key can perform the
decryption.
© 2020 Pearson Education, Inc.,
Hoboken, NJ. All rights reserved
 Asymmetric Algorithms
• Digital signature algorithm
• A digital signature is a value computed with a
cryptographic algorithm and associated with a data
object in such a way that any recipient of the data can
use the signature to verify the data’s origin and integrity

• Key exchange
• The process of securely distributing a symmetric key to
two or more parties

• User authentication
• The process of authenticating that a user attempting to
access an application or service is genuine and, similarly,
that the application or service is genuine

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Network Security

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Communications Security
• Deals with the protection of communications through
the network, including measures to protect against
both passive and active attacks
• Communications security is primarily implemented
using network protocols
• A network protocol consists of the format and procedures that
governs the transmitting and receiving of data between points in
a network
• A protocol defines the structure of the individual data units and
the control commands that manage the data transfer

• With respect to network security, a security protocol

may be an enhancement that is part of an existing
protocol or a standalone protocol

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Device Security
• The other aspect of network security is the
protection of network devices, such as routers
and switches, and end systems connected to the
network, such as client systems and servers

• The primary security concerns are intruders that

gain access to the system to perform
unauthorized actions, insert malicious software
(malware), or overwhelm system resources to
diminish availability

© 2020 Pearson Education, Inc., Hoboken, NJ. All rights reserved

 Device Security
• Firewalls
• A hardware and/or software capability that limits
access between a network and device attached to the
network, in accordance with a specific security policy.
• The firewall acts as a filter that permits or denies data
traffic, both incoming and outgoing, based on a set of
rules based on traffic content and/or traffic pattern

© 2020 Pearson Education, Inc.,

Hoboken, NJ. All rights reserved
 Device Security
• Intrusion detection
• Hardware or software products that gather and
analyze information from various areas within a
computer or a network for the purpose of
finding, and providing real-time or near-real-time
warning of, attempts to access system resources
in an unauthorized manner
• Intrusion prevention
• Hardware or software products designed to
detect intrusive activity and attempt to stop the
activity, ideally before it reaches its target
© 2020 Pearson Education, Inc.,
Hoboken, NJ. All rights reserved