Information Security

Properties of a cryptographic hash function $H$

• Variable input size: $H$ can be applied to a block of data of any length.
• Fixed output size: it produces a fixed-length hash value.
• Efficiency: computing $H(x)$ is easy, in hardware and software.
• Pre-image resistance (one-way): given $h$, it is computationally infeasible to find $x$ with $H(x)=h$.
• Second pre-image resistance (weak collision resistance): given $x$, it is infeasible to find $y\ne x$ with $H(y)=H(x)$.
• Collision resistance (strong): it is infeasible to find any pair $x\ne y$ with $H(x)=H(y)$.
• Pseudo-randomness: the output meets standard tests for pseudo-randomness (avalanche effect).

SHA-1 algorithm

SHA-1 takes a message of length less than $2^{64}$ bits and produces a 160-bit digest, processing 512-bit blocks.

1. Append padding bits: add a 1 bit followed by zeros so that the length is $448 \bmod 512$.
2. Append length: add the original length as a 64-bit value, so the message is a multiple of 512 bits.
3. Initialise the buffer: five 32-bit registers $A,B,C,D,E$ are set to $A=67452301,\;B=EFCDAB89,\;C=98BADCFE,\;D=10325476,\;E=C3D2E1F0$ (hex).
4. Process each 512-bit block in 80 rounds (4 stages of 20 steps). The block is expanded into 80 words by $W_t=ROTL^{1}(W_{t-3}\oplus W_{t-8}\oplus W_{t-14}\oplus W_{t-16}),\quad 16\le t\le79$ In each step $T=ROTL^{5}(A)+f_t(B,C,D)+E+W_t+K_t,$ then $E=D,\;D=C,\;C=ROTL^{30}(B),\;B=A,\;A=T$. The function $f_t$ and constant $K_t$ change at each stage: $f_t$ is $(B\wedge C)\vee(\neg B\wedge D)$, $B\oplus C\oplus D$, majority$(B,C,D)$, $B\oplus C\oplus D$ with $K_t=5A827999,\,6ED9EBA1,\,8F1BBCDC,\,CA62C1D6$.
5. Chaining: after the 80 steps the new $A..E$ are added (mod $2^{32}$) to the input chaining values of that block, giving the input to the next block.
6. Output: after the last block, the concatenation of $A\|B\|C\|D\|E$ is the 160-bit digest.

Diagram (flow):

Message -> [pad + length] -> M1 | M2 | ... | ML (512 bits each)
IV(160) -> [SHA-1 compression, 80 steps, Wt, Kt] -> H1 -> ... -> HL = 160-bit digest

Properties of a cryptographic hash function $H$

• Variable input size: $H$ can be applied to a block of data of any length.
• Fixed output size: it produces a fixed-length hash value.
• Efficiency: computing $H(x)$ is easy, in hardware and software.
• Pre-image resistance (one-way): given $h$, it is computationally infeasible to find $x$ with $H(x)=h$.
• Second pre-image resistance (weak collision resistance): given $x$, it is infeasible to find $y\ne x$ with $H(y)=H(x)$.
• Collision resistance (strong): it is infeasible to find any pair $x\ne y$ with $H(x)=H(y)$.
• Pseudo-randomness: the output meets standard tests for pseudo-randomness (avalanche effect).

SHA-1 algorithm

SHA-1 takes a message of length less than $2^{64}$ bits and produces a 160-bit digest, processing 512-bit blocks.

1. Append padding bits: add a 1 bit followed by zeros so that the length is $448 \bmod 512$.
2. Append length: add the original length as a 64-bit value, so the message is a multiple of 512 bits.
3. Initialise the buffer: five 32-bit registers $A,B,C,D,E$ are set to $A=67452301,\;B=EFCDAB89,\;C=98BADCFE,\;D=10325476,\;E=C3D2E1F0$ (hex).
4. Process each 512-bit block in 80 rounds (4 stages of 20 steps). The block is expanded into 80 words by $W_t=ROTL^{1}(W_{t-3}\oplus W_{t-8}\oplus W_{t-14}\oplus W_{t-16}),\quad 16\le t\le79$ In each step $T=ROTL^{5}(A)+f_t(B,C,D)+E+W_t+K_t,$ then $E=D,\;D=C,\;C=ROTL^{30}(B),\;B=A,\;A=T$. The function $f_t$ and constant $K_t$ change at each stage: $f_t$ is $(B\wedge C)\vee(\neg B\wedge D)$, $B\oplus C\oplus D$, majority$(B,C,D)$, $B\oplus C\oplus D$ with $K_t=5A827999,\,6ED9EBA1,\,8F1BBCDC,\,CA62C1D6$.
5. Chaining: after the 80 steps the new $A..E$ are added (mod $2^{32}$) to the input chaining values of that block, giving the input to the next block.
6. Output: after the last block, the concatenation of $A\|B\|C\|D\|E$ is the 160-bit digest.

Diagram (flow):

Message -> [pad + length] -> M1 | M2 | ... | ML (512 bits each)
IV(160) -> [SHA-1 compression, 80 steps, Wt, Kt] -> H1 -> ... -> HL = 160-bit digest

Information security is the protection of information and information systems from unauthorised access, use, disclosure, disruption, modification or destruction, so that confidentiality, integrity and availability (the CIA triad) are preserved.

Fundamental security design principles

• Economy of mechanism: keep the design as simple and small as possible so it is easier to analyse and verify.
• Fail-safe defaults: access is denied by default; permission is granted only when explicitly given.
• Complete mediation: every access to every object must be checked against the access-control policy.
• Open design: security must not depend on secrecy of the design; only keys are secret.
• Separation of privilege: access needs more than one condition (e.g. two keys or two approvals).
• Least privilege: each user or process gets only the minimum rights needed for its task.
• Least common mechanism: minimise mechanisms shared by many users, since sharing creates channels for leakage.
• Psychological acceptability: security controls must not make the resource much harder to use.
• Isolation: separate public systems from critical resources, users from each other, and security mechanisms from the rest of the system.
• Encapsulation: hide internal details of an object behind a well-defined interface.
• Modularity: build security functions as separate, replaceable modules.
• Layering (defence in depth): use several overlapping protection layers so that failure of one does not expose the system.
• Least astonishment: a program or interface should respond in the way users expect.

HMAC (Hash-based Message Authentication Code) is a message authentication code built from a cryptographic hash function (such as SHA-256) and a shared secret key. It gives both integrity and authenticity of a message.

$\text{HMAC}(K,M)=H\big((K^{+}\oplus opad)\,\|\,H((K^{+}\oplus ipad)\,\|\,M)\big)$

Here $K^{+}$ is the key padded with zeros to the hash block size, $ipad$ is the byte 0x36 repeated, and $opad$ is the byte 0x5C repeated.

Steps

1. Pad the key $K$ with zeros to block size $b$ to get $K^{+}$.
2. XOR $K^{+}$ with $ipad$ to get $S_i$.
3. Append the message $M$ to $S_i$ and hash it.
4. XOR $K^{+}$ with $opad$ to get $S_o$.
5. Append the inner hash to $S_o$ and hash again; the result is the HMAC.

Objectives

• To use available hash functions without modification, since they are fast and widely available in software.
• To allow easy replacement of the embedded hash function if a faster or more secure one appears.
• To preserve the original performance of the hash function without significant degradation.
• To use and handle keys in a simple way.
• To have a well-understood cryptographic analysis of the strength of the authentication mechanism, based on reasonable assumptions about the hash function.

Vulnerabilities of passwords

• Offline dictionary attack: the attacker steals the password file and tries common words against the hashes.
• Specific account attack: repeated guesses against one chosen account.
• Popular password attack: trying a few very common passwords (e.g. 123456) against many accounts.
• Password guessing against a single user: using personal information such as name, birthday or phone number.
• Workstation hijacking: using a logged-in, unattended terminal.
• Exploiting user mistakes: passwords written down, shared, or reused on many sites; social engineering and phishing.
• Exploiting multiple password use: one leaked password opens several systems.
• Electronic monitoring: sniffing passwords sent over the network or keylogging.

Strategies for selecting effective passwords

1. User education: users are told the rules of good passwords (length, mix of characters, no personal data) and are expected to follow them. Weak because many ignore them.
2. Computer-generated passwords: the system generates random pronounceable passwords. Secure but hard to remember, so users write them down.
3. Reactive password checking: the system periodically runs its own cracker to find guessable passwords and asks the owner to change them. It consumes resources and leaves a window of exposure.
4. Proactive password checking: the password is checked when the user selects it, and rejected if it is weak (too short, in a dictionary, derived from the user name). This gives the best balance of usability and security.

Passwords should also be salted and hashed before storage, and expire (password ageing).

Access right is the permission that a subject (user, process) has to perform a particular operation (read, write, execute, delete, create, search) on an object (file, device, record, resource). The set of access rights of subjects over objects is expressed by an access-control matrix, ACL or capability list.

Trust framework

A trust framework is a set of agreed technical, legal and operational rules, standards and policies that let different parties (identity providers, service providers, users) rely on each other's identity and attribute assertions. It establishes confidence about who the user is without each service having to verify the user itself.

Its main elements are:

• Identity/attribute provider: issues and manages identities and attributes.
• Relying party (service provider): consumes assertions and decides access.
• Subject/user: the entity being identified.
• Policies and rules: assurance levels, privacy rules, audit, liability and dispute handling.
• Standards and protocols: e.g. SAML, OpenID Connect, OAuth for exchanging the assertions.

Using a trust framework, a user authenticated at one provider (federated identity) can use many services with a single sign-on, and each party knows the level of assurance it can place on the identity.

Honeypot is a decoy system, deliberately made attractive and apparently vulnerable, placed on a network to lure attackers. It has no legitimate production use, so any traffic to it is suspicious. Its purposes are to divert attackers from real systems, collect information about attack methods, and encourage the attacker to stay long enough for administrators to respond.

Honeypots are instrumented with monitors and event loggers, and are usually placed in the DMZ, outside the external firewall, or in the internal network.

Types of honeypots

• Low-interaction honeypot: emulates only some services and the network stack (e.g. fake SSH or FTP). It is simple, low risk and easy to deploy, but gives little information and can be detected.
• High-interaction honeypot: a real operating system with real applications that the attacker can fully compromise. It gives rich information about attacker behaviour but is complex and risky, because it may be used to attack other systems if not contained.
• Production honeypot: deployed inside an organisation to detect attacks and protect the real network.
• Research honeypot: used by researchers to study new attack tools and tactics.
• Honeynet: a network of several honeypots simulating a whole network.

An Intrusion Detection System (IDS) monitors hosts and network traffic for malicious activity and policy violation, and raises alerts. Firewalls and access control are preventive and can be bypassed or misconfigured; an IDS is the detective layer that finds what gets through. It is called the backbone of information security because:

• it detects attacks that bypass preventive controls (insider attacks, zero-day exploits, tunnelled traffic);
• it provides early warning, which allows quick response and limits damage;
• it gives logs and evidence for forensic analysis and audit;
• it acts as a deterrent and helps verify that security policy and the firewall are working;
• it provides data to improve defences and understand attack patterns.

Categories of IDS

By the place of deployment:

1. Host-based IDS (HIDS): installed on a host; monitors system calls, log files, file integrity and process behaviour.
2. Network-based IDS (NIDS): placed at network points; analyses packets passing through the network.

By detection method:

1. Signature (misuse) based: compares activity with a database of known attack patterns. Accurate for known attacks, but cannot detect new ones.
2. Anomaly based: builds a profile of normal behaviour and flags deviations. Can detect unknown attacks but gives more false positives.
3. Hybrid: combines both approaches.

SSL (Secure Sockets Layer) is a protocol developed by Netscape that provides confidentiality, integrity and server (optionally client) authentication for communication over TCP, sitting between the application layer and the transport layer. It is used mostly with HTTP (HTTPS).

TLS (Transport Layer Security) is the IETF standardised successor of SSL 3.0 (RFC 5246, TLS 1.3 in RFC 8446). It is more secure than SSL, uses HMAC for message authentication, and has an improved pseudo-random function and alert handling. SSL is now deprecated.

Both have two layers: the Record Protocol (fragmentation, compression, MAC, encryption of application data) and upper protocols: Handshake, Change Cipher Spec and Alert.

Handshake protocol

The handshake is used before any application data is sent, to authenticate the parties, negotiate cipher suite and compression and establish keys. Its phases are:

1. Hello: the client sends ClientHello (version, random, session id, cipher suites); the server answers ServerHello with its chosen parameters and random.
2. Server authentication and key exchange: the server sends its certificate, optional ServerKeyExchange, optional certificate request, then ServerHelloDone.
3. Client authentication and key exchange: the client verifies the certificate, sends its certificate if requested and a ClientKeyExchange carrying the pre-master secret encrypted with the server's public key.
4. Finish: both sides send ChangeCipherSpec and a Finished message under the new keys. The master secret is derived from the pre-master secret and the two random values, and then session keys are generated.

Threat: a potential danger that could exploit a vulnerability and cause harm to an information asset; it is a possible violation of security. Attack: an actual attempt, an intelligent act, to exploit a vulnerability and violate security. A threat is the possibility; an attack is its realisation.

Types of security threats

1. Interruption (threat to availability): an asset is destroyed or made unavailable, e.g. cutting a line, deleting a file, denial of service.
2. Interception (threat to confidentiality): an unauthorised party gains access to an asset, e.g. wiretapping, packet sniffing, illicit copying of files.
3. Modification (threat to integrity): an unauthorised party gains access and alters the asset, e.g. changing values in a database or altering a message in transit.
4. Fabrication (threat to authenticity): an unauthorised party inserts counterfeit objects, e.g. adding false records or spoofed messages.

Other common categories

• Malicious software: viruses, worms, Trojan horses, ransomware, spyware, logic bombs, backdoors.
• Passive threats: eavesdropping and traffic analysis; they are hard to detect because nothing is altered.
• Active threats: masquerade, replay, modification of messages, denial of service.
• Social engineering and phishing: deceiving people to reveal credentials.
• Insider threats: misuse by authorised users.
• Network attacks: spoofing, man-in-the-middle, SQL injection, buffer overflow, DDoS.
• Physical and environmental threats: theft, fire, flood, power failure.

Controls against these include encryption, authentication, access control, firewalls, IDS, backups, patching and user training.

Cryptosystem: a cryptosystem is a five-tuple $(P, C, K, E, D)$ where $P$ is the set of plaintexts, $C$ the set of ciphertexts, $K$ the set of keys, $E$ the family of encryption functions $E_k: P\to C$ and $D$ the family of decryption functions $D_k: C\to P$ such that $D_k(E_k(p))=p$ for every $p$ and $k$. It is the complete scheme (algorithm, keys and procedures) that provides secrecy.

Vigenere cipher (polyalphabetic substitution)

A keyword is repeated to the length of the plaintext. Letters are numbered A=0, ..., Z=25.

$C_i=(P_i+K_i)\bmod 26,\qquad P_i=(C_i-K_i)\bmod 26$

Example: plaintext ATTACK, key KEY repeated KEYKEY:

Ciphertext is KXRKGI. Because one plaintext letter can map to different cipher letters, single-letter frequencies are flattened, which makes it stronger than Caesar cipher. It can still be broken using the Kasiski test or index of coincidence to find the key length.

Rail fence cipher (transposition)

The plaintext is written diagonally in a zig-zag over a chosen number of rails (rows), and the ciphertext is read row by row.

Example with 2 rails, plaintext MEETME:

M . E . M .
. E . T . E

Row 1 gives MEM, row 2 gives ETE, so ciphertext is MEMETE. To decrypt, the receiver knows the length and rail count, rebuilds the zig-zag positions, fills the ciphertext row by row and reads in zig-zag order. The cipher only permutes the letters, so letter frequencies are preserved and it is easily broken with few rails.

Security audit: a systematic, measurable evaluation of how well an organisation's information system conforms to a set of established criteria (security policy, standards, laws). It examines records, system activity, configuration and controls, and checks whether they work as intended.

Importance

• Verifies that security policy and controls are implemented and effective.
• Detects security violations, misuse and weaknesses early.
• Provides accountability, since actions can be traced to users.
• Gives evidence for forensic investigation and legal action.
• Helps compliance with laws and standards, and supports risk assessment and improvement.
• Acts as a deterrent against insiders.

Security auditing architecture

The architecture (per ITU-T X.816 / Stallings) consists of the following components:

1. Event discriminator: logic in the system software that filters events, deciding which are potentially security relevant and need to be recorded.
2. Audit recorder: writes the selected events into the audit trail (log) in a standard format.
3. Audit trail: the permanent, protected record of events.
4. Alarm processor: takes action on events flagged as alarms (e.g. alerts the administrator).
5. Audit analyzer: examines the audit trail, possibly in real time, to find patterns, anomalies and intrusions, and may trigger new audit rules.
6. Audit archiver: moves old records from the trail into long-term storage.
7. Audit provider: gives access to the audit trail to authorised reviewers.
8. Audit trail examiner: the person or tool (with the audit trail) that reviews the data and produces reports.
9. Security reports: summaries from analysis for administrators and auditors.

The data is collected from the application, system, network and user level; the audit trail itself must be protected from tampering, since an attacker would try to erase evidence.

Security attack: any action that compromises the security of information owned by an organisation, i.e. an attempt to exploit a vulnerability to violate confidentiality, integrity or availability. Attacks are classified as passive and active.

Active attacks involve modification of the data stream or creation of a false stream. They are hard to prevent but can be detected and recovered from.

1. Masquerade: one entity pretends to be another, e.g. using stolen credentials to gain extra privileges.
2. Replay: a captured data unit is retransmitted later to produce an unauthorised effect, e.g. replaying a bank transfer message.
3. Modification of messages: part of a legitimate message is altered, delayed or reordered. For example "Allow Ram to read file X" is changed to "Allow Hari to read file X".
4. Denial of service (DoS): prevents normal use or management of communication facilities, e.g. flooding a server with requests, or suppressing messages to a destination.

Fermat's little theorem: if $p$ is prime and $\gcd(a,p)=1$, then $a^{p-1}\equiv 1 \pmod p$.

Here $p=11$, $a=7$, so $7^{10}\equiv 1 \pmod{11}$. Since $2019=10\times 201+9$:

$7^{2019}=(7^{10})^{201}\cdot 7^{9}\equiv 7^{9}\pmod{11}$

Compute $7^2=49\equiv 5$, $7^4\equiv 25\equiv 3$, $7^8\equiv 9$, so $7^9\equiv 9\times 7=63\equiv 8 \pmod{11}$.

$7^{2019}\bmod 11 = 8$

Euler totient function: $\phi(n)$ is the number of positive integers less than or equal to $n$ that are relatively prime to $n$. For a prime $p$, $\phi(p)=p-1$; for $n=pq$ with distinct primes, $\phi(n)=(p-1)(q-1)$; in general $\phi(n)=n\prod_{p\mid n}(1-1/p)$.

Example: $\phi(10)$: numbers 1, 3, 7, 9 are coprime to 10, so $\phi(10)=4$. Check: $10(1-\tfrac12)(1-\tfrac15)=4$.

Galois field: a Galois field $GF(p^n)$ is a finite field, i.e. a finite set with addition, subtraction, multiplication and division (except by zero) that satisfy the field axioms. It exists only when the number of elements is a prime power. $GF(p)$ is the integers modulo prime $p$. Fields such as $GF(2^8)$ are used in AES.

Division of $5x^2+4x+6$ by $2x+1$ over $GF(7)$

The inverse of 2 in $GF(7)$ is 4, because $2\cdot4=8\equiv1$.

1. Leading term: $5x^2/2x = 5\cdot4\,x=20x\equiv 6x$. Multiply: $6x(2x+1)=12x^2+6x\equiv5x^2+6x$. Subtract: $(4x-6x)=-2x\equiv5x$, so the remainder so far is $5x+6$.
2. Next term: $5x/2x=5\cdot4=20\equiv6$. Multiply: $6(2x+1)=12x+6\equiv5x+6$. Subtract: $(5x+6)-(5x+6)=0$.

$\text{Quotient}=6x+6,\qquad \text{Remainder}=0$

Check: $(2x+1)(6x+6)=12x^2+18x+6\equiv5x^2+4x+6 \pmod 7$.

Digital signature: a mechanism, based on public-key cryptography, by which the sender signs a message with the sender's private key so that anyone can verify with the public key that the message came from the sender (authentication), has not been altered (integrity), and the sender cannot deny it (non-repudiation).

Digital Signature Standard (DSS) is the NIST standard (FIPS 186) that specifies the Digital Signature Algorithm (DSA) and also allows RSA and ECDSA. It uses the hash function SHA and produces only a signature, not encryption.

Approaches of DSS

1. RSA approach: the message is hashed to produce a fixed-length digest. The digest is encrypted with the sender's private key to form the signature, and the signature is sent with the message. The receiver hashes the received message, decrypts the signature with the sender's public key, and compares the two values. If they match the signature is valid.
2. DSA approach: the message is hashed with SHA, and the hash and a random per-message number $k$ are given to the signing function together with the sender's private key and global public parameters $(p,q,g)$. This produces the signature pair $(r,s)$. The verifier uses the sender's public key, the global parameters, the received hash and $(r,s)$ in the verification function to compute $v$, and the signature is valid if $v=r$.

In both approaches the signature is attached to the message; DSA signatures are not used for encryption or key exchange.

Firewall: a network security device or software placed between a trusted internal network and an untrusted network (the Internet) that monitors and filters incoming and outgoing traffic according to security rules. All traffic must pass through it, only authorised traffic is allowed, and the firewall itself must be immune to penetration.

Types of firewall

1. Packet-filtering firewall: works at the network layer; applies rules to each IP packet using source/destination address, port, protocol and interface. Fast and simple, but cannot check application data or track connection state, and is prone to IP spoofing.
2. Stateful inspection firewall: keeps a table of active connections and checks that each packet belongs to a valid, established session in addition to the rules. More secure than simple packet filtering.
3. Application-level gateway (proxy firewall): works at the application layer; the user connects to the proxy, which makes a separate connection to the server after checking the request. It can examine content and authenticate users, but is slower and needs a proxy for each application.
4. Circuit-level gateway: works at the transport layer; sets up two TCP connections (client to gateway, gateway to server) and relays data without inspecting its content. SOCKS is an example.
5. Next-generation / host-based / personal firewalls: combine deep packet inspection, intrusion prevention and application awareness, or protect a single host.

User authentication principles: user authentication is the process of verifying the identity claimed by a user before granting access. It has two steps: identification (presenting an identifier) and verification (providing evidence for the claim). Authentication is based on:

• Something you know: password, PIN, answers to questions.
• Something you have: smart card, token, phone (OTP).
• Something you are: fingerprint, face, iris (static biometrics).
• Something you do: voice, typing pattern, handwriting (dynamic biometrics).

Multi-factor authentication combines two or more of these to increase security.

Role-Based Access Control (RBAC)

Access rights are attached to roles, not directly to users. Users are assigned roles (e.g. teacher, accountant, admin) according to their job function, and a role has a set of permissions. A user gets the permissions of the roles assigned to them. Advantages: easy administration (change a role once), enforcement of least privilege and separation of duties, and easy handling of staff changes. It is less flexible when decisions depend on context.

Attribute-Based Access Control (ABAC)

Access decisions are made by evaluating rules over attributes of the subject (department, clearance, age), the object (type, owner, sensitivity), and the environment (time, location, device). A policy such as "doctors may read patient records only of their own department during duty hours" is evaluated at request time. It is very flexible and fine-grained and scales to many users without defining roles, but policies are more complex to design and evaluating them costs more.

Security audit trail: a chronological record of system activities (logs of events such as logins, file access, privilege changes and failed attempts) that makes it possible to reconstruct and examine the sequence of events and who did what, when and from where. It is the data generated and collected by the auditing function.

Requirements for security auditing

• Event definition: the set of auditable events must be defined (e.g. authentication, access to sensitive data, administrative actions, system start/stop).
• Selective, configurable auditing: the administrator must be able to choose which events are recorded, per user or object, to control volume.
• Complete and accurate content: each record must contain time, user identity, event type, source, object and outcome (success or failure).
• Protection of the trail: the log must be protected from unauthorised reading, modification and deletion, and be available (adequate storage and archiving).
• Reliable time source: synchronised timestamps.
• Audit analysis and reporting: tools to review, search and correlate records and to generate alarms.
• Accountability and privacy: events must be traceable to individuals while respecting legal and privacy limits.
• Minimal performance impact on the audited system.

Block cipher vs stream cipher

Playfair cipher (message TRIBHUVANUNIVERSITY, key BES)

Key square (I and J share a cell):

Digraphs (X added to the odd last letter): TR IB HU VA NU NI VE RS IT YX.

Rules: same row take the letter to the right; same column take the letter below; otherwise take the letter in own row and the column of the other letter.

Encryption of each digraph:

TR→UT, IB→DC, HU→IT, VA→YB, NU→OT, NI→OH, VE→WB, RS→XG, IT→HU, YX→ZY

Ciphertext: UTDCITYBOTOHWBXGHUZY.

Decryption reverses the rules (left, up) to give TRIBHUVANUNIVERSITYX; the final X is a padding letter, so the message is TRIBHUVAN UNIVERSITY.

Vernam cipher (key BES repeated to the length of the message, since the key must be as long as the message)

Using $C_i=(P_i+K_i)\bmod 26$ with A=0:

Key: BESBESBESBESBESBESB

Ciphertext: UVACLMWEFVRAWIJTMLZ. Decryption: $P_i=(C_i-K_i)\bmod 26$ with the same key, which gives back TRIBHUVANUNIVERSITY. (A true one-time pad uses a random key as long as the message; a repeated short key is much weaker.)

Kerberos is a network authentication service that lets a client prove its identity to servers over an insecure network using symmetric-key cryptography and a trusted third party, the Key Distribution Center (KDC), made of an Authentication Server (AS) and a Ticket Granting Server (TGS). Passwords are never sent over the network, and timestamps and tickets prevent replay.

Working (Kerberos v4/v5 dialogue)

1. AS exchange (get a ticket-granting ticket): the client sends its ID and the TGS ID to the AS. The AS replies with a Ticket Granting Ticket $Ticket_{tgs}=E_{K_{tgs}}[K_{c,tgs},ID_c,AD_c,ID_{tgs},TS,Lifetime]$ together with the session key $K_{c,tgs}$, both encrypted with a key derived from the user's password. Only the real user can decrypt it.
2. TGS exchange (get a service ticket): the client sends the TGT, the service ID and an authenticator $E_{K_{c,tgs}}[ID_c,AD_c,TS]$ to the TGS. The TGS verifies them and returns a service ticket $Ticket_v=E_{K_v}[K_{c,v},ID_c,AD_c,ID_v,TS,Lifetime]$ and the session key $K_{c,v}$ encrypted with $K_{c,tgs}$.
3. Client/server exchange: the client sends $Ticket_v$ and an authenticator encrypted with $K_{c,v}$ to the service server. The server decrypts the ticket with its own key $K_v$, checks the authenticator, and (for mutual authentication) replies with $E_{K_{c,v}}[TS+1]$.

After this, the client and server share a session key for secure communication and the user logs in once (single sign-on) for the ticket lifetime.

Trust frameworks

A trust framework is the set of agreed technical standards, policies, legal rules and procedures that allow separate organisations to accept each other's identity and attribute assertions. It involves identity providers who issue and manage identities, relying parties (service providers) who rely on them, and the users. Policies define assurance levels, privacy, audit and liability, while protocols such as SAML, OAuth and OpenID Connect carry the assertions. It makes federated identity and single sign-on across organisations possible, because each party knows how strongly an identity was verified. Kerberos realms with cross-realm trust is an example inside this idea.

IPSec (IP Security) is a set of protocols that provides security at the network (IP) layer, giving confidentiality, integrity, authentication and anti-replay protection for IPv4 and IPv6 packets. It is transparent to applications and the upper layers.

Benefits

• Provides strong security for all traffic crossing the perimeter when implemented in a firewall or router, and need not change the applications.
• Is below the transport layer, so it is transparent to applications and end users; no software changes are needed.
• Can be transparent to end users, so no training or key issuing is needed.
• Can secure individual users working remotely (VPN) and secure routing architecture.
• Allows secure branch-office connectivity over the Internet, and extranet connectivity with partners.
• Is resistant to bypass when deployed at a firewall.

IPSec architecture

The architecture consists of the following parts:

1. Protocols:
   • Authentication Header (AH): gives data integrity, source authentication and anti-replay; no encryption.
   • Encapsulating Security Payload (ESP): gives confidentiality (encryption) and optionally authentication and anti-replay.
   • Internet Key Exchange (IKE): negotiates algorithms and establishes keys automatically.
2. Modes:
   • Transport mode: protects the payload of the IP packet; original IP header is kept. Used host to host.
   • Tunnel mode: the whole original IP packet is protected and put in a new packet with a new IP header. Used between gateways (VPN).
3. Security Association (SA): a one-way logical relationship between sender and receiver that defines the security services. It is identified by the Security Parameter Index (SPI), destination IP address and security protocol identifier. Two SAs are needed for two-way communication.
4. Databases: the Security Policy Database (SPD) decides what to do with traffic (protect, bypass, discard) and the Security Association Database (SAD) holds the parameters of active SAs.
5. Cryptographic algorithms: encryption (3DES, AES), authentication (HMAC-SHA), and key exchange (Diffie-Hellman) used by AH and ESP.
6. Domain of interpretation (DOI) and policy: identifies the formats and parameters shared by the documents.

Security services: processing or communication services that enhance the security of data processing systems and information transfers. They use security mechanisms to counter attacks. X.800 lists authentication, access control, data confidentiality, data integrity and non-repudiation (and availability).

Four fundamental security design principles (from the common list)

1. Least privilege: each user, program or process is given only the minimum rights it needs for its job, and only for as long as needed. This limits the damage from errors or compromise.
2. Fail-safe defaults: access is denied unless explicitly permitted, so a failure or missing rule leaves the system secure rather than open.
3. Economy of mechanism: the design of security mechanisms should be as simple and small as possible, so that they can be fully analysed, tested and verified, with fewer bugs.
4. Complete mediation: every access to every object must be checked each time, with no caching of permissions that could be out of date. (Other principles are open design, separation of privilege, layering, isolation and psychological acceptability.)

Transposition cipher: an encryption method in which the letters of the plaintext are kept the same but their positions are rearranged (permuted) according to a rule or key. It gives diffusion but no substitution, so letter frequencies stay unchanged. Examples: rail fence cipher and columnar transposition.

Decryption of UIESTNVRIY with the rail fence cipher (2 rails)

The ciphertext has 10 letters, so the top rail has 5 and the bottom rail has 5:

• Top rail: U I E S T
• Bottom rail: N V R I Y

Reading in zig-zag order (top, bottom, top, bottom, ...) gives:

U . I . E . S . T .
. N . V . R . I . Y

Plaintext: U N I V E R S I T Y = UNIVERSITY

Euler's totient function: $\phi(n)$ is the number of positive integers less than $n$ that are relatively prime to $n$ (with $\phi(1)=1$). For prime $p$, $\phi(p)=p-1$; for primes $p\ne q$, $\phi(pq)=(p-1)(q-1)$. Example: $\phi(100)=100\cdot\frac12\cdot\frac45=40$.

Multiplicative inverse of 87 in $Z_{100}$

$\gcd(87,100)=1$, so the inverse exists. Euclidean algorithm:

$100=1\cdot87+13$ $87=6\cdot13+9$ $13=1\cdot9+4$ $9=2\cdot4+1$

Back-substitution:

$1=9-2\cdot4=9-2(13-9)=3\cdot9-2\cdot13$ $=3(87-6\cdot13)-2\cdot13=3\cdot87-20\cdot13$ $=3\cdot87-20(100-87)=23\cdot87-20\cdot100$

So $87\cdot23\equiv1\pmod{100}$ and the inverse is 23. Check: $87\times23=2001\equiv1\pmod{100}$.

Abelian group: a set $G$ with a binary operation $\cdot$ that is a group (closure, associativity, identity element, inverse for every element) and is also commutative, i.e. $a\cdot b=b\cdot a$ for all $a,b\in G$. Example: integers under addition.

Miller-Rabin test on $n=561$

Write $n-1=560=2^4\cdot35$, so $s=4$, $d=35$. Choose base $a=2$ and compute $2^{35}\bmod561$ and then repeated squares:

• $2^{35}\equiv263 \pmod{561}$ (not $1$ or $560$)
• $2^{70}\equiv263^2\equiv166$
• $2^{140}\equiv166^2\equiv67$
• $2^{280}\equiv67^2\equiv1$

The sequence is $263,166,67,1$. For a prime we need either $a^d\equiv1$ or one of $a^{2^rd}\equiv-1\equiv560$ for $r=0,1,2,3$. Neither happens (the value 1 appears after 67, which is not $\pm1$, so $67$ is a non-trivial square root of 1).

Hence 2 is a witness that 561 is composite. Indeed $561=3\cdot11\cdot17$; it is a Carmichael number that fools the Fermat test but not Miller-Rabin.

Password aging: a policy that forces users to change their passwords after a set period (e.g. 60 or 90 days). Old passwords expire and cannot be reused (password history), which limits the time an attacker can use a stolen or cracked password.

Biometric authentication process

Biometric authentication verifies identity from physical (fingerprint, face, iris, retina, hand geometry) or behavioural (voice, signature, typing rhythm) characteristics. It has two phases:

1. Enrollment: the user's biometric sample is captured by a sensor, features are extracted by a feature extractor, and the resulting template is stored in a database (linked with a user ID and often a PIN).
2. Verification (or identification):
   • The user presents the biometric sample to the sensor, and (for verification) gives an ID.
   • Features are extracted and converted to a template.
   • The matcher compares the live template with the stored template of that user and produces a similarity score.
   • If the score is above a threshold the user is accepted, otherwise rejected. In identification mode the sample is compared with all templates (1:N).

Accuracy is expressed by the False Accept Rate (FAR) and False Reject Rate (FRR); the threshold is a trade-off between them, and the point where they are equal is the equal error rate.

Malicious software (malware): any program or code intentionally written to harm, disrupt or gain unauthorised access to a computer system, its data or users. Examples are viruses, worms, Trojan horses, ransomware, spyware, logic bombs and backdoors.

Worms vs Trojan horses

Security audit: a systematic evaluation of how well an information system follows a set of security criteria (policy, standards, regulations). It reviews system records and activity, configuration and controls to check that they work and to find violations.

Architecture of security auditing

1. Event discriminator: software in the system that decides which events are security relevant and should be passed on for auditing.
2. Audit recorder: takes the selected events and writes them to the audit trail in a standard format.
3. Audit trail: the protected log of recorded events.
4. Alarm processor: generates alarms or actions when it sees events that are flagged as serious.
5. Audit analyzer: examines the trail (in real time or later) to detect patterns, anomalies or intrusions and can change auditing rules.
6. Audit archiver: stores older trail data in long-term storage.
7. Audit provider and examiner: give authorised administrators or auditors access to the audit data, which they review to prepare security reports.

The audit data flows from the system and applications, through the discriminator and recorder to the trail, and then to the analyzer, alarms and reports. The trail must be protected from alteration and unauthorised reading.

RSA algorithm

Key generation

1. Choose two large primes $p$ and $q$.
2. Compute $n=p\,q$ and $\phi(n)=(p-1)(q-1)$.
3. Choose $e$ with $1<e<\phi(n)$ and $\gcd(e,\phi(n))=1$.
4. Compute $d=e^{-1}\bmod\phi(n)$, i.e. $e\,d\equiv1\pmod{\phi(n)}$.
5. Public key $PU=\{e,n\}$; private key $PR=\{d,n\}$.

Encryption: for plaintext $M<n$, ciphertext $C=M^{e}\bmod n$.

Decryption: $M=C^{d}\bmod n$.

This works because $M^{ed}\equiv M\pmod n$ by Euler's theorem.

Numerical example: $p=5$, $q=19$, $m=4$

$n=5\times19=95,\qquad \phi(n)=4\times18=72$

Choose $e=5$, since $\gcd(5,72)=1$. Then find $d$ with $5d\equiv1\pmod{72}$: $5\times29=145=2\times72+1$, so $d=29$.

• Public key $=\{5,95\}$
• Private key $=\{29,95\}$

Encryption: $C=4^{5}\bmod95=1024\bmod95$. Since $95\times10=950$, $C=1024-950=74$.

Decryption: $M=74^{29}\bmod95$. Using the Chinese remainder theorem: mod 5, $74\equiv4\equiv-1$, so $(-1)^{29}\equiv-1\equiv4$. Mod 19, $74\equiv17\equiv-2$, and $2^{18}\equiv1$, so $(-2)^{29}=-2^{29}\equiv-2^{11}=-2048\equiv-15\equiv4$. Both give 4, so $M\equiv4\pmod{95}$.

Therefore the decrypted message is $M=4$, the original message.

ACL vs ACM

The Access Control Matrix (ACM) is a table with subjects (users, processes) as rows and objects (files, devices) as columns; each cell lists the rights of that subject on that object. An Access Control List (ACL) is the matrix stored by column: each object has a list of the subjects and their rights.

Five services of PGP for email security

1. Authentication (digital signature): the sender hashes the message with SHA, signs the hash with the sender's private key (RSA/DSS), and sends it with the message. The receiver verifies it with the sender's public key.
2. Confidentiality (encryption): the message is encrypted with a one-time symmetric session key (e.g. AES, 3DES, CAST-128). The session key is encrypted with the receiver's public key (RSA) and attached.
3. Compression: the message is compressed with ZIP after signing and before encryption, to save space and to remove redundancy that helps cryptanalysis.
4. E-mail compatibility: the binary output is converted to printable ASCII with radix-64 (Base64) so that it can pass through email systems.
5. Segmentation and reassembly: long messages are split into smaller segments to fit email size limits, and rebuilt at the receiver.

(PGP also provides key management through a key ring and web of trust.)

Security is the state of being protected against danger, loss or unauthorised access. In information security, it means protecting the confidentiality, integrity and availability of information and systems against threats.

Passive attacks try to learn or use information from the system without changing it. They are very difficult to detect because there is no alteration of data, so the emphasis is on prevention (encryption).

1. Release of message contents (eavesdropping): an attacker reads the contents of a transmission such as a phone call, email or file. Example: sniffing unencrypted passwords on a network with a packet analyser.
2. Traffic analysis: even when the contents are encrypted, an attacker watches the pattern, frequency, length and source/destination of messages to guess the nature of the communication. Example: noticing that many messages between a bank and a branch indicate a big transaction.

Confusion makes the relationship between the key and the ciphertext as complex as possible, so that the key cannot be found from the ciphertext; it is achieved by substitution. Diffusion spreads the influence of each plaintext letter over many ciphertext letters, so that statistical patterns of the plaintext are hidden; it is achieved by permutation/transposition. Both were proposed by Shannon and are used in modern block ciphers.

Playfair decryption of CDFNFTDTSBEQ with key FOHSS

Key square (keyword without repeated letters FOHS, then the rest of the alphabet with I/J together):

Digraphs: CD, FN, FT, DT, SB, EQ. Rules for decryption: same row take the letter to the left; same column take the letter above; otherwise swap the columns (rectangle).

• CD: same row, left: C→B, D→C, giving BC
• FN: F(1,1), N(3,5): rectangle gives row1 col5 = A, row3 col1 = I, giving AI
• FT: F(1,1), T(4,4): rectangle gives row1 col4 = S, row4 col1 = P, giving SP
• DT: D(2,3), T(4,4): rectangle gives row2 col4 = E, row4 col3 = R, giving ER
• SB: S(1,4), B(2,1): rectangle gives row1 col1 = F, row2 col4 = E, giving FE
• EQ: E(2,4), Q(4,2): rectangle gives row2 col2 = C, row4 col4 = T, giving CT

Plaintext: BCAISPERFECT, i.e. BCA IS PERFECT.

Group: a set $G$ with a binary operation $\cdot$ such that:

• Closure: $a\cdot b\in G$ for all $a,b\in G$.
• Associativity: $(a\cdot b)\cdot c=a\cdot(b\cdot c)$.
• Identity: there is $e\in G$ with $a\cdot e=e\cdot a=a$.
• Inverse: for every $a$ there is $a^{-1}$ with $a\cdot a^{-1}=a^{-1}\cdot a=e$.

(If the operation is also commutative it is an Abelian group.)

GCD(72345, 43215) by the Euclidean algorithm using $\gcd(a,b)=\gcd(b,a\bmod b)$:

$72345=1\times43215+29130$ $43215=1\times29130+14085$ $29130=2\times14085+960$ $14085=14\times960+645$ $960=1\times645+315$ $645=2\times315+15$ $315=21\times15+0$

The last non-zero remainder is 15, so $\gcd(72345,43215)=\mathbf{15}$.

AES key schedule (key expansion)

AES takes a 128-, 192- or 256-bit cipher key and expands it into a sequence of round keys, one 128-bit round key for the initial AddRoundKey and for each round. For AES-128 there are 10 rounds, so 11 round keys, i.e. 44 words of 32 bits $w[0],\dots,w[43]$.

Process for AES-128

1. The 16-byte key is copied into the first four words $w[0],w[1],w[2],w[3]$.
2. Each next word is computed from the previous word and the word four positions earlier:
   • If $i \bmod 4\ne0$: $w[i]=w[i-4]\oplus w[i-1]$.
   • If $i \bmod 4=0$: $w[i]=w[i-4]\oplus g(w[i-1])$.
3. The function $g$ performs
   • RotWord: a one-byte circular left shift of the word $[b_0,b_1,b_2,b_3]\to[b_1,b_2,b_3,b_0]$;
   • SubWord: each byte is substituted using the S-box;
   • XOR with round constant: the leftmost byte is XORed with $Rcon[i/4]$, where $Rcon[j]=(RC[j],0,0,0)$ and $RC[1]=01,\,RC[j]=2\cdot RC[j-1]$ in $GF(2^8)$: 01, 02, 04, 08, 10, 20, 40, 80, 1B, 36.
4. Words $w[4r..4r+3]$ form the round key for round $r$.

For 192- and 256-bit keys the same idea is used with 6 or 8 initial words; for 256-bit keys an extra SubWord is applied to every fourth word in the middle. The Rcon makes round keys different and the S-box gives non-linearity, so that knowing one round key does not easily give the others.

Token-based authentication: the user proves identity using something they have, a token, instead of (or in addition to) a password. After successful verification, the server issues a token (e.g. a hardware token or smart card, an OTP generator, or a signed web token such as JWT) which the client sends with later requests so that credentials need not be sent again. Tokens are time limited and can be revoked.

Core components of a trust framework

• Identity provider (IdP) / attribute provider: registers users, verifies and manages their identities and issues assertions about them.
• Relying party / service provider: the service that relies on the assertions to decide access.
• Subject (user): the entity whose identity and attributes are asserted.
• Policies and rules: the agreed legal, privacy, audit, liability and assurance-level requirements that all parties follow.
• Technical standards and protocols: e.g. SAML, OAuth, OpenID Connect and PKI, which carry and protect the assertions.
• Trust anchors/certification and audit: certificates and independent assessment that give confidence in the participants.

Digital signature: a value computed from a message with the sender's private key (usually on its hash) that the receiver can verify with the sender's public key. It provides authentication, message integrity and non-repudiation.

Phases of a computer virus

1. Dormant phase: the virus is idle, waiting for an event such as a date, another program or disk capacity. Not all viruses have this phase.
2. Propagation phase: the virus places a copy of itself into other programs or system areas; each infected program then also propagates it.
3. Triggering phase: the virus is activated by some event (date, count of copies, a system event) to perform its function.
4. Execution phase: the payload is carried out, which may be harmless (a message) or damaging (destroying files, stealing data).

Audit trail: a chronological, protected record of security-relevant events in a system (who did what, on which object, when, from where and with what result). Examples are login logs, file access logs and administrative actions.

Importance in security auditing

• Accountability: actions can be traced to individual users, which discourages misuse.
• Detection: it is the raw data used to detect intrusions, policy violations and unusual behaviour.
• Investigation and forensics: it lets investigators reconstruct what happened in an incident and provides evidence.
• Compliance: it demonstrates that controls are working, which laws and standards require.
• Recovery and improvement: it shows how damage occurred, which helps recovery and the improvement of controls.

For this, the audit trail must be complete and accurate and protected against tampering.

Feistel structure for block ciphers

Feistel proposed a general structure for a symmetric block cipher that mixes substitution and permutation to give confusion and diffusion. The plaintext block is divided into two halves, $L_0$ and $R_0$, and processed through $n$ rounds.

For each round $i$ (with subkey $K_i$ derived from the key by a key schedule):

$L_i=R_{i-1},\qquad R_i=L_{i-1}\oplus F(R_{i-1},K_i)$

After the last round the halves are swapped, giving the ciphertext $(R_n,L_n)$.

Block diagram (one round):

      L(i-1)           R(i-1)
        |                |------------+
        |                v            |
        |           [ F , K(i) ]      |
        |                |            |
        +-----> XOR <----+            |
        |                             |
        v                             v
       R(i) = L(i-1) xor F      L(i) = R(i-1)

Decryption uses the same structure with the subkeys in reverse order $K_n,\dots,K_1$. The round function $F$ need not be invertible. Design factors are block size, key size, number of rounds, subkey generation and round function; DES is a Feistel cipher with 16 rounds.

Miller-Rabin primality test

For an odd $n>2$ write $n-1=2^{s}d$ with $d$ odd. Pick a random base $a$ with $1<a<n-1$. $n$ passes (is probably prime) if $a^{d}\equiv1\pmod n$ or $a^{2^{r}d}\equiv-1\pmod n$ for some $0\le r<s$. Otherwise $n$ is definitely composite. Repeating with $k$ bases makes the error probability at most $4^{-k}$.

Example 1: $n=561$. $560=2^4\cdot35$. For $a=2$: $2^{35}\equiv263$, $2^{70}\equiv166$, $2^{140}\equiv67$, $2^{280}\equiv1$. No term is $1$ at the first position or $-1$, so 561 is composite ($561=3\cdot11\cdot17$).

Example 2: $n=29$. $28=2^2\cdot7$. For $a=2$: $2^{7}=128\equiv128-116=12$, then $12^2=144\equiv144-116=28\equiv-1$. This gives $-1$ so 29 passes, and is probably prime (it is prime).

Pretty Good Privacy (PGP) is a widely used program, written by Phil Zimmermann, that provides confidentiality and authentication for email and file storage. It uses well-known algorithms (RSA/DSS, Diffie-Hellman, CAST-128/3DES/AES, SHA) combined in a convenient package, and does not depend on a central authority; keys are trusted through the web of trust.

Five services provided by PGP

1. Authentication (digital signature): the sender creates a hash of the message (SHA-1), encrypts it with the sender's private key (RSA or DSS), and attaches it. The receiver decrypts with the sender's public key and compares it with a hash of the received message, which verifies the sender and the integrity.
2. Confidentiality (encryption): the message is encrypted using a random one-time session key with a symmetric cipher (CAST-128, 3DES, IDEA or AES). The session key is encrypted with the recipient's public key (RSA or ElGamal) and sent with the message. Only the recipient's private key can recover the session key.
3. Compression: the message (and signature) is compressed with ZIP after signing and before encryption. The signature is computed before compression so the uncompressed message can be verified later, and compression before encryption reduces size and removes redundancy that would help cryptanalysis.
4. E-mail compatibility: the encrypted binary data is converted to printable ASCII characters using radix-64 conversion, so it can pass through email systems.
5. Segmentation and reassembly: emails have a maximum length (often 50,000 octets); longer messages are broken into segments, each mailed separately, and reassembled by the receiver after removing headers. Segmentation is done after all other processing.

PGP also provides key management (public and private key rings, key IDs, key signing and trust levels).