UNIT 1:

1. Introduction to computer security

2. Need for security
3. Principles of security
4. Types of attacks
5. Possible types of Attacks
1. INTRODUCTION:
Information Security is an old concept, but a new field of specialization. It involves protecting
information, especially personal or sensitive information, from deliberate or accidental loss or
misuse. The field is increasingly important in the area of business because, as our dependence on
computers to store and transmit information accurately and securely grows, the vulnerabilities in
our systems and our habits become increasingly obvious and open to exploitation.
When we began to use computers for business functions, data management became more
difficult, but still manageable, because most vital functions were still handled on paper. In those
early days of computing, no one thought much about information security because networks
were rarely used and not much understood. Each computer had its own files and no easy way to
communicate with other computers; if you wanted to share information, you had to copy it on to
a disk and then copy the disk on the other computer. The information on any one computer was
relatively safe, as long as the computer’s user took care to set a password on the files and lock
the office door.
Then we began using networks and, although the rules changed fundamentally, human
behavior didn’t. Blocks of computers were yoked together into networks and subnets, sharing
common network space, printers and other services. Still, no one paid much attention to
information security. Most people thought the only way to get a computer virus was from a
floppy disk, and almost everyone believed that their personal information was worthless to
anyone else.
The Internet today is a widespread information infrastructure, but it is inherently an insecure
channel for sending messages. When a message (or packet) is sent from one Website to another,
the data contained in the message are routed through a number of intermediate sites before
reaching its destination. The Internet was designed to accommodate heterogeneous platforms so
that people who are using different computers and operating systems can communicate. The
history of the Internet is complex and involves many aspects – technological, organizational and
community. The Internet concept has been a big step along the path towards electronic
commerce, information acquisition and community operations.
Early ARPANET researchers accomplished the initial demonstrations of packet switching
technology. In the late 1970s, the growth of the Internet was recognized and subsequently a
growth in the size of the interested research community was accompanied by an increased need
for a coordination mechanism. The Defense Advanced Research Projects Agency (DARPA) then
formed an International Cooperation Board (ICB) to coordinate activities with some European
countries centered on packet satellite research,
While the Internet Configuration Control Board (ICCB) assisted DARPA in managing
Internet activity. In 1983, DARPA recognized that the continuing growth of the Internet
Community demanded a restructuring of coordination mechanisms. The ICCB was disbanded
and in its place the Internet Activities Board (IAB) was formed from the chairs of the Task
Forces. The IAB revitalized the Internet Engineering Task Force (IETF) as a member of the
IAB. By 1985, there was a tremendous growth in the more practical Engineering side of the
Internet. This growth resulted in the creation of a substructure to the IETF in the form of
working groups. DARPA was no longer the major player in the funding of the Internet. Since
then, there has been a significant decrease in Internet activity at DARPA. The IAB recognized
the increasing importance of IETF, and restructured to recognize the Internet Engineering
Steering Group (IESG) as the major standards review body. The IAB also restructured to create
the Internet Research Task Force (IRTF) along with the IETF.
1.1.History of Internet Security – Overview:
Since the early 1980s, the Internet has grown beyond its primarily research roots, to include
both a broad user community and increased commercial activity. This growth in the commercial
sector brought increasing concern regarding the standards process. Increased attention was paid
to making progress, eventually leading to the formation of the Internet Society in 1991. In 1992,
the Internet Activities Board was reorganized and renamed the Internet Architecture board (IAB)
operating under the auspices of the Internet Society. The mutually supportive relationship
between the new IAB, IESG and IETF led to them taking more responsibility for the approval of
standards, along with the provision of services and other measures which would facilitate the
work of the IETF.
 1.2.The Age of SecurityOver the last few decades, developers of communications systems
have been faced with a market demanding higher bandwidths, higher reliability, lower
cost, improved interoperability, and easier installation and operation. Users and
organizations have benefited greatly from the introduction of new communication
technologies such as xDSL, WiFi and fiber optics.
As networks incorporate more and more devices and span multiple locations, effectively
removing the network perimeter, they become increasingly vulnerable to security threats. Such
threats include the theft of confidential data, hacks, and malicious code - providing unguarded
entry into corporate networks and IT systems. To provide high-performance security solutions
that protect data, applications and infrastructure, equipment manufacturers are looking to
integrate security functionality deeper than ever - at the chip level.
“Computer crime remains a serious problem and some kinds of attacks can cause ruinous
financial damage. The stakes involved in information systems security have risen. Your
organization is vulnerable to numerous types of attack from many different sources and the
results of an intrusion can be devastating in terms of lost assets and good will.”
It should be clear now that, from a security perspective, the corporate network is no longer a
single entity and that current, popular approaches to protecting network devices have significant
limitations.
A common misperception among network security professionals is that there are three zones
of network trust: an unfrosted external network, a semi-trusted perimeter or DMZ network and a
trusted corporate network. The unfrosted external network typically includes the Internet and any
other networks that corporate IT services cannot directly control.
The perimeter or DMZ zone includes any Internet-facing hosts that accept connections from
users from unfrosted networks, while the corporate internal network was considered a safe and
secure location that was at little risk of compromise from other devices on the internal network.
Worms, viruses, Trojans, spy ware and scum ware have changed the network landscape so
that no network can be considered an implicitly trusted network. There are so many avenues of
attack, so many portals through which these exploits and malicious mobile code can move
between formerly trusted and unfrosted networks, that the concept of trusted network is no
longer valid.
 We should now think of the corporate internal network as consisting of multiple security
zones that include multiple application perimeters, with each perimeter providing special
protection for each application or set of applications contained within the perimeter.
As the scope of the network is increasing after the invention of the Internet and the web
technologies, the area of security is getting more importance. Nowadays the Internet is used in
e-business, resource planning, e-banking and in various service sectors. Because of this
worldwide transactions the network is highly facing the problems with unauthorized access,
intrusion etc.
Normally with the Internet various areas of risks are identified as follows:
(1) Data risk
(2) Physical risk
(3) Network risk
(4) Service risk
(5) Natural risk Etc.
2. Need for Network Security
In the past, hackers were highly skilled programmers who understood the details of computer
communications and how to exploit vulnerabilities. Today almost anyone can become a hacker
by downloading tools from the Internet. These complicated attack tools and generally open
networks have generated an increased need for network security and dynamic security policies.
The easiest way to protect a network from an outside attack is to close it off completely from the
outside world. A closed network provides connectivity only to trusted known parties and sites; a
closed network does not allow a connection to public networks.
Because they have no Internet connectivity, networks designed in this way can be considered
safe from Internet attacks. However, internal threats still exist.There is a estimates that 60 to 80
percent of network misuse comes from inside the enterprise where the misuse has taken place.
With the development of large open networks, security threats have increased significantly in the
past 20 years. Hackers have discovered more network vulnerabilities, and because you can now
download applications that require little or no hacking knowledge to implement, applications
intended for troubleshooting and maintaining and optimizing networks can, in the wrong hands,
be used maliciously and pose severe threats.
2.1.Why require security?
We need security to:
 (a) To protect our data, files and folders
(b) To protect our resources
(c) To protect e-commerce transaction information: user-id, password, pin, etc
(d) To Protect my site from getting blocked by any attack such as DOS
(e) To protect our I/P/ Address:
(f) To protect my e-mails:
(g) To protect Incoming packets so that no virus / worms comes in
(h) To protect outgoing packets so that the secrets does not leak out.

3. Principles of Security:
Generally the security issues can be classified into the following categories.
(1) Confidentiality
(2) Authenticity
(3) Availability
(4) Auditability
(5) Access Control
(6) Integrity
(7) Non-repudiability

Security

Confidentiality Authenticity Integrity

Fig. 1.1
These three are the basic levels of issues, which will lead to the further loopholes.
3.1.Confidentiality:
Basically the threats can be in the area of network or in the area of application. Mainly the
insiders who are having full access with the computer system create the application levels of
threats. This can be easily detected can be avoided by using suitable mechanisms. Even though
the application level threats are easy to detect, this is also creating high level of problems to the
system.
The network levels of attacks are dangerous because of the major business transactions that
are happening through the Internet. This is maintaining the actual secrecy of the message. The
message that is traveling through the network should not be opened by any of the third parties
who are not related with the transaction.
Nowadays majority of the bank transactions are happening through the network. So that
confidentiality issue is creating lot of problems related with network, software and data.
The confidentiality related issues could be belonging to any one of the following categories:
(1) IP Spoofing
(2) Packet sniffing
(3) Alteration of message
(4) Modification of message
(5) Man-in-middle
(6) Brute force attack
(7) Password cracking
By using any of the above-mentioned methods an user can enter into others message and can
create problem related to the secrecy of the message. The intension of the user may be viewing
the message without making many changes to the hacked message.
Normally in banking system the people used to receive their bank balance-using network. In
this kind of situation any hacker who knows the IP address can get these information about
others account balance.
In some situation people may hack the message and forward it to some unknown person,
which will create confusion between the original sender and the receiver. This will also lead to
the problem related with integrity.

A Secret B

C
Fig. 1.2 Loss of Confidentiality
3.2.Authenticity:
This can be defined as an identity for a user to assure that the message is coming from the
right person. This is also an another important issue along with confidentiality which may lead to
the further security threats. This can be assured by any of the following factors:
(1) Something you have (like tokens, credit card, passport etc).
(2) Something you know (like PIN numbers, account number etc).
(3) Something you are (like fingerprints, signatures etc).
Generally with the computer system passwords are the very simple authentication
mechanism, which help the system to authenticate a particular person. The people can use one-
time passwords and key technology to assure authenticity during message transaction.
Various issues related to authenticity includes.
(1) Stealing password
(2) Fake login screen
(3) Information leakage Etc.

A I am User A B

Fig. 1.3 Absence of Authenticity

Fabrication is possible in the absence of proper authentication mechanisms.
3.3.Availability:
This can be defined as keeping the right information or resources available to the right person
at the right time. This can happen either with the data or with the hardware resources. This will
stop the person from accessing various resources by flooding the network.
There is a complexity with the availability of the resources and data. Because it can be
identified as a issue only when the following conditions are existing in the system.
(1) The resources are completely available up to the users expectation.
(2) The content is present in a usable format.
(3) The access rights are used in a proper way.
The actual problem related with availability can be identified only when the above-
mentioned things are assured before the problem identification. This is a very serious issue,
which will totally stop the process and may lead the user to an idle condition without allowing
him to proceed with the further process.
The main problem related with the availability is DOS attack and DDOS attacks. Flooding
the network path by sending continuous packets, which will create a heavy traffic in the network,
does this. This stops the right people accessing right information at the right time.

A B

Fig. 1.4 Attack on Availability

3.4.Access Control:
This also an issue, which is dealing with the hardware resources, software and data. This is
helping the operating system to allow access to a particular resource or data only to an
authorized person. In this way it is interrelated with the authenticity and availability.
Because the authenticated users will be allotted with certain kinds of rights like Read, Write,
Read/Write, Owner etc. These rights will be maintained by the operating system in a tabular
format or in a linked list format. First the users authenticity has to be verified and then the
authentic users rights will be verified against the table.

USERS/FILES FILE1 FILE2 FILE3

USER1 RW - W

USER2 O RW W

USER3 - OR OW

The attacks related to authenticity and availability can also create the problem related with
access control.
Attacks related to access control are as follows:
(1) Intrusion
 (2) DDOS
(3) Interference
(4) Inference Etc.
The issues related with authenticity can be resolved by using hash algorithms.
3.5.Non-repudiability:
This is another issue, which is related with authenticity and integrity. Repudiability means
refusing. This is an issue, which is actually created by the sender who is participating in the
transaction. After sending a message a sender can refuse that he was not sending that message.
This is done intentionally to create problems at the receiver’s side, which creates confusion to
the receiver.
This can be done from either side. It may also be from the receiver side. The receiver can
deny after receiving the message that he doesn’t receive any message. Non-repudiation does not
allow the sender of the message to refute the claim of not sending that message.
The non-repudiability related issues can happen in any of the following three ways.
(1) Proof of origin
(2) Proof of receipt
(3) Proof of content
This can be assured by using digital signatures along with the hash algorithms. If the proper
authenticity and integrity is achieved then the problems related with non-repudiability can be
minimized. All above-mentioned issues are the basic issues of network security. Apart from
these various other threats like natural disasters, attacks, software modifications are also creating
problems with networks. But majority of the attacks are coming under the basic issues of the
network.
Ideal Route of the Message

A B

Transfer $ Actual Route Transfer $

100 to D of the message 1000 to C

Fig. 1.5 Loss of Integrity

 Wherever the problems are available accordingly solutions are also present. It is the
responsibility of the user to categorize the problem and identify the suitable solution.
Generally the solutions can be categorized as follows.
(a) Security Issues
(b) Security Objectives
(c) Security Techniques

Security Issue Security Objective Security Technique

Confidentiality Privacy of message Encryption

Authentication Origin Verification Digital Signatures

Challenge-response
Passwords
Biometric devices

Non-repudiation Proof of origin, Bi-directional

receipt and contents hashing
Digital signatures
Transaction
Certificates
Time stamps
Confirmation
services

Access controls Limiting entry to Firewalls

authorized users Passwords
Biometric devices

Types of Threats to the following data:

(1) Hardware
(2) Software
(3) Data
Hardware: Various computer components.
Software: Various applications involved.
Data: Various information stored in the system.
 The issues are related to any of these following categories.
(a) Interception
(b) Fabrication
(c) Modification
While selecting a solution, the area of the threat has to be identified and accordingly the
solution has to be finalized.
Hardware:
Modification

Interception
Dos Hardware (Theft)

Fabrication
(Substitution)

Fig. 1.6
Software:
Interruption
(Deletion)

Modification Software Interception

Fabrication

Fig. 1.7
Data:
Interruption (Loss) Interception

Data Fabrication

Modification

Fig. 1.8
Generally the security issues can be classified into the following categories.
(1) Confidentiality
(2) Authenticity
 (3) Availability
(4) Auditability
(5) Access Control
(6) Integrity
(7) Non-repudiability

Security

Confidentiality Authenticity Integrity

Fig. 1.9
These three are the basic levels of issues, which will lead to the further loopholes.

4. ATTACKS:
In the cryptographic literature, there are two types of attacker Passive and Active.
The first is a passive adversary, who can eavesdrop on all network communication, with the
goal learning as much confidential information as possible.
The other is an active intruder, who can
 Modify messages at will,
 Introduce packets into the message stream, or
 Delete messages.

Attacks

Passive Attacks Active Attacks

Interception

Reading the
Traffic Analysis
message content

Masquerade Message Message Denial of service

/ fabrication replay Modification / Interruption of
availability
 Fig. 2.10 Types of Attacks
4.1.Active Attacks:
 This type of attack requires the attacker to be able to transmit data to one or both of the
parties, or block the data stream in one or both directions. It is also possible that the attacker
is located between the communicating parties as shown in the figure below.
 In this case the attacker can stop all or parts of the data sent by the communicating parties.
This attacker can e.g. try to take the place of the client (or server) when the authentication
procedure has been performed.
 Without integrity checks of the received data, the server will not detect that the origin of the
data is not the authenticated person. A clever programmer can, with not to much effort,
implement a system like this on a computer acting as a gateway (bridge) between two
subnets. (On the Internet there are thousands of these computers.)

Alice Bob
(telnet client) (telnet server)

Mallet
(Active inbuder) Fig. 2.7 Active attack
The following are examples of different attacks this person could impose.
 Inserting his own data into the data stream.
 Playback of data from another connection.
 Playback of data that had previously been sent in the same and opposite direction on
the same connection.
 Deletion of data.
 Man-in-the-middle attack: In this attack, the intruder sits in the middle of the
communication link, intercepting messages and substituting them with his own messages. In
this way, he tries to fool the parties to believe they are talking to each other directly, while
they really are talking to the attacker him-selves.
 4.2.Passive Attacks:
A passive attack on a cryptosystem is one in which the cryptanalyst cannot interact with any
of the parties involved, attempting to break the system solely based upon observed data (i.e. the
cipher text). This can also include known plaintext attacks where both the plaintext and its
corresponding cipher text are known.
The passive attacks can take place in the following ways:
(1) Eavesdropping: the unauthorized capture of transmitted data either by some form of line
tapping or from the compromising emanations broadcast by the electrical signals in the line.
Radio, optical and microwave signals can be similarly intercepted covertly.

Alice Bob
(telnet client) (telnet server)

Eve
(passive cavesdropper)

Fig. 2.8 Passive attack

(2) Traffic Analysis: Even if enciphering has protected the message, an analysis of the traffic
down the line can, in many circumstances, reveal much to an outsider. The number, size,
frequency and times of messages sent, their sources and their destination can indicate, for
example an impending take – over bid, or the launch of a new product.
A passive attack is an attack where an unauthorized attacker monitors or listens in on the
communication between two parties. The figure below illustrates a passive attack where Eve
monitors the communication between Alice and Bob.
4.3.Practical side of attacks:
4.3.1. Application Level Attacks:
These attacks happen at an application level in the sends that the attacker attempts to access,
modify or prevent access to information of a particular application, or the application itself.
Example of this are trying to obtain someone's credit card information on the Internet, or'
changing the contents of a message to change the amount in a transaction, etc.
 4.3.2. Network level attacks:
These attacks generally aim at reducing the capabilities of a network by a number of possible
means, These attacks generally make an attempt to either slow down, or completely bring to halt,
a computer network. Note that this automatically can lead to application level attacks, because
once someone is able to gain access to a network, usually she is able to access/modify at least
some sensitive information, causing havoc.
4.3.3. Cookies:
Cookies are born as a result of specific characteristics of the Internet. The Internet uses HTIP
protocol, which is stateless.
Suppose that the client sends an HTIP request for a Web page to the server. The web server
locates that page on its disk, sends it back to the client, and completely forgets about this
interaction.
If the client wants to continue this interaction, it must identify itself to the server in the next
HTIP request. Otherwise, the server would not know that this same client and sent an HTIP
request earlier.
Since a typical application is likely to involve a number of interactions between the client and
the server, there must be some mechanism for the client to identify itself to the server each time
it sends a HTIP request to the server.
For this, cookies are used. They are a popular mechanism of maintaining the state information
i.e. identifying a client to a server.
A cookie is just one or more pieces of information stored as text strings in a text file on the
disk of the client computer i.e. Web browser.
4.3.4. These attacks take two main forms:
(a) Packet Sniffing (also called as snooping)
(b) Packet Spoofing.
Since the protocol used in this communication is called as Internet Protocol (IP), other names
for these two attacks are: (a) IP sniffing and (b) IP spoofing. The meaning remains the same.
(a) Packet Sniffing: Packet sniffing is a passive attack on an ongoing conversation. An attacker
need not hijack a conversation, but instead, can simply observe i.e. sniff packets as they pass
by. Clearly, to prevent an attacker from sniffing packets, the information that is passing
needs to be protected in some ways.
This can be done at two levels:
 (i) The data that is traveling can be encoded in some ways.
(ii) The transmission link itself can be encoded.
(b) Packet Spoofing: In this technique, an attacker sends packets with an incorrect source
address. When this happens, the receiver i.e. the party who receives the packets containing a
false source address would inadvertently send replies back to the forged address (called as
spoofed address) and not to the attacker.
This can lead to three possible cases:
(i) The attacker can intercept the reply- If the attacker is between the destination and the
forged source, the attacker can see the reply and use that information for hijacking
attacks.
(ii) The attacker need not see the reply-If the attacker's intention was a Denial of Service
(DOS) attack, the attacker need not bother about the reply.
(iii) The attacker does not want the reply- The attacker could simply be angry with the host.
So it may put that host's address as the forged source address and send the packet to the
destination. The attacker does not want a reply from the destination, as it wants the host
with the forged address to receive it and get confused.

5. Possible Types of attacks:

5.1. Distributed Attack
A distributed attack requires that the adversary introduce code, such as a Trojan horse or back-
door program, to a “trusted” component or software that will later be distributed to many other
companies and users Distribution attacks focus on the malicious modification of hardware or
software at the factory or during distribution. These attacks introduce malicious code such as a
back door to a product to gain unauthorized access to information or to a system function at a
later date.
5.2.Insider Attack
An insider attack involves someone from the inside, such as a disgruntled employee, attacking
the network Insider attacks can be malicious or no malicious. Malicious insiders intentionally
eavesdrop, steal, or damage information; use information in a fraudulent manner; or deny access
to other authorized users. No malicious attacks typically result from carelessness, lack of
knowledge, or intentional circumvention of security for such reasons as performing a task

5.3.Close-in Attack
A close-in attack involves someone attempting to get physically close to network components,
data, and systems in order to learn more about a network Close-in attacks consist of regular
individuals attaining close physical proximity to networks, systems, or facilities for the purpose
of modifying, gathering, or denying access to information. Close physical proximity is achieved
through surreptitious entry into the network, open access, or both.
5.4.Social Engineering:
One popular form of close in attack is social engineering in a social engineering attack, the
attacker compromises the network or system through social interaction with a person, through an
e-mail message or phone. Various tricks can be used by the individual to revealing information
about the security of company. The information that the victim reveals to the hacker would most
likely be used in a subsequent attack to gain unauthorized access to a system or network.
5.5.Phishing Attack
In phishing attack the hacker creates a fake web site that looks exactly like a popular site such as
the SBI bank or PayPal. The phishing part of the attack is that the hacker then sends an e-mail
message trying to trick the user into clicking a link that leads to the fake site. When the user
attempts to log on with their account information, the hacker records the username and password
and then tries that information on the real site.
5.6.Hijack attack
Hijack attack In a hijack attack, a hacker takes over a session between you and another
individual and disconnects the other individual from the communication. You still believe that
you are talking to the original party and may send private information to the hacker by accident.
5.7.Spoof attack
Spoof attack In a spoof attack, the hacker modifies the source address of the packets he or she is
sending so that they appear to be coming from someone else. This may be an attempt to bypass
your firewall rules.
5.8.Buffer overflow
Buffer overflow A buffer overflow attack is when the attacker sends more data to an application
than is expected. A buffer overflow attack usually results in the attacker gaining administrative
access to the system in commend prompt or shell.
5.9.Exploit attack
Exploit attack In this type of attack, the attacker knows of a security problem within an operating
system or a piece of software and leverages that knowledge by exploiting the vulnerability.

5.10. Password attack

Password attack An attacker tries to crack the passwords stored in a network account database or
a password-protected file. There are three major types of password attacks: a dictionary attack, a
brute-force attack, and a hybrid attack. A dictionary attack uses a word list file, which is a list of
potential passwords. A brute-force attack is when the attacker tries every possible combination
of characters
 Chapter 2

1. Plain Text and Cipher Text

2. Substitution & Transposition techniques

3. Playfair

4. Hill cipher

5. Encryption and Decryption

6. Symmetric and Asymmetric Key Cryptography

7. Steganography

1.Plain Text and Cipher Text:

1.1. Cryptography:

1.1.1. History of Cryptography:

 Existed long before the ubiquity of computers.

 Julius Caesar (100-44 BC) used a simple substitution with the normal alphabet (just shifting
the letters a fixed amount) in government communications”.
 Cryptography, the science of encrypting and decrypting information, dates as far back as
1900 BC.
 Thomas Jefferson, invented a wheel cipher in the 1790's,
 Used extensively during both the world wars; Cipher machines were created to encrypt
messages by the Nazis called by the allies as Enigma.
 Were used by bootleggers in the 1930s for liquor smuggling.
 In the 1970s, Dr. Horst Feistel established the precursor to today’s Data Encryption Standard
(DES) with his ‘family’ of ciphers, while working at IBM’s Watson Research Laboratory.
 Also in 1976, two contemporaries of Feistel, Whitfield Diffie and Martin Hellman first
introduced the idea of public key cryptography.
 1977, Rivest, Shamir and Adleman introduced to the world their RSA cipher, applicable to
public key cryptography and digital signatures.
 Zimmerman released his first version of Pretty Good Privacy (PGP) in 1991 as a freeware
product, which uses the IDEA algorithm.
1.1.2. Reason for its existence:

(1) Secrecy: Only intended receiver understands the message.

(2) Authentication: sender and receiver need to confirm each others identity.
(3) Message Integrity: Ensure that their communication has not been altered, either maliciously
or by accident during transmission.
1.1.3. Terms frequently used in Cryptography:

Cryptology: Originated for the Greek kryptóslógos, meaning ``hidden word''.

Plaintext: The message to be encrypted.
Key: It is the object used to encrypt the plaintext.
Cyphertext: It is the encrypted text.
Encryption: The process of converting plaintext into cyphertext using an appropriate key.
Decryption: The process of converting cyphertext into plaintext using a appropriate key.
Cryptography: IT is the art or science of keeping communication classified.
Cryptographers: People who indulge in cryptography are known as cryptograhers.
Cryptanalysis: The art or science of decrypting a cyphertext without knowing the authorized
key is known as cryptanalysis.
Cryptanalysts: People who indulge in cryptanalysis. Could be ethical or fraudsters.
Cipher: The method of decryption and encryption is generally known as cipher.

2. SUBSTITUTION TECHNIQUE AND TRANSPOSITION TECHNIQUE:

2.1. Substitution Technique:
It is the very basic technique, which makes use of simple letter substitution to generate cipher
text.
Specific methods used in this type include:
(1) Caesar cipher (used by Julius Caesar),
(2) Modified Caesar Cipher,
(3) Mono-alphabetic cipher,
(4) Homophonic substitution cipher,
(5) Polygram substitution cipher
(6) Polyalphabetic cipher etc.
Now let us study them (Substitution Technique) one by one:
(1) Caesar Cipher:
A cryptographic scheme proposed by Julius Caesar is one special case of substitutional cipher
where each alphabet is the message is replaced by an alphabet, three places down the line, in the
alphabetical order.
Thus “A” becomes “D” and “B” becomes “E”

Plain text A B C D E F G H I J K L M N

Cipher D E F G H I J K L M N O P Q
Text

Plain text O P Q R S T U V W X Y Z

Cipher Text R S T U V W X Y Z A B C

Caesar Cipher is very simple. But this simplicity comes with a cost. Obviously it is a very
weak scheme.
Algorithm to break Caesar Cipher:
(1) Read each alphabet in the cipher text message, and search for it in the second row of the
figure above
(2) When a match is found, replace that alphabet in the cipher text message with the
corresponding alphabet in the same column but the first row of the table (e.g. if the alphabet
in cipher text is J, replace it with G).
(3) Repeat the process for all alphabets in the cipher text message.
The process shown above will reveal the original plain text. Thus, given a cipher text message
L ORYH BRX, it is easy to work backwards and obtain the plain text I LOVE YOU as shown
below.

Cipher text L O R Y H B R X

Plain text I L O V E Y O U
 Caesar Cipher is good in theory, but not so good in practice.
Let Ke be the encryption key and Kd be the decryption key. Here we have assumed that the
value of Ke = 3 and thus Kd would also be 3,
Let us now try and complicate the Caesar Cipher to make an attacker's life difficult.
(2) Modified Version of Caesar Cipher:
How can we generalize Caesar Cipher a bit more? Let us assume that the cipher text alphabets
corresponding to the original plain text alphabets may not necessarily be three places down the
order, but instead, can be any places down the order. This can complicate matters a bit.
Thus, we are now saying that D would not necessarily replace an alphabet A in plain text. It
can be replaced by any valid alphabet, i.e. by E or by F or by G, and so on. Once the replacement
scheme is decided, it would be constant and will be used for all other alphabets in that message.
As we know, the English language contains 26 alphabets. Thus, an alphabet A can be replaced
by any other alphabet in the English alphabet set, (i.e. B through Z). Of course, it does not make
sense to replace an alphabet by itself (i.e. replacing A with A). Thus, for each alphabet, we have
25 possibilities of replacement. Hence, to break a message in the modified version of Caesar
Cipher, our earlier algorithm would not work.
Let us write a new algorithm to break this version of Caesar Cipher, as shown:
(1) Let k be a number equal to 1.
(2) Read the complete cipher text message.
(3) Replace each alphabet in the cipher text message with an alphabet that is k positions down
the order.
(4) Increment k by 1.
(5) If k is less than 26, then go to step 2. Otherwise, stop the process. 6. The original text
message corresponding to the cipher text message is one of the 25 possibilities produced by
the above steps.
We write down all the 25 possibilities and try to make sense. Whichever makes some sense
we keep and the other 24 are rejected. Trying out all possibilities is called Brute-Force Attack.
(3) Mono-alphabetic Cipher:
The major weakness of the Caesar Cipher is its predictability. Once we decide to replace an
alphabet in a plain text message with an alphabet that is k positions up or down the order, we
replace all other alphabets in the plain text message with the same technique. Thus, the
cryptanalyst has to tryout a maximum of 25 possible attacks, and she is assured of a success.
 Now imagine that rather than using a uniform scheme for all the alphabets in a given plain
text message, we decide to use random substitution. This means that in a given plain text
message, each A can be replaced by any other alphabet (B through Z), each B can also be
replaced by any other random alphabet (A or C through Z), and so on. The crucial difference
being, there is no relation between the replacement of B and replacement of A. That is, if we
have decided to replace each A with D, we need not necessarily replace each B with E-we can
replace each B with any other character I
To put it mathematically, we can now have any permutation or combination of the 26
alphabets, which means (26 x 25 x 24 x 23 x ... 2) or 4 x 1026 possibilities I This is extremely
hard to crack. It might actually take years to tryout these many combinations even with the most
modern computers.
(4) Homophonic Substitution Cipher:
The Homophonic Substitution Cipher is very similar to Mono Alphabetic Cipher. In a plain
substitution cipher technique, we replace one alphabet with another, but in this scheme, the
difference is that instead of having a fixed substitution, we can, choose the alphabet from a set.
So in this technique, A can be replaced by D, H, P, R; B can be replaced by E, I, Q, S etc.
Homophonic Substitution Cipher also involved substitution of one plain text character with a
Cipher Text character at a time. However the cipher text character can be any one of the chosen
sets.
(5) Polygram Substitution Cipher:
In Polygram Substitution Cipher technique, rather than replacing one plain text alphabet with
one cipher text alphabet at a time, a block of alphabets is replaced with another block. For
instance, HELLO could be replaced with YUQQW, but a totally different cipher text block
TEUL could replace HELL
(6) Poly-alphabetic Substitution Cipher:
This cipher uses multiple one-character keys. Each of the keys encrypts one plain text
character. The first key encrypts the first plain text character; the second key encrypts the second
plain text character, and so on. After al the keys are used, they are recycled. Thus if we have 30
one letter keys, every 30th character in the plain text would be replaced with the same key. This
number is called as the period of the cipher.
In some cases, the mono alphabetic cipher technique is used round after round over already
converted plain text and its cipher text. The more number of rounds, the more complex the
cipher becomes.
2.2. Transposition technique:
It is the modified version of substitution technique because this not only substitutes letters
but also makes some sort of permutation over the plain text in order to generate cipher text.
Specific examples include
(a) Rail fence technique.
(b) Simple columnar transposition.
(c) Simple columnar transposition with multiple rounds.
(d) Vernam cipher,
(e) Book cipher etc.
Now let us study them (Transposition Technique) one by one:
(1) Rail Fence Technique:
It uses a simple algorithm as:
(a) Write down the plain text message as a sequence of diagonals.
(b) Read the plain text written in step 1 as a sequence of rows.
Example: Original Plain text message: “Come home tomorrow”.
(1) After we arrange the plain text diagonally, it would like as follows:

C M H M T M R O

O E O E O O R W

(2) Now read the text row by row, write it sequentially. Thus we have:
C-M-H-M-T-M-R-O-O-E-O-E-O-O-R-W
(2) Simple Columnar Transposition Technique:
Basic Technique:
The idea is to:
(a) Write the plain text message row by row in a rectangle of a pre-defined size.
(b) Read the message column-by column, however, it need not be in the order of columns 1, 2,
3 etc. It can be any random order such as 2, 1, 3 etc.
(c) The message thus obtained is the cipher text message.
Original Plain Text Message:
Secrets have to be kept:
 (1) Let us consider a rectangle with S columns. Therefore, when we write the message into
the rectangle row by row it would look as follows:

Column Column Column Column Column Column

1 2 3 4 5 6

C O M E H O

M E T O M O

R R O W

(2) Now read the text in the order of the columns. 4, 6, 1, 2, 5, 3

(3) The cipher text thus obtained is:
E-O-W-O-O-C-M-R-O-E-R-H-M-M-T-O
(3) Simple Columnar Transposition Technique with Multiple Rounds: Here, the basic
Simple columnar technique is repeated for multiple rounds. The more number of rounds, the
more complex the cipher becomes. Hence, it is more difficult to crack.
The Basic Algorithm:
(1) Write the plain text message row-by-row in a rectangle of a pre-determined size
(2) Read the message column by column in a random sequence
(3) The message thus obtained as the cipher text message of round 1
(4) Use this output as a plain text for the next step
(4) Vernam Cipher (One-Time Pad): The Vernam Cipher, also called as One-Time Pad, is
implemented using a random set of non-repeating characters as the input cipher text. The
most significant point her is that once an input cipher text for transposition is used; it is
never used again for any other message (hence the name one-time). The length of the cipher
text is equal to the length of the original plain text.
Since, it is used as one-time pad and is discarded after a single use, this technique is
highly secure and suitable for small plain text message, but is impractical for large
messages.
(5) Book Cipher / Running Block Key Cipher: The idea used is quite simple and similar in
principle to Vernam Cipher. For producing cipher text, some portion of text from a book is
used, which serves the purpose of a one-time pad. This, the characters from a book are used
as one time pad, and they are added to the input plain text messages.

3. PLAYFAIR CIPHER:
The Playfair algorithm is based on the use of a 5 x 5 matrix of letters constructed using a
keyword..

1. Repeating plaintext letters that are in the same pair are separated with a filler letter,
such as x, so that balloon would be treated as ba lx lo on.
2. Two plaintext letters that fall in the same row of the matrix are each replaced by the
letter to the right, with the first element of the row circularly following the last. For
example, ar is encrypted as RM.
3. Two plaintext letters that fall in the same column are each replaced by the letter
beneath, with the top element of the column circularly following the last. For example,
mu is encrypted as CM.
4. Otherwise, each plaintext letter in a pair is replaced by the letter that lies in its own
row and the column occupied by the other plaintext letter. Thus, hsbecomes BP and ea
becomes IM (or JM, as the encipherer wishes)

Polyalphabetic cipher:

To encrypt a message, a key is needed that is as long as the message.

Usually, the key is a repeating keyword. For example, if the keyword is deceptive, the
message "we are discovered save yourself" is encrypted as follows:
key: deceptivedeceptivedeceptive
plaintext: wearediscoveredsaveyourself
ciphertext: ZICVTWQNGRZGVTWAVZHCQYGLMGJ

4. The Hill Cipher

As we pointed out above the Hill Cipher is a block cipher. Here is how it works in general. After
we discuss the general process we will look at an example.

4.1.Encryption with the Hill Cipher

The Hill Cipher Encryption Algorithm

1. Find an n n matrix E that is invertible modulo 26. This is actually the encryption
key.
2. Take the message that is to be sent (the plaintext), remove all of the spaces and
punctuation symbols, and convert the letters into all uppercase.

3. Convert each character to a number between 0 and 25. The usual way to do this is
A = 0, B = 1, C = 2, . . . , Z = 25.

A B C D E F G H I J K L M

0 1 2 3 4 5 6 7 8 9 10 11 12

N O P Q R S T U V W X Y Z

13 14 15 16 17 18 19 20 21 22 23 24 25

As a historical note, Lester Hill did not use this coding of letters to numbers, he simply
mixed up the order. Mixing up the order does not make the method more secure, it
simply combines the Hill cipher with a simple substitution cipher, which are easy to
break.

4. Divide this string of numbers up into blocks of size n. Note that if E is an n n

matrix then the block size is n. Another note, if the message does not break evenly
into blocks of size n we pad the ending of the message with characters, this can be
done at random.

5. Write each block as a column vector of size n. At this point the message is a sequence
of n-dimensional vectors, v1; v2; : : : ; vt.
6. Take each of the vectors and multiply them by the encryption matrix E, so

Ev1= w1
Ev2= w2
Ev3= w3
.
..
Evt =wt
 7. Take the vectors w1; w2; : : : ; wt, write the entries of the vectors in order, convert the
numbers back to characters and you have your cipher text.

One note about this algorithm is that we can do step 6 with a single matrix multiplication. If
we let the message matrix M be the matrix produced by having the vectors v1; v2; : : : ; vt as
columns, that is, M = [v1 v2 : : : vt] then EM = [w1 w2 : : : wt] = C would be our cipher text
matrix.

Example 7: Say Alice wants to send Bob the message \Cryptography is cool!"

1. Alice chooses the block size n = 3 and chooses the encryption matrix E to be,
2 3
2 3 15
5 8 12

E = 4 1 13 4 5
Since det (E) (mod 26) = 11, and 11 is invertible modulo 26, the matrix E is also invertible
modulo 26.

2. The message that is to be sent is \Cryptography is cool!", removing the spaces and
punctuation symbols, and convert the letters into all uppercase gives

CRYPTOGRAPHYISCOOL

3. Conversion to numbers using A = 0, B = 1, C = 2, . . . , Z = 25, gives

2 17 24 15 19 14 6 17 0 15 7 24 8 18 2 14 14 11

4. Dividing this string of numbers up into blocks of size 3.

2 17 24 15 19 14 6 17 0 15 7 24 8 18 2 14 14 11

so no padding is needed here.

5. Converting these blocks into a message matrix M gives,

M=2 2 15 6 15 8 14 3
 17 19 17 7 18 14

4 24 14 0 24 2 11 5
6. Multiply by the encryption matrix E,
2 3 15 2 15 6 15 8 14 25 11 11 21 22 1
EM = 2 5 8 12 3 2 17 19 17 7 18 14 3 = 2 18 5 10 3 0 2 3 =C

4 1 13 4 5 4 24 14 0 24 2 11 5 4 7 6 19 20 16 6 5

7. Convert C into the cipher text.

25 18 7 11 5 6 11 10 19 21 3 20 22 0 16 1 2 6

ZSHLFGLKTVDUWAQBCG

So Alice will send \ZSHLFGLKTVDUWAQBCG" to Bob.

Since this is a symmetric cipher, Alice and Bob would have to share this key with each other.
They obviously could not simply call or text each other with this information since Eve could
easily intercept that call or text and would know the key. So either Alice or Bob would have to
meet in person, in a secure location, and exchange the key or they would need some other trusted
person to deliver the key from Alice to Bob. This diffculty in exchanging the key securely gave
rise to the creation of public-key systems which are commonly used today, for more information
on public-key systems please see the references [5] and [7].

4.2. Decryption with the Hill Cipher

Now that Bob has the encrypted message and the encryption key he can decrypt the message that
Alice had sent to him. The decryption algorithm is essentially the same as the encryption
1
algorithm, except that we use E in place of E. Since EM = C, and E is invertible we can
calculate M = E 1C. We will call D = E 1 the decryption matrix, so DC = M. Remember that this
inverse is the inverse modulo 26.
The Hill Cipher Decryption Algorithm

1. Find D = E 1 (mod 26). This is the decryption key.

2. Take the ciphertext and convert it to the matrix C.

3. Calculate DC = M.

4. Convert the matrix M to the plaintext message. You may need to insert the appropriate
spaces and punctuation symbols since these were removed.

Example 8: Bob has the encrypted message ZSHLFGLKTVDUWAQBCG.

1. He calculates
2 3 15 1 10 19 16
2 5 8 12 3 (mod 26) = 2 4 23 7 3

4 1 13 4 5 4 17 5 19 5
2. He also converts the ciphertext to the matrix C.

ZSHLFGLKTVDUWAQBCG

25 18 7 11 5 6 11 10 19 21 3 20 22 0 16 1 2 6

and since he knows that the block size is 3 he constructs C as

25 11 11 21 22 1
C = 2 18 5 10 3 0 23

47 6 19 20 16 6 5
3. Calculate DC = M.
10 19 16 25 11 11 21 22 1 2 15 6 15 8 14
DC = 2 4 23 7 3 2 18 5 10 3 0 2 3 = 2 17 19 17 7 18 14 3 = M
 4 17 5 19 5 4 7 6 19 20 16 6 5 4 24 14 0 24 2 11 5
4. Convert the matrix M to the plaintext message.

2 17 24 15 19 14 6 17 0 15 7 24 8 18 2 14 14 11

CRYPTOGRAPHYISCOOL

So Bob adds in a couple spaces to get CRYPTOGRAPHY IS COOL!

5. INTRODUCTION TO BASIC ENCRYPTION AND DECRYPTION:

The term 'Cryptography' means the concept of encryption and decryption together.
Cryptography is the technique in which the original 'plain text' message is 'encrypted' i.e.
converted into a coded form called 'cipher text' at the sender's end, which is then transmitted to
the receiver. The receiver then 'decrypts' i.e. converts the 'cipher text' back into the 'plain text' to
get the original message back.

Fig.5.11
Cryptography is also called as an art or technique to achieve secure communication between
the communicating parties by encoding the messages between them such that no third party can
gain anything useful out of interception.
Various techniques are utilized for this purpose of cryptography. Broadly these techniques
fall into two categories.
(1) Symmetric key cryptography: In which the 'key' element used, is the 'same' for both
encryption as well as decryption and
(2) Asymmetric key cryptography: In which the 'key' element used, is different for both
encryption as well as decryption.
(a) Symmetric key cryptography is also known as 'private or secret key cryptography'
 Whereas
(b) Asymmetric key cryptography is also known as 'public key cryptography'
Recall that there are two basic types of encryption:
Symmetric algorithms: (also called “secret key”) use the same key for both encryption and
decryption;
Asymmetric algorithms: (also called “public key”) use different keys for encryption and
decryption.
For any encryption approach, there are two major challenges:
Key distribution: how do we convey keys to those who need them to establish secure
communication?
Key management: given a large number of keys, how do we preserve their safety and make
them available as needed.
Symmetric
1) Alice and Bob agree on a cryptosystem
2) Alice and Bob agree on a key
3) Alice takes her plaintext message and encrypts it using the encryption algorithm and the
key. This creates a ciphertext message
4) Alice sends the ciphertext message to Bob
5) Bob decrypts the ciphertext message with the same algorithm and key and reads it.
Asymmetric
1) Alice and Bob agree on a public-key cryptosystem
2) Bob sends Alice his public key
3) Alice encrypts her message using Bob’s public key and sends it to Bob
4) Bob decrypts Alice’s message using his private key
Problems:
Symmetric
• Keys must be distributed in secret
• If a key is compromised, Eve (eavesdropper) can
 decrypt any message
 pretend to be one of the parties
• A network requires a great number of keys
Asymmetric
• slow (~1000 times slower than the symmetric)
• vulnerable to chosen-plaintext attacks

Unit III
 1. Overview of Symmetic key cryptography

2. Symmetric Key algorithms

3. Algorithm types and modes

4. DES,RC4

1. Overview of Symmetric key cryptography

(1) Symmetric (secret key):
 An identical key is used for encryption and decryption
 Strength of algorithm is determined by the size of the key, longer the key more difficult
it is to crack.
 Key length is expressed in bits.
 Typical key sizes vary between 48bits and 448 bits.
 Set of possible keys for a cipher is called key space.
 For 40-bit key there are 240 possible keys.
 For 128-bit key there are 2128 possible keys.
 Each additional bit added to the key length doubles the security.
 To crack the key the hacker has to use brute-force (try all the possible keys till a key
works is found).
 Super Computer can crack a 56-bit key in 24 hours.
 It will take 272 times longer to crack a 128-bit key (Longer than the age of the universe).
Primitive Ciphers:
Caesar Cipher is a method in which each letter shifted in the plaintext n places.
Mono-alphabetic Cipher: Any letter can be substituted for any other letter
Advantages:
 Relatively simple and significantly faster than the rest.
 Used in an environment where single authority manages the keys.
 Used in environments where secure secret key distribution can take place.
Disadvantages:
 Key management (generation, transmission and storage of keys) may be a problem.
 People could repudiate sent messages claiming the receiver had compromised the key
 Third party involvement may be required for authentication of key. Database with keys of all
1.2. Types of Symmetric Ciphers:
(a) Stream cipher:
 Each bit or byte is encrypted or decrypted individually
 Simple substitution ciphers
 Used for a single message
(b) Block cipher:
A block cipher is a type of symmetric-key encryption algorithm that transforms a fixed-length
block of plaintext data into a block of cipher text data of the same length
 Encrypt data one bit or one byte at a time
 Used if data is a constant stream of information
 Iterated block cipher is when ciphering is repeatedly done
1.3. SYMMETRIC- KEY CRYPTOGRAPHY:
We can divide all the cryptography algorithms in the world into two groups: symmetric-key
(sometimes called secret-key) cryptography algorithms and public-key (sometimes called
asymmetric) cryptography algorithms.
In symmetric-key cryptography, the same key is used by both parties. The sender uses this
key and an encryption algorithm to encrypt data; the receiver uses the same key and the
corresponding decryption algorithm to decrypt the data

Fig. 5.12
In symmetric-key cryptography, the same key is used by the sender (for encryption) and the
receiver (for decryption). The key is shared.
In symmetric-key cryptography, the algorithm used for decryption is the inverse of the
algorithm used for encryption. This means that if the encryption algorithm uses a combination of
addition and multiplication, the decryption algorithm uses a combination of division and
subtraction.
 Note that the symmetric-key cryptography algorithms are so named because the same key can
be used in both directions.
In symmetric-key cryptography, the same key is used in both directions.
Symmetric-key algorithms are efficient; it takes less time to encrypt a message using a
symmetric-key algorithm than it takes to encrypt using a public-key algorithm. The reason is that
the key is usually smaller. For this reason, symmetric-key algorithms are used to encrypt and
decrypt long messages.
1.4. Symmetric-key Cryptography is Often Used for Long Messages:
Disadvantages of symmetric key:
A symmetric-key algorithm has two major disadvantages.
(1) Each pair of users must have a unique symmetric key.
This means that if N people in the world want to use this method, there needs to be N(N -
1)/2 symmetric keys.
For example, for 1 thousand people to communicate, 1000 * 999 /2 = 4, 99, 500 (4 lakhs
99 thousand and five hundred symmetric keys are needed. The distribution of the keys
between two parties can be difficult.
(2) The sender needs to exchange the key to the receiver. It may be hijacked in between!
1.5. SYMMETRIC- KEY CRYPTOGRAPHY:
We can divide all the cryptography algorithms in the world into two groups: symmetric-key
(sometimes called secret-key) cryptography algorithms and public-key (sometimes called
asymmetric) cryptography algorithms.
In symmetric-key cryptography, the same key is used by both parties. The sender uses this
key and an encryption algorithm to encrypt data; the receiver uses the same key and the
corresponding decryption algorithm to decrypt the data

Fig. 5.13
In symmetric-key cryptography, the same key is used by the sender (for encryption) and the
receiver (for decryption). The key is shared.
 In symmetric-key cryptography, the algorithm used for decryption is the inverse of the
algorithm used for encryption. This means that if the encryption algorithm uses a combination of
addition and multiplication, the decryption algorithm uses a combination of division and
subtraction.
Note that the symmetric-key cryptography algorithms are so named because the same key can
be used in both directions.
In symmetric-key cryptography, the same key is used in both directions.
Symmetric-key algorithms are efficient; it takes less time to encrypt a message using a
symmetric-key algorithm than it takes to encrypt using a public-key algorithm. The reason is that
the key is usually smaller. For this reason, symmetric-key algorithms are used to encrypt and
decrypt long messages.
Symmetric-key Cryptography is Often Used for Long Messages:
Disadvantages of symmetric key:
A symmetric-key algorithm has two major disadvantages.
(3) Each pair of users must have a unique symmetric key.
This means that if N people in the world want to use this method, there needs to be N(N -
1)/2 symmetric keys.
For example, for 1 thousand people to communicate, 1000 * 999 /2 = 4, 99, 500 (4 lakhs
99 thousand and five hundred symmetric keys are needed. The distribution of the keys
between two parties can be difficult.
(4) The sender needs to exchange the key to the receiver. It may be hijacked in between!

2.Symmetric Key Algorithms:

2.1. DES (DATA ENCRYPTION STANDARD) CIPHER ALGORITHM
DES CIPHER:
A 16-round Feistel cipher with block size of 64 bits. DES stands for Data Encryption
Standard. IBM developed DES in 1974 in response to a federal government public invitation for
data encryption algorithms. In 977, DES was published as a federal standard, FIPS PUB 46.
Algorithm:
Step 1: 64 bit plain text blocks is handed over to the initial permutation (IP) function.
 Step 2: IP is performed on the plain text.
Step 3: IP produces 2 halves; say LPT and RPT, both of 32 bit each.
Step 4: Perform 16 rounds of encryption process each with its own key.
Rounds are defined as follows in the algorithm:
4a: Key transformation 4b: Expansion Permutation (EP)
4c: S-Box Substitution
4d: P-Box Permutation 4e: XOR and Swap.
Step 5: LPT and RPT are rejoined finally and a Final Permutation (FP) is performed on the
combined block. Step 6: The result of this process produces 64-bit cipher text.
Diagrammatical Representation:

Plain Text (64 Bit)

IP

LPT RPT

16 Rounds

FP

Cipher Text

Fig. 5.14
Explanation of the Algorithm:
IP – Initial Permutation:
Comparing the IP table performs IP. It happens only once, and it happens before the first
round. It suggests how the transposition in IP should proceed, as shown in the IP table.
After this IP, 64 bit plain text is divided into 2 halves normal LPT and RPT, 08 32 bits each.
In the rounds, step 1 is key transformation.
That is achieved by:
(a) Shifting the key position by considering the Round Table.
(b) Compare the Compression Table to get the sub key of 48 bits.
Step 2: is Expansion Permutation (EP):
In this step, the 32-bit RPT is expanded to 48 bits as it of key length. The process is shown as
under:
The 32-bit text is divided into 8 blocks of 4 bits each. Then by adding 2 bits extra, that is the
first bit of the block 1 is the last bit of the block 8 and the last bit of the block 8 is the first bit of
the 7th block the 48-bit text is obtained.
Diagram for the same is as below:

Input Block 1 (4 bits) Input Block 2 (4 bits) Input Block 8 (4 bits)

1 2 3 4 5 6 7 8 29 30 31 32

1 2 3 4 5 6 7 8 9 10 11 12 43 44 45 46 47 48
Output Block 1 (6 bits) Output Block 2 (6 bits) Output Block 8 (6 bits)

Fig. 5.15
After this expansion it will be compared with the Expansion Permutation Table.
Step 3: in Round is S-Box Substitution:
(1) This step reduces 48 bits RPT into 32 bits because LPT is of 32 bits.
(2) It accepts 48 bits, does some XOR logic and gives 32 bits.
(a) The 48 bits key (Result of Step 1) and the 48 bits of RPT (Result of Step 2) will be
XOR and the output will be 48 bits Input block and that will be given as the input for
the S-Box Substitution.
 (b) The 48-bit block text will be divided into 8 blocks of 6 bits each.
(c) Decimal equivalent of the first and last bit in a block denotes the row number and
decimal equivalent of the bit 2, 3, 4 and 5 denotes the column number of the S-Box
Substitution table.
(d) Check the value and take the binary equivalent of the number.
(e) The result is 4-bit binary number.

(02) 0010 - coloum number

1 0 0 1 0 1

11 - Row Number (03)

Compare 3rd Row 2nd Coloum in SBox-1
Binary
0 0 0 1 Equivalent

Fig. 5.16
(f) For example if the 6-bit number is 100101 then the first and last bit is 11 and the
decimal equivalent of the number is 3. The remaining bits are 0010 and the decimal
equivalent of the number is 2. If it is the first block of input, then check the 3rd row 2nd
column value in the Sbox-1 substitution table. It is given as 1 in the table. Binary
equivalent of 1 is 0001.
(g) The input 100101 of 6-bit is now reduced to 0001 after S-Box Substitution.

Step 4: in Round is P-Box Permutation:

In this step, the output of S-Box, that is 32 bits are permuted using a p-box. This mechanism
involves simple permutation, that is replacement of each bit with another bit as specified in the
p-Box table, without any expansion or compression. This is called as P-Box Permutation. The P-
Box is shown below.
16 7 20 21 29 12 28 17 1 15 23 26 5 18 31 10

2 8 24 14 32 27 3 9 19 13 30 6 22 11 4 25

For example, a 16 in the first block indicates that the bit at position 16 moves to bit at position
1 in the output.
Step 5: is XOR and Swap:
 The untouched LPT, which is of 32 bits, is XORed with the resultant RPT that is with the
output produced by P-Box permutation. The result of this XOR operation becomes the new right
half. The old right half becomes the new left half in the process of swapping. This is shown
below.

Original 64 bit Plain Text Block

32 bit Left Plain Text Block 32 bit Right Plain Text Block

(1) Key Transformation

(not involved directly)
(2) Expansion permutation
(3) S-box Substitution
(4) P-box Substitution

XOR

32 bit Left Plain Text Block 32 bit Right Plain Text Block

Next Round

Fig. 5.17
Final Permutation (FP):
At the end of 16 rounds, the Final Permutation is performed only once. This is a simple
transposition based on the Final Permutation Table.
The output of the Final permutation is the 64-bit encrypted block.

2.2. IDEA ALGORITHM AND ITS WORKING:

International Data Encryption Algorithm (IDEA):
The IDEA in perceived as one of the strongest cryptographic algorithms. It was launched in
1990 and underwent certain changes in names and capabilities as shown in table.
Year Name
1990 Proposed Encryption Standard (PES)
1991 Improved Proposed Encryption Standard (IPES)
1992 International Data Encryption Algorithm (IDEA)
One popular email privacy technology known as Pretty Good Privacy (PGP) is based on
IDEA.
(1) IDEA is a block cipher.
(2) IDEA is reversible like DES, i.e. the same algorithm is used for encryption and decryption.
(3) It uses both confusion and diffusion for encryption.
Algorithm:
(1) Consider the input plain text of 64 bits.
(2) Divide the input plain text into 4 portions each of size 16 bits (Say P1 to P4).
(3) Now perform the 8 rounds of algorithm.
(a) In each round 6 sub-keys are generated from the original key. Each of the sub-keys
consists of 16-bits. These six sub-keys are applied to the four input blocks P1 to P4. Thus
for first round, we have 6 keys say k1 to k6; for second round, we have keys k7 to k12.
Finally for eighth round we have keys k43 to k48.
(b) Multiply, add and XOR the plain text blocks with sub keys.
(4) Perform an output transformation in sub-keys.
 (5) Combine all the 4 blocks of output transformation to get the cipher text of 64 bits.

Input Plain Text (64 bits)

P1 P2 P3 P4

K1
Round 1
K6
K7
Round 2
K12
K13
Round 3
K18
a
K49
Output Transformation (4 sub key)
K52
16 bits of
C1 C2 C3 C4
cipher text

Output Cipher Text (64 bits)

Fig. 5.18
Details of first round in IDEA:
The initial key consists of 128 bits from which 6 sub-keys k1 to k6 are generated for the first
round.
Since k1 to k6 consists of 16 bits each, out of original 128 bits, the first 96 bits (6 sub keys 
16 bits per sub-key) are used for the first round. Thus, at the end of the first round, bits 97-128 of
the original key are unused.
Details of second round in IDEA:
In 2nd round 31 unused bits are used. For second round we still require (96-31 = 65) more
bits. But the original key 128 bits are exhausted.
Now IDEA uses the techniques of key shifting. At this stage the original key is shifted left
circularly by 25 bits that is, the 26th bit of the original key moves to the first position and
becomes the first bit after the shift, and the 25th bit of the original key moves to the last position
and becomes the 128th bit after the shift.
Details of one round in IDEA:
(1) Multiply P1 and k1.
(2) Add P2 and k2.
(3) Add P3 and k3.
(4) Multiply P4 and k4
(5) XOR results of step 1 and step 3.
(6) XOR results of step 2 and step 4.
(7) Multiply steps 5 and k5.
(8) Add step 6 and step 7.
(9) Multiply the result of step 8 and k6.
(10) Add step 7 and step 9.
(11) XOR the results of step 1 and step 9.
(12) XOR the results of step 3 and step 9.
(13) XOR the results of step 2 and step 10.
(14) XOR the results of step 4 and step 10.
Details of output Transformation:
(1) The output transformation is a one-time operation. It takes place at the end of 8th round.
(2) It is 64 bit value divided into 4 sub-blocks (say R1 to R4 each consisting of 16 bits).
Step 1: Multiply R1 and k49.
Step 2: Add R2 and k50.
Step 3: Add R3 and k51.
Step 4: Multiply R4 and k52.
 R1 R2 R3 R4

K49 Multiply K50 Add K50 Add K50 Multiply

C1 C2 C3 C4

Output Cipher Text (64 bit)

Fig. 5.19
A Symmetric Cryptosystems Comparison Table
Cipher Security Speed (486 pc) Key length
DES low 400 kb/s 56 bits
Triple DES good 150 kb/s 112 bits
IDEA good* 200 kb/s 128 bits
Triple IDEA very good* ~100 kb/s 256 bits
* The algorithm is believed to be strong

** The algorithm itself is good, but it has a built-in weakness

Chapter 4:
1. AES

2. Algorithm types and modes

3. RC4

1.ADVANCED ENCRYPTION STANDARD (AES):

Origins:
clear a replacement for DES was needed
have theoretical attacks that can break it
have demonstrated exhaustive key search attacks
can use Triple-DES – but slow, has small blocks
US NIST issued call for ciphers in 1997
15 candidates accepted in Jun 98
5 were shortlisted in Aug-99
Rijndael was selected as the AES in Oct-2000
issued as FIPS PUB 197 standard in Nov-2001 AES Requirements:
private key symmetric block cipher
128-bit data, 128/192/256-bit keys
stronger & faster than Triple-DES
active life of 20-30 years (+ archival use)
provide full specification & design details
both C & Java implementations
NIST have released all submissions & unclassified analyses AES Evaluation Criteria:
initial criteria:
security – effort for practical cryptanalysis
cost – in terms of computational efficiency
algorithm & implementation characteristics
 final criteria
general security
ease of software & hardware implementation
implementation attacks
flexibility (in en/decrypt, keying, other factors) The AES Cipher – Rijndael
designed by Rijmen-Daemen in Belgium
has 128/192/256 bit keys, 128 bit data
an iterative rather than feistel cipher
processes data as block of 4 columns of 4 bytes
operates on entire data block in every round
designed to be:
resistant against known attacks
speed and code compactness on many CPUs
design simplicity
Rijndael:

data block of 4 columns of 4 bytes is state

key is expanded to array of words
has 9/11/13 rounds in which state undergo:
byte substitution (1 S-box used on every byte)
shift rows (permute bytes between groups/columns)
mix columns (subs using matrix multipy of groups)
add round key (XOR state with key material)
view as alternating XOR key & scramble data bytes
initial XOR key material & incomplete last round
with fast XOR & table lookup implementation
Byte Substitution:
a simple substitution of each byte
uses one table of 16x16 bytes containing a permutation of all 256 8-bit values
each byte of state is replaced by byte indexed by row (left 4-bits) & column (right 4-bits)
eg.byte {95} is replaced by byte in row 9 column 5
which has value {2A}
S-box constructed using defined transformation of values in GF (28)
designed to be resistant to all known attacks
Shift Rows:
a circular byte shift in each each
1st row is unchanged
2nd row does 1 byte circular shift to left
3rd row does 2 byte circular shift to left
4th row does 3 byte circular shift to left
decrypt inverts using shifts to right
since state is processed by columns, this step permutes bytes between the columns

Mix Columns:
each column is processed separately
each byte is replaced by a value dependent on all 4 bytes in the column
effectively a matrix multiplication in GF(28) using prime poly m(x) =x8+x4+x3+x+1
 to derive each new byte in col
decryption requires use of inverse matrix
with larger coefficients, hence a little harder
have an alternate characterization
each column a 4-term polynomial
with coefficients in GF (28)
and polynomials multiplied modulo (x4+1)

Add Round Key:

Lastly is the Add Round Key stage which is a simple bitwise XOR of the current block with a
portion of the expanded key. Note this is the only step which makes use of the key and obscures
the result, hence MUST be used at start and end of each round, since otherwise could undo effect
of other steps. But the other steps provide confusion/diffusion/non-linearity. That us you can
look at the cipher as a series of XOR with key then scramble/permute block repeated. This is
efficient and highly secure it is believed.
 AES Round:

AES Key Expansion:

takes 128-bit (16-byte) key and expands into array of 44/52/60 32-bit words
start by copying key into first 4 words
then loop creating words that depend on values in previous & 4 places back
in 3 of 4 cases just XOR these together
1st word in 4 has rotate + S-box + XOR round constant on previous, before XOR 4th
back
 The first block of the AES Key Expansion is shown here in Figure. It shows each group of 4
bytes in the key being assigned to the first 4 words, then the calculation of the next 4 words
based on the values of the previous 4 words, which is repeated enough times to create all the
necessary subkey information.
3. Algorithm types and modes:
3.1. Modes of Operation:
block ciphers encrypt fixed size blocks
eg. DES encrypts 64-bit blocks with 56-bit key
need some way to en/decrypt arbitrary amounts of data in practise
ANSI X3.106-1983 Modes of Use (now FIPS 81)defines 4 possible modes
subsequently 5 defined for AES & DES
have block and stream modes
3.1.1. Electronic Codebook Book (ECB):
message is broken into independent blocks which are encrypted
each block is a value which is substituted, like a codebook, hence name
each block is encoded independently of the other blocks Ci =
DESK1(Pi)
uses: secure transmission of single values
Advantages and Limitations of ECB:
message repetitions may show in ciphertext
if aligned with message block
particularly with data such graphics
or with messages that change very little, which become a code-book analysis
problem
weakness is due to the encrypted message blocks being independent
main use is sending a few blocks of data

3.1.2. Cipher Block Chaining (CBC):

message is broken into blocks

linked together in encryption operation
each previous cipher blocks is chained with current plaintext block, hence name
use Initial Vector (IV) to start process Ci =
DESK1(Pi XOR Ci-1)
C-1 = IV
uses: bulk data encryption, authentication
 Message Padding:

at end of message must handle a possible last short block

which is not as large as blocksize of cipher
pad either with known non-data value (eg nulls)
or pad last block along with count of pad size
•
eg. [ b1 b2 b3 0 0 0 0 5]
•
means have 3 data bytes, then 5 bytes pad+count
this may require an extra entire block over those in message
there are other, more esoteric modes, which avoid the need for an extra block
Advantages and Limitations of CBC:
ciphertext block depends on all blocks before it
any change to a block affects all following ciphertext blocks need Initialization Vector
(IV)
which must be known to sender & receiver
if sent in clear, attacker can change bits of first block, and change IV to
compensate
hence IV must either be a fixed value (as in EFTPOS)
or must be sent encrypted in ECB mode before rest of message

3.1.3. Cipher FeedBack (CFB):

message is treated as a stream of bits

added to the output of the block cipher
result is feed back for next stage (hence name)
standard allows any number of bit (1,8, 64 or 128 etc) to be feed back
denoted CFB-1, CFB-8, CFB-64, CFB-128 etc
most efficient to use all bits in block (64 or 128) Ci = Pi XOR
DESK1(Ci-1)
C-1 = IV
uses: stream data encryption, authentication
Advantages and Limitations of CFB:
appropriate when data arrives in bits/bytes
most common stream mode
limitation is need to stall while do block encryption after every n-bits
note that the block cipher is used in encryption mode at both ends
errors prorogate for several blocks after the error

3.1.4. Output FeedBack (OFB):

message is treated as a stream of bits

output of cipher is added to message
output is then feedback (hence name)
feedback is independent of message
can be computed in advance Ci = Pi XOR Oi
Oi = DESK1(Oi-1)
O-1 = IV
uses: stream encryption on noisy channels

Advantages and Limitations of OFB:

bit errors do not propagate
more vulnerable to message stream modification
a variation of a Vernam cipher
hence must never reuse the same sequence (key+IV)
sender & receiver must remain in sync
originally specified with m-bit feedback
subsequent research has shown that only full block feedback (ie CFB-64 or CFB-128)
should ever be used
Counter (CTR):
a “new” mode, though proposed early on
similar to OFB but encrypts counter value rather than any feedback value
must have a different key & counter value for every plaintext block (never reused) Ci
= Pi XOR Oi

Oi = DESK1(i)
uses: high-speed network encryptions

Advantages and Limitations of CTR:

efficiency
can do parallel encryptions in h/w or s/w
can preprocess in advance of need
good for bursts high speed links
random access to encrypted data blocks
provable security (good as other modes)
but must ensure never reuse key/counter values, otherwise could break (cf OFB)
PLACEMENT OF ENCRYPTION:
have two major placement alternatives
link encryption
 encryption occurs independently on every link

implies must decrypt traffic between links

requires many devices, but paired keys
4.RC4 Algorithm:

RC4 is a stream cipher designed in 1987 by Ron Rivest for RSA Security. It is a variable key-
size stream cipher with byte-oriented operations. The algorithm is based on the use of a random
permutation. Analysis shows that the period of the cipher is overwhelmingly likely to be greater
than 10100 [ROBS95]. Eight to sixteen machine operations are required per output byte, and the
cipher can be expected to run very quickly in software. RC4 was kept as a trade secret by RSA
Security. In September 1994, the RC4 algorithm was anonymously posted on the Internet on the
Cypherpunks anonymous remailers list.
The RC4 algorithm is remarkably simply and quite easy to explain. A variable-length key
of from 1 to 256 bytes (8 to 2048 bits) is used to initialize a 256-byte state vector S, with
elements S[0], S[1], …, S[255]. At all times, S contains a permutation of all 8-bit numbers from
0 through 255. For encryption and decryption, a byte k (see Figure 1) is generated from S by
selecting one of the 255 entries in a systematic fashion. As each value of k is generated, the
entries in S are once again permuted.

Initialization of S:

To begin, the entries of S are set equal to the values from 0 through 255 in ascending order; that
is; S[0] = 0, S[1] = 1, …, S[255] = 255. A temporary vector, T, is also created. If the length of
the key K is 256 bytes, then K is transferred to T. Otherwise, for a key of length keylen bytes, the
first keylen elements of T are copied from K and then K is repeated as many times as necessary
to fill out T. These preliminary operations can be summarized as follows:

/* Initialization */
for i = 0 to 255 do
S[i] = i;
T[i] = K[imodkeylen];
 Next we use T to produce the initial permutation of S. This involves starting with S[0]
and going through to S[255], and, for each S[i], swapping S[i] with another byte in S according
to a scheme dictated by T[i]:

/* Initial Permutation of S
*/ j = 0;
fori = 0 to 255 do

j = (j + S[i] + T[i]) mod 256;

Swap (S[i], S[j]);

Because the only operation on S is a swap, the only effect is a permutation. S still
contains all the numbers from 0 through 255.

Stream Generation

Once the S vector is initialized, the input key is no longer used. Stream generation involves
starting with S[0] and going through to S[255], and, for each S[i], swapping S[i] with another
byte in S according to a scheme dictated by the current configuration of S. After S[255] is
reached, the process continues, starting over again at S[0]:

/* Stream Generation
*/ i, j = 0;
 while(true)
i = (i + 1) mod 256;

j = (j + S[i])
mod 256;
Swap (S[i],
S[j]);

t = (S[i] + S[j])
mod 256; k =
S[t];

To encrypt, XOR the value k with the next byte of plaintext. To decrypt, XOR the
value k with the next byte of ciphertext.

Strength of RC4

A number of papers have been published analyzing methods of attacking RC4.. None of
these approaches is practical against RC4 with a reasonable key length, such as 128 bits.
A more serious problem is reported in [FLUH01]. The authors demonstrate that the WEP
protocol, intended to provide confidentiality on 802.11 wireless LAN networks, is
vulnerable to a particular attach approach. In essence, the problem is not with RC4 itself
but the way in which keys are generated for use as input to RC4. This particular problem
does not appear to be applicable to other applications using RC4 and can be remedied in
WEP by changing the way in which keys are generated. This problem points out the
difficulty in designing a secure system that involves both cryptographic functions and
protocols that make use of them.
UNIT V:
1. Asymmetric Key
Algorithms
2. Digital Signatures

3. Brief history of
Asymmetric Key
Cryptography
4. Overview of
Asymmetric Key
Cryptography
5. RSA algorithm

1. THE CONCEPT OF PUBLIC KEY AND PRIVATE KEY:

The Asymmetric key cryptography is also known as a 'public key cryptography',
which uses a key-pair rather than a single key. The importance of this scheme is that only
one key-pair is required to securely communicate between any number of other parties.
(unlike the huge no. of keys that we've seen with earlier method.) Hence, one problem is
overcome right away. One of these two keys is called public key (which can be
announced to the world) and another is private key (obviously to be kept with oneself).
This is to be followed by everyone who wants to communicate securely.
2. DIGITAL SIGNATURES:
In earlier discussion of Asymmetric key cryptography, we had considered the only
situation, in which if X is sender & Y receiver, then X encrypts the message with Y's
public key and on receiving, Y decrypts with his own private key. This method only
ensures secure communication between the two. Now consider another situation. If X is
sender and Y is receiver, X encrypts the message using his own private key! On
receiving, Y decrypts it using X's public key. The purpose behind this move is
'authentication'. It is clear that, only X knows his private key.
So, when Y receives this message (encrypted with X's private key), it is an indication
or proof that it has originated only from X and none else! Remember that in earlier
scheme, the purpose was only 'confidentiality' and the origin of message was not the
concern.
Now, one may say that if someone else wants to intercept this communication it
should be easy. i.e. anyone can decrypt the message who knows X's public key. This is
true, but then it will not be possible for anyone to again encrypt this message as only X
knows his private key. Thus receiver here will not be fooled that message came from X
This scheme confirms the origin of the message. So, in this case X cannot deny that he
has sent the message to Y, because it was encrypted with X's private key, known only to
X
The above discussion forms the basis for the concept called ‘ Digital Signature’’ In
case of our normal operations, we make use of our (handwritten) signatures. These are
used to confirm the 'origin' or the 'authentication' of the individual. In the Internet world,
it would be difficult to use any such method in practice. Hence the concept of 'Digital
signatures' was evolved.
This technique is vitally important in the E-commerce concept used in the Internet. It
proves as a valid mechanism for 'authenticity' of individual. Most of the financial
transactions done over Internet make use of this method.
2.1.Techniques of Digital signatures:
Actual working of Digital signatures involves the use of a concept called 'Message
digest' or 'hash'. Message digest is something like the summary of original message.
(works similar to the CRC checksum concept) This is basically used to verify the
'integrity' of data i.e. to ensure that the message has not been modified after it was sent by
sender and before it reaches the receiver.
The Digital Signature Standard (DSS) was developed by NIST first in 1991. It
suggests using the SHA-1 algorithm for calculating the message digest. This digest is
further used for performing Digital signatures, by using the algorithm called Digital
Signature Algorithm (DSA). In DSA, message digest is encrypted with the sender's
private key to form the Digital Signature (DS). This signature is transmitted further along
with the original message. It is also possible to use the earlier RSA algorithm for
performing digital signatures. RSA is prominently used over DSA as DSA turns out to be
more complicated.
2.2.STEPS FOR THE PROCESS:
Sender’s Side:
(1) If X is the sender, the SHA-1 algorithm is used to first calculate the message digest
(MD 1) of original message.
(2) This MD1 is further encrypted using RSA with X's private key. This output is called
the Digital Signature (DS) of X.
(3) Further, the original message (M) along with the Digital signature (DS) is sent to
receiver.
Receiver’s Side:
(1) Y thus receives the original message (M) and X's digital signature. Y uses the same
message digest algorithm used by X to calculate the message digest (MD2) of
received message (M).
(2) Also, Y uses X's public key to decrypt the digital signature. The outcome of this
decryption is nothing but original message digest (MD1) calculated by X.
(3) Y, then compares this digest MD1 with the digest MD2 he has just calculated in step
4. If both of them are matching, i.e. MDl = MD2, Y can accept the original message
(M) as correctly authenticated and assured to have originated from X. whereas, if
they are different, the message shall be rejected.
This method turns out to be foolproof. Even if an attacker intercepts anywhere in
between, it is not likely for him to again sign the modified/read message, as only X in this
case will know the private key! Hence, even if intercepted, this method remains very
much secure and reliable!

Fig.5.20
The Sender’s Side:
Modus Operandi – Digital Signature:
After the digest has been created, it is encrypted (signed) using the sender's private
key. The encrypted digest is attached to the original message and sent to the receiver.
Figure (on previous page) shows the sender site.

Fig.5.21
The Receiver’s Side:
The receiver receives the original message and the encrypted digest. He separates the
two. He applies the same hash function to the message to create a second digest. He also
decrypts the received digest, using the public key of the sender. If the two digests are the
same, all three-security measures are preserved. Figure 30.7 shows the receiver site.
2.3.Properties of Digital Signature:
(1) Digital signature does not provide privacy. If there is a need for privacy, another
layer of encryption/decryption must be applied.
(2) Digital signatures can provide:
(a) Integrity,
(b) Authentication, and
(c) Non-repudiation.
(i) Integrity: The integrity of a message is preserved because if Eve
intercepted the message and partially or totally changed it, the decrypted
message would be unreadable.
(ii) Authentication: We can use the following reasoning to show how a
message can be authenticated. If Eve sends a message while pretending that
 it is coming from Alice, she must use her own private key for encryption.
The message is then decrypted with the public key of Alice and will
therefore be nonreadable. Encryption with Eve's private key and decryption
with Alice's public key result in garbage.
(iii) Non-repudiation: Digital signature also provides for non-repudiation. Bob
saves the message received from Alice. If Alice later denies sending the
message, Bob can show that encrypting and decrypting the saved message
with Alice's private and public key can create a duplicate of the saved
message. Since only Alice knows her private key, she cannot deny sending
the message.

Digital
Signature

Message Digest Message Public key

Algorithm Digest Cipher
#

Sender’s
Private Key

Implementation of Digital signature

Source: Ecommerce by Kamlesh K. Bajaj.
 Channel Receiver’s
Sender Key Generator Receiver
Receivers
Public
Message Key

Encrypt Hash
Message + Massage Encrypted
Receivers
Signature with Public Key Message Secret Key

COMPARE
of the Receive
Hash

AND
Calculate Signature
with Secret Key Decrypt Message Message +
Compare
with Secret Key Signature

Sender’s
Verify Signature

CONTRAST
Secret Sender’s Kay
Generator with Public Key
Key Sender’s Public Key

BETWEEN
SYMMETRIC
CRYPTOGRAPHY AND ASYMMETRIC KEY CRYPTOGRAPHY:
KEY
Sr. Categories Symmetric Key Asymmetric Key
No. Cryptography Cryptography

Key used for Same key is used One key used for
encryption/ for encryption and encryption and
(1) decryption decryption another, different
key is used for
decryption

Key Process Ke = Kd KdKd

(2)
 Speed of Very fast Slower
(3) encryption/
decryption

Size of resulting Usually same as or More than the

encrypted text less than the original clear text
(4) original clear text size
size

Key agreement / A big problem No problem at all

(5)
exchange

Number of keys Equals about the Same as the

required as square of the number of
compared to the number of participants, so
(6)
number of participants, so scales up quite well
participants in the scalability is an
message exchange issue

Usage Mainly for Can be used for

encryption and encryption and
decryption decryption
(confidentiality), (confidentiality) as
(7)
cannot be used for well as for digital
digital signatures signatures
(integrity and non- (integrity and non-
repudiation checks) repudiation checks)

Efficiency in usage Symmetric key Public key

cryptography is algorithm are more
(8)
often used for long efficient for short
messages messages

The above table shows that both symmetric key cryptography and asymmetric key
cryptography have nice features.
 Also, both have some areas where better alternatives are generally desired.
Asymmetric key cryptography solves the major problem of key agreement / key
exchange as well as scalability.
However, it is far slower and produces huge chunks of cipher text as compared to
symmetric key Cryptography (essentially because it uses large keys and complex
algorithms as compared to symmetric key cryptography).
How nice it would be, if we can combine the two cryptography mechanisms, so as to
achieve the better of the two, and yet do not compromise on any of the features? More
specifically, we need to ensure that the following objectives are met.
(1) The solution should be completely secure.
(2) The encryption and decryption processes must not take a long time.
(3) The generated cipher text should be compact in size.
(4) The solution should scale to a large number of users easily, without introducing any
additional complications.
(5) The key distribution problem must be solved by the solution.
In practice symmetric key cryptography and asymmetric key cryptography are
combined to have a very efficient security solutions.
2.4.PRETTY GOOD PRIVACY:
The implementation of security at the application layer is more feasible and simpler,
particularly when the Internet communication involves only two parties, as in the case of
email and TELNET. The sender and the receiver can agree to use the same protocol and
to use any type of security services they desire. In this section, we discuss one protocol
used at the application layer to provide security: PGP.
Pretty Good Privacy (PGP) was invented by Phil Zimmermann to provide all four
aspects of security (privacy, integrity, authentication, and non-repudiation) in the sending
of email.
Fig.5.22
 PGP uses digital signature (a combination of hashing and public-key encryption) to
provide integrity, authentication, and non-repudiation. It uses a combination of secret-key
and public-key encryption to provide privacy. Specifically, it uses one hash function, one
secret key, and two private-public key pairs.
The figure shows how PGP creates secure email at the sender site. The email message
is hashed to create a digest. The digest is encrypted (signed) using Alice's private key.
The message and the digest are encrypted using the one-time secret key created by Alice.
The secret key is encrypted using Bob's public key and is sent together with the encrypted
combination of message and digest.
Figure below shows how PGP uses hashing and a combination of three keys to extract
the original message at the receiver site. The combination of encrypted secret key and
message plus digest is received. The encrypted secret key first is decrypted (using Bob's
private key) to get the one-time secret key created by Alice. The secret key then is used to
decrypt the combination of the message plus digest.
PRETTY GOOD PRIVACY:
 The implementation of security at the application layer is more feasible and simpler,
particularly when the Internet communication involves only two parties, as in the case of
email and TELNET. The sender and the receiver can agree to use the same protocol and
to use any type of security services they desire. In this section, we discuss one protocol
used at the application layer to provide security: PGP.
2.5.LONGITUDINAL REDUNDANCY CHECK / CYCLIC REDUNDANCY
CHECK (LRC / CRC):
A message digest us a finger print or the summary of a message. It is similar to the
concepts of LRC and CRC which us sued to verify the integrity of the data (i.e. to ensure
that a message has not bus tampered before it reaches to the receivers). Let us understand
this concept with the help of LRC example:
(1) A block of bits is organised in the form of a list (as rows in the LRC. consider if we
want to send 32 bits, we arrange them into a list as four (horizontal) rours. Then we
count how many 1 bits occur in each of the 8 (vertical columns). [If the no. of 1’s in
the column is odd then we say that the column has odd parity (indicated by a 1 bit in
the shaded LRC row); otherwise if the no. of 1s in the columns is even, we call it as
even parity (indicated by 0 bit in the shaded LRC row).]
(2) For instance in the first column, we have two 1’s indicating an even parity and
therefore, we have a 0 in the shaded LRC row for the first column. Similarly, for the
last column, we have 3 1’s indicating an odd parity and therefore we have a 1 in the
shaded LRC row for the last column.
(3) Thus, the parity bit for each column in calculated and a new row of eight parity bits
is created. These becomes the parity bits or the whole blocks. Thus, the LRC is
actually a finger print of the original message.
(4) The data along with the LRC is then sent to the receiver. The receiver separates the
data block from the LRC block. It performs its own LRC on the data block alone. It
then compares its LRC values with the ones received from the sender. If the two
LRC values match, then the receiver has a reasonable confidence that the message
sent by the sender has not been changed, while in transit.
Original Data

111 00 100 11 011 101 00 111 001 001 010 01 00 101 001

1 1 1 0 10 0
1 1 0 1 10 1 Original data
arranged as rows
0 0 1 1 00 1 of a list
0 0 1 1 00 1

LRC

111 00 100 11 011 101 00 111 001 001 010 01

The working of public and private keys:
Asymmetric key cryptography (using public and private keys) works as under:
Consider the scenario, X wants to send a message to Y, without having to worry about
its security.
(1) Then X and Y should each have a private key and a public key.
(a) X should keep its private key secret.
(b) Y should keep its private key secret.
(c) X should inform Y about its public key.
(d) Y should inform X about its public key
(Both now have their own set of keys ready.)
(2) When X wants to send message to Y, X encrypts with Y's public key (as it is known
to everyone)
(3) X then sends this message to Y.
(4) Then, Y decrypts this message using his own private key (known only to Y)
[This ensures in this case, that the message can be encrypted & sent by anyone,
but can only be decrypted by Y. Hence, any interception will not result in knowing
the sensitive information as key is only with Y.]
Similarly, on the other side, if Y wants to send the message to X, reverse method
is performed.
(5) Y encrypts the message using X's public key and sends this to X.
(6) On receiving the message, X can further decrypt it using his own private key.
The basis of this working lies in the assumption of large prime number with only two
factors. If one of the factors is used for encryption process, only the other factor shall be
used for decryption.
The best example of an asymmetric key cryptography algorithm is the famous RSA
algorithm (developed by Rivest, Shamir and Adleman at MIT in 1978, based on the
framework setup by Diffie& Hellman earlier).
3. ASYMMETRIC KEY CRYPTOGRAPHY:
In public-key cryptography, there are two keys: a private key and a public key. The
receiver keeps the private key. The public key is announced to the public.
 Imagine Alice, as shown in Figure 29.20, wants to send a message to Bob. Alice uses
the public key to encrypt the message. When Bob receives the message, the private key is
used to decrypt the message.

Fig. 5.23
In public-key encryption/decryption, the public key that is used for encryption is
different from the private key that is used for decryption.
The public key is available to the public; the private key is available only to an
individual.
3.1.Public-Key Encryption/Decryption has Two Advantages:
First, it removes the restriction of a shared symmetric key between two entities (e.g.,
persons) that need to communicate with each other. A shared symmetric key is shared by
the two parties and cannot be used when one of them wants to communicate with a third
party. In public-key encryption! Decryption, each entity creates a pair of keys; the private
one is kept, and the public one is distributed. Each entity is independent, and the pair of
keys created can be used to communicate with any other entity.
The second advantage is that the number of keys needed is reduced tremendously.
In this system, for I thousand users to communicate, only 1 thousand pairs of keys i.e.
2000 keys are needed, not 4,99,500, as was the case in symmetric-key cryptography.
3.2.Public-Key Cryptography also has Two Disadvantages:
The big disadvantage is the complexity of the algorithm. If we want the method to be
effective, the algorithm needs large numbers. Calculating the cipher text from plaintext
using the long keys takes a lot of time. That is the main reason that public-key
cryptography is not recommended for large amounts of text.
Public-Key Algorithms are more Efficient for Short Messages:
 The second disadvantage of the public-key method is that the association between an
entity and its public key must be verified. If Alice sends her public key via an email to
Bob, then Bob must be sure that the public key really belongs to Alice and nobody else.
One point needs to re-mention that if your private key were made public you would
Get Bankrupted in no time!

4. RSA ALGORITHM:
(1) Generate two large random primes, p and q, of approximately equal size
(2) Calculate N = PXQ
(3) Select the public key that is the encryption key E such that it is not a factor of (p-1)
(q-1).
(4) Select the private key that is the decryption key D such that the following equation is
true: (DXE) mod (P-1) X (Q-1)=1
(5) For encryption, calculate the cipher text CT as CT=PTE mod N.
(6) Send CT as the cipher text to the receiver.
(7) For decryption, calculate the plain text PT as PT=CTD mod N.
A Very Simple Example of RSA Encryption:
This is an extremely simple example using numbers you can work out on a pocket
calculator (those of you over the age of 35 can probably even do it by hand).
(1) Select primes p=11, q=3.
(2) n = pq = 11.3 = 33 phi = (p-1)(q-1) = 10.2 = 20
(3) Choose e=3 Check gcd(e, p-1) = gcd(3, 10) = 1 (i.e. 3 and 10 have no common
factors except 1), and check gcd(e, q-1) = gcd(3, 2) = 1therefore gcd(e, phi) = gcd(e,
(p-1)(q-1)) = gcd(3, 20) = 1
(4) Compute d such that ed = 1 (mod phi) i.e. compute d = e-1 mod phi = 3-1 mod 20 i.e.
find a value for d such that phi divides (ed-1) i.e. find d such that 20 divides 3d-1.
Simple testing (d = 1, 2,...) gives d = 7 Check: ed-1 = 3.7 - 1 = 20, which is divisible
by phi.
(5) Public key = (n, e) = (33, 3) Private key = (n, d) = (33, 7).
This is actually the smallest possible value for the modulus n for which the RSA
algorithm works.
Now say we want to encrypt the message m = 7, c = me mod n = 73 mod 33 = 343 mod
33 = 13. Hence the cipher text c = 13.
To check decryption we compute m' = cd mod n = 137 mod 33 = 7. Note that we don't
have to calculate the full value of 13 to the power 7 here. We can make use of the fact
that a = bc mod n = (b mod n).(c mod n) mod n so we can break down a potentially large
number into its components and combine the results of easier, smaller calculations to
calculate the final value.
7
One-way of calculating m' is as follows: m' = 13 mod 33 = 13(3+3+1) mod 33 =
133.133.13 mod 33 = (133 mod 33). (133 mod 33).(13 mod 33) mod 33 = (2197 mod
33).(2197 mod 33).(13 mod 33) mod 33 = 19.19.13 mod 33 = 4693 mod 33 = 7.
What would happen if your private key were made public?
The answer is in just one word!–
Get Bankrupted!
However rich you were! Now popper!!
The receiver of your private key can, not only withdraw all that you have but also can
also avail credit for banks and enjoy and you keep paying throughout your life!
UNIT VI

1. Knapsack algorithms
2. Elliptic Curve Cryptography
3. ElGamal

1.KNAPSACK PROBLEM:
Given an integer-vector X=(x1,…,xn) and an integer c.
Determine a binary vector B=(b1,…,bn) (if it exists) such thatXBT=c.
Knapsack problem with superincreasing vector – easy
Problem
Given a superincreasing integer-vectorX=(x1,…,xn)
and an integer c,determine a binary vectorB=(b1,…,bn) (if it exists) such that
XBT=c.

Algorithm–
to solve knapsack problems with superincreasing vectors:
fori¬ndownto2do
ifcł 2xithen terminate {no solution}
elseifc>xi thenbi¬ 1; c ¬ c – xi ;
elsebi= 0;
ifc = x1then b1 ¬ 1
elseifc = 0 thenb1 ¬ 0;
else terminate {no solution}
Example:
X=(1,2,4,8,16,32,64,128,256,512)c=999
X=(1,3,5,10,20,41,94,199)c=242
Let a (knapsack) vector
A=(a1,…,an)be given.
Encoding of a (binary) message B=(b1,b2,…,bn) by A is done by the vector/vector
multiplication:
ABT=c
and results in the crypto text c
 Decoding of c requires to solve the knapsack problem for the instant given by the
knapsack vector A and the crypto text c.
The problem is that decoding seems to be infeasible.
Example
If A=(74, 82,94, 83, 39, 99, 56, 49, 73, 99)and B =(1100110101) then
ABT=Each knapsack vector A=(a1,…,an)defines an integer valued
Knapsack-function

f A : x | 0  x  2n  N 
Specified by f A x    ai
i th bit in the binary
representation of x is 1

Example A0=(43,129,215,473,903,302,561,1165,697,1523)
fA0(364)=fA0(0101101100)=129+473+903+561+1165=3231
Unambiguity of knapsack systems
For unambiguity of the decryption of the knapsack cryptosystems with knapsack
vector A, it is important that
Example: If A=(17,103,50,81,33), then 131=17+33+81=50+81
S nd therefore for crypto texts:
(131, 33, 100, 234, 33)
SAUNA FAUNA
Two plaintexts are obtained
1.. Choose a superincreasing vector X=(x1,…,xn).
2. Choose m,u such that m>2xn,gcd(m,u)=1.
3. Compute u -1modm,X'=(x1’,…,xn'),xi’=uximod m.
diffusion
confusion
Cryptosystem: X' - public key
X, u,m - trapdoor information
Encryption: of a binary vector w of length n: c = X' w
Decryption: compute c‘ = u-1c mod m
and solve the knapsack problem with X and c'.
Lemma Let X, m, u, X', c, c' be as defined above. Then the knapsack problem
instances (X,c') and (X',c) have at most one solution, and if one of them has a solution,
then the second one has the same solution.
 Proof Let X'w=c. Then
c‘ºu-1cºu-1X'wºu-1uXwºXw (mod m).
Since X is superincreasing and m>2xn we have
(X w)mod m=X w
and therefore c‘=Xw.
Example X=(1,2,4,9,18,35,75,151,302,606)
m=1250, u=41
X‘=(41,82,164,369,738,185,575,1191,1132,1096)
In order to encrypt an English plaintext, we first encode its letters by 5-bit
numbers _ - 00000, A - 00001, B - 00010… and then divide the resulting binary strings
into blocks of length 10.
Plaintext: Encoding of AFRICA results in vectors
w1=(0000100110)w2=(1001001001)w3=(0001100001)
Encryption: c1’=X'w1=3061 c2’=X'w2=2081 c3’=X‘w3=2203
Crypto text :( 3061, 2081, 2203)
Decryption of crypto texts: (2163, 2116, 1870, 3599)
By multiplying with u–1=61 (mod 1250) we get new crypto texts (several new c’)
(693,326,320,789)
and in the binary form solutions B of equations XBT=c’ have the form
(1101001001, 0110100010, 0000100010, 1011100101)
That is the resulting plaintext is:
ZIMBABWE
2.ELLIPTIC CURVE CRYPTOGRAPHY:

majority of public-key crypto (RSA, D-H) use either integer or polynomial

arithmetic with very large numbers/polynomials
imposes a significant load in storing and processing keys and messages
an alternative is to use elliptic curves
offers same security with smaller bit sizes
newer, but not as well analysed
Real Elliptic Curves:
an elliptic curve is defined by an equation in two variables x & y, with
coefficients
consider a cubic elliptic curve of form
 y2= x3+ ax+ b
where x,y,a,b are all real numbers
also define zero point O
have addition operation for elliptic curve
geometrically sum of Q+R is reflection of intersection R

Finite Elliptic Curves:

Elliptic curve cryptography uses curves whose variables & coefficients are finite
have two families commonly used:
prime curves Ep(a,b) defined over Zp
•
use integers modulo a prime
•
best in software
binary curves E2m(a,b) defined over GF(2n)
•
use polynomials with binary coefficients
•
best in hardware
Elliptic Curve Cryptography:
ECC addition is analog of modulo multiply
ECC repeated addition is analog of modulo exponentiation
need “hard” problem equiv to discrete log

Q=kP, where Q,P belong to a prime curve

 is “easy” to compute Q given k,P
but “hard” to find k given Q,P
known as the elliptic curve logarithm problem
Certicom example: E23(9,17)
ECC Diffie-Hellman:
can do key exchange analogous to D-H
users select a suitable curve Ep(a,b)
select base point G=(x1,y1)
with large order n s.t.nG=O
A & B select private keys nA<n, nB<n
compute public keys: PA=nAG, PB=nBG
compute shared key: K=nAPB,K=nBPA
same since K=nAnBG

ECC Encryption/Decryption:
several alternatives, will consider simplest
must first encode any message M as a point on the elliptic curve Pm
select suitable curve & point G as in D-H
each user chooses private key nA<n
and computes public key PA=nAG
to encrypt Pm : Cm={kG, Pm+kPb}, k random
decrypt Cm compute: Pm+kPb–nB(kG) =
Pm+k(nBG)–nB(kG) = Pm

ECC Security:
relies on elliptic curve logarithm problem
fastest method is “Pollard rho method”
compared to factoring, can use much smaller key sizes than with RSA etc
for equivalent key lengths computations are roughly equivalent
hence for similar security ECC offers significant computational advantages

NUMBER THEORY:
Prime Numbers:
prime numbers only have divisors of 1 and self
they cannot be written as a product of other numbers
note: 1 is prime, but is generally not of interest
eg. 2,3,5,7 are prime, 4,6,8,9,10 are not
prime numbers are central to number theory
list of prime number less than 200 is:
2 3 5 7 11 13 17 19 23 29 31 37 41 43 47 53 59 61 67 71 73 79 83 89 97 101 103 107
109
113 127 131 137 139 149 151 157 163 167 173 179 181 191 193 197 199
Prime Factorisation:
to factor a number n is to write it as a product of other numbers: n=a x b x c
note that factoring a number is relatively hard compared to multiplying the factors
together to generate the number
the prime factorisation of a number n is when its written as a product of primes

eg. 91=7x13 ; 3600=24x32x52

3. Elgamal algorithm:
Chapter 7
1. Digital Certificates
2. Public Key Infrastructure
3. Private key management
4. Public Key Infrastructure Standards

1.Digital Certificates:

1.1.KEY DISTRIBUTION:
Every process of encryption and decryption is necessarily associated with a 'key'- the
combination used for encryption and/or decryption, and an algorithm i.e. the rules or
steps used for both encryption and decryption. The requirement of 'same' key as in case
of 'symmetric' key cryptography leads to a common problem called 'problem of key
distribution', i.e. how the two parties should agree upon a 'common' key that has to be
used for the process. This is as described below.
1.2. Problem of Key Distribution in Symmetric Key Cryptography:
As in case of symmetric key cryptography, the key that has to be used for both
encryption and decryption should be the 'same' this leads to a problem that how the two
parties requiring secure communication can 'agree' or 'decide' upon a common key,
without letting any third person know about it? There can be many ways in which the two
parties will try to communicate assuming it is secure, but it may not be so. e.g. even if
they exchange letters, seal envelopes into locked boxes, talk over open media for the
common key, or send the key along with the locked boxes, whatever may be the means
used, it turns out to be practically non-viable or difficult to implement.
That is to say, there are very much chances of intercepting the communication
between two parties if any of these methods are used. This is called the 'problem of key
distribution'.
In order to come out of this problem, one good solution was given by two scientists
jointly known as 'Diffie-Hellman key exchange algorithm'.
1.3. The Diffie-Hellman Key Exchange Algorithm:
 Whitefield Diffie and Martin Hellman, in 1976 have come out with a good solution to
the problem of key distribution as mentioned above. The steps of this algorithm are as
given below. (It must be noted, that this is NOT an encryption or decryption algorithm
but is only used for agreeing upon a. symmetric key. Once it is done, some specific
algorithm should be used for the purpose of encryption/decryption.)

Fig. 5.24
Steps for Algorithm:
Assume two parties viz. 'first' and 'second' want to communicate securely.
(1) Let 'first' and 'second' agree upon two large prime nos., say n and g. These need not
be kept secured. (i.e. everyone can know these values.)
(2) 'First’ chooses another large random no. say x to calculate another number A such
that, A = g^xmod n. (Note, value of x is only known to 'first'!)
(3) This no. A is then sent by 'first' to 'second'.
(4) 'Second’ also chooses another large random no. say y to calculate another number B
such that,
(5) B = g^y mod n. (Note, value of y is only known to 'second'!)
(6) This no. B is then sent by 'second' to 'first'.
(7) Now, independently, 'first' calculates the key KI as: KI = B^xmod n
(8) Also, 'second' independently calculates the key K2 as: K2 = A^y mod n
(9) As it should be required here in symmetric key cryptography, KI = K2.
Example:
 Let us take an actual example, to illustrate above algorithm. Assuming values such as
n= 11, g=7, x=3 and y=6, we have following equations:
(1) Value of A=7^3mod 11 =343 mod 11 =2.
(2) Value of B = 7^6mod 11 = 117649 mod 11 = 4.
(3) Key KI = 4^3mod 11 = 64 mod 11 = 9.
(4) And, Key K2 = 2^6mod 11 = 64 mod 11 = 9.
(5) Thus, we find that KI = K2.
(6) Hence the algorithm is proved.
1.4. Problems with the Algorithm:
Although, it is seen that this algorithm turns out to be a good solution to the above
mentioned key distribution problem, still it does not solve all the problems! This is
because the algorithm can fail if a hacker makes what is called as the man-in-the-middle
attack. This way, even though the two parties will feel that they are talking to each other,
practically they are in-turn communicating with the hacker as he places himself in
between them and switches back and forth the communication.
For example:
(1) Alice wants to communicate with Bob securely. For this purpose, she sends the
values of n and g to Bob. Let n=11 and g=7.
(2) Alice does not realize that the attacker Tom is listening quietly; to the conversation
between her and Bob. Tom simply picks up the values of n and g, and also forwards
them to Bob as they originally were.

Alice Tom Bob

N=11, g=7 N=11, g=7 N=11, g=7

(3) Now, let us assume that Alice, Tom and Bob select random numbers x and y.

Alice Tom Bob

X=3 x=8,y=6 y=9

(4) Alice calculates A and Bob calculates B whereas Tom calculates both A and B to
play the role of man in middle.

Alice Tom Bob

A = gxmod n A = gxmod n B = gymod n

 = 73 mod 11 = 78 mod 11 = 79 mod 11

= 343 = 5764801 mod 11 = 40353607 mod 11

mod 11

=2 =9 =8

B = gymod n

= 76 mod 11

= 117649 mod 11

=4

(5) Alice send her A2 to Bob. Tom intercepts it and send his A 9 to him.
(a) In return, Bob sends his B 8 to Alice. Tom intercepts it and send his B 4 to
Alice.
(b) Based on these values, all the three persons now calculate their keys.
Alice Tom Bob
K1 = Bx mod K1 = Bx mod n K2 = Ay mod n
n

= 43 mod 11 = 88 mod 11 = 99 mod 11

= 64 mod 11 = 16777216 mod 11 = 387420489 mod

11

=9 =5 =5

K2 = Ay mod n

= 26 mod 11

= 64 mod 11

=9

As we can see, the MITM attack can work against the Diffie-Hellman Key exchange
algorithm, causing it to fail. This is plainly because the person in middle makes the actual
communicators believe that they are talking to each other, whereas they are actually
talking to he man-in-the middle, who is talking to each of them.
The second problem is regarding the no. Of keys required. In our example, we have
just seen the situation of only two communicating parties. What would be the situation if
a third party say 'third' is added!
 One must think of the situation when communication between first-second, second-
third as well as third-first must be secure! This would obviously require three keys! Then
assume how many keys would be required to securely communicate between 1000 people
that to independently?
To find out this answer, one formula is used. It says, the total no. of keys required to
securely communicate between 'n' individuals is = n (n-l) / 2. Hence in our example for
1000 people, 1000(999)/2 = 499500 keys would be needed. This certainly increases the
complications further.
In order to recover from these problems, the second technique (mentioned in the
beginning) comes into picture, i.e. the Asymmetric Key cryptography. This states that
two types of keys would be required, one each for encryption and decryption.
2. THE CONCEPT OF PUBLIC KEY AND PRIVATE KEY:
The Asymmetric key cryptography is also known as a 'public key cryptography',
which uses a key-pair rather than a single key. The importance of this scheme is that only
one key-pair is required to securely communicate between any number of other parties.
(unlike the huge no. of keys that we've seen with earlier method.) Hence, one problem is
overcome right away. One of these two keys is called public key (which can be
announced to the world) and another is private key (obviously to be kept with oneself).
This is to be followed by everyone who wants to communicate securely.
The working of public and private keys:
Asymmetric key cryptography (using public and private keys) works as under:
Consider the scenario, X wants to send a message to Y, without having to worry about
its security.
(7) Then X and Y should each have a private key and a public key.
(e) X should keep its private key secret.
(f) Y should keep its private key secret.
(g) X should inform Y about its public key.
(h) Y should inform X about its public key
(Both now have their own set of keys ready.)
(8) When X wants to send message to Y, X encrypts with Y's public key (as it is known
to everyone)
(9) X then sends this message to Y.
(10) Then, Y decrypts this message using his own private key (known only to Y)
[This ensures in this case, that the message can be encrypted & sent by anyone,
but can only be decrypted by Y. Hence, any interception will not result in knowing
the sensitive information as key is only with Y.]
Similarly, on the other side, if Y wants to send the message to X, reverse method
is performed.
(11) Y encrypts the message using X's public key and sends this to X.
(12) On receiving the message, X can further decrypt it using his own private key.
The basis of this working lies in the assumption of large prime number with only two
factors. If one of the factors is used for encryption process, only the other factor shall be
used for decryption.
The best example of an asymmetric key cryptography algorithm is the famous RSA
algorithm (developed by Rivest, Shamir and Adleman at MIT in 1978, based on the
framework setup by Diffie& Hellman earlier).
3.ASYMMETRIC KEY CRYPTOGRAPHY:
In public-key cryptography, there are two keys: a private key and a public key. The
receiver keeps the private key. The public key is announced to the public.
 Imagine Alice, as shown in Figure 29.20, wants to send a message to Bob. Alice uses
the public key to encrypt the message. When Bob receives the message, the private key is
used to decrypt the message.

Fig. 5.25
In public-key encryption/decryption, the public key that is used for encryption is
different from the private key that is used for decryption.
The public key is available to the public; the private key is available only to an
individual.
Public-Key Encryption/Decryption has Two Advantages:
First, it removes the restriction of a shared symmetric key between two entities (e.g.,
persons) that need to communicate with each other. A shared symmetric key is shared by
the two parties and cannot be used when one of them wants to communicate with a third
party. In public-key encryption! Decryption, each entity creates a pair of keys; the private
one is kept, and the public one is distributed. Each entity is independent, and the pair of
keys created can be used to communicate with any other entity.
The second advantage is that the number of keys needed is reduced tremendously.
In this system, for I thousand users to communicate, only 1 thousand pairs of keys i.e.
2000 keys are needed, not 4,99,500, as was the case in symmetric-key cryptography.
Public-Key Cryptography also has Two Disadvantages:
The big disadvantage is the complexity of the algorithm. If we want the method to be
effective, the algorithm needs large numbers. Calculating the cipher text from plaintext
using the long keys takes a lot of time. That is the main reason that public-key
cryptography is not recommended for large amounts of text.
Public-Key Algorithms are more Efficient for Short Messages:
 The second disadvantage of the public-key method is that the association between an
entity and its public key must be verified. If Alice sends her public key via an email to
Bob, then Bob must be sure that the public key really belongs to Alice and nobody else.
One point needs to re-mention that if your private key were made public you would
Get Bankrupted in no time!

4.RSA ALGORITHM:
(8) Generate two large random primes, p and q, of approximately equal size
(9) Calculate N = PXQ
(10) Select the public key that is the encryption key E such that it is not a factor of (p-1)
(q-1).
(11) Select the private key that is the decryption key D such that the following equation is
true: (DXE) mod (P-1) X (Q-1)=1
(12) For encryption, calculate the cipher text CT as CT=PTE mod N.
(13) Send CT as the cipher text to the receiver.
(14) For decryption, calculate the plain text PT as PT=CTD mod N.
A Very Simple Example of RSA Encryption:
This is an extremely simple example using numbers you can work out on a pocket
calculator (those of you over the age of 35 can probably even do it by hand).
(6) Select primes p=11, q=3.
(7) n = pq = 11.3 = 33 phi = (p-1)(q-1) = 10.2 = 20
(8) Choose e=3 Check gcd(e, p-1) = gcd(3, 10) = 1 (i.e. 3 and 10 have no common
factors except 1), and check gcd(e, q-1) = gcd(3, 2) = 1therefore gcd(e, phi) = gcd(e,
(p-1)(q-1)) = gcd(3, 20) = 1
(9) Compute d such that ed = 1 (mod phi) i.e. compute d = e-1 mod phi = 3-1 mod 20 i.e.
find a value for d such that phi divides (ed-1) i.e. find d such that 20 divides 3d-1.
Simple testing (d = 1, 2,...) gives d = 7 Check: ed-1 = 3.7 - 1 = 20, which is divisible
by phi.
(10) Public key = (n, e) = (33, 3) Private key = (n, d) = (33, 7).
This is actually the smallest possible value for the modulus n for which the RSA
algorithm works.
Now say we want to encrypt the message m = 7, c = me mod n = 73 mod 33 = 343 mod
33 = 13. Hence the cipher text c = 13.
To check decryption we compute m' = cd mod n = 137 mod 33 = 7. Note that we don't
have to calculate the full value of 13 to the power 7 here. We can make use of the fact
that a = bc mod n = (b mod n).(c mod n) mod n so we can break down a potentially large
number into its components and combine the results of easier, smaller calculations to
calculate the final value.
7
One-way of calculating m' is as follows: m' = 13 mod 33 = 13(3+3+1) mod 33 =
133.133.13 mod 33 = (133 mod 33). (133 mod 33).(13 mod 33) mod 33 = (2197 mod
33).(2197 mod 33).(13 mod 33) mod 33 = 19.19.13 mod 33 = 4693 mod 33 = 7.
What would happen if your private key were made public?
The answer is in just one word!–
Get Bankrupted!
However rich you were! Now popper!!
The receiver of your private key can, not only withdraw all that you have but also can
also avail credit for banks and enjoy and you keep paying throughout your life!
DIGITAL ENVELOPE:
 In practice, symmetric key cryptography and asymmetric key cryptography are
combined to a very efficient security solution.
When using secret-key cryptosystems, users must first agree on a session key, that is, a
secret key to be used for the duration of one message or communication session. In
completing this task there is a risk the key will be intercepted during transmission. This is
part of the key management problem.
Public-key cryptography offers an attractive solution to this problem within a
framework called a digital envelope.
It is a secure container for electronic message. It includes a packet of electronic data
including an encoded message, plus authenticating information
The digital envelope consists of a message encrypted using secret-key cryptography
and an encrypted secret key. While digital envelopes usually use public-key cryptography
to encrypt the secret key, this is not necessary.
(1) If Alice and Bob have an established secret key, they could use this to encrypt the
secret key in the digital envelope.
(2) Suppose Alice wants to send a message to Bob using secret-key cryptography for
message encryption and public-key cryptography to transfer the message encryption
key.
(3) Alice chooses a secret key and encrypts the message with it, then encrypts the secret
key using Bob's public key.
(4) She sends Bob both the encrypted secret key and the encrypted message.
(5) When Bob wants to read the message he decrypts the secret key, using his private
key, and then decrypts the message, using the secret key.
(6) In a multi-addressed communications environment such as e-mail, this can be
extended directly and usefully.
(7) If Alice's message is intended for both Bob and Carol, the message encryption key
can be represented concisely in encrypted forms for Bob and for Carol, along with a
single copy of the message's content encrypted under that message encryption key.
(8) Alice and Bob may use this key to encrypt just one message or they may use it for an
extended communication.
(9) One of the nice features about this technique is they may switch secret keys as
frequently as they would like.
 Not only do digital envelopes help solve the key management problem; they increase
performance without sacrificing security. The increase in performance is obtained by
using a secret-key cryptosystem to encrypt the large and variably sized amount of
message data, reserving public-key cryptography for encryption of short-length keys.
In general, secret-key cryptosystems are much faster than public-key cryptosystems.
The digital envelope technique is a method of key exchange, but not all key exchange
protocols use digital envelopes.
5.THE CONCEPT OF HASH (MESSAGE DIGEST):
Signing the Digest:
We said before that public-key encryption is efficient if the message is short.
Using a public key to sign the entire message is very inefficient if the message is very
long.
The solution is to let the sender sign a digest of the document instead of the whole
document. The sender creates a miniature version or digest of the document and signs it;
the receiver then checks the signature on the miniature.
To create a digest of the message, we use a hash function. The hash function creates a
fixed-size digest from a variable-length message, as shown in Figure.

Fig. 5.26
The two most common hash functions are called MD5 (Message Digest 5) and SHA-I
(Secure Hash Algorithm I). The first one produces a 120-bit digest. The second produces
a 160-bit digest.
Note that a hash function must have two properties to guarantee its success.
First, hashing is one-way; the digest can only be created from the message, not vice
versa.
Second, hashing is a one-to-one function; there is little probability that two messages
will create the same digest. We will see the reason for this condition shortly.
 After the digest has been created, it is encrypted (signed) using the sender's private
key. The encrypted digest is attached to the original message and sent to the receiver.
Idea of a Message Digest:
The concept of message digests is based on similar principles. However, it is slightly
wider in scope. For instance, suppose that we have a number 4000 and we divide it by 4
to get 1000 Thus, 4 can become a fingerprint of the number 4000. Dividing 4000 by 4
will always yield 1000. If we change either 4000 or 4, the result will not be 1000.
Another important point is, if we are simply given the number 4, but are not given any
further information, we would not be able to trace back the equation 4 x 1000 = 4000.
Thus, we have one more important concept here. The fingerprint of a message (in this
case, the number 4) does not tell anything about the original message (in this case, the
number 4000). This is because there are infinite other possible equations, which can
produce the result 4.
Another simple example of message digest: Let us assume that we want to calculate
the message digest of a number 7391753. Then, we multiply each digit in the number
with the next digit (excluding it if it is 0), and discarding the first digits of the
multiplication operation, if the result is a two-digit number.
Thus, we perform a hashing operation (or a message digest algorithm) over a block of
data to produce its hash or message digest, which is smaller in size than the original
message. This concept is shown in fig.
Actually, the message digests are not so small and straightforward to compute.
Message digests usually consist of 128 or more bits. This means that the chance of any
two-message digests being the same is anything between 0 and at least 2128. The
message digest length is chosen to be so long with a purpose. This minimizes that the
scope for two messages digests being the same.

Requirement of a Message Digest

We can summarize the requirements of the message digest concept, as follows:
(1) Given a message, it should be very easy to find its corresponding message digest.
Also for a given message, the message digest must always be the same.
(2) Given a message digest, it should be very difficult to find the original message for
which the digest was created.
(3) Given any two messages, if we calculate their message digests, the two message
digests must be different.
Another basis of message digest is that it should not give any clue or indication of the
original message. i.e. it should not be possible to revert back to original message from the
digest. Also, for a given message it's digest should be the same always.
Different algorithms are used to convert original message into its message digest. The
popularly used ones are MD5 or Message Digest 5 (developed by Rivest) a modified
version of earlier MD4, MD3 and MD2, while the first one was simply MD, and the SHA
(Secure Hash Algorithm) developed by National Institute of Standards and Technology
(NISI) in 1993. SHA-l is promoted & prominently used than the MD5 algorithm.

7391753

7  3 = 21 9  7 = 63

1  9 = 09 3  5 = 15

9  1 = 09 5  3 = 15

Fig. 5.27

Fig. 5.28
MD5:
In cryptography, MD5 (Message-Digest algorithm 5) is a widely used, partially
insecure cryptographic hash function with a 128-bit hash value. As an Internet standard
(RFC 1321), MD5 has been employed in a wide variety of security applications, and is
also commonly used to check the integrity of files. An MD5 hash is typically expressed
as a 32 digit hexadecimal number.
 MD5 was designed by Ron Rivest in 1991 to replace an earlier hash function, MD4. In
2007 a group of researchers including Arjen Lenstra described how to create a pair of
files that share the same MD5 checksum
MD5 Algorithm Description:
We begin by supposing that we have a 1000-bit message as input, and that we wish to
find its message digest.
The following five steps are performed to compute the message digest of the message.
Step 1: Append Padding Bits:
The message is "padded" (extended) so that its length (in bits) is Similar to 448,
modulo 512. That is, the message is extended so that it is just 64 bits timid of being a
multiple of 512 bits long. Padding is always performed, even if the length of the message
is already similar to 448, modulo 512. Padding is performed as follows: a single "1" bit is
appended to the message, and then "0" bits are appended so that the length in bits of the
padded message becomes congruent to 448, modulo 512. In all, at least one bit and at
most 512 bits are appended.
Step 2: Append Length:
A 64-bit representation of 1000 (The message length excluding padded one) is
appended to the result of the previous step.
In the unlikely event that the message length is greater than 2^64, then only the low-
order 64 bits of b are used.
At this point the resulting message (that is message + padding + length) has a length
that is an exact multiple of 512 bits. Equivalently, this message has a length that is an
exact multiple of 16 (32-bit) words.
Step 3: Divide the input into 512-bit blocks:
Now, we divide the input message into blocks, each of length 512 bits.
Step 4: Initialize MD Buffer/Chaining Variables:
A four-word buffer (A, B, C, D) is used to compute the message digest. Here each of
A, B, C, D is a 32-bit register. These registers are initialized to the following values in
hexadecimal, low-order bytes first):
A: 01 23 45 67
B: 89 ab cd ef
C:fe dc ba 98
D: 76 54 32 10
Step 5: Process Message in 16-Word Blocks:

5.1: Copy the four chaining variables into four corresponding

variables a, b, c, and d. The Algorithm considers the
combination of abcd as a 128 bit single registers. This is
useful for holding intermediate as well as final results.

5.2: Divide the current 512 bit block into 16 sub blocks of 32
bit each.

5.3: Now we have 4 rounds. In each round, we process all the

16 sub blocks.

The inputs to each round are:

(1) All the 16 sub-blocks. Say M[0] to M[15] of 32 bits.
(2) The variables a, b, c and d of 32 bits.
(3) Some constants t, an array of 64 elements. Say t[1] to t[64].Since there are four
rounds, we use 16 out of the 64 values of t in each round.
The Process of Rounds:
(1) A process P is first performed on b, c and d. This process P is different in all the four
rounds.
(2) The variable a is added to the output of the process P.
(3) The message sub-block M[I] is added to the output of step 2.
(4) The constant t[k] is added to the output of step 3.
(5) The output of step 4 is circular-left shifted by s bits. The value of s keeps changing.
(6) The variable b is added to the output of step 5.
(7) The output of step 6 becomes the new abcd for the next round.
One MD5 Operation:

a b c d

Process P

ADD

M [I] ADD

T [K] ADD

SHIFT

ADD

a b c d

Fig. 5.29
We define four auxiliary functions that is Process P in our context, that each take as
input of three 32-bit words and produce as output one 32-bit word.

Round 1 = (b and c) or (not (b)) and d

Round 2 = (b and d) or (c and (not(c)))

Round 3 = b xor c xor d

Round 4 = c xor (b or not (d))

For any encryption approach, there are two major challenges:

Key distribution: how do we convey keys to those who need them to establish secure
communication.
Key management: given a large number of keys, how do we preserve their safety and
make them available as needed.
Public Key Infrastructure:

Symmetric
6) Alice and Bob agree on a cryptosystem
7) Alice and Bob agree on a key
8) Alice takes her plaintext message and encrypts it using the encryption algorithm
and the key. This creates a ciphertext message
9) Alice sends the ciphertext message to Bob
10) Bob decrypts the ciphertext message with the same algorithm and key and reads
it.
Asymmetric
5) Alice and Bob agree on a public-key cryptosystem
6) Bob sends Alice his public key
7) Alice encrypts her message using Bob’s public key and sends it to Bob
8) Bob decrypts Alice’s message using his private key
Problems:
Symmetric
• Keys must be distributed in secret
• If a key is compromised, Eve (eavesdropper) can
 decrypt any message
 pretend to be one of the parties
• A network requires a great number of keys
Asymmetric
• slow (~1000 times slower than the symmetric)
• vulnerable to chosen-plaintext attacks
 Private – Key Cryptography:
• Traditional private/secret/single key cryptography uses one key
• Key is shared by both sender and receiver
• if the key is disclosed communications are compromised
• also known as symmetric, both parties are equal
– hence does not protect sender from receiver forging a message & claiming
is sent by sender
Public Key Cryptography:
• Probably most significant advance in the 3000 year history of cryptography
• Uses two keys – a public key and a private key
• asymmetric since parties are not equal
• uses clever application of number theory concepts to function
• complements rather than replaces private key cryptography
• public-key/two-key/asymmetric cryptography involves the use of two keys:
• a public-key, which may be known by anybody, and can be used to
encrypt messages, and verify signatures
• a private-key, known only to the recipient, used to decrypt messages,
and sign (create) signatures
 • is asymmetric because
• those who encrypt messages or verify signatures cannot decrypt messages
or create signatures
• public-key/two-key/asymmetric cryptography involves the use of two keys:
• a public-key, which may be known by anybody, and can be used to
encrypt messages, and verify signatures
• a private-key, known only to the recipient, used to decrypt messages,
and sign (create) signatures
• is asymmetric because
• those who encrypt messages or verify signatures cannot decrypt messages
or create signatures

Why Public Key Cryptography:

• developed to address two key issues:

– key distribution – how to have secure communications in general without
having to trust a KDC with your key
– digital signatures – how to verify a message comes intact from the
claimed sender
Public Key Characteristics:
• public invention due to Whitfield Diffie& Martin Hellman at Stanford U. in 1976
– known earlier in classified community
 – Public-Key algorithms rely on two keys with the characteristics that it is:
– computationally infeasible to find decryption key knowing only algorithm
& encryption key
– computationally easy to en/decrypt messages when the relevant
(en/decrypt) key is known
– either of the two related keys can be used for encryption, with the other
used for decryption (in some schemes)

Public Key applications:

• can classify uses into 3 categories:
– encryption/decryption (provide secrecy)
– digital signatures (provide authentication)
– key exchange (of session keys)
• some algorithms are suitable for all uses, others are specific to one
Security of Public key schemes:
• like private key schemes brute force exhaustive search attack is always
theoretically possible
• but keys used are too large (>512bits)
• security relies on a large enough difference in difficulty between easy
(en/decrypt) and hard (cryptanalyse) problems
• more generally the hard problem is known, its just made too hard to do in
practise
• requires the use of very large numbers
• hence is slow compared to private key schemes
Chapter 8:
1. Hash Functions
2. Key Predistribution
3. Diffie-Hellmean Key Exchange
4. Kerberos
5. The station – to – station Protocol
1. Hash Funtions:

Message Authentication;
message authentication is concerned with:
protecting the integrity of a message
validating identity of originator
non-repudiation of origin (dispute resolution)
will consider the security requirements
then three alternative functions used:
message encryption
message authentication code (MAC)
hash function
Security Requirements:
disclosure
traffic analysis
masquerade
content modification
sequence modification
timing modification
source repudiation
destination repudiation
Message Encryption:
message encryption by itself also provides a measure of authentication
if symmetric encryption is used then:
receiver know sender must have created it
since only sender and receiver now key used
know content cannot of been altered
if message has suitable structure, redundancy or a checksum to detect any
 changes
if public-key encryption is used:
encryption provides no confidence of sender
since anyone potentially knows public-key
however if
sender signs message using their private-key
then encrypts with recipients public key
have both secrecy and authentication
again need to recognize corrupted messages
but at cost of two public-key uses on message
1.1.Message Authentication Code (MAC):
generated by an algorithm that creates a small fixed-sized block
depending on both message and some key
like encryption though need not be reversible
appended to message as a signature
receiver performs same computation on message and checks it matches the MAC
provides assurance that message is unaltered and comes from sender

can also use encryption for secrecy

generally use separate keys for each
can compute MAC either before or after encryption
is generally regarded as better done before
why use a MAC?
sometimes only authentication is needed
sometimes need authentication to persist longer than the encryption (eg.
archival use)
note that a MAC is not a digital signature
MAC Properties:
 a MAC is a cryptographic checksum
MAC = CK(M)
condenses a variable-length message M
using a secret key K
to a fixed-sized authenticator
is a many-to-one function
potentially many messages have same MAC
but finding these needs to be very difficult
Requirements for MACs:
taking into account the types of attacks
need the MAC to satisfy the following:

1. knowing a message and MAC, is infeasible to find another message with

same MAC
2. MACs should be uniformly distributed
3. MAC should depend equally on all bits of the message
Using Symmetric Ciphers for MACs:
can use any block cipher chaining mode and use final block as a MAC
Data Authentication Algorithm (DAA) is a widely used MAC based on DES-
CBC
using IV=0 and zero-pad of final block
encrypt message using DES in CBC mode
and send just the final block as the MAC
• or the leftmost M bits (16≤M≤64) of final block
but final MAC is now too small for security
can use any block cipher chaining mode and use final block as a MAC
Data Authentication Algorithm (DAA) is a widely used MAC based on DES-
CBC
using IV=0 and zero-pad of final block
encrypt message using DES in CBC mode
and send just the final block as the MAC
• or the leftmost M bits (16≤M≤64) of final block
but final MAC is now too small for security
Hash Functions:
condenses arbitrary message to fixed size
h = H(M)
usually assume that the hash function is public and not keyed
cf. MAC which is keyed
hash used to detect changes to message
can use in various ways with message
most often to create a digital signature

1.2.Requirements for Hash Functions:

1. can be applied to any sized message M

2. produces fixed-length output h
3. is easy to compute h=H(M) for any message M
4. given h is infeasible to find x s.t. H(x)=h
•
one-way property
5. given x is infeasible to find y s.t. H(y)=H(x)
•
weak collision resistance
6. is infeasible to find any x,ys.t. H(y)=H(x)
•
strong collision resistance

Simple Hash Functions:

are several proposals for simple functions
based on XOR of message blocks
not secure since can manipulate any message and either not change hash or change
has also need a stronger cryptographic function (next chapter)
1.3.Birthday Attacks:
might think a 64-bit hash is secure
but by Birthday Paradox is not
birthday attack works thus:
opponent generates 2m/2 variations of a valid message all with
essentially the same meaning
opponent also generates 2m/2 variations of a desired fraudulent message
two sets of messages are compared to find pair with same hash (probability
> 0.5 by birthday paradox)
have user sign the valid message, then substitute the forgery which will
have a valid signature
conclusion is that need to use larger MAC/hash
Block Ciphers as Hash Functions:
can use block ciphers as hash functions
using H0=0 and zero-pad of final block
compute: Hi = EMi [Hi-1]
and use final block as the hash value
similar to CBC but without a key
resulting hash is too small (64-bit)
both due to direct birthday attack
and to “meet-in-the-middle” attack
other variants also susceptible to attack
Hash Functions & MAC Security:
like block ciphers have:
brute-force attacks exploiting
strong collision resistance hash have cost 2m/2
•
have proposal for h/w MD5 cracker
•
128-bit hash looks vulnerable, 160-bits better
MACs with known message-MAC pairs
•
can either attack keyspace (cf key search) or MAC
•
at least 128-bit MAC is needed for security
cryptanalytic attacks exploit structure
 like block ciphers want brute-force attacks to be the best alternative

have a number of analytic attacks on iterated hash functions

CVi = f[CVi-1, Mi]; H(M)=CVN
typically focus on collisions in function f
like block ciphers is often composed of rounds
attacks exploit properties of round functions

1.5.Hash and MAC Algorithms:

Hash Functions
condense arbitrary size message to fixed size
by processing message in blocks
through some compression function
either custom or block cipher based
Message Authentication Code (MAC)
fixed sized authenticator for some message
to provide authentication for message
by using block cipher mode or hash function

Most important modern hash functions follow the basic structure shown in this figure.
This has proved to be a fundamentally sound structure, and newer designs simply refine
the structure and add to the hash code length. Within this basic structure, two approaches
have been followed in the design of the compression function, as mentioned previously,
which is the basic building block of the hash function.
Secure Hash Algorithm:

 SHA originally designed by NIST & NSA in 1993

 was revised in 1995 as SHA-1
 US standard for use with DSA signature scheme
o standard is FIPS 180-1 1995, also Internet RFC3174
o nb. the algorithm is SHA, the standard is SHS
 based on design of MD4 with key differences
 produces 160-bit hash values
 recent 2005 results on security of SHA-1 have raised concerns on its use in
future applications
Revised Secure Hash Standard:
NIST issued revision FIPS 180-2 in 2002
adds 3 additional versions of SHA
SHA-256, SHA-384, SHA-512
designed for compatibility with increased security provided by the AES cipher
structure & detail is similar to SHA-1
hence analysis should be similar
but security levels are rather higher
SHA-512 Overview:
SHA-512 Compression Function:

heart of the algorithm

processing message in 1024-bit blocks
consists of 80 rounds
updating a 512-bit buffer
using a 64-bit value Wt derived from the current message block
and a round constant based on cube root of first 80 prime numbers
Keyed Hash Functions as MACs:
want a MAC based on a hash function
because hash functions are generally faster
code for crypto hash functions widely available
hash includes a key along with message
original proposal:
KeyedHash = Hash(Key|Message)
some weaknesses were found with this
eventually led to development of HMAC
1.6.HMAC:
specified as Internet standard RFC2104
uses hash function on the message: HMACK =
Hash[(K+ XOR opad) ||
Hash[(K+ XOR ipad)||M)]]
where K+ is the key padded out to size
and opad, ipad are specified padding constants
overhead is just 3 more hash calculations than the message needs alone
any hash function can be used
eg. MD5, SHA-1, RIPEMD-160, Whirlpool
HMAC Security:
proved security of HMAC relates to that of the underlying hash algorithm
attacking HMAC requires either:
brute force attack on key used
birthday attack (but since keyed would need to observe a very large number
of messages)
choose hash function used based on speed verses security constraints

1.7.CMAC:
previously saw the DAA (CBC-MAC)
widely used in govt& industry
but has message size limitation
can overcome using 2 keys & padding
thus forming the Cipher-based Message Authentication Code (CMAC)
adopted by NIST SP800-38B
 2. Kerberos:

Kerberos:
trusted key server system from MIT
provides centralised private-key third-party authentication in a distributed network
allows users access to services distributed through network
without needing to trust all workstations
rather all trust a central authentication server
two versions in use: 4 & 5
2.1. Kerberos Requirements:
its first report identified requirements as:
secure

reliable
transparent
scalable
implemented using an authentication protocol based on Needham-Schroeder
2.2.Kerberos v4 Overview:
a basic third-party authentication scheme
have an Authentication Server (AS)
users initially negotiate with AS to identify self
AS provides a non-corruptible authentication credential (ticket granting
ticket TGT)
have a Ticket Granting server (TGS)
 users subsequently request access to other services from TGS on basis of
users TGT
2.3. Kerberos v4 Dialogue:
1. obtain ticket granting ticket from AS
•
once per session
2. obtain service granting ticket from TGT
•
for each distinct service required
3. client/server exchange to obtain service
•
on every service request

2.4. Kerberos Realms:

a Kerberos environment consists of:
a Kerberos server
a number of clients, all registered with server
application servers, sharing keys with server
this is termed a realm
 typically a single administrative domain
if have multiple realms, their Kerberos servers must share keys and trust

2.5.Kerberos Version 5:
developed in mid 1990’s
specified as Internet standard RFC 1510
provides improvements over v4
addresses environmental shortcomings
•
encryption alg, network protocol, byte order, ticket
lifetime, authentication forwarding
and technical deficiencies
•
double encryption, non-std mode of use, session keys, password
attacks
 3. Diffie-Hellman Key Exchange:
Diffie-Hellman’s Algorithm:
 Key agreement is a method to create secret key by exchanging only public keys.
 Example:
o Bob sends Alice his public key
o Alice sends Bob her public key
o Bob uses Alice’s public key and his private key to generate a session key
o Alice uses Bob’s public key and her private key to generate a session key
o Using a key agreement algorithm both will generate same key
o Bob and Alice do not need to transfer any key

Generate Secret Generate Secret

Random Number x Random Numbery
Bob Alice
exchange
Compute Public public keys Compute Public
Key ax mod p Key ay mod p

Compute Session Compute Session

Key (ay)x mod p Key (ax) y mod p

Identical Secret Kay

Bob & Alice agree on non-secret prime p and value a

 Diffie-Hellman is the first key agreement algorithm
o Invented by Whitfield Diffie & Martin Hellman
o Provided ability for messages to be exchanged securely without having to have
shared some information previously
o Inception of public key cryptography which allowed keys to be exchanged in the
open
 No exchange of secret keys
o Man-in-the middle attack avoided
Authentication:
Authentication is the process of determining the authenticity of a message or user.
Two types of authentication:
 Authentication of the identity presented by a remote or application participating in a
session
 Authentication of the sender’s identity is presented along with a message.
 Use of secret character string only known to user and server
 Problems with password based authentication:
o Attacker learns password by social engineering
o Attacker cracks password by brute-force and/or guesswork
o Eavesdrops password if it is communicated unprotected over the network
o Replays an encrypted password back to the authentication server
Set of rules that governs the communication of data related to authentication between
the server and the user
 Techniques used to build a protocol are:
o Transformed password
 Password transformed using one way function before transmission
 Prevents eavesdropping but not replay
o Challenge-response
 Server sends a random value (challenge) to the client along with the
authentication request. This must be included in the response
 Protects against replay
o Time Stamp
 The authentication from the client to server must have time-stamp embedded
 Server checks if the time is reasonable
 Protects against replay
 Depends on synchronization of clocks on computers
o One-time password
 New password obtained by passing user-password through one-way function
n times which keeps incrementing
 Protects against replay as well as eavesdropping
Personal Tokens are hardware devices that generate unique strings that are usually
used in conjunction with passwords for authentication
 Different types of tokens exist
 o Storage Token: A secret value that is stored on a token and is available after the
token has been unlocked using a PIN.
o Synchronous one-time password generator: Generate a new password periodically
(e.g. each minute) based on time and a secret code stored in the token.
o Challenge-response: Token computes a number based on a challenge value sent
by the server.
o Digital Signature Token: Contains the digital signature private key and computes
a computes a digital signature on a supplied data value.
 A variety of different physical forms of tokens exist

4.Station – to Station Protocol:

• The Station-to-Station (STS) protocol adds authentication:

1. A ® B : tA
2. B ® A : tB , { SignB(tA, tB ) }Kab
3. A ® B : { SignA(tA, tB ) }Kab

1. A ® B : A, B, tA
2. B ® A : B, A, tB , { SignB(tA, tB ) }Kab
3. A ® B : A, B, { SignA(tA, tB ) }Kab
• Good Key: as before Key
• Key Confirmation: A knows that B knows the Kab.

1. A ® E(B) : A, B, tA
1’. E ® B : E, B, tA
2’. B ® E : B,E,tB,{SignB(tA,tB)}Kab
2. E(B) ® A : B,A,tB,{SignB(tA,tB)}Kab
3. A ® E(B) : A, B, { SignA(tA, tB ) }Kab

4.1.What does STS Provides:

• Attacker E does NOT learn the key.

• B does not accept the key.
• But A does accept the key.
This can be fixed by changing line 2 to:
2. B ® A : tB , { A, SignB(tA, tB ) }Kab
This is not done because this attack does not pose a real risk.
In this case Key Confirmation is enough
4.2.Security Properties of STS
• the scheme is secure against known session key attacks and provides perfect forward
secrecy
• the scheme is a secure mutual identification scheme (i.e., if the adversary is active
during a given flow of the protocol, then no honest participant will “accept” after that
time)
• in addition, the scheme is a secure KAS wrt a passive adversary (i.e., U and V can both
compute the same session key, K,and the adversary cannot compute any information
about K)
• if U “accepts”, it means that she believes that – she has been communicating with V – U
and V can compute the same session key, and – no one other than V can compute any
information about the session key.
4.3. Key Authentication and Key Confirmation:
Suppose U and V are honest, and they execute an SKDS or KAS. At the end of the
session, U and V should each be able to compute the same session key,K, whose value
should be unknown to the adversary. Suppose that U “accepts”. The following properties
discuss various types of assurance that may be provided to U :
implicit key authentication
U is assured that no one other than V can compute K
implicit key confirmation
U is assured that V can compute K, and no one other than V can compute K
explicit key confirmation
U is assured that V has computed K, and no one other than V can compute K
Chapter 9:
1. Firewalls
2. TCP
3. VPN

1.Firewalls:
INTRODUCTION:
1.1.What are Firewalls?
The Internet is a vital and growing network that is changing the way many
organizations and individuals communicate and do business. Using the Internet we can
get connected to any other computer, no matter how far the two are located from each
other on the network. However, the Internet suffers from significant and widespread
security problems. Many agencies and organizations have been attacked or probed by
intruders, with resultant high losses to productivity and reputation. In some cases,
organizations have had to disconnect from the Internet temporarily, and have invested
significant resources in correcting problems with system and network configuration. Sites
that are unaware of or ignorant of these problems face a significant risk that network
intruders will attack them. Even sites that do observe good security practices face
problems with new vulnerabilities in networking software and the persistence of some
intruders. But this facility usually may be a nightmare for network support staff, which is
left with a very difficult job of trying to protect the corporate networks from a variety of
attacks. At a broad level, there are two kinds of attacks:
(1) Most corporations have large amounts of valuable and confidential data in their
networks. Leaking of this critical information to competitors can be a great setback.
(2) Apart from the danger of the insider information leaking out, there is a great danger
of the outside elements (such as viruses and Worms) entering a corporate network to
create havoc.
(a) Some of the problems with Internet security are a result of inherent
vulnerabilities in the services (and the protocols that the services implement),
while others are a result of host configuration and access controls that are poorly
implemented or overly complex to administer.
 (b) Additionally, the role and importance of system management is often short-
changed in job descriptions, resulting in many administrators being, at best, part-
time and poorly prepared. We will talk about these problems in detail.
The Security Related Problems in the Internet:
Vulnerable:
TCP/IP services - a number of the TCP/IP services are not secure and can
be compromised by knowledgeable intruders; services used in the local area-
networking environment for improving network management are especially vulnerable.
Ease of spying and spoofing:
The majority of Internet traffic is unencrypted; e-mail, passwords, and file transfers
can be monitored and captured using readily available software, intruders can then reuse
passwords to break into systems.
Lack of policy:
Many sites are configured unintentionally for wide-open Internet access without
regard for the potential for abuse from the Internet; many sites permit more
TCP/IP services than they require for their operations and do not attempt to limit access
to information about their computers that could prove valuable to intruders.
Complexity of configuration:
Host security access controls are often complex to configure and monitor; controls that
is accidentally misconfigured often result in unauthorized access.
As a result of these dangers, we must have mechanisms which can ensure that the
inside information remains inside, and also prevents the outsider attackers from entering
inside a corporate network. This is where a firewall is needed.
A firewall acts like a guard, which can guard a corporate network by standing
between the network and the outside world. A firewall is a network security system
designed to prevent unauthorized access to a private network from any other network. It
works closely with a router program to determine if a packet should be forwarded to its
destination. It also provides a proxy service that makes network requests on behalf of the
users on a network.
All traffic between the network and the Internet in either direction must pass through
the firewall. The firewall decides if the traffic can be allowed to flow, or whether it must
be stopped from proceeding further. Technically, therefore, a firewall is specialized
version of a router. Apart from the basic routing functions and rules, a router can be
configured to perform the firewall functionality with the help of additional software
resources.

Fig. 4.30 Architecture of Firewall

1.2.Need of firewall:
The Internet, like any other society, is plagued with the kind of jerks who enjoy the
electronic equivalent of writing on other people's walls with spray paint, tearing their
mailboxes off, or just sitting in the street blowing their car horns. Some people try to get
real work done over the Internet, and others have sensitive or proprietary data they must
protect. Usually, a firewall's purpose is to keep the jerks out of your network while still
letting you get your job done.
Many traditional-style corporations and data centers have computing security policies
and practices that must be adhered to. In a case where a company's policies dictate how
data must be protected, a firewall is very important, since it is the embodiment of the
corporate policy. Frequently, the hardest part of hooking to the Internet, if you're a large
company, is not justifying the expense or effort, but convincing management that it's safe
to do so. A firewall provides not only real security--it often plays an important role as a
security blanket for management.
Lastly, a firewall can act as your corporate “ambassador'' to the Internet. Many
corporations use their firewall systems as a place to store public information about
corporate products and services, files to download, bug fixes, and so forth. Several of
these systems have become important parts of the Internet service structure (e.g.:
UUnet.uu.net, whitehouse.gov, gatekeeper.dec.com) and have reflected well on their
organizational sponsors.
The following list summarizes the primary benefits of using a firewall.
(1) Protection from Vulnerable Services.
(2) Controlled Access to Site Systems.
(3) Concentrated Security.
(4) Enhanced Privacy.
(5) Logging and Statistics on Network Use, Misuse.
(6) Policy Enforcement.
1.3.What can a firewall protect against?
(1) Some firewalls permit only email traffic through them, thereby protecting the
network against any attacks other than attacks against the email service. Other
firewalls provide less strict protections, and block services that are known to be
problems.
(2) Generally, firewalls are configured to protect against unauthenticated interactive
logins from the “outside'' world. This, more than anything, helps prevent vandals
from logging into machines on your network. More elaborate firewalls block traffic
from the outside to the inside, but permit users on the inside to communicate freely
with the outside. The firewall can protect you against any type of network-borne
attack if you unplug it.
(3) Firewalls are also important since they can provide a single “choke point'' where
security and audit can be imposed. Unlike in a situation where someone dialing in
with a modem is attacking a computer system, the firewall can act as an effective
“phone tap” and tracing tool. Firewalls provide an important logging and auditing
function; often they provide summaries to the administrator about what kinds and
amount of traffic passed through it, how many attempts there were to break into it,
etc.
(4) This is an important point: providing this “choke point'' can serve the same purpose
on your network as a guarded gate can for your site's physical premises. That means
anytime you have a change in “zones'' or levels of sensitivity, such a checkpoint is
appropriate. A company rarely has only an outside gate and no receptionist or
security staff to check badges on the way in. If there are layers of security on your
site, it's reasonable to expect layers of security on your network.
1.4.What can't a firewall protect against?
(1) Firewalls can't protect against attacks that don't go through the firewall. Many
corporations that connect to the Internet are very concerned about proprietary data
leaking out of the company through that route. Unfortunately for those concerned, a
magnetic tape can just as effectively be used to export data. Many organizations that
are terrified (at a management level) of Internet connections have no coherent policy
about how dial-in access via modems should be protected. It's silly to build a 6-foot
thick steel door when you live in a wooden house, but there are a lot of organizations
out there buying expensive firewalls and neglecting the numerous other back-doors
into their network.
(2) For a firewall to work, it must be a part of a consistent overall organizational
security architecture. Firewall policies must be realistic and reflect the level of
security in the entire network. For example, a site with top secret or classified data
doesn't need a firewall at all: they shouldn't be hooking up to the Internet in the first
place, or the systems with the really secret data should be isolated from the rest of
the corporate network.
(3) Another thing is that a firewall can't really protect you against the traitors or idiots
inside your network. While an industrial spy might export information through your
firewall, he's just as likely to export it through a telephone, FAX machine, or floppy
disk. Floppy disks are a far more likely means for information to leak from your
organization than a firewall! Firewalls also cannot protect you against stupidity.
Users who reveal sensitive information over the telephone are good targets for social
engineering; an attacker may be able to break into your network by completely
bypassing your firewall, if he can find a “helpful'' employee inside who can be
fooled into giving access to a modem pool.
(4) Before deciding this isn't a problem in your organization, ask yourself how much
trouble a contractor has getting logged into the network or how much difficulty a
user who forgot his password has getting it reset. If the people on the help desk
believe that every call is internal, you have a problem.
(5) Lastly, firewalls can't protect against tunneling over most application protocols to
roamed or poorly written clients. There are no magic bullets and a firewall is not an
excuse to not to implement software controls on internal networks or ignores host
security on servers. Tunneling “bad'' things over HTTP, SMTP, and other protocols
is quite simple and trivially demonstrated. Security isn't “fire and forget''.
 The characteristics of a good firewall can be described as follows:
(1) All traffic from inside to outside, and vice versa must pass through the firewall. To
achieve this, all the access to the local network must first be physically blocked, and
access only via the firewall should be permitted.
(2) Only the traffic authorized as per the local security policy should be allowed to pass
through.
(3) The firewall itself must be strong enough, so as to render attacks on it useless.
The word 'firewall' has come from a kind of arrangement in automobiles, to prevent
the passengers from engine components. The firewalls in computers also work with
similar concept. It is defined as 'the collection of components that are placed between the
local (unprotected) private network / workstation and the Internet (unprotected) which is
the external public network.
Firewalls come in various categories, configurations, set of devices and products,
which run on the hosts in the network. They work like logical security guards, which
keep an eye on the outgoing and incoming traffic.
1.5.Advantages of the Firewall:
(1) A firewall prevents unauthorized Internet users from accessing a private network
connected to the Internet.
(2) It enforces a security policy by allowing a single point for implementing and
controlling all security decisions to be made.
(3) It filters, monitors, and logs the sessions between any two networks. As a result, your
exposure to the Internet is also limited.
Limitation of the Firewall:
The main limitations of a firewall can be listed as follows:
(1) Insider's intrusion: A firewall system is designed to thwart outside attacks.
Therefore, if an inside user attacks the internal network in some way, the firewall
cannot prevent such an attack.
(2) Direct Internet traffic: A firewall must be configured very carefully. It is effective
only if it is the only-entry point of an organization's network. If, instead, the firewall
is one of the entry-exit points, a user can bypass the firewall and exchange
information with the Internet via the other entry exit points. This can open up the
 possibilities of attacks on the internal network through those points. The firewall
cannot, obviously be expected to take care of such situations.
(3) Virus attacks: A firewall cannot protect the internal network from virus threats.
This is because a firewall cannot be expected to scan every incoming file or packet
for possible virus contents. Therefore, a separate virus detection and removal
mechanism is required for preventing virus attacks. Alternatively, some vendors
bundle their firewall products with anti virus software, to enable both the features out
of the box.
(4) It needs specialized skills to configure, and many attacks occur because of badly
configured policies on a firewall.
1.6.KINDS OF FIREWALLS:
In general, the firewalls have been classified as per the work carried out by them.
They have two basic types:
(1) Network-Level Firewall (or) Packet Filtering and
(2) Application Level.
Based on these two primary types two more types have also resulted. They are:
(1) Circuit level gateways and
(2) Dynamic Firewall (or) Stateful Multi-layer inspection
Packet Filters:
This is the basic level of the firewalls. As the name suggests, this firewall checks for
each and every IP packet individually, either coming in or going out of private network.
A network level firewall uses the protocols on the two networks to filter the data.
Filtering systems are often built into routers or can be added optionally. The router being
a point of interconnection between two networks, it becomes a natural location for
filtering.

Fig. 4.31
Source: Basics of network security, firewalls and VPNs-NIIT.
According to the selected policies (called Rule-sets or Access Control Lists or ACLs)
it determines whether to accept a packet or reject it. This is the first line of defense
against the intruders, and is not totally foolproof. It has to be combined with other
techniques as well, to strengthen the security.
Advantages of packet filters:
(1) Simple and straightforward mechanism.
(2) It is cost effective.
(3) It is fairly effective and adequate in most cases.
(4) Operation is totally transparent to the users.
(5) Faster in operation.
(6) It has a built-in operating system optimized for security and performance. So it can
be plugged into a network, regardless of the OS being used.
Disadvantages of packet filters:
(1) It does not support user authentication as the filtering is based purely on the IP
address of the hardware system.
(2) Rule-sets to be defined for a packet filter may be very complex and rigid.
(3) In order to allow certain access, some exceptions to the rules need to be added. This
may add further to the complexity.
(4) Some packet filters do not filter on the source TCP/UDP ports at all, which may
increase the flaws in the filtering system.
(5) It does not allow you to record the logs of individual sessions. These do not possess
any auditing capabilities and auditing is considered to be of major importance in
security.
(6) All the applications on Internet may not be fully supported by packet filtering
firewalls.
(7) It does not conceal the internal architecture of the network and hence it gets exposed.
(8) Using packet filters may be complex as graphical interface is not available in most of
the cases.
Application level filtering:
An application gateway is also called as a proxy server. This is because it acts like a
proxy i.e. deputy or substitute, and decides about the flow of application level traffic.
An application gateway typically works as follows:
(1) An internal user contacts the application gateway using a TCP/IP application, such as
HTTP or TELNET.
(2) The application gateway asks the user about the remote host with which the user
wants to set up a connection for actual communication (i.e. its domain name or IP
address) The application gateway also asks for the user id and the password required
to access the services of the application gateway.
(3) The user provides the information to the application gateway.
(4) The application gateway now accesses the remote host on behalf of the user, and
passes the packets of the user to the remote host.

Fig. 4.32 An Application Level Firewall

Application gateways are generally more secure than packet filters, because rather
than examining every packet against a number of rules, we simply detect whether a user
is allowed to work with a TCP/IP application or not.
The disadvantage is the overhead in terms of connections. There are actually two sets
of connections now: one / between the end user and the application gateway, and another
between the application gateway and the remote host. The application gateway has to
manage these two sets of connections, and the traffic going between them. This means
that the actual communicating internal host is under an illusion.
The Application level firewalls work at the topmost layer in the network i. e. the
Application Layer. Hence, they can monitor the flow of information in great details. They
do not need to check each and every packet but rather check an application as a whole
and determine whether it should be allowed the access of a network both in-bound as
well as out-bound. Hence, they are more secure than the packet filters.
These are also called Application level gateways as they are between the local network
and the Internet. They require the policies to be set up by using specific software and
hence are NOT transparent to the end users.
Another variation in them is called a Proxy server. These are the hosts which
make/receive the requests to/from the Internet to the local network which they do on
behalf of the local clients. These provide a single point of entry for Internet traffic into
the, local network.
The Proxy servers work with two faces - one towards the local network (with an
internal I P address) and another towards the Internet (using an external lP address),
which is similar to the coin with two sides. Local network clients refer to it using its local
I P address whereas anyone from the Internet uses its external lP address for
communication.
The services, which are proxied, include FTP, DNS, TELNET, HTTP, SMTP and so
on. Thus, the application gateway allows the clients to think or believe that they are
getting the direct connection to the Internet; in fact it is routed always through the proxy
server.
Examples of Application level firewalls include Zone Lab's Zone Alarm, and Zone
Alarm-Pro, IBM firewall, Mc-A’fee Firewall, Norton Firewall, Linux based Mitel
Networks SME server, Squid proxy server, Wingate, Winproxy and many more with
various facilities and configurations.
Advantages of Application level fire walls:
(1) Checks traffic in greater details than the packet filters.
(2) No need to check each and every packet, but checks application as a whole.
(3) Provides more security than the packet filters.
(4) These are available as software with Graphical interface, hence specifying, changing
the Rule-sets is easier in this case.
(5) Ability to hide the structure, topology and other sensitive information of the private
network from the external parties.
(6) Has capability of complete auditing/logging of events, which is an important aspect
of security.
(7) Easier to install, setup and operate from the point of users (also called as personal
firewalls sometimes)
Disadvantages of Application level firewalls:
(1) Operation may be slower since it has to check the traffic in more detail.
(2) The software products used may be costly to procure.
(3) In some cases, setup may be difficult and require administrative help.
(4) They are not transparent to the end users, and may have to be set up specifically on
the client nodes.
(5) It does not support new services easily.
1.7.Circuit level Gateways:
Another variation of firewalls is called the Circuit Level Gateways. These are set to
run on the Transport level of TCP/IP model (or Session layer in case of the OSI model).
This check for the specific sessions or services for filtering. They neither check
individual packets nor the entire applications for filtering purpose. They are sometimes
called as the Relays which relay the sessions / services (also called circuits) for the users.
Normally they relay the services such as Telnet or FTP for the users. But in the process,
they tend to break the standard client-server model.
Thus, for every request/response, there will be two connections to be set-up: one from
the client machine to the firewall, and the second between the firewall to the external
server, and similarly in reverse way. But they provide the facility to control these
services. It is hence possible to enable/disable these services through the circuit gateways.
It performs some additional functions as compared to those performed by an
application gateway. A circuit gateway, in fact, creates a new connection between itself
and the remote host. The user is not aware of this, and thinks that there is a direct
connection between itself and the remote host. Also, the circuit gateway changes the
source IP addresses in the packets from the end user's IP address to its own. This way the
IP address of the internal network are hidden from the outer world.
The SOCKS server is an example of the real life implementation of a circuit gateway.
It is a client server application. The SOCKS client runs on the internal host, and, the
SOCKS server runs on the firewall.
Fig. 4.33
Advantages of Circuit level gateways:
(1) More secure than packet filters since work on higher level.
(2) Do not check individual packets inbound or outbound.
(3) Can hide internal network structure to the external entities.
(4) Flexibility to enable or disable sessions or services is available.
(5) Less expensive compared to the Application level products.
(6) Operation is transparent to the end-users
Disadvantages of Circuit level gateways:
(1) Less secure compared to application level gateways.
(2) Breaks the client-server model.
(3) Requires two dedicated connections to be set up for each service / response.
1.8.Dynamic (Stateful Multi-layer Inspection) Firewalls:
The last category of firewalls is the Dynamic also known as the Stateful, multi-layer
inspection type. As the name suggests it checks the traffic in multiple layers viz.
Application, Transport as well as Internet layer. Hence, it combines all the advantages of
the first three categories of firewalls. These are the recent type of firewalls being used.
They check the individual packets at the Internet layer, checks for valid sessions at the
Transport layer and evaluates the application at the topmost layer.
Another difference between this type and earlier ones is the awareness of a State and
the Dynamic nature of them. This means, the firewall can modify itself or can adapt to
changes in situations and can change the rules dynamically. This facility is not available
in any of the earlier types, which make this a more efficient. and hence they are known to
be Stateless. For this purpose the firewall needs to maintain some historical information
about all the transactions in a form called state tables. These state tables are updated as
and when new events are generated. These are used by the firewall to modify or update
the Rule-sets in different situations.
Examples of this type of firewall include Checkpoint's Firewall-1, Sun's Sunscreen
etc.

Fig. 4.34 Stateful Inspection

Advantages of Dynamic Firewalls:
(1) Scans the traffic in three different layers in great details.
(2) Provides much more security than in first three types of firewalls.
(3) Facility to adapt to the changes in the stage of network.
(4) More flexible in its operation due to its dynamic nature.
(5) Combines most of the advantages of first three types of firewalls.
Disadvantages of Dynamic Firewalls:
(1) Operation much slow may reduce the overall performance.
(2) Applications need to be procured, especially and can be expensive.
(3) Setup or implementation may be more difficult.
Distributed Firewalls:
 Provide multiple checkpoints less prone (is in multiple forms). Possible to prevent
inside attacks more secure implementation Servers can be outside perimeter more
flexibility in operation Different security levels possible
The Distributed firewalls are the host-resident security solutions, which protect the
enterprise network's critical end points against the intrusion. As the name suggests, the
firewall implementation is distributed over multiple points rather than providing a single-
point-entry into your network in case of traditional firewalls. With distributed firewalls,
one can provide separate level of security to the Web, Mail servers, Application servers
or individual nodes in the setup.
These are meant to provide higher security to the corporate networks. These can also
prevent the malicious inside attacks also within the network, as they treat all traffic as
unfriendly whether it is originating from the Internet or your Local network. This is more
important advantage, since most of the attacks are initiated from inside the network.
These firewalls also guard the individual machines the same way as the perimeter
firewall guards the entire network. .
These are like the personal firewalls but the additional features include the centralized
management, logging and fine access-control granularity. These are the prime
features considered for implementation of firewalls in larger enterprises. These protect
remote employees, precious servers of the enterprise, internal network as well as the
individual terminal. Presently, organizations of various types that are security conscious
are deploying the Distributed type of firewalls and have a scope of unlimited scalability
even keeping the same performance. In some cases, even the perimeter firewalls need not
be installed at all when distributed firewalls are deployed.
Fig. 4.35
Some key differences between the Traditional Firewall implementations and the
Distributed Firewall Implementations are as stated below.
Traditional Firewalls:
(a) Provide single entry point into the network.
(b) More prone to attacks.
(c) Cannot prevent inside attacks.
(d) Less secure implementation.
(e) Servers have to be inside perimeter.
(f) Has less flexibility of operation.
(g) Provides same level of security.

2.Virtual Private Network:

2.1.Introduction:

The virtual private network (VPN) technology included in Windows Server 2003 helps
enable cost-effective, secure remote access to private networks. VPN allows
administrators to take advantage of the Internet to help provide the functionality and
security of private WAN connections at a lower cost. In Windows Server 2003, VPN is
enabled using the Routing and Remote Access service. VPN is part of a comprehensive
network access solution that includes support for authentication and authorization
services, and advanced network security technologies.

There are two main strategies that help provide secure connectivity between private
networks and enabling network access for remote users.

Dial-up or leased line connections

A dial-up or leased line connection creates a physical connection to a port on a remote

access server on a private network. However, using dial-up or leased lines to provide
network access is expensive when compared to the cost of providing network access
using a VPN connection.

VPN connections

VPN connections use either Point-to-Point Tunneling Protocol (PPTP) or Layer Two
Tunneling Protocol/Internet Protocol security (L2TP/IPSec) over an intermediate
network, such as the Internet. By using the Internet as a connection medium, VPN saves
the cost of long-distance phone service and hardware costs associated with using dial-up
or leased line connections. A VPN solution includes advanced security technologies such
as data encryption, authentication, authorization, and Network Access Quarantine
Control.

Note

 Network Access Quarantine Control is used to delay remote access to a private

network until the configuration of the remote access computer has been examined
and validated.

Using VPN, administrators can connect remote or mobile workers (VPN clients) to
private networks. Remote users can work as if their computers are physically connected
to the network. To accomplish this, VPN clients can use a Connection Manager profile to
initiate a connection to a VPN server. The VPN server can communicate with an Internet
Authentication Service (IAS) server to authenticate and authorize a user session and
maintain the connection until it is terminated by the VPN client or by the VPN server. All
services typically available to a LAN-connected client (including file and print sharing,
Web server access, and messaging) are enabled by VPN.

VPN clients can use standard tools to access resources. For example, clients can use
Windows Explorer to make drive connections and to connect to printers. Connections are
persistent: Users do not need to reconnect to network resources during their VPN
sessions. Because drive letters and universal naming convention (UNC) names are fully
supported by VPN, most commercial and custom applications work without modification.

2.2.VPN Scenarios

Virtual private networks are point-to-point connections across a private or public network
such as the Internet. A VPN client uses special TCP/IP-based protocols, called tunneling
protocols, to make a virtual call to a virtual port on a VPN server. In a typical VPN
deployment, a client initiates a virtual point-to-point connection to a remote access server
over the Internet. The remote access server answers the call, authenticates the caller, and
transfers data between the VPN client and the organization’s private network.

To emulate a point-to-point link, data is encapsulated, or wrapped, with a header. The

header provides routing information that enables the data to traverse the shared or public
network to reach its endpoint. To emulate a private link, the data being sent is encrypted
for confidentiality. Packets that are intercepted on the shared or public network are
indecipherable without the encryption keys. The link in which the private data is
encapsulated and encrypted is known as a VPN connection.
There are two types of VPN connections:

 Remote access VPN

 Site-to-site VPN

Remote Access VPN

Remote access VPN connections enable users working at home or on the road to access a
server on a private network using the infrastructure provided by a public network, such as
the Internet. From the user’s perspective, the VPN is a point-to-point connection between
the computer (the VPN client) and an organization’s server. The exact infrastructure of
the shared or public network is irrelevant because it appears logically as if the data is sent
over a dedicated private link.

Site-to-Site VPN

Site-to-site VPN connections (also known as router-to-router VPN connections) enable

organizations to have routed connections between separate offices or with other
organizations over a public network while helping to maintain secure communications. A
routed VPN connection across the Internet logically operates as a dedicated WAN link.
When networks are connected over the Internet, as shown in the following figure, a router
forwards packets to another router across a VPN connection. To the routers, the VPN
connection operates as a data-link layer link.

A site-to-site VPN connection connects two portions of a private network. The VPN
server provides a routed connection to the network to which the VPN server is attached.
The calling router (the VPN client) authenticates itself to the answering router (the VPN
server), and, for mutual authentication, the answering router authenticates itself to the
calling router. In a site-to site VPN connection, the packets sent from either router across
the VPN connection typically do not originate at the routers.

2.3.VPN Connection Properties

PPTP-based VPN and L2TP/IPSec-based VPN connection properties are described in the
following sections.

Encapsulation

VPN technology provides a way of encapsulating private data with a header that allows
the data to traverse the network.

Authentication

There are three types of authentication for VPN connections:

User authentication

For the VPN connection to be established, the VPN server authenticates the VPN client
attempting the connection and verifies that the VPN client has the appropriate
permissions. If mutual authentication is being used, the VPN client also authenticates the
VPN server, providing protection against masquerading VPN servers.

The user attempting the PPTP or L2TP/IPSec connection is authenticated using Point-to-
Point (PPP)-based user authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP-TLS), Microsoft Challenge-Handshake
Authentication Protocol (MS-CHAP), Microsoft Challenge-Handshake Authentication
Protocol version 2 (MS-CHAP v2), Shiva Password Authentication Protocol (SPAP), and
Password Authentication Protocol (PAP). For PPTP connections, you must use EAP-
TLS, MS-CHAP, or MS-CHAP v2. EAP-TLS using smart cards or MS-CHAP v2 is
highly recommended, as they provide mutual authentication and are the most secure
methods of exchanging credentials.

Computer authentication with L2TP/IPSec

By performing computer-level authentication with IPSec, L2TP/IPSec connections also

verify that the remote access client computer is trusted.

Data authentication and integrity

To verify that the data being sent on an L2TP/IPSec VPN connection originated at the
other end of the connection and was not modified in transit, L2TP/IPSec packets include
a cryptographic checksum based on an encryption key known only to the sender and the
receiver.

Data Encryption

Data can be encrypted for protection between the endpoints of the VPN connection. Data
encryption should always be used for VPN connections where private data is sent across
a public network such as the Internet. Data that is not encrypted is vulnerable to
unauthorized interception. For VPN connections, Routing and Remote Access uses
Microsoft Point-to-Point Encryption (MPPE) with PPTP and IPSec encryption with
L2TP.

Address and Name Server Allocation

When a VPN server is configured, it creates a virtual interface that represents the
interface on which all VPN connections are made. When a VPN client establishes a VPN
connection, a virtual interface is created on the VPN client that represents the interface
connected to the VPN server. The virtual interface on the VPN client is connected to the
virtual interface on the VPN server, creating the point-to-point VPN connection.

The virtual interfaces of the VPN client and the VPN server must be assigned IP
addresses. The assignment of these addresses is done by the VPN server. By default, the
VPN server obtains IP addresses for itself and VPN clients using the Dynamic Host
Configuration Protocol (DHCP). Otherwise, a static pool of IP addresses can be
configured to define one or more address ranges, with each range defined by an IP
network ID and a subnet mask or start and end IP addresses.

Name server assignment, the assignment of Domain Name System (DNS) and Windows
Internet Name Service (WINS) servers to the VPN connection, also occurs during the
process of establishing the VPN connection.

2.4.Tunneling Overview

Tunneling is a method of using a network infrastructure to transfer data for one network
over another network. The data (or payload) to be transferred can be the frames (or
packets) of another protocol. Instead of sending a frame as it is produced by the
originating node, the tunneling protocol encapsulates the frame in an additional header.
The additional header provides routing information so that the encapsulated payload can
traverse the intermediate network.

The encapsulated packets are then routed between tunnel endpoints over the network.
The logical path through which the encapsulated packets travel through the network is
called a tunnel. After the encapsulated frames reach their destination on the network, the
frame is de-encapsulated (the header is removed) and the payload is forwarded to its final
destination. Tunneling includes this entire process (encapsulation, transmission, and de-
encapsulation of packets).

2.5.Tunneling Protocols

Tunneling enables the encapsulation of a packet from one type of protocol within the
datagram of a different protocol. For example, VPN uses PPTP to encapsulate IP packets
over a public network such as the Internet. A VPN solution based on either PPTP or
L2TP can be configured.

PPTP and L2TP depend heavily on the features originally specified for PPP. PPP was
designed to send data across dial-up or dedicated point-to-point connections. For IP, PPP
encapsulates IP packets within PPP frames and then transmits the encapsulated PPP-
packets across a point-to-point link. PPP was originally defined as the protocol to use
between a dial-up client and a network access server (NAS).

PPTP

PPTP allows multiprotocol traffic to be encrypted and then encapsulated in an IP header

to be sent across an organization’s IP network or a public IP network such as the Internet.
PPTP encapsulates Point-to-Point Protocol (PPP) frames in IP datagram’s for
transmission over the network. PPTP can be used for remote access and site-to-site VPN
connections. PPTP is documented in RFC 2637 in the IETF RFC Database.

PPTP uses a TCP connection for tunnel management and a modified version of Generic
Routing Encapsulation (GRE) to encapsulate PPP frames for tunneled data. The payloads
of the encapsulated PPP frames can be encrypted, compressed, or both. The following
figure shows the structure of a PPTP packet containing an IP datagram.

When using the Internet as the public network for VPN, the PPTP server is a PPTP-
enabled VPN server with one interface on the Internet and a second interface on the
intranet.

L2TP

L2TP allows multiprotocol traffic to be encrypted and then sent over any medium that
supports point-to-point datagram delivery, such as IP, X.25, frame relay, or asynchronous
transfer mode (ATM). L2TP is a combination of PPTP and Layer 2 Forwarding (L2F), a
technology developed by Cisco Systems, Inc. L2TP represents the best features of PPTP
and L2F. L2TP encapsulates PPP frames to be sent over IP, X.25, frame relay, or ATM
networks. When configured to use IP as its datagram transport, L2TP can be used as a
tunneling protocol over the Internet. L2TP is documented in RFC 2661 in the IETF RFC
Database.

L2TP over IP networks uses User Datagram Protocol (UDP) and a series of L2TP
messages for tunnel management. L2TP also uses UDP to send L2TP-encapsulated PPP
frames as tunneled data. The payloads of encapsulated PPP frames can be encrypted,
compressed, or both, although the Microsoft implementation of L2TP does not use MPPE
to encrypt the PPP payload. The following figure shows the structure of an L2TP packet
containing an IP datagram.
L2TP with IPSec (L2TP/IPSec)

In the Microsoft implementation of L2TP, IPSec Encapsulating Security Payload (ESP)

in transport mode is used to encrypt L2TP traffic. The combination of L2TP (the
tunneling protocol) and IPSec (the method of encryption) is known as L2TP/IPSec.
L2TP/IPSec is described in RFC 3193 in the IETF RFC Database.

The result after applying ESP to an IP packet containing an L2TP message is shown in
the following figure.

2.6.Routing for VPN

Routing for remote access and site-to-site VPN connections is described in the following
sections.

Routing for Remote Access VPN Connections

Conventional routing occurs between routers over either LAN-based shared access
technologies, such as Ethernet or Token Ring, or WAN-based point-to-point
technologies, such as T1 or frame relay.

Default Routing

The preferred method for directing packets to a remote network is to create a default
route on the remote access client that directs packets to the remote network (the default
configuration for VPN remote access clients). Any packet that is not intended for the
neighboring LAN segment is sent to the remote network. When a connection is made, the
remote access client, by default, adds a default route to its routing table and increases the
metric of the existing default route to ensure that the newest default route is used. The
newest default route points to the new connection, which ensures that any packets that are
not addressed to the local LAN segment are sent to the remote network.

Under this configuration, when a VPN client connects and creates a new default route,
Internet sites that have been accessible are no longer accessible (unless Internet access is
available through the organization’s intranet). This poses no problem for remote VPN
clients that require access only to the organization’s network. However, it is not
acceptable for remote clients that need access to the Internet while they are connected to
the organization’s network.

Split Tunneling

Split tunneling enables remote access VPN clients to route corporate-based traffic over
the VPN connection while sending Internet-based traffic using the user’s local Internet
connection. This prevents the use of corporate bandwidth for access to Internet sites.

However, a split tunneling implementation can introduce a security issue. If a remote

access client has reachability to both the Internet and a private organization network
simultaneously, the possibility exists that the Internet connection could be exploited to
gain access to the private organization network through the remote access client.
Security-sensitive companies can choose to use the default routing model to help ensure
that all VPN client communications are protected by the corporate firewall.

Routing for Site-to-Site VPN Connections

With conventional WAN technologies, IP packets are forwarded between two routers
over a physical or logical point-to-point connection. This connection is dedicated to the
customer across a private data network that is provided by the WAN service provider.

With the advent of the Internet, packets can now be routed between routers that are
connected to the Internet across a virtual connection that emulates the properties of a
dedicated, private, point-to-point connection. This type of connection is known as a site-
to-site VPN connection. Site-to-site VPN connections can be used to replace expensive
long-haul WAN links with short-haul WAN links to a local Internet service provider
(ISP).

A site-to-site VPN connection connects two portions of a private network. The VPN
server provides a routed connection to the network to which the VPN server is attached.
On a site-to-site VPN connection, the packets sent from either router across the VPN
connection typically do not originate at the routers.

To facilitate routing between the sites, each VPN server and the routing infrastructure of
its connected site must have a set of routes that represent the address space of the other
site. These routes can be added manually, or routing protocols can be used to
automatically add and maintain a set of routes.

Site-to-Site Routing Protocols

There are two routing protocols that can be used in a site-to-site VPN deployment:

 Routing Information Protocol (RIP)

 Open Shortest Path First (OSPF)

RIP

RIP is designed for exchanging routing information within a small to medium-size

network. RIP routers dynamically exchange routing table entries.

The Windows Server 2003 implementation of RIP has the following features:
  The ability to select which RIP version to run on each interface for incoming and
outgoing packets.

 Split-horizon, poison-reverse, and triggered-update algorithms that are used to

avoid routing loops and speed recovery of the network when topology changes
occur.

 Route filters for choosing which networks to announce or accept.

 Peer filters for choosing which router’s announcements are accepted.

 Configurable announcement and route-aging timers.

 Simple password authentication support.

 The ability to disable subnet summarization.

OSPF

OSPF is designed for exchanging routing information within a large or very large
network. Instead of exchanging routing table entries like RIP routers, OSPF routers
maintain a map of the network that is updated after any change to the network topology.
This map, called the link state database, is synchronized between all the OSPF routers
and is used to compute the routes in the routing table. Neighboring OSPF routers form an
adjacency, which is a logical relationship between routers to synchronize the link state
database.

3.Introduction to TCP:
TCP:
Because insiders are trusted, is it okay to allow outgoing TCP connections? Not
completely. Although the insiders might be trusted, it is not always certain that the code
they are running is behaving properly.
Applets running on users' machines are considered insiders.
There are ways that bad things can originate from the inside. Assume that the mail
filter is weeding out viruses and worms. That only works if users obtain their mail via
POP3 or IMAP.
 If mail is read through a Web-based server, such as Hotmail or Hushmail, there is little
to prevent the poor user from infection via these vectors. Once hit, the inside machine
may generate problematic outgoing TCP connections. (Imagine a dual-mode worm:
When it can, it spreads by direct attacks on vulnerable systems, but it also e-mails copies
of itself to users behind firewalls. Your imagination won’t be stretched very far; these
worms exist.)
Incoming TCP connections should not be allowed. If there is a strong need for access
to an internal machine from the outside, this should be handled via a dedicated proxy,
often from a machine on the DMZ.
If possible, use cryptographically enhanced services such as ssh. It is also best to limit
the sets of machines that can be reached; and, if possible, the set of machines that can
initiate access. The filtering rule for TCP can be summarized as follows:

Inbound and outbound queries can be summarised as:

Sr. Protocol Outbound Inbound Comment

No. Query response

(1) TCP Allow Block Generally

trust insider

NTP (Network Time Protocol)

There are now cheap, extremely accurate time devices available based on the Global
Positioning System and other radio sources. If these are not used, there are time sources
on the Internet. You should limit access to selected, trusted external servers.
If you have a close relationship with the outside time server, you may want to use
NTP’s built-in authentication mechanisms. It is also common to run an external NTP
server of your own and use the firewall to restrict insiders' access to that server alone.

Inbound and outbound queries can be summarised as:

Sr. Protocol Outbound Inbound Comment

No. Query response

(1) NTP Passive Block Put FTP

server in
DMZ

SSH:
 One of the principles of computer security is to trust as little as possible. Ssh is one of
the things we trust. As with Mail, it is thus crucial to keep up with bugs and patches. Ssh
has indeed had some serious security problems in the past. Ssh is reasonable to allow
through the firewall because it implements cryptographic authentication and encryption,
and is the best way we know of to allow access through a firewall.
Depending on your internal trust policies, you may want to terminate incoming ssh
connections at the firewall. Here you can do strong, centralized authentication. It's also
attractive to pretend that doing so prevents people or malicious programs from creating
back doors, but it's just that: a pretense. If you permit outbound TCP, it's easy to create
back doors, and ssh's port forwarding just lets Bad Guys do it a bit more easily, from the
command line. The rule for ssh is as follows:

Inbound and outbound queries can be summarised as:

Sr. Protocol Outbound Inbound Comment

No. Query response

(1) ssh allow allow Stay current on

patches

Telnet:
Telnet Services:
(1) Outbound Telnet Service
(2) Inbound Telnet Service
Outbound Telnet Service:
In an outbound telnet a local client is talking to a remote server. We need to handle
both outgoing and incoming packets. The outgoing packets contain the user’s keystrokes
and have the following characteristics.
(1) The IP Source address of the outgoing packets is the local host’s IP address.
(2) The IP Destination address of the outgoing packets is the remote host’s IP address.
(3) Telnet is a TCP-based service. So the IP packet type is TCP.
(4) The TCP Destination port is 23.
(5) The TCP Source port number is some seemingly random number greater than 1023
(6) The first outgoing packet, establishing the connection, will not have the ACK bit set;
the rest of the outgoing packets will.
 The incoming packets contain the data to be displayed on the user’s screen and have
the following characteristics.
(1) The IP Source address of the incoming packets is the remote host’s IP address.
(2) The IP Destination address is the local host’s IP address.
(3) The IP packet type is TCP.
(4) The TCP Source port is 23.That is the port the server use.
(5) The TCP Destination port number is the same random number greater than 1023 that
we used as the source port for the outgoing packets.
(6) All incoming packets will have the ACK bit set.

Fig. 4.36
Inbound telnet Services:
In the inbound telnet services a remote client communicates with a local telnet server.
We need to handle both incoming and the outgoing packets.
The incoming packets for the inbound telnet services contain the users keystrokes and
have the following characteristics:
(1) The IP source address of these packets in the remote host address.
(2) The IP destination address is the local host address.
(3) The IP packet type is TCP.
(4) The TCP source code is some random code number greater than 1023.
(5) The TCP destination port is 23.
(6) The TCP ACK bit will not be set on the very first inbound packet establishing the
connection, but it will be set on all other inbound packets.
The outgoing packet for this inbound telnet service contain the server responses and
have the following characteristics:
(1) The IP source address is the local host address
(2) The IP destination address is the remote host address
(3) The IP packet type is TCP
(4) The IP source port is 23
(5) The TCP destination port is the same random port “Z” that was used as a source port
for the inbound packets.
(6) The TCP ACK bit will be set on all outgoing packets.
Telnet Summary:
(1) Rule A allows packets out to remote telnet servers.
(2) Rule B allows the returning packets to come back in because it verifies that the ACK
bit is set, Rule B can be abused by an attacker to allow incoming TCP connections
from port 23 on the attackers end to port above 1023 on your end.
(3) Rule C is the default rule. If none of the preceding rules apply the packet is blocked.
Remember from your previous discussion that any blocked packet should be logged
and that it may or may not cause an ICMP message to be returned to the originator.
The following table illustrates the various types of packets involved in inbound and
outbound telnet services:

Service Packet Source Destination Packet Source Destination ACK

direction Direction Address Address type port Port Set

Outbound Outgoing Internal External TCP Y 23 a

Outbound Incoming External Internal TCP 23 Y Yes

Inbound Incoming External Internal TCP Z 23 a

Inbound Outgoing Internal External; TCP 23 Z yes

(A) The TCP ACK bit will be set on all but the first of these packets which establishes
the Connection.
Note that y and z are both random port numbers above 1023.
If u want to allow outgoing telnet, but nothing else you would set up your packet
filtering as follows:

Rule Direction Source Destination Protocol Source Destination ACK Action

Address Address port Port set

A Out Internal Any TCP >1023 23 Either Permit

B In Any Internal TCP 23 >1023 yes Permit

C Either Any Any Any Any Any Either Deny
Chapter 10
1. IP Security
2. SSL

1.IP Security:
have a range of application specific security mechanisms
eg. S/MIME, PGP, Kerberos, SSL/HTTPS
however there are security concerns that cut across protocol layers
would like security implemented by the network for all applications
general IP Security mechanisms
provides
authentication
confidentiality
key management
applicable to use over LANs, across public & private WANs, & for the Internet
1.1.IPSec Uses:
1.2.Benefits of IPSec;

in a firewall/router provides strong security to all traffic crossing the perimeter

in a firewall/router is resistant to bypass

is below transport layer, hence transparent to applications

can be transparent to end users

can provide security for individual users

secures routing architecture

1.3.IP Security Architecture:

specification is quite complex

defined in numerous RFC’s

incl. RFC 2401/2402/2406/2408

many others, grouped by category

mandatory in IPv6, optional in IPv4


have two security header extensions:

Authentication Header (AH)

Encapsulating Security Payload (ESP)

1.4.IPSec Services:


Access control

Connectionless integrity

Data origin authentication

Rejection of replayed packets

a form of partial sequence integrity

Confidentiality (encryption)
 
Limited traffic flow confidentiality
Security Associations :


a one-way relationship between sender & receiver that affords security for traffic flow

defined by 3 parameters:

Security Parameters Index (SPI)

IP Destination Address

Security Protocol Identifier

has a number of other parameters

seq no, AH & EH info, lifetime etc

have a database of Security Associations

1.5.Authentication Header (AH):


provides support for data integrity & authentication of IP packets

end system/router can authenticate user/app

prevents address spoofing attacks by tracking sequence numbers

based on use of a MAC

HMAC-MD5-96 or HMAC-SHA-1-96

parties must share a secret key
2. Secure Socket Layer(SSL):

2.1.INTRODUCTION
The Secure Socket Layer (SSL) protocol is an Internet protocol for the security exchange
information between a Web browser and a Web Server. Logically, it provides a secure
pipe between the Web Browser and Web server. SSL allows sensitive information such
as credit card numbers, social security numbers, and login credentials to be transmitted
securely.

Web Secure Socket Web

Browser Layer (SSL)
Server

(Fig): Secure Socket Layer)

It can be conceptually considered as an additional layer in TCP/IP protocol suite.
The SSL layer is located between application layer and the transport layer.
Application Layer
SSL Layer
Transport Layer
Internet Layer
Data Link Layer
Physical Layer
(Fig)Position of SSL in TCP/IP
It provides two basic security services: AUTHENTICATION and
CONFIDENTIALITY.

Secure Socket
Layer Sevices

Authentication Confidentiality

(fig) SSL Services

SSL was developed by Netscape Corporation in 1994.
All major web browser support SSL. Currently, SSL comes in three versions: 2,3 and 3.1.
2.2.Working of SSL
SSL has three sub- protocols: 1.Handshake Protocol
2. Record Protocol
3. Alert Protocol

SSl sub-
protocols

Handshake Record Alert

Protocol Protocol Protocol

2.3.HANDSHAKE PROTOCOL

 The handshake protocol of SSL is the first sub-protocol used by the client and the
server to communicate using a SSL-enabled connection.
Handshake message has three fields:

Type Length Content

1 byte 3 byte 1 or more bytes

(Fig) format of handshake protocol.

a) Type (1 byte): This field indicates the length of the message in byte.
b) Length (3 bytes): This field contains the length of the message in bytes.
c) Content (1 or more byte): This field contains the parameters associated with this
message depending upon the message type.

Message Type Parameters

Hello request None
Client Hello Version, Random Number, Session Id, Cipher suite, Compression
method
Server Hello Version, Random Number, Session Id, Cipher suite, Compression
method
Certificate Chain of X.509V3 certificates
Server-key Parameter, signatures
Exchange
Certificate request Type, authorities
Server hello Done None
Certificate verify Signature
Client-key Parameters, signatures
exchange
Finished Hash value

(Fig)SSL handshake protocol message types

Web 1. Establish security capabilities. Web Server

Browser 2. Server authentication and key exchange.

3. Client authentication and key exchange.

4.Finish

Phase 1: Establish Security Capabilities

The first phase of the SSL handshake is used to initiate a logical connection and establish
the security capabilities associated with that connection. This consists of two messages:
the client hello and the server hello.

Web Step 1: Client Hello Web Server

Browser Step 2: Sever Hello

(Fig.)Phase 1: Establish Security capabilities.

The client hello message consists of the following parameters.
  Version: This field identifies the highest version of SSL that the client can
support.
 Random: It contains two sub fields:
 A 32-bit date-time field that identifies the current system
date and time on the client computer.
 A 28-byte random number generated by the random-
number generator software built inside the client computer.
 Session ID: This is a variable length identifier. If this contains a non-zero value, it
means that there is already a connection between the client and the server, and the
client wishes to upgrade the parameters of that connection.
 Cipher suite: This list contains a list of the compression algorithms supported by
the client.

The server hello message consists of the following phase:

 Version: This field identifies the lower of the versions suggested by the client and
the highest supported by the server.
 Random: This field has the same structure as the random field of the client. The
random value generated by the server is completely independent of the client’s
Random value.
 Session id: If the session id value sent by the client was non-zero, the server uses
the same value. Otherwise, the server creates a new session id and puts it in this
field.
 Cipher suite: Contains a single cipher suite, which the server selects from the list
sent earlier by the client.
 Compression method: Contains a compression algorithm, which the server selects
from the list sent earlier by the client.

Phase 2: Server Authentication and Key Exchange.

The server initiates the second phase of the SSL handshake, and is the sole sender of all
message inthis phase. The client is the sole recipient of all these messages.
 Web Step 1: Certificate
Web Server
Browser Step 2: Server Key
Exchange

Step 3: Certificate request

Step 4: Server hello done

Four steps of phase 2:

First step : Certificate
The server sends its digital certificate and the entire chain leading up to root CA to the
client. This will help the client to authenticate the server using the server’s public key
from the server’s certificate.
Second Step: Server Key Exchange(optional)
It is used only if the server does not send its digital certificate to the client in step 1.
Third Step: Certificate Request
The server can request for the client’s digital certificate.
Fourth Step: Server Hello Done
Message indicates to the client that its partition of the hello message is complete.
Phase 3: Client Authentication and Key Exchange
The client initiates this third phase o the SSL handshake, and is the sole sender of the all
message in this phase. The server is the sole recipient of all these messages. This phase
contains three steps:

1. Certificate
2. Client Key Exchange
3. Certificate Verify.
 Step 1: Certificate
Web Web
Browser Step 2: Client Key Exchange
Server

Step 3: Certificate Verify

(fig) Client Authentication and key exchange.

First Step: Certificate (optional):
This step is performed only if the server had requested for the client’s digital certificate.
Second Step: Client Key Exchange:
Allows the client to send information to the server, but in opposite direction. This
information is related to the symmetric key that both the parties will use in this session.
Third Step: (Certificate Verify):
It is necessary only if the server had demanded client authentication.
Phase 4: Finish
The client initiates the fourth phase of SSL handshake, which the server ends. This phase
contains four steps:

Web 1. Change cipher specs Web

2. Finished
Browser Server
Step 3: Change cipher specs
(Fig)Phase 4: Finished

Step 4: Finished
2.4.RECORD PROTOCOL

 The Record protocol in SSL comes into picture after a successful hanshake is
completed between the client and the server.
 Adter the client and the server have optionally authenticated each other and have
decided what algorithms to use for secure information exchanged.
 The services of this steps are as follows:

Services of
Record
Protocol

Confidentiality Integrity

(fig)Services of Record Protocol

a.)Confidentiality: This is achieved by using the secret key that is defined by the
handshake protocol.
b.)Integrity: The SSL record protocol takes an application message as input,it
fragments it into smaller blocks,optionally compress each block.
Steps of Record protocol:

Addition of
Fragmentation Compression Encryption Append HEader
MAC

(fig)Process of Record Protocol

1. Fragmentation: The original application is broken into blocks, so that the size of
the block is less than or equal to 214 bytes(16,384 bits).
2. Compression:The fragmented blocks are optionally compressed.
3. Addition of MAC: Usinng the shared key established previously in the handshake
protocol, the Message Authentication Code(MAC) for each block is calculated.
4. Encryption: Using the symmetric key, the output of the previous step in
encrypted.
5. Append Header: Finally, a header is added to the encrypted block.
Field Length(in Decription
bits)
Conetnt Type 8 bits Specifies the protocol used for processing the record
Major Version 8 bits Specifies the major version of the SSL protocol in
used
Minor Version 8 bits Specifies the minor version of the SSL protocol in
used
Compressed 16 bits Specifies the length in bits of the original plain text
length
(fig) Contents of the header

The final SSL message looks as follows:

Content Type Major Version Minor Version Compressed Length

Plain Text(optionally compressed)

MAC(0,16 or 20 bytes)

2.5.ALERT PROTOCOL
 When either the client or the server detects an error, the detecting party
sends an alert message to the other party.
 If the error is fatal, both the parties immediately close the SSL connection.
 Both the parties also destroy the session identifiers,secrets and keys
associated with this connection before it is terminated.
 Other errors,which are not so severe,do not result in the termination of the
connection.Instead,the parties handle the error and continue.
 Severity Cause
Byte 1 Byte 2

(Fig).Alert protocol message format.

Each alert message consists of two bytes.The first byte signifies the type
of error.If it is a warning, this byte contains 1.If the error is fatal, this byte
contains 2.The second byte specifies the actual error.
Alert Descriptive
Unexpected message An inappropriate message was received
Bad record MAC A message is received without a correct MAC
Decompression The decomposition function received an improper
failure input.
Handshake failure Sender was unable to negotiate an acceptable set of
security paeameters from the available options.
Illegal parameters A field in the handshake
message was out of range
or was inconsistent with
the other fields.
(fig) Fatal alerts

Alert Description
No certificate Sent in response to certificate request if an appropriate certificate
is not available.
Bad certificate A certificate was corrupt
Unsupported The type of the received certificate is not supported
certificate
Certificate revoked The signer of a certificate has revoked it
Certificate expired A received certificate has expired
Certificate unknown An unspecified error occurred while processing the certificate
 Close notify Notifies that the sender will not send any more messages in this
connection. Each party must send this message before closing its
side of the connection.
(fig) Non-fatal alerts
Closing SSL Connection

 Before ending the SSL connection, the client and the server must inform each
other that their
Side of the connection is ending.
 Each party sends a Close notify alert to the other party. This ensures a graceful
closure of the connection.
 When a party receives this alert, it must immediately stop whatever it is doing,
send its own Close notify alert and end the connection from its side as well.
 If an SSL connection ends without a Close notify from either party, it cannot be
resumed.

2.6.SSL CERTIFICATE
SSL Certificates are small data files that digitally bind a cryptographic key to an
organization’s details. When installed on a web server, it activates the padlock and the
https protocol (over port 443) and allows secure connections from a web server to a
browser. Typically, SSL is used to secure credit card transactions, data transfer and
logins, and more recently is becoming the norm when securing browsing of social media
sites. SSL Certificates bind together:
 A domain name, server name or hostname
 An organizational identity (i.e. company name) and location
2.7.CREATE SECURE CONNECTION

When a browser attempts to access a website that is secured by SSL, the browser and the
web server establish an SSL connection using a process called an “SSL Handshake”.
Essentially, three keys are used to set up the SSL connection: the public, private, and
session keys. Anything encrypted with the public key can only be decrypted with the
private key, and vice versa.
Because encrypting and decrypting with private and public key takes a lot of processing
power, they are only used during the SSL Handshake to create a symmetric session key.
After the secure connection is made, the session key is used to encrypt all transmitted
data.

1. Browser connects to a web server (website) secured with SSL (https). Browser
requests that the server identify itself.
2. Server sends a copy of its SSL Certificate, including the server’s public key.
3. Browser checks the certificate root against a list of trusted CAs and that the
certificate is unexpired, unrevoked, and that its common name is valid for the
website that it is connecting to. If the browser trusts the certificate, it creates,
encrypts, and sends back a symmetric session key using the server’s public
key.
4. Server decrypts the symmetric session key using its private key and sends
back an acknowledgement encrypted with the session key to start the
encrypted session.
5. Server and Browser now encrypt all transmitted data with the session key.

2.8.NEED OF SSL

One of the most important components of online business is creating a trusted

environment where potential customers feel confident in making purchases. Browsers
give visual cues, such as a lock icon or a green bar, to help visitors know when their
connection is secured. If your site collects credit card information you are required by the
Payment Card Industry (PCI) to have an SSL Certificate. If your site has a login section
or sends/receives other private information (street address, phone number, health records,
etc.), you should use SSL Certificates to protect that data.
Your customers want to know that you value their security and are serious about
protecting their information. More and more customers are becoming savvy online
shoppers and reward the brands that they trust with increased business.
2.9.ADVANTAGE AND DISADVANTAGE OF SSL
ADVANTAGE
1.Customers Will Trust Your Website:
The SSL encryption will cause your customer to trust your website as professional and
genuine, knowing that his personal information will be safe when he submits. This will
help to increase the number of submissions that you receive.
2.Avoid Disputes Due to Credit Card Fraud:
If a customer submits his credit card information on your unprotected server and then
experiences identity theft, the first place he will likely suspect is your website. Even if
your website is not the source of the issue, you still may have to deal with a lengthy and
involved dispute process with the customer and his credit card company. If your website
has SSL technology, you are less likely to deal with these types of claims from
customers.

DISADVANTAGE
1. Regular Renewal: Like a website domain and hosting plan, an SSL certificate expires
after a short period of time—usually one to five years. You have to renew the SSL
protection regularly and pay the subscription price again forever in order to keep the
protection. If you forget to renew the SSL protection, your website will display an error
on the user's computer stating that the certificate is not valid.
2. Complex Installation: SSL technology can be difficult to install on a website,
especially for someone who isn't very familiar with website development. The provider
will send you a set of files to install in a certain folder of your web server. You must also
activate the certificate using specific instructions from the provider. The process can be
overwhelming for a beginner, and some trial-and-error may be required to get the
technology to work properly on your website.
2.10.CONCLUSION

 SSL is a Protocol for communicating between Web server and web browser.
 The approves that the site you are navigating is secure or not.
 SSL works in three protocols: Handshake, Record and Alert Protocol.
 Secure web server obtain SSL certificate to provide confidence to the users that
the website is secure. For example: banking website.
 SSL certificate provides confidence to the user.
Chapter 11
1. SET

2. TLS

1.SET:
1.1.Introduction

Electronic commerce, as exemplified by the popularity of the Internet, is going to have an

enormous impact on the financial services industry. No financial institution will be left
unaffected by the explosion of electronic commerce. Even though SSL is extremely
effective and widely accepted as the online payment standard, it requires the customer
and merchant to trust each other: an undesirable requirement even in face-to-face
transactions, and across the Internet it admits unacceptable risks.

Visa and MasterCard and a consortium of 11 technology companies made a promise to

banks, merchants, and consumers: they would make the Internet safe for credit card
transactions and send electronic commerce revenues skyward. With great fanfare, they
introduced the Secure Electronic Transaction protocol for processing online credit card
purchases [1].

1.2.Overview of SET Protocol

Secure payment systems are critical to the success of E-commerce. There are four
essential security requirements for safe electronic payments (Authentication, Encryption,
Integrity and Non -repudiation). Encryption is the key security schemes adopted for
electronic payment systems, which is used in protocols like SSL and SET.

1.3.Problem with SSL

The SSL protocol, widely deployed today on the Internet, has helped create a basic level
of security sufficient for some hearty souls to begin conducting business over the Web.
SSL is implemented in most major Web browsers used by consumers, as well as in
merchant server software, which supports the seller's virtual storefront in cyberspace.
Hundreds of millions of dollars are already changing hands when cybershoppers enter
their credit card numbers on Web pages secured with SSL technology.

In this sense, SSL provides a secure channel to between the consumer and the merchant
for exchanging payment information. This means any data sent through this channel is
encrypted, so that no one other than these two parties will be able to read it. In other
words, SSL can give us confidential communications, it also introduces huge risks:

! The cardholder is protected from eavesdroppers but not from the merchant. Some
merchants are dishonest: pornographers have charged more than advertised price,
expecting their customers to be too embarrassed to complain. Some others are just
hackers who put up a snazzy illegal Web site and profess to be the XYZ Corp., or
impersonate the XYZ Corp. and collecting credit card numbers for personal use.

! The merchant has not protected from dishonest customers who supply an invalid
credit card number or who claim a refund from their bank without cause. Contrary to
popular belief, it is not the cardholder but the merchant who has the most to lose from
fraud. Legislation in most countries protects the consumer.

1.4.SET protocol Overview

What we want here is a protocol very similar to credit card transactions at a local store,
something SSL doesn’t mimic in functionality. SET is the one.

Purpose and Entities

Purpose

The purpose of the SET protocol is to establish payment transactions that

! provide confidentiality of information;
! ensure the integrity of payment instructions for goods and services order
data;
 ! authenticate both the cardholder and the merchant .

Main Entities

There are four main entities in SET:

! Cardholder (customer)
! Merchant (web server)
! Merchant’s Bank (payment gateway, acquirer): payment gateway is a device
operated by an acquirer. Sometime, separate these two entities.
! Issuer (cardholder’s bank)

1.5.How it Works

Both cardholders and merchants must register with CA (certificate authority) first,
before they can buy or sell on the Internet, which we will talk about later. Once
registration is done, cardholder and merchant can start to do transactions, which
involve 9 basic steps in this protocol, which is simplified.

1. Customer browses website and decides on what to purchase

2. Customer sends order and payment information, which includes 2 parts
in one message:
a. Purchase Order – this part is for merchant
b. Card Information – this pat is for merchant’s bank only.
3. Merchant forwards card information (part b) to their bank
4. Merchant’s bank checks with Issuer for payment authorization
5. Issuer send authorization to Merchant’s bank
6. Merchant’s bank send authorization to merchant
7. Merchant completes the order and sends confirmation to the
customer
8. Merchant captures the transaction from their bank
9. Issuer prints credit card bill (invoice) to customer
1.6.Protocol Overview

SET (Secure Electronic Transaction) is a very comprehensive security protocol,

 which utilizes cryptography to provide confidentiality of information, ensure
payment integrity, and enable identity authentication. For authentication purposes,
cardholders, merchants, and acquirers will be issued digital certificates by their
sponsoring organizations.
It relies on cryptography and digital certificate to ensure message confidentiality
and security. Digital envelop is widely used in this protocol. Message data is
encrypted using a randomly generated key that is further encrypted using the
recipient's public key. This is referred to as the "digital envelope" of the message
and is sent to the recipient with the encrypted message. The recipient decrypts the
digital envelope using a private key and then uses the symmetric key to unlock the
original message.
Digital certificates, which are also called electronic credentials or digital IDs, are
digital documents attesting to the binding of a public key to an individual or
entity. Both cardholders and merchants must register with a certificate authority
(CA) before they can engage in transactions. Thecardholder thereby obtains
electronic credentials to prove that he is trustworthy. The merchant similarly
registers and obtains credentials. These credentials do not contain sensitive details
such as credit card numbers. Later, when the customer wants to make purchases,
he and the merchant exchange their credentials. If both parties are satisfied then
they can proceed with the transaction. Credentials must be renewed every few
years, and presumably are not available to known fraudsters.

1.7.SET Cryptography
Overview
Secure Electronic Transactions (SET) relies on the science of cryptography – the
encoding and decoding messages. There are two primary encryption methods in use
today: secret-key cryptography and public-key cryptography. Secret-key cryptography is
impractical for exchanging messages with a large group of previously unknown
correspondents over a public network. For a merchant to conduct transactions securely
with millions of subscribers, each consumer would need a distinct key assigned by that
merchant and transmitted over a separate secure channel. However, by using public-key
cryptography, that same merchant could create a public/private key pair and publish the
public key, allowing any
consumer to send a secure message to that merchant. This is why SET uses both methods
in its encryption process. The secret-key cryptography used in SET is the well-known
Data Encryption Standard (DES), which is used by financial institutions to encrypt PINs
(personal identification numbers). And the public-key cryptography used in SET is RSA.
In the following section, the usage of symmetric (secret-key) and asymmetric (public-
key) key encryption in SET will be discussed.

Use of Symmetric Key

In SET, message data is encrypted using a randomly generated symmetric key (a DES 56
-bit key). This key, in turn, is encrypted using the message recipient’s public key (RSA).
The result is the so called “digital envelope” of the message. This combines the
encryption speed of DES with the key management advantages of RSA public-key
encryption. After encryption, the envelope and the encrypted message itself are sent to
the recipient. After receiving the encrypted data, the recipient decrypts the digital
envelope first using his or her private key to obtain the randomly generated symmetric
key and then uses the symmetric key to unlock the original message.

This level of encryption, using DES, can be easily cracked using modern hardware. In
1993, a brute-force DES cracking machine was designed by Michael Wiener – one which
was massively parallel. For less than a million dollars, a 56-bit DES key could be cracked
in average time of 3.5 hours. For a billion dollars, a parallel machine can be constructed
that cracks 56-bit DES in a second (Schneier, 1996). Obviously, this is of great concern
since DES encrypts the majority of a SET transaction.

Use of Asymmetric Key – Digital Signature (Message Digests)

In SET, the public key cryptography is only used to encrypt DES keys and for
authentication (digital signature) but not for the main body of the transaction. In SET, the
RSA modulus is 1024 bits in length (Using the latest facto
ring results it appears that factoring a 1024-bit modulus would require over
100,000,000,000 MY of computational effort). To generate the digital signature, SET
uses a distinct public/private key. Each SET participant possesses two asymmetric key
pairs: a “key exchange” pair, which is used in the process of section key encryption and
decryption, and a “signature” pair for the creation and verification of digital signatures
(160-bit message digests).

The algorithm is such that changing a single bit in the message will change, on average,
half of the bits in the message digest. Approximately, the possibility of two messages
having the same message digest is one in
1,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000, which means it is
computationally unfeasible to generate two different messages that have the same
message digest.
RSA-OAEP

RSA-OAEP (RSA Encryption Scheme - Optimal Asymmetric Encryption Padding) was

proposed by Bel-lare and Rogaway in 1994 which is one of the innovations of SET.
RSA-OAEP public-key encryption scheme combines the encoding method of OAEP
with the encryption primitive RSA. RSA-OAEP takes a plaintext as input, transforms it
into an encoded message via OAEP and apply RSAEP (RSA encryption primitive) to the
result (interpreted as an integer) using an RSA Public Key. RSA-OAEP is intended to
be both efficient and secure and is designed to encrypt only short messages--typically
secret keys for symmetric encryption or MAC algorithms. OAEP ties the security of RSA
encryption closely to that of the basic RSA operation. The version of OAEP used in SET
is a more advanced version of the original scheme. While existing message formatting
methods for RSA encryption have no known flaw, the provable security aspects of OAEP
are very appealing. OAEP is very new but already it is a part of the IEEE P1363
standards effort.

RSA-OAEP encryption scheme has been proven to be semantically secure against

adaptive chosen-ciphertext attacks in the random oracle model under the RSA
assumption. However, the reduction is not tight, and thus it is not clear what security
assurances the proof provides. It is recommended that RSA-OAEP be modified to RSA-
OAEP+ that has a tighter security reduction, and furthermore can be easily modified to
allow encryption of arbitrarily-long messages. Furthermore, the RSA-KEM encryption
scheme of which has a tight reduction should be considered as a replacement for RSA-
OAEP.

Dual Signatures

A new application of digital signatures is introduced in SET, namely the concept of dual
signatures. Dual signatures is needed when two messages are need to be linked securely
but only one party is allowed to read each. The following picture shows the process of
generating dual signatures.
In SET, dual signatures are used to link an order message sent to the merchant with the
payment instructions containing account information sent to the acquirer (merchant
bank). When the merchant sends an authorization request to the acquirer, it includes the
payment instructions sent to it by the cardholder and the message digest of the order
information. The acquirer uses the message digest from the merchant and computes the
message digest of the payment instructions to check the dual signatures.

1.8.SET Process

The SET protocol utilizes cryptography to provide confidentiality of information, ensure

payment integrity, and enable identity authentication. For authentication purposes,
cardholders, merchants, and acquirers will be issued digital certificates by their
sponsoring organizations. It also use dual signature, which hides the customer’s credit
card information from merchants, and also hides the order information to banks, to
protect privacy.

Process Steps

1). Merchant sends invoice and unique transaction ID (XID)

2). Merchant sends merchant certificate and bank certificate (encrypted with
CA’s private key)
3). Customer decrypts certificates, obtains public keys
4). Customer generates order information (OI) and payment info (PI)
encrypted with different session keys and dual-signed
5). Merchant sends payment request to bank encrypted with bank-
merchant session key, PI, digest of OI and merchant’s certificate
6). Bank verifies that the XID matches the one in the PI
7). Bank sends authorization request to issuing bank via card network 8).
Bank sends approval to merchant
9). Merchant sends acknowledgement to customer
. Payment Initialization

The Purpose of the payment initialization is to allow customer to get certificate from the
merchant. The initialization request is represented as PinitReq which carries eight fields
of information (Table 1).
Table 1- Fields in Payment Initialization

Field Information
RRPID Request/Response Pair ID
Language Customer’s Language
LID_C Customer’s Local ID
[LID_M] Merchant’s Local ID
Chall_C Customer’s challenge salt to Merchant’s signature freshness
BrandID Card Brand (VISA, Master etc.)
BIN Bank ID Number
Thumbs Thumbnails (hashes) of of certificates known to Customer

Before two parties use public-key cryptography to conduct business, each wants to be
sure that the other party is authenticated. One way to be sure that the public key belongs
to the right party is to receive it over a secure channel directly from the same place.
However, in most circumstances this solution is not practical.
An alternative to secure transmission of the key is to use a trusted third party to
authenticate that the public key belongs to Alice. Such a party is known as a Certificate
Authority (CA). Because SET participants have two key pairs, theyalso have two
certificates. Both certificates are created and signed at the same time by the Certificate
Authority.

1.9.Certificate of Participants
Cardholder certificates

Cardholder certificates function as an electronic representation of the payment card.

Because they are digitally signed by a financial institution, they cannot be altered by a
third party and and can only be generated by a financial institution. A cardholder
certificate does not contain the account number and expiration date. Instead the account
information and a secret value known only to the ardholder’s software are encoded using
a one-way hashing algorithm. If the account number, expiration date, and the secret value
are known, the link to the certificate can be proven, but the information cannot be derived
by looking at the certificate. Within the SET protocol, the cardholder supplies the account
information and the secret value to the payment gateway where the link is verified.

A certificate is only issued to the cardholder when the cardholder’s issuing financial
institution approves it. By requesting a certificate, a cardholder has indicated the intent to
perform commerce via electronic means. This certificate is transmitted to merchants with
purchase requests and encrypted payment instructions. Upon receipt of the cardholder’s
certificate, a merchant can be assured, at a minimum, that the account number has been
validated by the card-issuing financial institution or its agent. In this specification,
cardholder certificates are optional at the payment card brand’s discretion.

Merchant certificates

Merchant certificates function as an electronic substitute for the payment brand decal that
appears in the store window—the decal itself is a representation that the merchant has a
relationship with a financial institution allowing it to accept the payment card brand.
Because they are digitally signed by the merchant’s financial institution, merchant
certificates cannot be altered by a third party and can only be generated by a financial
institution. These certificates are approved by the acquiring financial institution and
provide assurance that the merchant holds a valid agreement with an Acquirer. A
merchant must have at least one pair of certificates to participate in the SET environment,
but there may be
multiple certificate pairs per merchant. A merchant will have a pair of certificates for
each payment card brand that it accepts.

Payment Gateway Certificates

Payment gateway certificates are obtained by Acquirers or their processors for the
systems that process authorization and capture messages. The gateway’s encryption key,
which the cardholder gets from this certificate, is used to protect the cardholder’s account
information. Payment gateway certificates are issued to the Acquirer by the payment
brand.

Acquirer Certificates

An Acquirer must have certificates in order to operate a Certificate Authority that can
accept and process certificate requests directly from merchants over public and private
networks. Those Acquirers that choose to have the payment card brand process certificate
requests on their behalf will not require certificates because they are not processing SET
messages. Acquirers receive their certificates from the payment card brand.

Issuer Certificates

An Issuer must have certificates in order to operate a Certificate Authority that can accept
and process certificate requests directly from cardholders over public and private
networks. Those Issuers that choose to have the payment card brand process certificate
requests on their behalf will not require certificates because they are not processing SET
messages. Issuers receive their certificates from the payment card brand.
1.10.SET Certificate Hierarchy

Root Signaute

Brand Signaure

Geo-Political Signature
(Optional)

CCA MCA PCA

Signature Signatue Signature

Cardholde Payment Payment

r Merchant Gateway Gateway
Signature Signature Signature Key Exchange

Figure 3- Hierarchy of Trust

Registration

Participants Registration

As described in section 1, both the cardholder and the merchant have to register with a
CA before they can do transactions. And the registration processes have to be secure
enough, since these two processes involve sensitive details.
Cardholder Registration

This process comprised 6 messages between two parties: cardholder and Issuer (CA).
1. The cardholder initiates request to the CA.
2. After the CA receives message 1 from the cardholder, the CA replies. The message
includes the CA’s public key-exchange key certification signed by root CA, CA’s
signature certificate and the initial request encrypted using CA’s private key.
3. The cardholder request a registration form in this message. He randomly generates a
symmetric key K1, which is used to encrypt the request, and sends this along with a
digital envelop including key K1 and his credit card number.
4. The CA determines the cardholder’s issuing bank by the credit card number and
returns the appropriate the form, which is signed by the CA and along with CA’s
signature certificate.
5. The cardholder generates a public/private signature key pair, two symmetric keys
K2, K3 and a random number S1. He creates a message with his filled registration
form, public key, and K2, and its digital signature. This message is encrypted using
K3 and sent with a digital envelop including K3 and card number.
6. The CA verifies the information, then issue a digital ID to CA. The CA generates a
secret value using the random number S2 generated by the CA and S1. This secret
value, the account number and the expiration date further feed into a one-way
hashing to generate a secret number. The CA signs the certificate includes this secret
number and the cardholder’s public signature key. Then, CA sends this certificate
encrypted using K2 along with and its signature certificate.

This registration process includes 3 steps. The first two messages are about to get CA’s
public key. Once the cardholder has CA’s key-exchange key, he can request a registration
form in message 3 and 4. The certificate is in the last 2 messages.

Merchant Registration
The Merchant’ registration is simpler than cardholder’s, which include 4 messages. The
first two messages are almost same as cardholder’s, except in the second message the
registration form has been sent. The merchant has to generate two public/private key
pairs – one is for signature, the other is for key-exchange—instead of one pair compared
to the cardholder.
Two problems with registration protocol

The registration protocol has been proved to be secure [3]. But there are two risks to
cause insecure. The first is that the cardholder is not required to generate a fresh signature
key pair, but may register an old one. There is a risk that the old one could be
compromised. And another problem is that the secret value generation mentioned above
which is the exclusive-OR of numbers (S1, S2) chosen by two parties. Since exclusive-
OR is invertible, a criminal working for a CA can give every cardholder the same secret
value. This combination introduces some risk that a criminal can impersonate the
cardholder.

These two problems are fixable. The first insecurity can be repaired in the cardholder’s
implementation. The second one can be fixed by replacing exclusive-OR by one-way
hashing.
3.Transport Layer Security(TLS):

The Transport Layer Security (TLS) protocol, Secure Sockets Layer (SSL) protocol,
versions 2.0 and 3.0, and the Private Communications Transport (PCT) protocol are
based on public key cryptography. The Security Channel (Schannel) authentication
protocol suite provides these protocols. All Schannel protocols use a client/server model.

In the authentication process, a TLS/SSL client sends a message to a TLS/SSL server,

and the server responds with the information that the server needs to authenticate itself.
The client and server perform an additional exchange of session keys, and the
authentication dialog ends. When authentication is completed, SSL-secured
communication can begin between the server and the client using the symmetric
encryption keys that are established during the authentication process.

For servers to authenticate to clients, TLS/SSL does not require server keys to be stored
on domain controllers or in a database, such as the Microsoft Active Directory directory
service. Clients confirm the validity of a server’s credentials with a trusted root
certification authority’s (CA’s) certificates, which are loaded when you install Microsoft
Windows Server 2003. Therefore, unless user authentication is required by the server,
users do not need to establish accounts before they create a secure connection with a
server.

3.1.History and Standards for TLS and SSL

SSL was developed by Netscape Communications Corporation in 1994 to secure

transactions over the World Wide Web. Soon after, the Internet Engineering Task Force
(IETF) began work to develop a standard protocol that provided the same functionality.
They used SSL 3.0 as the basis for that work, which became the TLS protocol. The
implementation of the TLS protocol in Windows Server 2003 closely follows the
specification defined in Request for Comments (RFC) 2246, The TLS Protocol
Version 1.0. For more information about TLS, see RFC 2246 in the IETF RFC database.

TLS and SSL are most widely recognized as the protocols that provide secure HTTP
(HTTPS) for Internet transactions between Web browsers and Web servers. TLS/SSL can
also be used for other application level protocols, such as File Transfer Protocol (FTP),
Lightweight Directory Access Protocol (LDAP), and Simple Mail Transfer Protocol
(SMTP). TLS/SSL enables server authentication, client authentication, data encryption,
and data integrity over networks such as the World Wide Web.

3.2.Differences between TLS and SSL

Although there are some slight differences between SSL 3.0 and TLS 1.0, this reference
refers to the protocol as TLS/SSL.

Note

 Although their differences are minor, TLS 1.0 and SSL 3.0 are not
interchangeable. If the same protocol is not supported by both parties, the parties
must negotiate a common protocol to communicate successfully.

3.3.TLS Enhancements to SSL

 The keyed-Hashing for Message Authentication Code (HMAC) algorithm

replaces the SSL Message Authentication Code (MAC) algorithm.

HMAC produces more secure hashes than the MAC algorithm. The HMAC
 produces an integrity check value as the MAC does, but with a hash function
construction that makes the hash much harder to break. For more information
about the HMAC, see “Hash Algorithms in The Handshake Layer in TLS/SSL
Architecture” in How TLS/SSL Works.

 TLS is standardized in RFC 2246.

 Many new alert messages are added.

 In TLS, it is not always necessary to include certificates all the way back to the
root CA. You can use an intermediary authority.

 TLS specifies padding block values that are used with block cipher algorithms.
RC4, which is used by Microsoft, is a streaming cipher, so this modification is not
relevant.

 Fortezza algorithms are not included in the TLS RFC, because they are not open
for public review. (This is Internet Engineering Task Force (IETF) policy.)

 Minor differences exist in some message fields.

3.4.Benefits of TLS/SSL

TLS/SSL provides numerous benefits to clients and servers over other methods of
authentication, including:

 Strong authentication, message privacy, and integrity

 Interoperability

 Algorithm flexibility

 Ease of deployment

 Ease of use

Strong authentication, message privacy, and integrity

TLS/SSL can help to secure transmitted data using encryption. TLS/SSL also
authenticates servers and, optionally, authenticates clients to prove the identities of
parties engaged in secure communication. It also provides data integrity through an
integrity check value. In addition to protecting against data disclosure, the TLS/SSL
security protocol can be used to help protect against masquerade attacks, man-in-the-
middle or bucket brigade attacks, rollback attacks, and replay attacks.

Interoperability

TLS/SSL works with most Web browsers, including Microsoft Internet Explorer and
Netscape Navigator, and on most operating systems and Web servers, including the
Microsoft Windows operating system, UNIX, Novell, Apache (version 1.3 and later),
Netscape Enterprise Server, and Sun Solaris. It is often integrated in news readers, LDAP
servers, and a variety of other applications.

Algorithm flexibility

TLS/SSL provides options for the authentication mechanisms, encryption algorithms, and
hashing algorithms that are used during the secure session.

Note

 Data can be encrypted and decrypted, but you cannot reverse engineer a hash.
Hashing is a one-way process. Running the process backward will not create the
original data. This is why a new hash is computed and then compared to the sent
hash.

Ease of deployment

Many applications use TLS/SSL transparently on a Windows Server 2003 operating

system. You can use TLS for more secure browsing when you are using Internet Explorer
and Internet Information Services (IIS) and, if the server already has a server certificate
installed, you only have to select the check box.

Ease of use

Because you implement TLS/SSL beneath the application layer, most of its operations
are completely invisible to the client. This allows the client to have little or no knowledge
of the security of communications and still be protected from attackers.
3.5.Limitations of TLS/SSL

There are a few limitations to using TLS/SSL, including:

Increased processor load

This is the most significant limitation to implementing TLS/SSL. Cryptography,

specifically public key operations, is CPU-intensive. As a result, performance varies
when you are using SSL. Unfortunately, there is no way to know how much performance
you will lose. The performance varies, depending on how often connections are
established and how long they last. TLS uses the greatest resources while it is setting up
connections.

Administrative overhead

A TLS/SSL environment is complex and requires maintenance; the system administrator

must configure the system and manage certificates.

3.6.Common TLS/SSL Scenarios

Many people think of TLS and SSL as protocols that are used with Web browsers to
browse the Internet more securely. However, they are also general purpose protocols that
can be used whenever authentication and data protection are necessary. For example, you
can use TLS/SSL for:

 SSL-secured transactions with an e-commerce Web site

 Authenticated client access to an SSL-secured Web site

 Remote access

 SQL access

 E-mail
Chapter 12:
1. Timestamping protocol
2. 3-D Secure Protocol
3. E- mail security

1. Time stamp based protocols:

! Each transaction is issued a timestamp when it enters the system.
If an old transaction Ti has time-stamp TS(Ti), a new transaction Tj
is assigned time-stamp TS(Tj) such that TS(Ti) <TS(Tj). (system
clock or logical counter)

! The protocol manages concurrent execution such that the time-

stamps determine the serializability order. If Ti<Tj then the
produced schedule is equivalent to a serial schedule in which Ti
is executed before Tj.

! In order to assure such behavior, the protocol maintains for each

data Q two timestamp values:
! W-timestamp(Q) is the largest time-stamp of any
transaction thatexecuted write(Q) successfully.
! R-timestamp(Q) is the largest time-stamp of any
transaction thatexecuted read(Q) successfully.

2.2 The timestamp ordering protocol ensures that any conflicting

read and write operations are executed in timestamp order.
2.3 When a transaction is rolled back, the system
assigns it a new timestamp and restarts it.
2.4 Suppose a transaction Ti issues a read(Q)
If TS(Ti) <W-timestamp(Q), then Ti needs to
read a value of Q that was already
overwritten.
Hence, the read operation is rejected, and Ti is rolled
back.
 If TS(Ti)≥W-timestamp(Q), then the read
operation is executed, and R-timestamp(Q) is set
to max(R-timestamp(Q), TS(Ti)).
„ Suppose that transaction Ti issues write(Q).
1. If TS(Ti) < R-timestamp(Q), then the value of Q
that Ti is producing was needed previously, and
the system assumed that that value would never
be produced.
„ Hence, the write operation is rejected, and Ti is rolled
back.
2. If TS(Ti) < W-timestamp(Q), then Ti is
attempting to write an obsolete value of
Q.
„ Hence, this write operation is rejected, and Ti is rolled
back.
3. Otherwise, the write operation is executed, and W-
timestamp(Q) is set to TS(Ti).

Example:

A partial schedule for several data items for transactions

with timestamps 1, 2, 3, 4, 5
„ The timestamp-ordering protocol guarantees
serializability since all the arcs in the precedence
graph are of the form:

Thus, there will be no cycles in the precedence graph

2 Timestamp protocol ensures freedom

from deadlock as no transaction ever
waits.

3 But the schedule may not be cascade-free, and

may not even be recoverable.
2.3-D Secure Protocol:

2.1.How it works

The 3D Secure feature

enables the shopper to
enter a password to
confirm their identity with
the card issuer. If accepted
they then complete their
order, and when received
by you, you have much
more confidence that is
genuine and real.

Please note that all

new Solution
customers must use the
3D Secure integration. If
using our secure checkout
page, this is already done
for you.

2.2.Main Key Benefits

 Added protection from fraudulent payments

 Allows you to trade online more safely
 Enhances shopper confidence and spending
 Reduces costs from fraudulent chargeback

2.3.Chargeback Liability Shift

If you are enabled for 3D Secure (Verified by Visa and MasterCard SecureCode) you can
be protected from certain "it wasn't me" Chargebacks on credit, and some debit, card
transactions. According to Visa, over 80% of all chargebacks fall into this 'friendly"
fraud-related category. Liability for this kind of chargeback passes from the merchant to
the card issuer, even if the card issuer is not a participating member of the scheme, or if
the cardholder is not enrolled.

2.4.What is it?

The 3-D Secure protocol was developed by

The objective is to benefit all participants
Visa to improve the security of Internet
by providing Issuers the ability to fully
payments. The protocol is offered with the
authenticate cardholders through the use
service name Verified by Visa. MasterCard
of a password during Internet purchases,
has also adapted a similar protocol called
reducing the likelihood of fraudulent
MasterCard SecureCode. Both are
usage of Visa and MasterCard credit cards
designed to allow authentication of
and improving overall transaction
cardholders by their Issuers at participating
performance
merchants.

2.5.What does 3D secure stand for?

3D Secure stands for 3 Domain Secure. The three parties involved in the 3D Secure
process are the following:

1) The Vendor
2) The Acquiring Bank
3) Visa and MasterCard

Please note that 3D secure does not totally eliminate fraud or chargebacks, therefore
merchants should continue to use their anti-fraud systems and security measures

2.6.Benefits of 3-D Secure

The combined effect of ease and flexibility of implementation, secure transmission of

account information, and reduced disputes offers the following benefits for all parties
involved:

 Increased consumer confidence, leading to increased sales

  Increased card acceptance through better merchant confidence in accepting
international transactions
 Reduced cardholder disputes, exception handling, retrievals, chargebacks, re-
presentments, write-offs, and associated handling costs

2.7.Benefits for Members

The primary benefit of 3-D Secure for A less tangible, but nevertheless real,
Members is the reduction in disputed benefit is the assurance members can
transactions and the resultant exception provide to their cardholders who are
handling expense and losses. It is expected considering e-commerce transactions.
that nearly 80% of all e-commerce Studies indicate that as many as a third of
chargebacks and fraud, and a substantial cardholders are afraid to shop online due
proportion of customer complaints, could be to security concerns. Authenticated
eliminated with the use of Authenticated Payment may convince prospective
Payment. This will have a positive impact ecommerce shoppers that it is safe to use
on Member profitability. their card online.

Benefits for Cardholder Benefits for Merchants

 Increased consumer confidence  Minimal impact on merchant’s

when purchasing on the Internet interaction with consumer
 No special software is needed at the  Increased sales by enhancing
cardholder access device consumer confidence
 Easy to use  Reduced risk of fraudulent
 Control over card use for online transactions
purchases  Decrease in disputed transactions

3.E-Mail Security:

3.1.Email Security
Electronic mail (email) is perhaps the most popularly used system for exchanging business
information over the Internet (or any other computer network). At the most basic level, the email
process can be divided into two principal components: (1) mail servers, which are hosts that
deliver, forward, and store email; and (2) mail clients, which interface with users and allow users
to read, compose, send, and store email. This document addresses the security issues of mail
servers and mail clients, including Web-based access to mail.

Mail servers and user workstations running mail clients are frequently targeted by attackers.
Because the computing and networking technologies that underlie email are ubiquitous and well-
understood by many, attackers are able to develop attack methods to exploit security weaknesses.
Mail servers are also targeted because they (and public Web servers) must communicate to some
degree with untrusted third parties. Additionally, mail clients have been targeted as an effective
means of inserting malware into machines and of propagating this code to other machines. As a
result, mail servers, mail clients, and the network infrastructure that supports them must be
protected.

3.2. WHAT DOES EMAIL SECURITY INVOLVE?

The three main principles of Information Security involve maintaining the confidentiality,
integrity, and availability of information resources. These three principles can be directly applied
to the area of email security as well.

 Confidentiality of email involves making sure it is protected from unauthorized

access.

 Integrity of email involves a guarantee that it has not be modified or destroyed by an

unauthorized individual.

 Availability of email involves ensuring that mail servers remain on-line and able to
service the user community. A weakness in any one of these three key areas will
undermine the security posture of an email system and open the door to exploitation.

3.3.Examples of email security issues

 To exchange email with the outside world, a requirement for most organizations,
it is allowed through organizations’ network perimeter defences. At a basic level,
viruses and other types of malware may be distributed throughout an organization
via email. Increasingly, however, attackers are getting more sophisticated and
using email to deliver targeted zero-day attacks in an attempt to compromise
users’ workstations within the organization’s internal network.
 Given email’s nature of human to human communication, it can be used as a
social engineering vehicle. Email can allow an attacker to exploit an
organization’s users to gather information or get the users to perform actions that
further an attack.

 Flaws in the mail server application may be used as the means of compromising
the underlying server and hence the attached network. Examples of this
unauthorized access include gaining access to files or folders that were not meant
to be publicly accessible, and being able to execute commands and/or install
software on the mail server.

 Denial of service (DoS) attacks may be directed to the mail server or its support
network infrastructure, denying or hindering valid users from using the mail
server.

 Sensitive information on the mail server may be read by unauthorized individuals

or changed in an unauthorized manner.

 Sensitive information transmitted unencrypted between mail server and client

may be intercepted. All popular email communication standards default to
sending user names, passwords, and email messages unencrypted.

 Information within email messages may be altered at some point between the
sender and recipient.

 Malicious entities may gain unauthorized access to resources elsewhere in the

organization’s network via a successful attack on the mail server. For example,
once the mail server is compromised, an attacker could retrieve users’ passwords,
which may grant the attacker access to other hosts on the organization’s network.

 Malicious entities may attack external organizations from a successful attack on a

mail server host.

 Misconfiguration may allow malicious entities to use the organization’s mail

server to send email-based advertisements (spam).
 Users may send inappropriate, proprietary, or other sensitive information via
email. This could expose the organization to legal action.

3.4.Why is SSL important for Exchange Servers?

 Exchange servers come with useful remote access features such as Outlook Web
Access, Outlook Anywhere, and ActiveSync. These features allow your users to
access their email from any location with an internet connection by using a web
browser, their laptop, or a mobile device such as a smartphone.
 This convenience carries with it some security risks, the most obvious being the
risk of password credentials being compromised.


 Operating any of these remote access services without SSL means that the
connection, including password credentials, occurs over an unsecured HTTP
connection. HTTP is the protocol that most websites use. It is fast, stable, and
works through just about any firewall. But HTTP has no built in security. Every
bit of data sent over HTTP is unencrypted, so when passwords are sent over
HTTP they are sent “in the clear”, vulnerable to network sniffers.

 Because so much of this remote access occurs from untrusted locations such as
free wireless hotspots, it is critical that SSL be used to protect this traffic.
Chapter 13:
1. WAP
2. IP Security
3. Security in GSM and 3G

1. The WAP Forum

In 1997, Ericsson, Motorola, Nokia, and Unwired Planet formed the WAP
Forum(www.wapforum.org). More than 90 companies in the wireless
telecommunications business are members of the WAP Forum. WAP is the standard
developed by the WAP Forum, a consortium formed by device manufacturers, service
providers, content providers, and application providers. WAP specifies an application
framework and protocols for wireless devices. WAP is a kind of fusion of mobile
networking technologies and Internet technologies.

The WAP Forum’s objectives include:

o To bring Internet content and advanced data services to digital cellular
phones and other wireless terminals.
o To create an interoperable wireless protocol specification that will work
across differing wireless network technologies.
o To enable the creation of content and applications that could scale across
a wide range of wireless bearer networks and device types.
o To embrace and extend existing standards and technologies
The key features provided by WAP include:
o A programming model similar to the Internet
o Wireless Markup Language(WML)
o WMLScript
o Wireless Telephony Application(WTA)
1.1.The WAP Service Model

In the current Internet model, the client runs a copy of the Web browser, which uses
the underlying Internet protocols to access useful content residing in a server in the
network. Such interactions occur through using HTTP request and reply messages. WAP
is based on an Internet technology that has been optimized to address the constraints of
wireless links and wireless devices. Services created by HTML do not usually fit well on
small handheld wireless devices due to their display HTML. WML pages can be also be
encoded in binary format to reduce the amount of data to be transmitted over the wireless
interface.
The WAP service model reveals the presence of a WAP proxy, which is responsible for
protocol conversion and data formatting. It acts as the interface between the wired and
wireless worlds. These two environments have extreme differences, such as available
bandwidth, bit error rates, and storage and processing capabilities. When a mobile device
requests information via the WAP, it is intercepted and interpreted by the WAP proxy,
which then forwards the request via HTTP on behalf of the mobile device to the
appropriate HTTP server in the network. When the proxy receives the information in
response to its earliest request, the information is stored and converted (formatting) to a
suitable form for processing and display on the mobile device using the WAP protocol.

! The user selects an option on their mobile device that has a URL with WML
 content assigned to it.

! The phone sends the URL request via the phone network to a WAP gateway, using
the binary encoded WAP protocol.

! The gateway translates this WAP request into a conventional HTTP request for the
specified URL, and sends it on to the Internet.
! The appropriate Web server picks up the HTTP request.
! The server processes the request, just as it would be any other request. If the URL
refers to a static WML file, the server delivers it. If a CGI script is requested, it is
processed and the content returned as usual.
! The Web server adds the HTTP header to the WML content and returns it to the
gateway.
! The WAP gateway compiles the WML into binary form.
! The gateway then sends the WML response back to the phone.
! The phone receives the WML via the WAP protocol.
! The micro-browser processes the WML and displays the content on the screen.

1.2.Adapting to the Restrictions of the Wireless Network

Low Bandwidth

The size of an average HTML page these days, including graphics, is around 20KB.
With a 56 Kbps modem, the download time for this page would be in the region of 4
seconds. As the bandwidth of a wireless network is around 9.6Kbps, however, the
download time for the data equivalent of just that one page would be around 17
seconds. That is not making any allowances for the network itself being slow due to
congestion, or for latency. The majority of mobile users are not aware of access
speeds, and they should have to care about the differences in access methods to get the
same perception of performance. WAP addresses this bandwidth issue by minimizing
the traffic over the wireless interface. WML and WMLScript are binary encoded into a
compact form before they are transmitted, in order to minimize the bandwidth
restriction.
Less Connection Stability and Unpredictable Bearer Availability

Wired network access provides a more or less reliable connection to the network. That
is not the case in wireless networks, where the bearers might be inaccessible for
shorter or longer periods of time due to fading, lost radio coverage, or deficient
capacity. If you have ever lost a connection when you were driving in your car, you
will know just how frustrating this can be. The architects of the WAP protocol
infrastructure, when putting together the specifications for WAP, have taken the
problem of connection stability into account and have designed into the layers.
Small Display
Instead of using the flat document structure that HTML provides, WML
structures its document in decks and cards. A card is a single unit of
interaction with the end-user, such as a text screen, a selection list, an input
field, or a combination of those. A card is typically small enough to be
displayed even on a small screen. When an application is executed, the user
navigates through a series of cards-the series of cards used for making an
application is collected in a deck.

Limited Memory and CPU

Wireless devices are usually not equipped with large amounts of memory
or computational power in comparison to desktop computers. The memory
restriction applies to RAM as well as ROM. Even though it is likely that
more memory and more powerful CPUs will be available in the near future,
the relative difference will most probably remain. WAP handles these
restrictions by defining a lightweight protocol stack. The limited set of
functionalities provided by WML and WMLScript makes it possible to
implement browsers that make small claims on computational power and
ROM resources. When it comes to RAM, the binary encoding of WML and
WMLScript helps to keep the amount of RAM used as small as possible.
Development on mobile communication devices. It achieves this through a layered
protocol design, covering protocols at Layer 4 and above. The WAP protocol stack is
independent of the underlying network, which could take the form of GSM, CDMA,
CDPD, iDEN, etc. Hence, WAP is essentially an application stack specification; it is not
network-centric.
Wireless Application Environment (WAE)

Generally, WAE enables a spectrum of applications to be supported over WAP.

WAE has two main elements, namely: (a) user agents, and (b) services and formats.
The former includes the WML and WTA(Wireless Telephone Application) user agents.
The latter consists of WML scripts, image formats, etc. A user agent can take the form
of a Web browser. The WML user agent is responsible for the interpretation of WML
and WMLScript. WAP employs the same addressing model as in the Internet, that is, it
use Uniformed Resource Locators(URLs). A URL uniquely identifies an available
resource. WAP also uses Uniform Resource Identifiers (URIs) to address resources that
are not accessed via well-known protocols.

Wireless Session Protocol (WSP)

The WSP provides both connection-oriented and connectionless services. It is

 optimized for low-bandwidth networks with relatively long latency. WSP is a binary
version of HTTP version 1.1, but with the additions of : (a) session migrations, (b)
header caching, etc. WAP connection mode allows the establishment of sessions
between a client and the WAP gateway or proxy. It can handle session interruptions as a
result of mobility and reestablish session states at a later point in time. Header caching
allows better bearer utilization since in HTTP, most of the requests contain static
headers that need to be re-sent again.
Wireless Transaction Protocol (WTP)

WTP is designed for transaction-style communications on wireless devices. In a

transaction, users express their intentions and financial commitments to service
providers for processing. Very often, such transactions demand reliable, fast, and secure
communications. WTP is a lightweight protocol suitable for implementation in thin
clients. WTP implements selective retransmission of lost segments.

Wireless Transport Layer Security(WTLS)

WTLS is needed for WAP to ensure data integrity, privacy, authentication, and
protection from denial-of-service. It is based on Transport Layer Security(TLS) 1.0, but
optimized for wireless channels. It provides transport layer security between a WAP
client and the WAP gateway/proxy. Digital certificates are used for authentication and
nonrepudiation of server and client. Encryption is also used to enhance the degree of
confidentiality.

Wireless Datagram Protocol(WDP)

WDP is the transport layer protocol in WAP. It has the same functionality provided
by the Internet User Datagram Protocol(UDP). Whether WAP uses UDP or WDP,
datagram delivery services are provided by port number functionality and the
characteristics of different bearer services are hidden from the upper layers. WDP can
be extended to provide segmentation and reassembly functions.
2.IP Security:

2.1.Introduction to IPsec

IPsec provides security mechanisms that include secure datagram authentication and
encryption mechanisms within IP. When you invoke IPsec, IPsec applies the security
mechanisms to IP datagrams that you have enabled in the IPsec global policy file.
Applications can invoke IPsec to apply security mechanisms to IP datagrams on a per-
socket level.

Figure 1–1 shows how an IP addressed packet, as part of an IP datagram, proceeds when
IPsec has been invoked on an outbound packet. As you can see from the flow diagram,
authentication header (AH) and encapsulating security payload (ESP) entities can be
applied to the packet. Subsequent sections describe how you apply these entities, as well
as authentication and encryption algorithms.
Figure 1–1 IPsec Applied to Outbound Packet Process

Figure 1–2 shows the IPsec inbound process.

Figure 1–2 IPsec Applied to Inbound Packet Process

2.2.IPsec Security Associations

An IPsec security association (SA) specifies security properties that are recognized by
communicating hosts. These hosts typically require two SAs to communicate securely. A
single SA protects data in one direction. The protection is either to a single host or a
group (multicast) address. Because most communication is peer-to-peer or client-to-
server, two SAs must be present to secure traffic in both directions.
The security protocol (AH or ESP), destination IP address, and security parameter index
(SPI) identify an IPsec SA. The SPI, an arbitrary 32-bit value, is transmitted with an AH
or ESP packet.. An integrity checksum value is used to authenticate a packet. If the
authentication fails, the packet is dropped.

Security associations are stored in a security associations database. A socket-based

administration engine, the pf_key interface, enables privileged applications to manage the
database. The in.iked daemon provides automatic key management.

2.3.Key Management

A security association contains the following information:

 Material for keys for encryption and authentication

 The algorithms that can be used
 The identities of the endpoints
 Other parameters that are used by the system

SAs require keying material for authentication and encryption. The managing of keying
material that SAs require is called key management. The Internet Key Exchange (IKE)
protocol handles key management automatically. You can also manage keys manually
with the ipseckey command. SAs on IPv4 and IPv6 packets can use automatic key
management.

2.4.Protection Mechanisms

IPsec provides two mechanisms for protecting data:

 Authentication Header (AH)

 Encapsulating Security Payload (ESP)

Both mechanisms have their own Security Association Database (SADB).

Authentication Header

The authentication header provides data authentication, strong integrity, and replay
protection to IP datagrams. AH protects the greater part of the IP datagram. AH cannot
protect fields that change non deterministically between sender and receiver. For
example, the IP TTL field is not a predictable field and, consequently, not protected by
AH. AH is inserted between the IP header and the transport header. The transport header
can be TCP, UDP, ICMP, or another IP header when tunnel are being used.

Authentication Algorithms and the AH Module

IPsec implements AH as a module that is automatically pushed on top of IP. The

/dev/ipsecah entry tunes AH with the ndd command. Future authentication algorithms can
be loaded on top of AH. Current authentication algorithms include HMAC-MD5 and
HMAC-SHA-1. Each authentication algorithm has its own key size and key format
properties.

Security Considerations for AH

Replay attacks threaten an AH when an AH does not enable replay protection. An AH

does not protect against eavesdropping. Adversaries can still see data that is protected
with AH.

Encapsulating Security Payload

The encapsulating security payload (ESP) header provides confidentiality over what the
ESP encapsulates, as well as the services that AH provides. However, ESP only provides
its protections over the part of the datagram that ESP encapsulates. ESP's authentication
services are optional. These services enable you to use ESP and AH together on the same
datagram without redundancy. Because ESP uses encryption-enabling technology, ESP
must conform to U.S. export control laws.

ESP encapsulates its data, so ESP only protects the data that follows its beginning in the
datagram. In a TCP packet, ESP encapsulates only the TCP header and its data. If the
packet is an IP-in-IP datagram, ESP protects the inner IP datagram. Per-socket policy
allows self-encapsulation, so ESP can encapsulate IP options when ESP needs to. Unlike
the authentication header (AH), ESP allows multiple kinds of datagram protection. Using
only a single form of datagram protection can make the datagram vulnerable. For
example, if you use ESP to provide confidentiality only, the datagram is still vulnerable
to replay attacks and cut-and-paste attacks. Similarly, if ESP protects only integrity, ESP
could provide weaker protection than AH. The datagram would be vulnerable to
eavesdropping.

Security Considerations for ESP

An ESP without authentication is vulnerable to cut-and-paste cryptographic attacks and

to replay attacks. When you use ESP without confidentiality, ESP is as vulnerable to
eavesdropping as AH is.

Authentication and Encryption Algorithms

IPsec uses two types of algorithms, authentication and encryption. The authentication
algorithms and the DES encryption algorithms are part of core Solaris installation. If you
plan to use other algorithms that are supported for IPsec, you must install the Solaris
Encryption Kit. The Solaris Encryption Kit is provided on a separate CD.

Authentication Algorithms

Authentication algorithms produce an integrity checksum value or digest that is based on

the data and a key. The man pages for authentication algorithms describe the size of both
the digest and key. The following table lists the authentication algorithms that are
supported in the Solaris operating environment. The table also lists the format of the
algorithms when the algorithms are used as security options to the IPsec utilities and their
man page names.
Protection Policy and Enforcement Mechanisms

IPsec separates its protection policy from its enforcement mechanisms. You can enforce
IPsec policies in the following places:

 On a system-wide level
 On a per-socket level

IPsec applies the system-wide policy to incoming datagrams and outgoing datagrams.
You can apply some additional rules to outgoing datagrams, because of the additional
data that is known by the system. Inbound datagrams can be either accepted or dropped.
The decision to drop or accept an inbound datagram is based on several criteria, which
sometimes overlap or conflict. Conflicts are resolved by determining which rule is parsed
first. Except when a policy entry states that traffic should bypass all other policy, the
traffic is automatically accepted. Outbound datagrams are either sent with protection or
without protection. If protection is applied, the algorithms are either specific or non-
specific.

The policy that normally protects a datagram can be bypassed. You can either specify an
exception in the system-wide policy, or you can request a bypass in the per-socket policy.
For intra-system traffic, policies are enforced, but actual security mechanisms are not
applied. Instead, the outbound policy on an intra-system packet translates into an inbound
packet that has had those mechanisms applied.

Transport and Tunnel Modes

When you invoke ESP or AH after the IP header to protect a datagram, you are using
transport mode. An example follows. A packet starts off with the following header:
ESP, in transport mode, protects the data as follows:

AH, in transport mode, protects the data as follows:

AH actually covers the data before the data appears in the datagram. Consequently, the
protection that is provided by AH, even in transport mode, covers some of the IP header.

When an entire datagram is inside the protection of an IPsec header, IPsec is protecting
the datagram in tunnel mode. Because AH covers most of its preceding IP header, tunnel
mode is usually performed only on ESP. The previous example datagram would be
protected in tunnel mode as follows:

In tunnel mode, the inner header is protected, while the outer IP header is unprotected.
Often, the outer IP header has different source and different destination addresses from
the inner IP header. The inner and outer IP headers can match if, for example, an IPsec-
aware network program uses self-encapsulation with ESP. Self-encapsulation with ESP
protects an IP header option.

The Solaris implementation of IPsec is primarily an implementation of IPsec in transport

mode. Tunnel mode is implemented as a special instance of the transport mode. The
implementation treats IP-in-IP tunnels as a special transport provider. The ifconfig
configuration options to set tunnels are nearly identical to the options that are available to
socket programmers when enabling per-socket IPsec. Also, tunnel mode can be enabled
in per-socket IPsec. In per-socket tunnel mode, the inner packet IP header has the same
addresses as the outer IP header.

3.GSM Security :

The Purpose of GSM Security: The use of radio communications for transmission to the
mobile subscribers makes GSM Public Land Mobile Networks (PLMN) particularly
sensitive to misuse of their resources by unauthorized persons using manipulated Mobile
Stations, who try to impersonate authorized subscribers and eavesdropping of the various
information, which are exchanged on the radio path. So the security features in GSM
PLMN is implemented to protect:

• The access to the mobile services.

• Any relevant item from being disclosed at the radio path, mainly in order to ensure the
privacy of user-related information.

Security Features of GSM several security functions were built into GSM to safeguard
subscriber privacy. These include:

 Authentication of the registered subscribers only

 Secure data transfer through the use of encryption
 Subscriber identity protection
 Mobile phones are inoperable without a SIM
 Duplicate SIM are not allowed on the network

3.1.Authentication of the registered subscribers:

International Mobile Subscriber identity (IMSI) authentication is the corroboration by

the land- based part of the system that the subscriber identity (IMSI or TMSI), transferred
by the mobile subscriber within the identification procedure at the radio path, is the one
claimed. The purpose of this authentication security feature is to protect the network
against unauthorized use. It enables also the protection of the GSM PLMN subscribers by
denying the possibility for intruders to impersonate authorized users.

3.2.The authentication procedure:

• The mobile station sends IMSI to the network

• The network received the IMSI and found the correspondent KI of that IMSI.

• The network generated a 128 bit random number (RAND) and sent it to the mobile
station over the air interface.

• The MS calculates a SRES with the A3 algorithm using the given Challenge (RAND)
and the KI residing in the SIM.

• At the same time, the network calculates the SRES using the same algorithm and the
same inputs.

• The MS sends the SRES to the network

• The network test the SRES for validity.

The authentication is based on a shared secret KI between the subscriber’s home

network’s HLR and the subscriber' s SIM. This KI was generated and write to the SIM
card at a safe place when the SIM card is personalized, and a copy of the key is put to the
HLR. When a new GSM subscriber turns on his phone for the first time, its IMSI is
transmitted to the AuC on the network. After which, a Temporary Mobile Subscriber
Identity (TMSI) is assigned to the subscriber. The IMSI is rarely transmitted after this
point unless it is absolutely necessary. This prevents a potential eavesdropper from
identifying a GSM user by their IMSI. The user continues to use the same TMSI,
depending on the how often, location updates occur. Every time a location update occurs,
the network assigns a new TMSI to the mobile phone. The TMSI is stored along with the
IMSI in the network. The mobile station uses the TMSI to report to the network or during
call initiation. Similarly, the network uses the TMSI, to communicate with the mobile
station. The Visitor Location Register (VLR) performs the assignment, the administration
and the update of the TMSI. When it is switched off, the mobile station stores the TMSI
on the SIM card to make sure it is available when it is switched on again.

3.3.Encryption of the data

a. Generation of the cipher key KC

GSM makes use of a ciphering key to protect both user data and signal on the vulnerable
air interface. Once the user is authenticated, the RAND (delivered from the network)
together with the KI (from the SIM) is sent through the A8 ciphering key generating
algorithm, to produce a ciphering key (KC). The A8 algorithm is stored on the SIM card.
The KC created by the A8 algorithm, is then used with the A5 ciphering algorithm to
encipher or decipher the data.

Note that the session key is generated in the SIM card of the Mobil Station. And the
network can use the same set of Ki, RAND and the same algorithm to generate the same
key to decrypt the data. Almost all the GSM operators use one algorithm (called
COMP128) for both authentication and generation of Kc. As will be discussed below.
Encryption of the data Encrypted communication is initiated by a ciphering mode request
command from the GSM network. Upon receipt of this command, the mobile station
begins encryption and decryption of data. Each frame in the over-the-air traffic is
encrypted with a different key-stream. The A5 algorithm used to encrypt the data is
initialized with the KC and the number of the frame to be encrypted, thus generating a
different key stream for every frame. The same KC is used as long as the MSC does not
authenticate the MS again, in which case a new KC is generated. In practice, the same
KC may be in use for days. The MS authentication is an optional procedure in the
beginning of a call, but it is usually not performed. So it is very common the KC will not
change during calls. When it is switched off, the mobile station stores the TMSI on the
SIM card to make sure it is available when it is switched on again. The A5 algorithm is
implemented in the hardware of the mobile phone, as it has to encrypt and decrypt data
on the fly.

Other security features Subscriber identity protection The IMSI(International Mobile

Subscriber Identity) is stored in the SIM card. To ensure subscriber identity
confidentiality, the Temporary Mobile Subscriber Identity (TMSI) is used. The TMSI is
sent to the mobile station after the authentication and encryption procedures have taken
place. The mobile station responds by confirming reception of the TMSI. The TMSI is
valid in the location area in which it was issued. For communications outside the location
area, the Location Area Identification (LAI) is necessary in addition to the TMSI. Smart
card The smart card is like a micro computer which has memory, cpu and operating
system. By programming the rom, it can store the sensitive data with very high security
level. So it provides a good way to store the Ki and IMSI and other sensitive user data.
Chapter 14
Authentication basics
Certificate – based authentication
Passwords

1.Authentication Basics:
1.1.AUTHENTICATION:
This error message indicates that the authentication process between your local computer and
the remote host computer has for some reason failed. The most common cause for failed
authentication is an incorrect password, likely caused by a typing mistake.
Also the user name may be incorrect. So it is necessary to check that the typing has been done
correctly.
One possible reason for authentication failure is that the remote host computer may have been
configured to require several authentication methods to be used. For example both password and
public key authentication could be used for increased security. Even if the password is typed
incorrectly, some other required authentication method could have failed. A relatively common
situation is one where the remote host computer is expecting public-key authentication and the
user has not sent the public key to the host. It may also be possible that the user account on the
remote host computer has been disabled or that the remote host computer is having temporary
problems causing errors with the login procedure.
Try to connect again and carefully type in your user name and password. If after a couple of
retries you are sure that you have entered both of them correctly, contact the system
administrator of the remote host computer.

Authentication

Something Something Something Some place

that you that you that you Are where you
 Know Have Are

Authentication can be stated as the method of validating the identity of genuine or authorized
users.
Something that you know:
 The very first and the foremost are your user-id and passwords.
 The next can be your personal matters such as your date of birth, your mother’s maiden
name, your pet’s name etc.
These are simple to use and require no special hardware; user-id and password continue to be
the most popular method of authentication.
Something that you have:
 Image of person’s face
 Retina or iris
 Fingerprints
 Hand geometry
 Digital Signature
Something that you are:
This is the actual physical feature of the user like the fingerprints or the way the user
communicates (Voice) or the way that the user looks (Image) etc. These are the natural qualities
of the user, which cannot be changed or misused even by the user himself.
There are various methods used for this purpose, but the most commonly used one is by way
of login name and passwords. In order to keep your authentication method foolproof, some strict
policies have to be adopted. But, still the authentication failure is one of the ways in which the
intruders can penetrate into the systems.
Firstly the passwords have to be properly designed using all the available rules. Sometimes, if
the password is stored in some user database in clear text, then the intruder can easily intercept it
another example of authentication failure is by way of a fake login program run on a terminal.
One more form of authentication attack may come from the remote login programs. Protocols
like rlogin, telnet is vulnerable to this. If these are available on for your host, intruders may keep
retrying till they are lucky and get a chance to penetrate these systems. Hence, normally it is
advised to turn often-remote login features for added security.
Most of the attacks that take place are as a result of some authentication failure. But
authentication failures or authentication race refers to the tactic of beating a one-time
password scheme that works with many security systems.
Usually a one-time password is a good technique of ensuring that the password even if
intercepted and understood will not have any significance since its not going to be used again.
But even then eavesdroppers can easily pick up a plain password on an unencrypted session and
they may take a shot at single time passwords also.
For this we assume an example of a password that contains only digits and is of known
length. The attacker initiates ten connections to the desired service. Each connection is waiting
for the same unknown password. The valid user connects and starts typing the correct password.
The attack program watches this, and relays the correct characters to its ten connections as
they arc typed. When anyone digit remains to be entered, the program sends a different digit to
each of its connections, before the valid user can type the last digit. Because the computer is
faster, it wins the race, and one of the connections is validated. These authentication schemes
often allow only a single login with each password, so the valid user will be rejected, and will
have to try again. Of course, in this case the attacker needs to know the length of the password.

2.Passwords & Authentication tokens:

2.1.Intruders:
 Significant issue for networked systems is hostile or unwanted access

 Either via network or local

 can identify classes of intruders:

 Masquerader

 Misfeasor

 Clandestine user
 Varying levels of capability

 clearly a growing publicized problem

 from “Wily Hacker” in 1986/87

 to clearly escalating CERT stats

 may seem benign, but still cost resources

 there is no way in advance to know whether an intruder will be benign or malign

 may use compromised system to launch other attacks

 awareness of intruders has led to the development of CERTs

2.2.Intrusion Techniques:

 Aim to gain access and/or increase privileges on a system

 Basic attack methodology

 target acquisition and information gathering

 initial access

 privilege escalation

 covering tracks

 key goal often is to acquire passwords

 so then exercise access rights of owner

Password Guessing:

 one of the most common attacks

 attacker knows a login (from email/web page etc)

 then attempts to guess password for it

  defaults, short passwords, common word searches

 user info (variations on names, birthday, phone, common words/interests)

 exhaustively searching all possible passwords

 check by login or against stolen password file

 success depends on password chosen by user surveys show many users choose poorly.

2.3.Password Capture:

 another attack involves password capture

 watching over shoulder as password is entered

 using a trojan horse program to collect

 monitoring an insecure network login

• eg. telnet, FTP, web, email

 extracting recorded info after successful login (web history/cache, last number
dialed etc)

 using valid login/password can impersonate user

 users need to be educated to use suitable precautions/countermeasures

2.4.Password Management:

 front-line defense against intruders

 users supply both:

 login – determines privileges of that user

 password – to identify them

 passwords often stored encrypted

  Unix uses multiple DES (variant with salt)

 more recent systems use crypto hash function

 should protect password file on system

2.5.Password Study:

 Purdue 1992 - many short passwords

 Klein 1990 - many guessable passwords

 conclusion is that users choose poor passwords too often

 need some approach to counter this

Managing Passwords:

Education:

 can use policies and good user education

 educate on importance of good passwords

 give guidelines for good passwords

 minimum length (>6)

 require a mix of upper & lower case letters, numbers, punctuation

 not dictionary words

 Generally ignored by many users

2.6.Computer Generated:

 let computer create passwords

 if random likely not memorisable, so will be written down (sticky label syndrome)

 even pronounceable not remembered

  have history of poor user acceptance

 FIPS PUB 181 one of best generators

 has both description & sample code

 generates words from concatenating random pronounceable syllables

2.7.Reactive Checking:

 reactively run password guessing tools

 note that good dictionaries exist for almost any language/interest group

 cracked passwords are disabled

 but is resource intensive

 bad passwords are vulnerable till found

2.8.Proactive checking:

 most promising approach to improving password security

 allow users to select own password

 but have system verify it is acceptable

 simple rule enforcement (see earlier slide)

 compare against dictionary of bad passwords

 use algorithmic (markov model or bloom filter) to detect poor choices)

3.Certificate based authentication:

3.1.X.509 Authentication Service:


part of CCITT X.500 directory service standards

distributed servers maintaining user info database

defines framework for authentication services
 
directory may store public-key certificates

with public key of user signed by certification authority

also defines authentication protocols

uses public-key crypto & digital signatures

algorithms not standardised, but RSA recommended

X.509 certificates are widely used

3.2.X.509 Certificates:


issued by a Certification Authority (CA), containing:

version (1, 2, or 3)

serial number (unique within CA) identifying certificate

signature algorithm identifier

issuer X.500 name (CA)

period of validity (from - to dates)

subject X.500 name (name of owner)

subject public-key info (algorithm, parameters, key)

issuer unique identifier (v2+)

subject unique identifier (v2+)

extension fields (v3)

signature (of hash of all fields in certificate)

notation CA<<A>> denotes certificate for A signed by CA
Obtaining a Certificate:


any user with access to CA can get any certificate from it

only the CA can modify a certificate

because cannot be forged, certificates can be placed in a public directory

CA Hierarchy:


if both users share a common CA then they are assumed to know its public key

otherwise CA's must form a hierarchy

use certificates linking members of hierarchy to validate other CA's

each CA has certificates for clients (forward) and parent (backward)

each client trusts parents certificates

enable verification of any certificate from one CA by users of all other CAs in hierarchy
Certificate Revocation:
 
certificates have a period of validity


may need to revoke before expiry, eg:
1. user's private key is compromised

2. user is no longer certified by this CA

3. CA's certificate is compromised


CA’s maintain list of revoked certificates
1. the Certificate Revocation List (CRL)


users should check certificates with CA’s CRL
Authentication Procedures:


X.509 includes three alternative authentication procedures:

One-Way Authentication

Two-Way Authentication

Three-Way Authentication

all use public-key signatures

One-Way Authentication:


1 message ( A->B) used to establish

the identity of A and that message is from A

message was intended for B

integrity & originality of message

message must include timestamp, nonce, B's identity and is signed by A

may include additional info for B

eg session key

Two-Way Authentication:


2 messages (A->B, B->A) which also establishes in addition:

the identity of B and that reply is from B

that reply is intended for A

integrity & originality of reply

reply includes original nonce from A, also timestamp and nonce from B

may include additional info for A

Three-Way Authentication:

3 messages (A->B, B->A, A->B) which enables above authentication without synchronized clocks


has reply from A back to B containing signed copy of nonce from B

means that timestamps need not be checked or relied upon
2.3.X.509 Version 3:


has been recognised that additional information is needed in a certificate

email/URL, policy details, usage constraints

rather than explicitly naming new fields defined a general extension method

extensions consist of:

extension identifier

criticality indicator

extension value

Certificate Extensions:
 
key and policy information


convey info about subject & issuer keys, plus indicators of certificate policy

certificate subject and issuer attributes

support alternative names, in alternative formats for certificate subject and/or issuer


certificate path constraints

allow constraints on use of certificates by other CA’s
Chapter 15
1. Security handshake pitfalls
2. Single Sign On (SSO)
3. Biometric authentication

1. Security handshake pitfalls:

During the handshake phase communication parameters are negotiated and initial
information are exchanged. Some of these information are secret (e.g. the password), some
are not (e.g. the user names).

To cope with different types of threats individual protocols have different strengths and
weaknesses.

– Some threats are more likely in some situations.

– Availability of resources may differ:

· Computational power

· Specialized hardware

– Humans and computers may behave differently.

– Protocols themselves may be flawed.

Login Only:

Many protocols were designed for environments where eavesdropping was not a concern.
Authentication in such protocols consist of :

1. Alice sends her name and password to Bob.

2. Bob verifies the name and password, and then communication commences, without any
further attention to security.

A very common enhancement to such a protocol is to replace the transmission of the clear
text password with a cryptographic challenge /response.

Login only/ shared secret:

This would be a big improvement over clear text passwords. An eavesdropper cannot
impersonate Alice based on overhearing the exchange, since next time there will be a different
challenge.

However, there are some weaknesses to this protocol:

– Authentication is not mutual.

– If this is the entire protocol, then Trudy can hijack the conversation after the initial exchange. –
An eavesdropper could mount an off -line password -guessing attack.

– Someone who has access to Bob’s database can impersonate Alice.

This protocol has only minor security differences from the previous one:

– This protocol requires reversible cryptography, for example a secret key cryptographic
algorithm.

– If R is a recognizable quantity, Trudy can mount a password-guessing attack without

eavesdropping by merely sending the message „I am Alice“and obtaining K {R}.

This modification requires Bob and Alice to have synchronized clocks. The properties of this
modification include:

– It can be added very easily to a protocol designed for sending cleartext passwords, since is
does not add any additional messages.

– The protocol is now more efficient. The server does not have to keep any transient status
information about Alice.

– Someone eavesdropping can use Alice’s K (albeit only within a small time interval).
 – Another potential security pitfall occurs if there are multiple servers for which Alice uses
the same secret K AB: an eavesdropper who acts quickly can use Alice’s encrypted
timestamp field, and impersonate Alice on a different server.

Requirements and disadvantages of the discussed protocols:

– They require a secret key cryptography algorithm, and therefore shared secret keys.

– Trudy can impersonate Alice if she can read Bob’s database.

Theses weaknesses can be avoided if the protocol is based on public key technology.

Login Only / One-Way Public Key:

The above protocol is based on a public key and similar to the first protocol. Bob verifies
Alice’s signature [ R] login if the result matches R. using her public key , and accepts the Alice .

The advantage of this protocol:

– Reading Bob’s database at is no longer a potential security- threat, but it must be protected
from unauthorized modification.

– If you can impersonate Bob’s network address you can trick Alice into signing something (wait
for Alice to try log in and then give her your quantity ).
Properties of this protocol:

– Requires a reversible public key algorithm.

– If you can impersonate Bob’s network address you can trick Alice into decrypting something
(wait for Alice to try log in and send the encrypted message ).

Solution:

– A message should have a structure so that it cannot be mistaken for another type .

Login Only / Lamport’s Hash:

Lamport’s Hash:

– Interesting one- time password scheme.

– It allows Bob to authenticate Alice in a way that neither eavesdropping on an authentication

exchange nor reading Bob’s database enables someone to impersonate Alice.

– No need for public key cryptography.

Requirements:

– Alice remembers a password, Alice is a human.

– Bob (the server) has a database; for each user it stores:

· username,

· n, decremented each time the user authenticates herself,

 · hash (Password ), i.e. hash(hash(...(hash(Password ))...)))

Initialization of a password:

– Alice chooses a password.

– The workstation of Alice chooses the number n and computes

Authentication of a user:

– Alice enters her username and password.

– Her workstation sends the name to Bob which returns n.

– The workstation computes hash n-1 (Password) and sends the result to Bob.
 – Bob takes the received value and hashes it once, and compares it with its database. In case
of a match Bob considers the response valid , replaces the stored quantity with the received
quantity, and replaces n by n-1 .

Setting up a new password:

– If n = 1 Alice needs to set her password again.

– In many situations it suffices to choose a new password, compute hash (new Password),
and transmit hash (new Password) and n to Bob.

– An enhancement is to add a salt value to the password (like in the UNIX- Password
environment), with the same advantages.

– Another advantage of salt is that Alice will not need to change her password if n = 1. n n

2.Single Sign on:

What is single sign on?

Single Sign On (SSO) (also known as Enterprise Single Sign On or "ESSO") is the ability for a
user to enter the same id and password to logon to multiple applications within an enterprise. As
passwords are the least secure authentication mechanism, single sign on has now become known
as reduced sign on (RSO) since more than one type of authentication mechanism is used
according to enterprise risk models.

For example, in an enterprise using SSO software, the user logs on with their id and password.
This gains them access to low risk information and multiple applications such as the enterprise
portal. However, when the user tries to access higher risk applications and information, like a
payroll system, the single sign on software requires them to use a stronger form of
authentication. This may include digital certificates, security tokens, smart cards, biometrics or
combinations thereof.

Single sign on can also take place between enterprises using federated authentication. For
example, a business partner's employee may successfully log on to their enterprise system. When
they click on a link to your enterprise's application, the business partner's single sign on system
will provide a security assertion token to your enterprise using a protocol like SAML, Liberty
Alliance, WS Federation or Shibboleth. Your enterprise's SSO software receives the token,
checks it, and then allows the business partner's employee to access your enterprise application
without having to sign on.

Single sign on federated authentication also works with your employees. For example, an
employee who is trying to access your outsourced benefits supplier to update their benefits
information would click on the benefits link on your intranet. Your enterprise's single sign on
software would then send a security assertion token to the benefits supplier. The benefits
supplier's SSO system would then take the token, check it and grant access to your employee
without making them sign on.

Single Sign On Benefits

Single sign on benefits are:

 Ability to enforce uniform enterprise authentication and/or authorization policies across

the enterprise
 End to end user audit sessions to improve security reporting and auditing
 Removes application developers from having to understand and implement identity
security in their applications
 Usually results in significant password help desk cost savings

Since the internet is stateless, this means that the single sign on software must check every
request by the user's browser to see if there is an authentication policy pertaining to the resource
or application the user is trying to access. In a medium to large enterprise, this means that every
time the user clicks on a different URL, there is traffic between the user's browser, the web or
application servers and the security server. This traffic can become large and cumbersome from a
performance perspective. Therefore, most modern single sign on systems use LDAP
(Lightweight Directory Access Protocol) directories to store the authentication and authorization
policies. The LDAP directories are made for high performance lookups thus addressing the high
traffic load. Further, the LDAP directories are often the source for the single sign on system to
authenticate against.

Single sign on systems in medium to large enterprises can become a single point of enterprise
failure if not properly designed. If the single sign on system goes down but the applications
remain up, no user can access any resource or application protected by the SSO system. Many
enterprises have experienced this painful condition resulting in productivity loss. Therefore, it is
essential that your enterprise single sign on system have a good and well tested failover and
disaster recovery design.

Finally, single sign on systems in medium to large enterprises requires good identity data
governance. Enterprise security features being offered by the single sign on system is only as
good as the underlying identity data. Thus it is critical that all enterprise identity data have good,
quick business processes that pick up on any change to the identity such as new identity creation,
identity termination or role changes. Without this, enterprise SSO systems are vulnerable to
creating enterprise security holes.

Components of Single Sign-On

Single Sign-On has two components:

 Login Serve
 Single Sign-On Application Programming Interface (API)

Login Server

The first time that a user seeks access to an application, the Login Server:

 Authenticates the user by means of user name and password

 Passes the client's identity to the various applications
 Marks the client being authenticated with an encrypted login cookie
In subsequent user logins, this login cookie provides the Login Server with the user's identity,
and indicates that authentication has already been performed. If there is no login cookie, then the
Login Server presents the user with a login challenge.

To guard against sniffing, the Login Server can send the login cookie to the client browser over
an encrypted SSL channel.

The login cookie expires with the session, either at the end of a time interval specified by the
administrator, or when the user exits the browser. It is never written to disk.

A partner application can expire its session through its own explicit logout.

Single Sign-On Application Programming Interface (API)

The Single Sign-On API enables:

 Applications to communicate with the Login Server and to accept a user's identity as
validated by the Login Server
 Administrators to manage the application's association to the Login Server

Single Sign-On Application Types

There are two kinds of applications to which Single Sign-On provides access:

 Partner Applications
 External Applications

Partner Applications

Partner applications are integrated with the Login Server. They contain a Single Sign-On API
that enables them to accept a user's identity as validated by the Login Server.

External Applications
External applications are web-based applications that retain their authentication logic. They do
not delegate authentication to the Login Server and, as such, require a user name and password to
provide access. Currently, these applications are limited to those which employ an HTML form
for accepting the user name and password. The user name may be different from the SSO user
name, and the Login Server provides the necessary mapping.

Single Sign-On Authentication Methods

Single Sign-On can use one of these authentication methods:

Single Sign-On Authentication Methods

Local user Uses a lookup table within the Login Server schema. This table contains
authentication user name, password, Login Server privilege level, and other auditing fields
for the user. The incoming password is one-way hashed and compared to the
entry in the table.

External repository Typically relies on an LDAP-compliant directory. In this case, the Login
authentication Server binds to the LDAP-compliant directory, then looks up the user
credentials stored there. External Authentication includes LDAP and
Database Authentication and any others that may be custom-developed.

How Single Sign-On Works

Whenever a user accesses either a partner application or an external application, the Login
Server first authenticates that user.

This section contains these topics:

 Authenticating to the Login Server

 Accessing a Partner Application
 Accessing an External Application

Authenticating to the Login Server

The Login Server authenticates a user in this way:

Accessing a Partner Application

When a user seeks access to a partner application, the following steps occur:

Partner Application Development Requirement

  To implement an authentication check:

1. Protected URLs need to check for an application session cookie for authorization.

2. If no application session cookie exists, then the browser redirects the user to the
Single Sign-On server.

3. If the URL is publicly accessible, then no authorization check is implemented.

 To implement a sign-on URL:

1. This URL must establish an application session cookie using the identity
information sent by the Single Sign-On server.

2. The browser then redirects the user to the requested URL

Accessing an External Application

You can accessing an external application through Oracle Portal. In this scenario, Oracle Portal
functions as a partner application.

This section contains these topics:

 Authenticating to Oracle Portal

 Authenticating to an External Application for the First Time
 Authenticating to an External Application After the First Time

Authenticating to Oracle Portal

When a user seeks access to an external application by way of Oracle Portal, Single Sign-On
authenticates the user to Oracle Portal through this process:
If, during the same session, the user again seeks access to Oracle Portal, then the Login Server
does not prompt the user for user name and password. Instead, it obtains that information from
the login cookie on the client browser.

Authenticating to an External Application for the First Time

Single Sign-On uses the process described in the next figure under these conditions:

 The user has authenticated to the Oracle Portal

 The user is accessing an external application for the first time through Oracle Portal
Authenticating to an External Application After the First Time

Single Sign-On uses the process described in the next figure if the user:

 Has authenticated to the Oracle Portal

 Has a user name and password in the Login Server password store
 Is accessing an external application after the first time
3. Biometric Authentication:

The Biometric Advantage

Of course, one-time password tokens can be lost as well as potentially hacked so relying on
"something they have" is not always a foolproof approach.

Instead, an even more secure two-factor system can be based on "something they are" – that is,
biometric information derived from measurable biological or behavioral characteristics.

Common biological characteristics used for enterprise authentication are fingerprints, palm or
finger vein patterns, iris features, and voice or face patterns. These last three involve no physical
contact with a biometric sensor, which makes them less intrusive to use.
Behavioral characteristics such as keystroke dynamics – a measure of the way that a user types,
analyzing features such as typing speed and the amount of time they "dwell" on a given key –
can also be used to authenticate a user.

The biggest growth area is the deployment of systems that make use of a Smartphone as a
portable biometric sensor, according to Ant Allan, a research vice president at Gartner. "There is
an explosion in the choice of authentication methods open to organizations, and we are certainly
seeing a shift towards biometric systems that take advantage of sensors in mobile devices – the
camera, for face or iris recognition, the microphone for voice recognition, and the keyboard for
typing rhythm," he said.

The advantages of this Smartphone-based approach are that it is not necessary to purchase any
special biometric hardware, because users are likely to have their phone with them any time they
need to log on to a system, and the phone's cellular or Wi-Fi connectivity can be used to transmit
biometric information to a back-end authentication system.

Benefits and Drawbacks

The main benefit of using a biometric authentication factor instead of a physical token is that
biometrics can't easily be lost, stolen, hacked, duplicated, or shared. They are also resistant to
social engineering attacks – and since users are required to be present to use a biometric factor, it
can also prevent unethical employees from repudiating responsibility for their actions by
claiming an imposter had logged on using their authentication credentials when they were not
present.

"Biometric systems can be much more convenient than tokens and other systems, and are useful
to augment existing security methods like passwords," said Alan Goode, a security analyst at
Goode Intelligence. "For added security they are also sometimes used as a third factor," he
added.

The main drawback of any biometric system is that it can never be 100 percent accurate. To use
a biometric system, it is first necessary for each user to enroll by providing one or more samples
of the biometric in question (such as a fingerprint) which is used to make a "template" of that
biometric. When a user attempts to authenticate, the biometric they provide is then compared
with their stored template. The system then assesses whether the sample is similar enough to the
template to be judged to be a match.

A measure of a system's accuracy is commonly provided by two statistics: False Non Match Rate
(FNMR) and False Match Rate (FMR). The former measures how often a biometric is not
matched to the template when it should be, while the latter measures how often a false biometric
is matched (and authentication is allowed) when it shouldn't be. Most biometric systems can be
"tuned" to reduce one of these two measurements, usually at the expense of the other. "It's
important to understand that when a user supplies a password or a number from an OTP (one
time password) token, it is either correct or it isn’t. With biometrics you never get a definitive
yes or no," explained Mark Diodati, a Gartner analyst.

What to Look For

1. Cost. The purpose of implementing any biometric system is generally to maintain the same
level of security at lower cost, or to improve security at a reasonable cost. The cost of
implementing a biometric system will depend on whether biometric authentication can be added
to your existing authentication infrastructure using standards such as BioAPI (vendors such as
Entrust support fingerprint readers as authenticators on their platform), or whether your entire
authentication platform has to be replaced, or whether you decide to use an additional biometric
authentication system in parallel with your existing one.

An alternative approach could be to use biometrics to access a single sign-on system that then
accesses your existing authentication system(s).

Other factors include the cost of sensors such as fingerprint readers or iris scanners that have to
be purchased. This drawback obviously does not apply with biometric system that use smart
phones as sensors.

2. Biometric type and security. Different biometric systems provide different levels of security
as measured by FNMR and FMR scores – and with the current state of technology, a good
fingerprint reader generally offers a lower FNMR and FMR (and therefore "better security") than
non-contact technologies such as voice or face recognition.

But before rejecting any biometric type on the grounds that its FNMR and FMR scores are too
high, it is important to consider what level of security you really need a biometric system to
provide. A biometric system that you plan to use as the single factor for authentication needs to
offer more security than a system that you plan to use as a second or third factor.

It's also important to take into account the environment the biometric authentication system will
be used in. For example, fingerprint readers do not work well in environments where users'
fingers are likely to be dirty. Similarly, voice recognition systems are not a good match for
excessively noisy environments.

3. Anti-spoofing measures. One potential problem with biometric factors is that they are not
"secrets" in the way that passwords or tokens are. This means that it could be possible for a
hacker to present a photograph to fool a facial recognition system, to present a wax cast of a
fingerprint to a reader, or to play back a recording of a voice to a voice recognition system. It
may even be possible to intercept the biometric data from the reader and replay it later,
bypassing the biometric sensor. Before purchasing any biometric technology, be sure to
understand what types of anti-spoofing measures it employs.

Vendors tackle this problem in a number of ways. For example, some voice recognition systems
require users to authenticate by asking them to speak a series of random words, preventing them
from using a previously recorded voice sample. Similarly, face recognition systems may attempt
to detect blinking to ascertain that the image in front of the camera is not a photograph.
Sophisticated fingerprint readers also measure heat or electrical conductivity to establish that the
finger is "alive."

4. Revocation. Unlike a password, biometric characteristics such as fingerprints can't be revoked

or changed. This can pose a serious problem should a hacker successfully compromise the
database housing the biometric credentials. Some biometric systems may deal with this challenge
by uniquely distorting or transforming the biometric template when it is stored, and transforming
or distorting the biometric in the same way during the match process. If a hacker compromises a
fingerprint template database, users can then re-enroll and distinct templates can be generated by
using a different distortion or transformation. Ask any vendor you talk to how their system deals
with template revocation.

5. Compatibility with operating systems and devices. Make sure any biometric system you are
considering works with every operating system in your organization that will use it. The same
goes for mobile devices such as tablets and cell phones.

6. Ease of management. When evaluating a biometric authentication system, make sure to pay
particular attention to how easily the system can be managed using the management software
provided to you by the vendor. It's particularly important to investigate how easily you can enroll
large numbers of users into the system.

# 7. Integration with directory systems: It's advisable to consider if the system can integrate
easily with Active Directory or any other LDAP directory system you use. If not, does it use its
own directory system, and how practical would it be for you to use it?