NETWORK AND INFORMATION SECURITY (316317)

Unit - IV Firewall and Encryption Algorithms

4.1 Firewall: Need of Firewall, Types of Firewalls
❖ Need / Importance of Firewall
✓ Acts as a security barrier between trusted internal network (LAN) and
untrusted external network (Internet).
✓ Prevents unauthorized access, blocks malicious traffic (e.g., hackers,
malware, DoS attacks).
✓ Enforces security policies (e.g., allow HTTP/HTTPS, block certain ports).
✓ Monitors and logs traffic for auditing.
✓ Essential in modern networks due to increasing cyber threats (ransomware,
phishing, data breaches).

❖ Types of Firewalls (based on filtering method – OSI layers)

1. Packet Filtering Firewall (Stateless)

➢ Works primarily at the Network layer (Layer 3) and Transport layer (Layer
4) of the OSI model, inspecting individual packet headers without regard to
context or sequence.
➢ Evaluates packets based on predefined rules involving source/destination IP
addresses, protocol types (TCP/UDP/ICMP), port numbers, and direction of
traffic.
➢ Implements security through Access Control Lists (ACLs) that permit or
deny traffic matching specific criteria.
➢ Offers high performance and low latency due to minimal processing
overhead, making it suitable for high-speed networks and edge routers.
➢ Limitations include inability to detect spoofed packets, fragmented attacks,
or application-specific threats, and vulnerability to certain evasion
techniques.
2. Stateful Packet Filtering Firewall (Stateful Inspection)
➢ Operates at Network and Transport layers while maintaining awareness of
the state and context of active network connections (e.g., new, established,
related, invalid).

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

➢ Tracks session information in a dynamic state table, allowing return traffic

only for legitimate outbound-initiated connections and blocking unsolicited
or anomalous packets.
➢ Provides stronger protection against IP spoofing, session hijacking, and
certain DoS attacks compared to stateless filters by validating the entire
communication flow.
➢ Balances security and performance better than application-layer options,
widely used in enterprise perimeter defenses, routers, and next-generation
firewalls (NGFW).
➢ Drawbacks include higher memory/CPU usage for state tracking and
potential issues with protocols that use dynamic ports.
3. Application Gateway / Application Layer Firewall (Proxy Firewall)
➢ Functions at the Application layer (Layer 7), acting as an intermediary
(proxy) that terminates connections from clients and establishes separate
connections to destination servers.
➢ Performs deep packet inspection (DPI) of actual application data,
commands, and content, enabling protocol-specific validation, user
authentication, content filtering, and malware scanning.
➢ Offers the highest level of security by preventing direct client-server
communication and blocking unauthorized application behaviors (e.g.,
specific HTTP methods or FTP commands).
➢ Commonly deployed for web proxies, email gateways, FTP proxies, and in
scenarios requiring strong access control and logging at the application level.
➢ Cons include reduced speed/transparency, increased resource demands, and
incompatibility with some protocols unless specifically supported.
4. Circuit Gateway / Circuit Level Gateway
➢ Operates at the Session layer (Layer 5), focusing on validating TCP/UDP
session establishment (e.g., three-way handshake) rather than packet
contents.
➢ Monitors connection setup to ensure legitimacy before allowing data flow,
often used in conjunction with proxies (e.g., SOCKS protocol
implementations).
➢ Provides efficient protection for certain session-oriented protocols without
the overhead of full application-layer analysis.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

➢ Suitable for environments needing quick validation of connection

authenticity with moderate security requirements.
➢ Limited by lack of content inspection, inability to detect application-layer
exploits, and reliance on underlying protocol behavior.

4.2 Firewall policies, Configuration, Limitations, Demilitarized zone

(DMZ)

➢ Firewall Policies
✓ Comprehensive rule sets that define permitted and prohibited network traffic
based on multiple criteria including IP addresses, ports, protocols, users, time
schedules, application types, and content categories.
✓ Typically follow a "default deny" principle (implicit deny-all) to block
unspecified traffic, with explicit allow rules added only for necessary services.
✓ Support advanced features like stateful inspection, NAT integration, VPN
passthrough, rate limiting, QoS prioritization, and integration with threat
intelligence feeds.
✓ Require regular review, testing, documentation, and updates to adapt to
evolving threats, new applications, business needs, and compliance standards.
➢ Configuration
✓ Involves defining security zones/interfaces (e.g., internal, external, DMZ),
assigning IP ranges, and creating ordered rule bases where earlier rules take
precedence.
✓ Includes enabling logging/alerting, setting timeouts for sessions, applying
anti-spoofing measures, integrating with authentication systems, and testing
rules with simulated traffic.
✓ Modern configurations often use GUI-based management, automation
scripts, centralized policy orchestration, and version control for large-scale
deployments.
➢ Limitations of Firewalls
✓ Cannot detect or prevent threats originating from inside the network (insider
threats, compromised endpoints, lateral movement).
✓ Ineffective against malware already present on systems, encrypted malicious
traffic (unless SSL/TLS inspection enabled), or zero-day exploits bypassing
rule logic.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

✓ Performance degradation under heavy load, misconfiguration risks leading to

security gaps, and inability to provide end-to-end encryption or application-
layer behavioral analysis alone.
✓ Limited visibility into application payloads without advanced features
(NGFW, DPI), and challenges in handling modern protocols like QUIC or
peer-to-peer traffic.
➢ Demilitarized Zone (DMZ)
✓ A segregated perimeter network segment hosting publicly accessible services
(web servers, mail servers, DNS, FTP) to isolate them from the internal
trusted network.
✓ Minimizes damage from compromised public-facing servers by restricting
direct access to internal resources, databases, or user workstations.
✓ Implemented using single multi-homed firewalls, dual-firewall architectures
(screened subnet), or virtualized zones with strict inter-zone traffic controls.
✓ Typical rules allow limited inbound traffic from Internet to DMZ, outbound
from DMZ to Internet, restricted DMZ-to-internal access (e.g., only for
specific management or data pulls), and controlled internal-to-DMZ for
administration.

4.3 DES (Data Encryption Standard) algorithm, AES (Advanced

Encryption Standard) algorithm, RSA (Rivest-Shamir-Adleman) algorithm
➢ DES (Data Encryption Standard)
Data Encryption Standard (DES) is a symmetric key block cipher used to encrypt
digital data. It was developed by IBM and adopted as a U.S. federal standard in
1977 for securing sensitive information.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

✓ DES converts plain text (readable data) into cipher text (unreadable form)
using a secret key. The same key is used for both encryption and
decryption.
✓ Type: Symmetric encryption
✓ Block size: 64 bits
✓ Key size: 64 bits (56 bits effective + 8 parity bits)
✓ Number of rounds: 16

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

Step 1: Input Plaintext

The encryption process starts with a 64-bit block of plaintext.
Example: Plaintext (64 bits)
Step 2: Initial Permutation (IP)
The first step in DES is Initial Permutation, where the 64-bit plaintext block
is rearranged according to a predefined permutation table.
• No bits are removed or added.
• Only the positions of bits are changed.
This step increases diffusion in the encryption process.
Step 3: Splitting the Block
After the initial permutation, the 64-bit block is divided into two equal halves:
• Left Half (L0) – 32 bits
• Right Half (R0) – 32 bits
These halves will be processed through 16 rounds of encryption.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

Step 4: 16 Rounds of Encryption (Feistel Structure)

DES uses a Feistel Network, which performs the same operations repeatedly
for 16 rounds.
For each round i (1 to 16):
Li = Ri-1
Ri = Li-1 XOR f(Ri-1, Ki)
Where:
• Ki = Round key
• f = Round function
Each round uses a different 48-bit subkey derived from the main key.
Step 5: Function f(R, K)
The function f performs several operations:
1. Expansion
The 32-bit right half is expanded to 48 bits using an expansion permutation.
2. XOR with Round Key
The expanded 48-bit block is XORed with the 48-bit round key.
Expanded Right Half ⊕ Round Key
3. Substitution (S-Boxes)
The 48-bit result is divided into eight groups of 6 bits.
Each group is passed through an S-box (Substitution Box) that converts:
6 bits → 4 bits
48 bits → 32 bits
4. Permutation (P-Box)
The 32-bit output from the S-boxes is rearranged using a Permutation Box
(P-box).
This increases diffusion in the cipher.
Step 6: Swap the Halves
After completing 16 rounds:

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

L16 and R16 are swapped

This produces:
R16 L16
Step 7: Final Permutation (IP⁻¹)
The swapped block undergoes the Final Permutation, which is the inverse of
the Initial Permutation.
This produces the final 64-bit ciphertext.
➢ DES Encryption Flow Summary
1. Input 64-bit plaintext
2. Apply Initial Permutation (IP)
3. Divide into L0 and R0
4. Perform 16 rounds of Feistel operations
5. Swap halves
6. Apply Final Permutation
7. Obtain 64-bit ciphertext
➢ Key Generation in DES
DES uses a 56-bit key to generate 16 round keys.
Key generation steps:
1. 64-bit key input
2. Parity bits removed → 56 bits
3. Split into two halves
4. Left shift operations
5. Compression permutation
6. Generate 16 subkeys (48-bit each)
➢ Advantages of DES
• Simple and efficient algorithm
• Well studied and standardized
• Easy hardware implementation

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

➢ Disadvantages of DES
• Small key size (56 bits)
• Vulnerable to brute-force attacks
• Replaced by stronger algorithms like Advanced Encryption Standard
(AES)
➢ AES (Advanced Encryption Standard)
• The current NIST-standard symmetric block cipher (2001 onward),
selected after open competition to replace DES.
• Supports 128-bit fixed block size with flexible key lengths of 128, 192, or
256 bits, and corresponding 10, 12, or 14 rounds.
• Uses a Substitution-Permutation Network (SPN) with operations like
SubBytes (S-box), ShiftRows, MixColumns, and AddRoundKey for strong
diffusion/confusion.
• Highly secure against known attacks, extremely efficient in both software
and hardware implementations, and forms the backbone of modern
encryption (TLS, VPNs, disk encryption, etc.).

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

• Input Array

✓ The Input Array is the initial data that AES encrypts. AES always
works on a fixed block size of 128 bits (16 bytes), regardless of the
key size.
✓ The 16 bytes are placed into a 4 × 4 matrix
✓ Filling is done column-wise (top to bottom, then left to right)

• State Table

✓ The State Table (State Matrix) is the heart of AES encryption.

It is a dynamic 4 × 4 matrix that continuously changes during each
encryption round.
✓ A 4 × 4 matrix of bytes
✓ Initially same as input array
✓ Updated after every transformation step

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

• Key Table

✓ The Key Table represents the encryption key arranged in matrix form.
For AES-128, the key size is 16 bytes (128 bits), similar to the input.
✓ One Single Row is converted to one Word as single cell represents 1
byte, 1 word represents 4 bytes.
✓ The key is expanded and 44 word are generated for the key table i.e
(W0 – W43).

K0 K4 K8 K12
K1 K5 K9 K13
W0 W1 W2 W42 W43
K2 K6 K10 K14
K3 K7 K11 K15

1. Key Expansion (Preprocessing Step)

✓ The original key (128/192/256-bit) is expanded into multiple round keys
✓ For AES-128 → 11 keys (1 initial + 10 rounds)
✓ Uses:
o RotWord
o SubWord
o Rcon
✓ These keys are used in each round
2. Initial Round (Round 0)
• AddRoundKey
✓ The input (state matrix) is XORed with the initial key
✓ This is done before starting the main rounds
3. Main Rounds (Repeated Process)
Number of rounds depends on key size:

Key Size Rounds

128-bit 10

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

Key Size Rounds

192-bit 12

256-bit 14

Each round consists of 4 steps:

(a) Substitute Bytes
✓ Each byte is replaced using an S-box
✓ Provides confusion (security)
(b) ShiftRows
• Rows of the state matrix are shifted:
o Row 0 → No shift
o Row 1 → Left shift by 1
o Row 2 → Left shift by 2
o Row 3 → Left shift by 3
(c) MixColumns
✓ Each column is mixed using matrix multiplication
✓ Provides diffusion (spreads data)
(d) AddRoundKey
✓ State is XORed with the round key
4. Final Round (Last Round)
The final round is slightly different:
Steps:
✓ SubBytes
✓ ShiftRows
✓ AddRoundKey
✓ MixColumns is NOT performed in the final round

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

4.4 Diffie-Hellman key exchange algorithm, Man-in-the-middle attack

The Diffie–Hellman Key Exchange Algorithm (DH) is one of the most
important developments in modern cryptography. It was introduced in 1976 by
Whitfield Diffie and Martin Hellman, and it solved a major problem in secure
communication:
How can two users create a shared secret key over an insecure network
without ever sending the key directly?
Before Diffie–Hellman, secure communication required that both parties
already shared a secret key, which was difficult in large networks.
Diffie–Hellman introduced the idea of public key cryptography, where:
• Some information is public.
• Some information remains private.
• A shared secret can be mathematically generated.
✓ Objective of Diffie–Hellman
The main purpose of the algorithm is:
➢ Secure exchange of secret keys
➢ Communication over untrusted networks
➢ Foundation for secure encryption systems
It is important to note:
➡️ Diffie–Hellman does not encrypt data directly.
➡️ It is used only to generate a shared secret key.
This key is later used with encryption algorithms like AES.
✓ Key Concepts Used
Prime Number (P)
A large prime number shared publicly.
Primitive Root / Generator (G)
A number used to generate values in modular arithmetic.
Private Key
A secret number selected individually by each user.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

Public Key
Value calculated from private key and shared openly.
Shared Secret Key
Final common key calculated independently by both users.
✓ Working Process (Detailed Explanation)
Assume two users:
• Alice
• Bob

Step 1 – Public Parameters

Both agree on: id = 80qwt9

P = Large prime number

G = Generator value

These values are public and can be known by everyone.

Step 2 – Private Key Selection

• Alice chooses private number a

• Bob chooses private number b

These values are never shared.

Step 3 – Public Key Generation

Alice calculates:

id = 80qwt9

A = G^a mod P

Bob calculates:

id = 80qwt9

B = G^b mod P

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

These values are exchanged publicly.

Step 4 – Secret Key Computation

Alice computes:

K = B^a mod P

➢ Man-in-the-Middle (MITM) Attack on DH

• An active attacker intercepts and relays all communication, impersonating
each party to establish separate keys with Alice and Bob.
• Allows the attacker to decrypt, modify, or inject traffic in real time without
detection unless additional authentication is present.
• Mitigated through authenticated key exchange using digital signatures,
certificates (e.g., in TLS), public key pinning, or pre-shared keys.
4.5 Hash Function: Introduction, Features of Hash Functions, MD5 and SHA
algorithm
Hash Function
✓ It is a mathematical function that converts a numerical input value into another
compressed numerical value.
✓ A hash function is a cryptographic algorithm that converts data of any size
into a fixed length output, known as a hash value, message digest, or hash
code. The output appears as a random string of characters representing the
original data.
✓ Hash functions are one-way functions, meaning it is practically impossible to
recover the original data from the hash value. Their main purpose is to ensure
data integrity, which means verifying that data has not been altered during
storage or transmission.
✓ For example, when downloading software, websites often provide a hash
value so users can verify whether the file has been modified or corrupted.
✓ Hash functions are widely used in password storage, digital signatures, file
verification, and data integrity checking.

• Features of Hash Functions

✓ A good hash function should satisfy the following properties:

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

1. Fixed-Length Output: Regardless of input size, the output hash value always
has a fixed length.
2. Deterministic Output The same input always generates the same hash value.
3. Fast Computation The hash value should be computed quickly for efficiency.
4. Pre-image Resistance It should be difficult to determine the original input from
the hash value.
5. Collision Resistance It should be extremely difficult to find two different inputs
producing the same hash output.
6. Avalanche Effect A small change in input should result in a completely different
hash value.
❖ MD5 (Message Digest 5)
MD5 (Message Digest Algorithm 5) is a widely known hash function developed
by Ron Rivest in 1991. It produces a 128-bit hash value, usually represented as a
32-character hexadecimal number.
• Working of MD5
MD5 processes input data in several stages:
1. Padding the message so its length becomes suitable for processing:
➢ Padding is done such that total length in 64 bit less than exact multiple of 512
➢ Eg; 1000 bit is the original message, So 512 * 2 = 1024, 512*3 = 1536 1536
– 64 = 1472, so 1472 is the 64 bit less than exact multiple of 512.
➢ Hence 1000 + 472 = 1472 bits
2. Appending message length information.
➢ Append original length before padding (modulo 64)
➢ 1000 [length mod 2^64]
➢ Generally 64 bits are added than the value becomes exact multiple of 512
3. Processing data in fixed-size blocks.
➢ Divide it in 512 blocks
4. Applying multiple rounds of bitwise operations and transformations.
5. Producing the final 128-bit message digest.
• Advantages of MD5

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

✓ Fast processing speed

✓ Easy implementation
✓ Useful for integrity checking Disadvantages of MD5
✓ Vulnerable to collision attacks
✓ No longer secure for cryptographic use
✓ Can be broken using modern computing power

• Applications of MD5

✓ File integrity verification

✓ Checksums for downloads
✓ Data consistency verification (non-security use)

❖ SHA (Secure Hash Algorithm) Family

The Secure Hash Algorithm (SHA) family was developed by the National
Security Agency (NSA) to provide stronger security than MD5. SHA algorithms
generate larger hash values and are widely used in modern security systems.
➔ SHA is a modified version of MD5
➔ o/p is a message digest of 160 bits in length
SHA Properties:-
➔ Generating original message from digest
➔ Finding two messages generating same digest
• Working of SHA
SHA algorithms operate similarly to MD5 but include stronger operations:
1. Message padding and block processing.
2. Multiple rounds of logical and mathematical operations.
3. Compression functions to generate final hash values.
The larger hash size makes SHA algorithms more secure.
• Advantages of SHA

✓ Strong security
✓ Collision resistant
✓ Widely adopted standard

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

• Disadvantages of SHA

✓ Slightly slower than MD5

✓ Older versions like SHA-1 are now weak Applications of SHA
✓ Digital signatures
✓ SSL/TLS certificates
✓ Blockchain technology
✓ Secure password storage
✓ Data integrity verification
4.6 Digital Signature: Introduction and working of digital signature, Digital
Certificate
A digital signature is a cryptographic technique used to verify the authenticity,
integrity, and non-repudiation of digital messages, documents, or data. It is the
digital equivalent of a handwritten signature but far more secure and reliable.
It provides three main security properties:
• Authenticity — Confirms the signer is who they claim to be.
• Integrity — Ensures the document has not been altered after signing.
• Non-repudiation — The signer cannot later deny having signed it.
Digital signatures rely on asymmetric cryptography (public-key cryptography)
and are typically implemented using standards like RSA, ECDSA, or DSA.
How Digital Signatures Work (Step-by-Step)
1. Key Pair Generation The signer generates a pair of mathematically related
keys:
o Private key — kept secret by the signer.
o Public key — shared openly (usually via a certificate).
2. Signing Process (by the Sender/Signer)
o Compute a hash (message digest) of the original document using a
secure hash function (e.g., SHA-256). The hash is a fixed-size unique
fingerprint of the document.
o Encrypt this hash using the signer's private key.
o The result is the digital signature.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

 NETWORK AND INFORMATION SECURITY (316317)

o The original document + digital signature is sent to the recipient.

Formula (conceptual): Digital Signature = Encrypt(Hash(Document), Private Key)
3. Verification Process (by the Receiver)
o The receiver computes the hash of the received document using the
same hash function.
o Decrypts the digital signature using the sender's public key to get the
original hash.
o Compares the two hashes:
▪ If they match → document is unchanged (integrity) and signature
is valid (authenticity).
▪ If they don't match → document was tampered with or signature
is invalid.
Formula (conceptual): Decrypted Hash = Decrypt(Digital Signature, Public Key)
If Decrypted Hash == Hash(Received Document) → Valid
This process works because only the private key can create a signature that the
corresponding public key can verify — and only the owner should have the
private key.
• Digital Certificate
A digital certificate (also called a public key certificate or identity certificate) is
an electronic document that binds a public key to an identity (person,
organization, device, website, etc.) and is digitally signed by a trusted third party
called a Certificate Authority (CA).
It follows the X.509 standard in most cases.
Main contents of a Digital Certificate
• Subject name (who the certificate is for)
• Public key
• Issuer (the CA that issued it)
• Validity period (not before / not after dates)
• Serial number
• Digital signature of the CA (using the CA's private key)

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

How Digital Certificates Work

1. An entity (e.g., you or a company) generates a key pair.
2. You create a Certificate Signing Request (CSR) containing your public key
and identity information.
3. You submit the CSR to a trusted Certificate Authority (CA) (e.g., DigiCert,
Sectigo, Let's Encrypt).
4. The CA verifies your identity (domain validation, organization validation,
extended validation, etc.).
5. The CA signs the certificate with its own private key and returns the signed
digital certificate.
6. Anyone can verify the certificate by checking the CA's signature using the
CA's well-known public key (pre-trusted in browsers/OS).
This creates a chain of trust: Your certificate → Intermediate CA → Root CA
(trusted by operating systems and browsers).
Relationship Between Digital Signature and Digital Certificate
• A digital certificate contains your public key and proves ownership of that
key (via CA signature).
• A digital signature is created using your private key and can be verified
using the public key from your certificate.
• In practice, most real-world digital signing tools require a digital certificate
to create legally binding digital signatures (e.g., in PDF signing, email
signing with S/MIME, code signing).
Simple Analogy:
• Digital Certificate → Like a passport (issued by trusted authority, proves
your identity and contains your "photo"/public key).
• Digital Signature → Like your actual signature on a document (unique to
you, verifiable against the passport).
Together, they form the foundation of Public Key Infrastructure (PKI) used in
HTTPS websites, secure email, document signing, software signing, VPNs, and
more.

SUBJECT TEACHER: PROF. D. B. MAHANKALE

NETWORK AND INFORMATION SECURITY (316317)

SUBJECT TEACHER: PROF. D. B. MAHANKALE