CSS - Module 2

Symmetric & Asymmetric Key Cryptography

Complete Exam Answer Guide
Mumbai University | Cryptography & System Security
Q1. DES Algorithm - Data Encryption Standard [V. IMP]
What is DES?
DES (Data Encryption Standard) is a symmetric key block cipher. It was developed by IBM and
adopted by the US government in 1977. It encrypts 64-bit blocks of data using a 56-bit key.
Simple words: DES takes your original data (called plaintext), scrambles it using a secret key, and
gives you unreadable data (ciphertext). The same key is used to decrypt it back.

Key Parameters of DES

Parameter Value
Block Size 64 bits (8 bytes)
Key Size 56 bits (technically 64 bits, but 8 bits are parity
bits)
Number of Rounds 16 rounds
Type Feistel cipher (Symmetric Block Cipher)
Structure Feistel Network

DES Algorithm - Step by Step

Step 1: Initial Permutation (IP)
The 64-bit plaintext is first rearranged (permuted) using a fixed table called IP. This is just a shuffling of
bits — no encryption yet. It's just to scatter the bits for better diffusion.

Step 2: Splitting
After IP, the 64-bit block is split into two halves: Left (L0) = 32 bits and Right (R0) = 32 bits.

Step 3: 16 Rounds of Feistel Processing

This is the MAIN part. For each round i (from 1 to 16):
• Li = Ri-1 (Left of current round = Right of previous round)
• Ri = Li-1 XOR F(Ri-1, Ki) (Right = Left XOR result of F function)
Where F is the Feistel function and Ki is the sub-key for that round.

The F Function (Feistel Function) - MOST IMPORTANT

The F function has 4 sub-steps:
• Expansion (E): Ri-1 (32 bits) is expanded to 48 bits using an expansion table. Some bits are
repeated.
• XOR with Sub-key: The 48-bit expanded value is XOR'd with the 48-bit round key Ki.
• S-Box Substitution: The 48-bit result is divided into 8 groups of 6 bits. Each group goes into one
S-Box and comes out as 4 bits. Result = 32 bits.
• P-Box Permutation: The 32-bit output of S-boxes is permuted using a fixed P-table.

Step 4: Key Schedule (Sub-key Generation)

The original 56-bit key generates 16 different 48-bit sub-keys (K1 to K16):
• PC-1 Permutation: 64-bit input key → 56-bit key (removes parity bits)
• The 56 bits are split into two 28-bit halves: C0 and D0
• For each round: both halves are shifted left (1 or 2 positions depending on round)
• PC-2 Permutation: selects 48 bits from 56 bits → this is the round sub-key

Step 5: Final Permutation (FP or IP-1)

After 16 rounds, the two 32-bit halves are swapped and joined into 64 bits. Then FP (which is the
inverse of IP) is applied to give the final 64-bit ciphertext.

Purpose of S-Boxes in DES

S-Boxes (Substitution Boxes) are the ONLY non-linear component in DES. This is what makes DES
secure!
There are 8 S-boxes in DES (S1 to S8). Each S-box:
• Takes 6-bit input
• Gives 4-bit output (compression)
• Uses a 4x16 lookup table
How an S-box works: If input is 6 bits = b1 b2 b3 b4 b5 b6, then row = b1b6 (first and last bit), column =
b2b3b4b5 (middle 4 bits). Look up table[row][col] → 4-bit output.
📌 Purpose of S-boxes: Provides CONFUSION (hides relationship between key and
ciphertext). Without S-boxes, DES would be completely linear and easily breakable.

Avalanche Effect in DES

The Avalanche Effect means: A small change in input (even 1 bit) causes a huge change in output
(typically 50% of bits change).
Example: If you change just 1 bit in the plaintext or key, roughly 32 out of 64 bits in the ciphertext will
change.
Why important? It ensures that the cipher is unpredictable. An attacker cannot guess the relationship
between input and output.
In DES, the Avalanche Effect is achieved by: S-boxes (confusion), P-box permutation (diffusion), and
16 rounds of Feistel processing.
💡 Exam Tip: S-boxes provide CONFUSION, P-boxes provide DIFFUSION, together creating
the Avalanche Effect.
Q2. Kerberos & TGS - Single Sign-On [VV. IMP]
What is Kerberos?
Kerberos is a network authentication protocol developed at MIT. It uses symmetric key cryptography
(secret key) to verify the identity of users over a non-secure network. It allows a user to prove their
identity to services without sending passwords over the network.
Named after: The three-headed dog (Cerberus) from Greek mythology that guards the gates of the
underworld. The three heads represent: Client, Server, and KDC.

Key Components of Kerberos

Component Full Form Role
Client (C) User/Client Machine The user who wants to access a service
AS Authentication Server Verifies the user's identity (password check)
TGS Ticket Granting Issues service tickets after authentication
Server
SS Service Server The actual server the user wants to use (e.g., file server,
email)
KDC Key Distribution AS + TGS together form the KDC
Centre
TGT Ticket Granting Ticket A special ticket that proves identity to TGS

Working of Kerberos - Step by Step

Phase 1: Authentication with AS (Login Phase)
Step 1: Client sends a request to AS: 'Hello, I am user Alice. I want to access TGS.'
Step 2: AS checks its database. If Alice exists, AS sends back TWO things encrypted with Alice's
password:
• Session Key (Kc,tgs): for communicating with TGS
• TGT (Ticket Granting Ticket): contains Alice's ID, timestamp, and Kc,tgs — encrypted with
TGS's secret key (so Alice cannot read/modify it)
Step 3: Client decrypts using her password → gets Session Key and TGT

Phase 2: Getting Service Ticket from TGS

Step 4: Client sends to TGS: (a) TGT (unchanged), (b) Authenticator = {ClientID, timestamp} encrypted
with Kc,tgs, (c) Service ID (which service Alice wants)
Step 5: TGS decrypts TGT using its own secret key → gets Kc,tgs → uses it to decrypt Authenticator
→ verifies ClientID and timestamp (checks replay attack prevention)
Step 6: TGS sends back: Session Key for service (Kc,ss) encrypted with Kc,tgs, Service Ticket
encrypted with Service Server's key

Phase 3: Accessing the Service

Step 7: Client sends to Service Server: (a) Service Ticket, (b) New Authenticator encrypted with Kc,ss
Step 8: Service Server decrypts Service Ticket → verifies identity → grants access

Working of TGS (Ticket Granting Server)

TGS is the heart of Kerberos. Its job is to:
• Receive TGT from client (which client got from AS)
• Verify the TGT by decrypting with its own secret key
• Check the Authenticator (to prevent replay attacks)
• Issue a Service Ticket for the requested service
• Send back a new Session Key for client-service communication
The TGT acts like a visitor's pass. Once you have it, you can use it to get individual access passes
(Service Tickets) for different services without logging in again.

Why is Kerberos called SSO (Single Sign-On)?

SSO means: Login ONCE, access MANY services.
In Kerberos:
• User logs in ONCE and gets a TGT from AS
• This TGT is valid for a certain time period (e.g., 8 hours)
• During this time, user can access multiple services (file server, email server, print server, etc.)
by presenting the TGT to TGS
• User does NOT need to enter password again for each service
This is why Kerberos is called SSO — one authentication, multiple service access.
📌 Password is NEVER sent over the network in Kerberos. Everything is ticket-based.
💡 Exam Tip: Remember: AS gives TGT, TGS gives Service Ticket, SS gives Service. The
password is only used once to decrypt the first response from AS.
Q3. RSA Algorithm - Theory & Numericals [V. IMP]
What is RSA?
RSA (Rivest-Shamir-Adleman) is a Public Key (Asymmetric) cryptography algorithm. It uses TWO keys:
a Public Key (for encryption) and a Private Key (for decryption). Security of RSA is based on the
mathematical difficulty of factoring large numbers.

RSA Key Generation - Steps

Step 1: Choose two large prime numbers p and q
Example: p = 17, q = 11

Step 2: Calculate n = p x q
n = 17 x 11 = 187. This n is the modulus used in both keys.

Step 3: Calculate phi(n) = (p-1)(q-1)

phi(n) = (17-1)(11-1) = 16 x 10 = 160

Step 4: Choose e such that 1 < e < phi(n) and gcd(e, phi(n)) = 1
e must be coprime with phi(n). Choose e = 7. Check: gcd(7, 160) = 1 ✓

Step 5: Calculate d such that (d x e) mod phi(n) = 1

d is the modular multiplicative inverse of e. (d x 7) mod 160 = 1. d = 23. Check: 23 x 7 = 161, 161 mod
160 = 1 ✓

Keys
• Public Key = (e, n) = (7, 187) ← share this with everyone
• Private Key = (d, n) = (23, 187) ← keep this secret

Encryption and Decryption

Encryption (using Public Key)
Formula: C = M^e mod n
Let M (plaintext) = 88
C = 88^7 mod 187 = 11 (ciphertext)

Decryption (using Private Key)

Formula: M = C^d mod n
M = 11^23 mod 187 = 88 (original plaintext recovered)
Complete Numerical Example
Step Operation Result
1 Choose p and q p = 61, q = 53
2 n=pxq n = 61 x 53 = 3233
3 phi(n) = (p-1)(q-1) phi = 60 x 52 = 3120
4 Choose e (coprime with 3120) e = 17, gcd(17, 3120) = 1
5 Find d: (d x 17) mod 3120 = 1 d = 2753
6 Public Key (e=17, n=3233)
7 Private Key (d=2753, n=3233)
8 Encrypt M=65: C = 65^17 mod 3233 C = 2790
9 Decrypt C=2790: M = 2790^2753 mod M = 65 (original)
3233

📌 Security basis: Even if attacker knows n, e, and C — they cannot find d without factoring
n. Factoring large numbers (2048 bits) is computationally infeasible.
💡 Exam Tip: For numericals: Always show all 5 steps of key generation, then show
encryption (C = M^e mod n), then decryption (M = C^d mod n). If given p, q — calculate n,
phi(n), find e and d.
Q4. Diffie-Hellman Key Exchange - MITM Attack & Prevention [V.
IMP]
What is Diffie-Hellman?
Diffie-Hellman (DH) is a key exchange protocol. It allows two parties to create a SHARED SECRET
KEY over an insecure channel WITHOUT ever sending the key itself. The shared key is then used for
symmetric encryption.
Security is based on the difficulty of solving the Discrete Logarithm Problem.

DH Algorithm - How Key Exchange Works

Setup (Public Parameters)
• Both parties agree on: p = a large prime number, g = a primitive root of p (generator)
• p and g are PUBLIC — everyone can see them

Step 1: Alice's Private and Public Keys

• Alice chooses a secret number 'a' (private key)
• Alice computes: A = g^a mod p (public key)
• Alice sends A to Bob

Step 2: Bob's Private and Public Keys

• Bob chooses a secret number 'b' (private key)
• Bob computes: B = g^b mod p (public key)
• Bob sends B to Alice

Step 3: Computing Shared Secret

• Alice computes: S = B^a mod p
• Bob computes: S = A^b mod p
• Both get the SAME value! Because B^a = (g^b)^a = g^(ab) = (g^a)^b = A^b

DH Numerical Example
Parameter Value
Public prime p 23
Generator g 5
Alice's private key a 6
Bob's private key b 15
Alice's public key A = g^a mod p 5^6 mod 23 = 8
Bob's public key B = g^b mod p 5^15 mod 23 = 19
Alice computes shared key: B^a mod p 19^6 mod 23 = 2
Bob computes shared key: A^b mod p 8^15 mod 23 = 2
 Parameter Value
Shared Secret Key 2 (Both got same value!)

Man-in-the-Middle (MITM) Attack on DH

What is MITM Attack?
An attacker (Mallory) sits BETWEEN Alice and Bob, intercepts all messages, and secretly
communicates with both of them. Both Alice and Bob think they are talking to each other, but they are
actually talking to Mallory!

How MITM Works on DH

• Step 1: Alice sends her public key A = g^a mod p to Bob
• Step 2: Mallory INTERCEPTS this. Mallory generates her own private key m and public key M =
g^m mod p
• Step 3: Mallory sends M to Bob (pretending to be Alice)
• Step 4: Bob sends his public key B = g^b mod p to Alice
• Step 5: Mallory INTERCEPTS this too. Mallory sends M to Alice (pretending to be Bob)
• Result: Alice shares secret key S1 = M^a mod p with Mallory. Bob shares secret key S2 = M^b
mod p with Mallory. Mallory can decrypt everything!
📌 The problem: DH has NO authentication. You don't know who you're exchanging keys
with!

How to Prevent MITM Attack

Solution 1: Digital Signatures / Certificates
Alice and Bob sign their DH public keys using their private signing keys. The other party verifies the
signature using the public certificate. If Mallory changes the public key, the signature won't match —
attack detected!

Solution 2: Public Key Infrastructure (PKI)

Use a trusted Certificate Authority (CA) to issue certificates to Alice and Bob. When Alice sends her
public key, she also sends a certificate signed by CA. Bob verifies the certificate — if Mallory
substitutes the key, CA's signature fails.

Solution 3: Out-of-Band Authentication

Alice and Bob compare their shared keys through a different channel (e.g., phone call). If both values
match, no MITM attack happened.

Solution 4: Use Authenticated DH (like TLS/SSL)

Modern protocols like TLS use DH for key exchange BUT also use RSA/ECDSA for authentication.
This is called Authenticated DH and prevents MITM.
💡 Exam Tip: Exam answer: MITM happens because DH has no authentication. Solution is to
use Digital Signatures or PKI to verify identities before key exchange.
Q5. Block Cipher Modes of Operation [V. IMP]
What are Block Cipher Modes?
A block cipher (like DES or AES) encrypts a fixed-size block. But in real life, data is larger than one
block. Modes of operation define HOW to apply a block cipher to encrypt longer messages.
There are 5 standard modes:

Mode 1: ECB - Electronic Code Book

How it works:
• Divide plaintext into 64-bit blocks: P1, P2, P3...
• Each block is INDEPENDENTLY encrypted with the SAME key K
• Ci = E(K, Pi) for each block

Advantages:
• Simple to implement
• Parallel encryption possible
• Random access possible (can decrypt any block independently)

Disadvantages:
• If two blocks have the same plaintext, they produce the SAME ciphertext
• Patterns in plaintext are visible in ciphertext — NOT secure for most applications
• Vulnerable to replay attacks (attacker can reorder blocks)
📌 ECB is NOT recommended for secure communication. Famous example: ECB mode
encryption of an image shows the original pattern!

Mode 2: CBC - Cipher Block Chaining

How it works:
• Each plaintext block is XOR'd with the PREVIOUS ciphertext block before encryption
• C1 = E(K, P1 XOR IV) where IV = Initialization Vector
• Ci = E(K, Pi XOR Ci-1) for i > 1
• Decryption: Pi = D(K, Ci) XOR Ci-1

Advantages:
• Identical plaintext blocks produce DIFFERENT ciphertext (unlike ECB)
• Each block depends on all previous blocks — more secure
• Widely used in practice

Disadvantages:
• Sequential encryption only (cannot parallelize encryption)
• An error in one block affects that block and the next block in decryption
• Requires an IV (must be random and unpredictable)
Mode 3: CFB - Cipher Feedback Mode
How it works:
• Previous ciphertext is encrypted with key, then XOR'd with current plaintext
• C1 = P1 XOR E(K, IV)
• Ci = Pi XOR E(K, Ci-1)
• Converts block cipher into a stream cipher

Advantages:
• Can encrypt data smaller than block size (useful for character-by-character encryption)
• Error propagation is limited to 2 blocks

Disadvantages:
• Sequential — cannot parallelize encryption
• Key and IV must not be reused

Mode 4: OFB - Output Feedback Mode

How it works:
• Similar to CFB, but the KEYSTREAM is generated independently of plaintext/ciphertext
• Oi = E(K, Oi-1) where O0 = IV
• Ci = Pi XOR Oi
• Pi = Ci XOR Oi

Advantages:
• Keystream can be precomputed before data is available
• Bit errors in ciphertext affect ONLY corresponding bits in plaintext (no error propagation)
• Converts block cipher to stream cipher

Disadvantages:
• IV must NEVER be reused with the same key (reuse breaks security completely)
• No error detection capability

Mode 5: CTR - Counter Mode

How it works:
• A counter value is encrypted with the key to generate keystream blocks
• Keystream block = E(K, Counter_i)
• Ci = Pi XOR E(K, Counter_i)
• Counter is incremented for each block

Advantages:
• FULLY PARALLELIZABLE — blocks are independent, great performance
• Random access possible (can decrypt any block directly)
• No error propagation — bit error affects only that bit
• Very efficient for hardware implementation
Disadvantages:
• Counter value must never be reused with the same key

Mode Parallel Error Random Access Use Case

Encryption Propagation
ECB Yes None (1 block) Yes NOT recommended
CBC No 2 blocks Decryption only SSL/TLS, Disk Encryption
CFB No 2 blocks Decryption only Stream data, Characters
OFB Keystream only None (same bit) No Satellite communication
CTR Yes (fully) None (same bit) Yes High-speed systems, AES-
GCM
Q6. AES Algorithm - Advanced Encryption Standard [V. IMP]
What is AES?
AES (Advanced Encryption Standard) is a symmetric block cipher that replaced DES in 2001. It was
designed by two Belgian cryptographers: Joan Daemen and Vincent Rijmen (originally called Rijndael).
AES is the most widely used encryption standard today.

AES Key Parameters

Parameter AES-128 AES-192 AES-256
Key Size 128 bits 192 bits 256 bits
Block Size 128 bits 128 bits 128 bits
Number of Rounds 10 12 14
Round Key Size 128 bits 128 bits 128 bits

AES Structure - State Array

AES works on a 4x4 matrix of bytes called the 'State'. The 128-bit block = 16 bytes = 4x4 matrix. All
operations are performed on this State matrix.

AES Algorithm - Step by Step

Initial Step: Add Round Key
Before any rounds: XOR the plaintext block with the first round key (K0). State = Plaintext XOR Key0

Each Round has 4 Operations:

Operation 1: SubBytes (Byte Substitution)
Each byte in the State is replaced using a substitution table called S-box (a 16x16 lookup table). This
provides NON-LINEARITY and CONFUSION. It's similar to DES S-boxes but works on full bytes (8 bits
in, 8 bits out).

Operation 2: ShiftRows
Each ROW of the State matrix is shifted left by different amounts:
• Row 0: shift by 0 (no shift)
• Row 1: shift left by 1 byte
• Row 2: shift left by 2 bytes
• Row 3: shift left by 3 bytes
Purpose: This provides DIFFUSION — bytes from different columns are mixed together.

Operation 3: MixColumns
Each COLUMN of the State is multiplied with a fixed polynomial over GF(2^8). This mixes the 4 bytes
of each column. It's a matrix multiplication in finite field arithmetic.
Purpose: Maximum DIFFUSION — each output byte depends on all 4 input bytes in that column.
 📌 MixColumns is NOT applied in the LAST round of AES.

Operation 4: AddRoundKey
XOR the current State with the round key Ki. The round keys are derived from the original key using the
Key Expansion algorithm (also called Key Schedule).

AES Key Expansion

AES expands the original key into (Nr+1) round keys, where Nr = number of rounds. Each round key is
128 bits (16 bytes). For AES-128: original 128-bit key → 11 round keys (K0 to K10).
The key expansion uses: RotWord (circular byte rotation), SubWord (apply S-box to each byte), Rcon
(Round Constant XOR).

AES vs DES - Full Comparison

Feature DES AES
Developed by IBM + NSA (1977) Joan Daemen & Vincent Rijmen
(2001)
Key Size 56 bits (weak) 128, 192, or 256 bits (strong)
Block Size 64 bits 128 bits
Number of Rounds 16 10 / 12 / 14
Structure Feistel Network Substitution-Permutation Network
(SPN)
Security Broken (brute-force possible) Currently unbroken
Speed Slower (especially in software) Faster (hardware + software)
S-boxes 8 S-boxes, 6-bit input, 4-bit output 1 S-box (byte-to-byte, 8-to-8)
Attacks Vulnerable to brute force, Resistant to known attacks
differential & linear cryptanalysis
Hardware Support No dedicated instruction AES-NI hardware instructions in
modern CPUs
Usage Today Obsolete, not recommended Widely used (TLS, AES-256 for top
secret data)

Why AES is Better than DES

1. Larger Key Size
DES has only 56-bit key = 2^56 = ~72 quadrillion combinations. This was cracked in 22 hours in 1999!
AES-128 has 2^128 combinations — would take longer than the age of the universe to brute-force.

2. Larger Block Size

DES uses 64-bit blocks, making it vulnerable to birthday attacks. AES uses 128-bit blocks, far more
secure.

3. Better Mathematical Structure

AES uses Substitution-Permutation Network (SPN) instead of Feistel. ALL bytes are transformed in
each round (in Feistel, only half the data is processed per round). This makes AES more efficient and
secure.

4. Resistance to Differential and Linear Cryptanalysis

AES was specifically designed to resist these attacks. Its MixColumns step provides high resistance
through branch number = 5.

5. Hardware Acceleration
Modern Intel and AMD processors have AES-NI instructions — dedicated hardware for AES
operations. This makes AES extremely fast in modern systems.

6. Flexibility
AES offers 3 key sizes (128, 192, 256-bit) for different security requirements. DES offers only one (56-
bit).
💡 Exam Tip: AES-256 is used by governments to encrypt TOP SECRET data. AES-128 is
used in HTTPS (TLS/SSL) for everyday web browsing.
Quick Revision - Key Formulas & Points
Topic Key Formula / Point to Remember
DES 64-bit block, 56-bit key, 16 rounds, Feistel structure, 8 S-boxes
DES F-function Expand (32→48) → XOR with Key → S-boxes (48→32) → P-box
S-box 6-bit input, 4-bit output. Row = b1b6, Col = b2b3b4b5
Avalanche Effect 1-bit change → ~50% output bits change
Kerberos AS gives TGT, TGS gives Service Ticket, SS gives Service
Kerberos SSO Login once, get TGT, use TGT to get many service tickets
RSA Encryption C = M^e mod n
RSA Decryption M = C^d mod n
RSA Key Gen n=pq, phi=(p-1)(q-1), choose e, find d s.t. de mod phi = 1
DH Key Exchange Shared Secret = g^(ab) mod p
DH MITM No authentication in DH → use Digital Signatures or PKI
AES vs DES AES: 128-bit block, 128/192/256-bit key. DES: 64-bit block, 56-bit key
AES 4 Operations SubBytes → ShiftRows → MixColumns → AddRoundKey
AES SPN vs DES Feistel AES processes ALL bytes each round; DES only half

All the best for your exams!

Mumbai University | CSS Module 2 | Prepared for exam preparation