UNIT – I:

Security Concepts: Introduction, The need for security, Security approaches,

Principles of security, Types of Security attacks, Security services, Security
Mechanisms, A model for Network Security Cryptography. Classical Encryption
Techniques-symmetric cipher model, Substitution techniques, Transposition
techniques, Rotor Machines, Steganography.

Introduction

The generic name for the collection of tools designed to protect data
and to thwart (prevent fromsucceedingin)hackersiscomputersecurity.
The term network security is somewhat misleading, because
virtually all businessgovernment and academic organizations interconnect
their data processing equipment with a collection of interconnected
networks. Such a collection is often referred to as an internet, and theterm
internet security is used.
There are no clear boundaries between thesetwo forms of
[Link] example,one of the most publicized types of attack on
information systems is the computer virus. A virus may be
introducedinto asystemphysically when itarrives in adiskette and
issubsequently loaded onto a computer, viruses may also arrive over an
internet, in either case, once the virus is resident on a
computersystem,internalcomputersecuritytoolsareneededtodetectandre
coverfromthevirus.

The need for security

 Protecting Confidential Information
o Prevents unauthorized users from accessing sensitive data.
o Cryptography ensures that even if data is intercepted, it cannot be read
without the key.
 Data Integrity
o Ensures that the data received is the same as the data sent.
o Prevents unauthorized modification, deletion, insertion, or corruption of
messages.
 Authentication
o Verifies the identity of users, devices, and servers before communication.
 o Prevents intruders from impersonating legitimate users.

SECURITYSERVICES
Theclassificationofsecurityservicesareasfollows:
CONFIDENTIALITY: Ensures that the information in a computer system and
transmittedinformation are accessible only for reading by authorized parties.
Confidentiality is theprotectionoftransmitteddatafrompassive attacks. Forexample,
whenaTCPconnectionis set up between two systems, this broad protection prevents
the release of any user data transmitted over the TCP connection.
ConnectionConfidentiality
Theprotectionofalluserdataonaconnection.
ConnectionlessConfidentiality
The protectionofalluserdata ina singledatablock
Selective-FieldConfidentiality
Theconfidentialityofselected fieldswithintheuser dataonaconnectionorinasingledata
block.

Traffic-FlowConfidentiality
The protection of the information that might be derived from observation of traffic
flows.

AUTHENTICATION:Theauthenticationserviceisconcernedwithassuringthat
acommunication is Authentic. The assurance that the communicating entity is the one
that it claims to be.
Ensuresthattheoriginofamessageorelectronicdocument iscorrectly identified,withan
assurance that the identity is not false.

PeerEntityAuthentication
Used inassociationwitha logicalconnectiontoprovideconfidence inthe identityoftheentities
connected.

Data-Origin Authentication
In a connectionless transfer, provides assurance that the source of received data is as
claimed.

INTEGRITY:Ensuresthatonlyauthorizedpartiesareableto
modifycomputersystemassetsand transmitted information. Modification includes writing,
changing status, deleting, creating
anddelaying orreplaying oftransmitted messages.
NON REPUDIATION: Requires that neither the sender nor the receiver of a
message be able to [Link] message
issent,thereceivercanprovethattheallegedsender in fact sent the message. Similarly,
when a message is received, the sender can prove that the alleged receiver in fact
received the message
ACCESS CONTROL: Requires that access to information resources may be
controlled bythe target system. accesscontrolistheabilitytolimit
andcontroltheaccesstohostsystemsand [Link]
achievethis,eachentitytryingtogainaccessmust first be identified, or authenticated
AVAILABILITY: Requiresthatcomputersystem
assetsbeavailabletoauthorizedpartieswhen needed

Security Mechanisms

Oneofthe mostspecific securitymechanismsinuse iscryptographictechniques.

Encryptionorencryption-liketransformationsofinformationarethe
mostcommonmeansof providing security. Some of the mechanisms are

1 ENCIPHERMENT: It refers to the process of applying mathematical algorithms

for converting data into a formthat is not intelligible. This depends on algorithmused
and encryption keys.

2
DIGITALSIGNATURE:Theappendeddataoracryptographictransformationappliedto
anydata unit allowing to prove the source and integrityofthe data unit and protect
against forgery.
3 ACCESSCONTROL: Avarietyoftechniquesused
forenforcingaccesspermissionstothesystem resources.
4DATAINTEGRITY:Avarietyofmechanismsused to assuretheintegrityofadataunit
or stream of data units.
5 AUTHENTICATIONEXCHANGE:Amechanismintendedto ensurethe
identityofanentityby means of information exchange.

6TRAFFICPADDING: Theinsertionofbits into

gapsinadatastreamtofrustratetrafficanalysis attempts.
7
ROUTINGCONTROL:Enablesselectionofparticularphysicallysecureroutesforcertaindat
aand allows routing changes once a breach of security is suspected.
8 NOTARIZATION:The use ofatrustedthirdpartytoassure certainpropertiesofa data
exchange

Principles of security

SECURITYGOALS

CONFIDENTIALITY DATA INTEGRITY AVAILABILITY

CONFEDENTIALITY:
 hidinginformationfromanauthorizedaccess
  informationwhileexchangeshouldremainsecret
DATA INTEGRITY:
 preventinginformationfromunauthorizedmodification
 need techniquestoensuretheintegrityofthe data
 preventingthemodification
 detectanymodificationmade
AVAILABILITY:
 should beeasilyavailabletoauthorizedusers
 data must be available to authorized

userscryptographicalgorithmsareusedtoachievethea
bovegoals

THE OSI SECURITYARCHITECTURE

TheOSIsecurityarchitecturefocusesonsecurityattacks,
mechanisms,[Link] be defined briefly as
• Securityattack: Anyactionthat
compromisesthesecurityofinformationownedbyan organization.
• Securitymechanism: Aprocess(oradevice
incorporatingsuchaprocess)thatisdesignedto detect, prevent, or recover from a
security attack.
• Securityservice: Aprocessingorcommunicationservicethat
enhancesthesecurityofthedata processingsystemsandthe
informationtransfersofanorganization. Theservicesare intendedto counter
securityattacks, and they make use of one or more security mechanisms to provide
the service.

Types of Security attacks

Generictypesofattacks
 Passiveattacks
 Activeattacks
. Apassiveattackattemptstolearnor makeuseofinformationfromthesystembut doesnot
affect system resources. An active attack attempts to alter system resources or affect
their operation.
PassiveAttacks
Passiveattacksareinthenatureofeavesdropping
on,ormonitoringof,[Link] ofthe opponent is to obtain informationthat
is being transmitted. Two types ofpassive attacks are the release of message contents
and traffic analysis.
1) Releaseofmessagecontents:

The release of message contents is easily understood .Atelephone conversation, an

electronic mailmessage,andatransferred file
[Link] like to prevent an opponent
from learning the contents of these transmissions.

2) Trafficanalysis:

A second type of passive attack, traffic analysis, is subtler .Suppose that we had a
wayof masking the contents of messages or otherinformation traffic so that
opponents, even if they captured the message, couldnot extract the information from
the message. The common technique formasking contents is encryption. If we had
encryption protection in place, anopponent might still be able to observe the pattern
of these messages. Theopponent could determinethe locationand
identityofcommunicatinghostsandcouldobservethe frequencyand lengthof messages
being exchanged. Thisinformation might be usefulinguessing the natureof the
communication thatwas taking place.
Passiveattacksareverydifficulttodetect,becausetheydonotinvolveanyalterationofthe data.

Activeattack:

Anactiveattackattemptstoaltersystemresourcesoraffecttheiroperation. Active attacks

involve some modification of the data stream or the creation of a false stream.
Activeattackscanbesubdividedintofour categories:
 masquerade,
 replay,
 modificationofmessages,and
 Denialofservice.
Masquerade:
Amasqueradetakesplacewhenoneentitypretendstobeadifferententity(Figure:).A
masquerade attack usually includes one of the other forms of active attack.
 For example, authentication sequences can be captured and replayed after a
valid authentication sequence has taken place, thus enabling an authorized
entity with few privileges to obtain extra privileges by impersonating an
entity that has those privileges.

Replay:

Replay involves the passive capture of a data unit and its subsequent retransmission
to produce an unauthorized effect.
Modificationofmessages:
Modification of messages simply means that some portion ofa legitimate message is
altered, or that messages are delayed or reordered, to produce an unauthorized effect
(Figure: c).
Forexample,amessagemeaning“AllowJohnSmithtoreadconfidentialfileaccounts”is
modified to mean “Allow Fred B

rown
to read confidential file accounts

Denialof service:
Thedenialofservicepreventsorinhibitsthenormaluseormanagementofcommunications
facilities (Figure d). This attack may have a specific target;
Forexample,an entity may suppress all messages directed toa particulardestination (e.g.,
the security audit service).
Another formofservicedenialisthedisruptionofanentirenetwork—either bydisablingthe
network or by overloading it with messages so as to degrade performance
A model for Network Security Cryptography

Classical Encryption Techniques-symmetric cipher model

SYMMETRICCIPHERMODEL:
Symmetric encryption is a form of cryptosystem in which encryption and decryption
are performed using the same key. It is also known as conventional encryption.
Symmetric encryption, also referred to as conventional encryption or single-key
encryption.
Asymmetricencryptionschemehasfiveingredients
• Plaintext: Thisistheoriginalintelligible messageordatathatisfed

intothealgorithmas input.
• Encryption algorithm: The encryption algorithm performs various

substitutions
and transformations on the plaintext.
• Secret key: The secret key is also input to the encryption [Link] key is a

value independent ofthe plaintext and ofthe algorithm. The algorithmwillproduce

a different output [Link]
substitutionsandtransformations performed by the algorithm
depend onthe key.
• Ciphertext: This is the scrambled message produced as output. It depends onthe

plaintext and the secret key. For a given message, two different keys will
producetwodifferentciphertexts.

• Decryption algorithm: This is essentially the encryption algorithm run inrevers.

It takes the ciphertext and the secret key and produces the originalplaintext.

Therearetworequirementsforsecureuseofconventionalencryption:
1. Weneedastrongencryptionalgorithm. At aminimum,wewould likethealgorithmto

besuch that an opponent who knows the algorithm and hasaccess to one or more
ciphertexts would be unable to decipher the ciphertextor figure out the key.
[Link] must haveobtainedcopiesofthesecret

keyinasecurefashionand must keep the key secure.

 Letustakeacloserlook attheessentialelementsofasymmetricencryption
scheme, using below Figure. A source produces a message in plaintext, . The
elements of are letters in some finite alphabet. Traditionally, the alphabet usually
consisted of the 26 capital [Link],thebinaryalphabet {0,1} istypicallyused.
For encryption, akeyofthe form is generated. Ifthe key is generated at the message
source, then it must also be provided to the destinationbymeansofsomesecurechannel.

Alternatively, athirdpartycouldgeneratethekey and securely deliver it toboth source

and destination
 With the message and the encryption key as input, the encryption algorithm
forms the ciphertext .We can write this as This notation indicates that is produced
byusing encryption algorithmE asafunctionoftheplaintext, withthespecific
functiondetermined bythe valueof the key .
Theintendedreceiver, inpossessionofthekey, isabletoinvertthetransformation:
X=D(K,Y)

Cryptographicsystemsarecharacterizedalongthreeindependent dimensions:
1. The type of operations used for transforming plaintext to ciphertext. All

encryption algorithms are based on two general principles: substitution, in which

each element in the plaintext (bit,letter,groupofbitsorletters)ismappedinto
anotherelement,andtransposition,in which elements in the plaintext are rearranged.
The fundamental requirement is that no information be lost (that is, that all
operations are reversible).
2. The number of keys used. If both sender and receiver use the same key, the

system is referredtoassymmetric,single-key,secret-
key,[Link] receiver use different keys, the
system is referred to as asymmetric, two-key, or public-key encryption.
3. The way in which the plaintext is processed. A block cipher processes the

input one block ofelementsat atime,producinganoutput block foreachinput

[Link] processes the input elements continuously, producing output
one element at a time, as it goes along.

SUBSTITUTION TECHNIQUES

1) Caesarcipher(or) shift cipher

Theearliest knownuseofasubstitutioncipherandthesimplest
[Link] cipher involves replacing each letter of the alphabet
with the letter standing 3 places furtherdown the alphabet.
plain:meetmeafterthetogaparty
cipher:PHHWPHDIWHUWKHWRJDSDUWB
Note that the alphabet is wrapped around, so that letter following„ z‟is „a‟.
[Link] letter,substitute
The cipher text letter
C= E(3,p)=(p +3)mod26
Ashiftmaybeofanyamount,so thatthegeneralCaesaralgorithm is
C= E(k,p)=(p+k)mod26
WhereKtakes [Link] simply
 p =D(k,C)=(C-k)mod26
Drawbacks

 Thereareonly25keystotry.
 Thelanguageof theplaintextisknownandeasilyrecognizable
 2) MonoalphabeticCiphers:

Withonly25possiblekeys,theCaesarcipher isfarfromsecure. Adramatic increase

inthekey space can be achieved by allowing an arbitrary substitution. Before
proceeding, we define the term permutation. A permutation of a finite set of
elements is an ordered sequence of all the elementsof, witheachelement
appearingexactlyonce. Forexample, if, S ={a, b, c}thereare six permutations of
S:
abc,acb,bac,bca,cab,cba

Ingeneral,thereare3!permutationsofasetofelements,becausethefirst element
canbe chosen in one of n ways, the second in ways, the third in ways, and so
on.
RecalltheassignmentfortheCaesar cipher:
plain:abc defghijklmnopqrstuvwxyz
cipher:DEFGHIJ KLM NOPQR STUVWXY ZAB C
If, instead,the“cipher”
linecanbeanypermutationofthe26alphabeticcharacters,thenthere are 26! or
greater than 4 * 1026 possible keys.
Suchanapproachisreferredto asa monoalphabetic substitutioncipher, because
a single cipher alphabet (mapping fromplain alphabet to cipher alphabet) is
used per message.

3) PlayfairCipher

The best-known multiple-letter encryption cipher is the Play fair, which treats
digrams in the plaintext
[Link]
 m
isbasedontheuseofa5 5 matrixoflettersconstructedusinga keyword.

M N A R
C Y B D
E F G I/J K
L P Q S T
U V W X Z

In this case, the keyword is monarchy. The matrix is constructed by filling in the
letters ofthe keyword (minus duplicates) from left to right and from top to
bottom, and then filling in the remainderofthe matrixwiththeremaining
[Link] lettersIandJcount as one letter. Plaintext is
encrypted two letters at atime, according to the following rules:
1. Repeating plaintext letters that are in the same pair are separated with a filler

letter ,such asx, so that balloon would be treated as ba lx lo on.

2. Two plaintext letters that fall in the same row of the matrix are each replaced

by the letter to the right, with the first element ofthe row circularly following
the last. For example, ar is encrypted as RM.
3. Two plaintext letters that fall in the same column are each replaced by the letter

beneath, with the top element of the column circularly following the [Link]
example, mu is encrypted as CM.
4. Otherwise ,each plaintext letter in a pair is replaced by the letter that lies in its

own row and the column occupied by the other plaintext letter. Thus, hs becomes
BP and ea becomes IM (or JM, as the encipherer wishes).

example
Plaintext=meetmeattheschoolhouse
Splitting two letters as a unit => me et me at theschoxolho us ex
Correspondingciphertext =>CLKLCL
RSPDILHYAVMPHFXLIU
Strength of playfair cipher
Playfaircipher isagreat advanceoversimplemonoalphabeticciphers.Sincethereare26letters,
26x26 = 676 diagrams are possible, so identification of individual diagram is more
difficult.
4) Polyalphabeticciphers

a) Vigenerecipher:
To encrypt a message, a key is needed that is as long as the message. Usually,
the key is a [Link], ifthekeywordis deceptive,the
message “wearediscovered save yourself” is encrypted as
Key :
deceptivedeceptivedeceptive
plaintext:
wearediscoveredsaveyourself
ciphertext:ZICVTWQNGRZGVTWAVZHCQYGLMGJ
Expressednumerically,wehavethefollowingresult.
 Key 3 4 2 4 15 19 8 21 4 3 4 2 4 15
Plaintext 22 4 0 17 4 3 8 18 2 14 21 4 17 4
ciphertext 25 8 2 21 19 22 1 13 6 17 25 6 21 19
6

Key 19 8 21 4 3 4 2 4 15 19 8 21 4
Plaintext 3 18 0 21 4 24 1 20 17 18 4 11 5
4
ciphertext 22 0 21 25 7 2 1 24 6 11 12 6 9
6

Strength of Vigenerecipher
 Therearemultipleciphertextlettersforeachplaintext letter.
 Letterfrequencyinformationisobscured.
b) Vernam cipher
Theultimatedefenseagainstsuchacryptanalysisistochooseakeywordthatisaslo
ngastheplain
[Link]&
Tengineern
[Link](bits)ratherthanlett
[Link] system can be expressed succinctly as follows

ci=pi ki

where

pi=ithbinarydigitofplaint

extki=ithbinary digit
ofkey
ci=ithbinarydigitofciphertext
= exclusive-or (XOR)operation
Example:
 c) OneTimePad:
It is an unbreakable crypto system. The key is of same length as the message.
Onceakeyisused, it is discarded and never used again.
An example should illustrate our point. Suppose that we are using a Vigenère scheme
with 27 characters inwhichthetwenty-seventhcharacter isthespacecharacter,
butwithaone-timekey that is as long as the message. Consider the ciphertext

ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS
Wenowshowtwodifferentdecryptionsusingtwodifferentkeys:
ciphertext:
ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS key:

PXLMVMSYDOFUYRVZWCTNLEBNECVGDUPAHFZZLMNYIH
plaintext: MR MUSTARD WITH THE CANDLESTICK IN THE HALL
ciphertext:
ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS key:

MFUGPMIYDGAXGOUFHKLLLMHSQDQOGTEWBQFGYOVUHW
T plaintext: MISS SCARLET WITH THE KNIFE IN THE LIBRARY
Suppose that a cryptanalyst had managed to find these two keys. Two plausible
plaintexts are produced. How is the cryptanalyst to decide which is the correct
decryption?

TRANSPOSITIONTECHNIQUES:
a) Railfence

Rail fence is simplest of such cipher, in which the plaintext is written down as a
sequence of diagonals and then read off as a sequence of rows.
Forexample,to encipherthe message “meet meafterthetogaparty”witha
railfenceof depth 2, we write the following:
 me matrht gpry e t e f
eteoaat
Theencrypted messageis
MEMATRHTGPRYETEFETEOAAT

b) RowTranspositionCiphers:
A more complex scheme is to write the message in a rectangle, row byrow, and read the
messageoff, column bycolumn, but permutetheorderofthecolumns. TheorderofcForexample,
Key: 4 312567
Plaintext:attackp ost po ne
duntilt
woamxyz
Ciphertext:TTNAAPTMTSUOAODWCOIXKNLYPETZ
Apuretranspositioncipher iseasilyrecognized because it hasthesame letterfrequenciesasthe original
plaintext.
Rotor Machines

ROTOR MACHINES
The example just given suggests that multiple stages of encryption can produce
an algorithm that is significantly more difficult to cryptanalyze. This is as true
of substi-tution ciphers as it is of transposition ciphers. Before the introduction
of DES, the most important application of the principle of multiple stages of
encryption was a class of systems known as rotor machines.9

The basic principle of the rotor machine is illustrated in Figure 2.8. The
machine consists of a set of independently rotating cylinders through which
electri-cal pulses can flow. Each cylinder has 26 input pins and 26 output pins,
with internal wiring that connects each input pin to a unique output pin. For
simplicity, only three of the internal connections in each cylinder are shown.

If we associate each input and output pin with a letter of the alphabet, then a
single cylinder defines a monoalphabetic substitution. For example, in Figure
2.8, if an operator depresses the key for the letter A, an electric signal is applied
to the first pin of the first cylinder and flows through the internal connection to
the twenty-fifth output pin.
Consider a machine with a single cylinder. After each input key is depressed,
the cylinder rotates one position, so that the internal connections are shifted
accordingly. Thus, a different monoalphabetic substitution cipher is defined.
After 26 letters of plaintext, the cylinder would be back to the initial position.
Thus, we have a poly-alphabetic substitution algorithm with a period of 26.

A single-cylinder system is trivial and does not present a formidable cryptana-

lytic task. The power of the rotor machine is in the use of multiple cylinders, in
which the output pins of one cylinder are connected to the input pins of the
next. Figure 2.8 shows a three-cylinder system. The left half of the figure
shows a position in which the input from the operator to the first pin (plaintext
letter a) is routed through the three cylinders to appear at the output of the
second pin (ciphertext letter B).
With multiple cylinders, the one closest to the operator input rotates one pin
position with each keystroke. The right half of Figure 2.8 shows the system’s
config-uration after a single keystroke. For every complete rotation of the inner
cylinder, the middle cylinder rotates one pin position. Finally, for every
complete rotation of the middle cylinder, the outer cylinder rotates one pin
position. This is the same type of operation seen with an odometer. The result is
that there are 26 * 26 * 26 = 17,576 different substitution alphabets used before
the system repeats. The addition of fourth and fifth rotors results in periods of
[Link].c 24
om
456,976 and 11,881,376 letters, respectively. As David Kahn eloquently put it,
referring to a five-rotor machine [KAHN96, ]:

A period of that length thwarts any practical possibility of a

straightforward solution on the basis of letter frequency. This
general solution would need about 50 letters per cipher alphabet,
meaning that all five rotors would have to go through their com-
bined cycle 50 times. The ciphertext would have to be as long as
all the speeches made on the floor of the Senate and the House of
Representatives in three successive sessions of Congress. No
cryptanalyst is likely to bag that kind of trophy in his lifetime; even
diplomats, who can be as verbose as politicians, rarely scale those
heights of loquacity.

[Link].c 25
om
Steganography.

In cryptography and information security, steganography is the practice of

concealing a secret message within a non-secret carrier, such as an image or audio
file, to prevent detection of its existence. While the terms are sometimes
confused, stenography refers to shorthand writing, whereas steganography is the
specific field of data hiding used in cybersecurity.

Key Differences: Steganography vs. Cryptography

While both aim to protect information, they use different mechanisms:

 Goal: Cryptography makes data unreadable (scrambling it into ciphertext),

whereas steganography makes data unnoticeable (hiding it in plain sight).

 Structure: Cryptography typically alters the data's structure to secure it;

steganography keeps the carrier’s structure intact so it appears normal to an
observer.

 Detection: An encrypted message is obviously a secret, attracting attention; a

steganographic message aims to avoid suspicion entirely.

Common Digital Techniques

1. Image Steganography: The most popular method, often using Least
Significant Bit (LSB) insertion. This replaces the last bits of pixel data with
secret bits, causing changes so subtle they are invisible to the human eye.

2. Audio Steganography: Hiding data in sound files by modifying echo, phase,

or using LSB coding.

3. Text Steganography: Concealing messages within text through formatting

changes, extra whitespaces, or intentional spelling errors.

4. Network Steganography: Embedding data into network protocols like TCP or

IP headers during transmission.

[Link].c 26
om
[Link].c 27
om