Information Security (CS-422)

By
Dr. Mukul Majhi

Department of Computer Science and Engineering (DoCSE)

NIT Hamirpur, India
Outline

❑ Cryptographic attacks

❑ Services and Mechanism

❑ Techniques
Cryptographic attacks

Cryptographic attacks

Cryptanalytic Non- Cryptanalytic

Cryptanalytic attacks

▪ All cryptographic algorithms act upon the message distribution and

converts it using the key to a ciphertext distribution which looks
random.

▪ The objective is to find properties of the cipher which does not exist in
a random function.

▪ The attackers guesses the key and looks for the distinguishing property.
If the property is detected, the guess is correct, otherwise the next guess
is tried.
Contd…
▪ Efficient attackers will try to adopt a “divide and conquer” strategy to
reduce the complexity of guessing the key from the brute force search
complexity.

▪ An attack is said to be theoretically successful if the guessing

complexity is lesser than the brute force search complexity (practically
infeasible).

These methods inspects the mathematical properties of the cryptographic

algorithms and aims at finding distinguishers. The attacks are combinations of
statistical and algebraic techniques aimed at finding the secret key of a cipher.
Non-cryptanalytic attacks

▪ These attacks do not exploit the mathematical weakness of the

cryptographic algorithms.

▪ These attacks are threatening to the security goals.

▪ The Non-cryptanalytic attacks can be divided into 3 types:

(1) Threat to C
(2) Threat to I
(3) Threat to A
Non-cryptanalytic attacks
Attacks threatening Confidentiality

▪ Two types of attacks threaten the confidentiality of information

(1) Snooping
(2) Traffic analysis

Snooping : refers to unauthorized access to data.

-To prevent snooping, the data can be made unreadable for the
intruder by using enciphering techniques.

Traffic Analysis : enciphering the data may make it unreadable for the
intruder, but can obtain some other type of information by
monitoring online traffic.
Attacks threatening Integrity

▪ Four types of attacks threaten the Integrity

(1) Modification
(2) Masquerading
(3) Replaying
(4) Repudiation

Modification : after accessing information, the attacker modifies the

information to make it beneficial for themselves.

Masquerading : happens when the attacker impersonates somebody else.

Attacks threatening Integrity

Replaying : The attacker obtains a copy of a message sent by a user and

later tries to replay it.

Repudiation : This type of attack is performed by one of the two parties in

the communication: the sender or the receiver. The sender of
the message might later deny that she has sent the message and
the receiver of the message might later deny that he has
received the message.
Attacks threatening Availability
▪ The attacks threatening availability
(1) Denial of Service

Denial of Service : Denial of service (DoS) is a very common attack. It may slow
down or totally interrupt the service of a system.
To achieve this:
- the attacker might send many bogus requests to a server that the server crashes
because of the heavy load.

- the attacker might intercept and delete a server’s response to a client, making the
client to believe that the server is not responding.

- the attacker may also intercept requests from the clients, causing the clients to send
requests many times and overload the system.
Passive and Active attack
Passive attack

- The attacker’s goal is just to obtain information.

- means the attack does not modify data or harm the system. The system continues
with its normal operation.

- however, the attack may harm the sender or the receiver of the message.

- it is difficult to detect

- Attacks that threaten confidentiality : snooping and traffic analysis are passive
attacks.

- Passive attacks can be prevented by enciphering the data.

Passive and Active attack

Active attack

- An active attack may change the data or harm the system.

- Active attacks are normally easier to detect than to prevent, because an

attacker can launch them in a variety of ways.

- Attacks that threaten Integrity and Availability are active attacks.

Categorization of passive and active attacks
Security Services and Mechanisms

➢ The International Telecommunication Union-Telecommunication

Standardization Sector (ITU-T) provides some security services and
some mechanisms to implement those services.

➢ Security services and mechanisms are closely related because a

mechanism or combination of mechanisms are used to provide a
service.

➢ A mechanism can be used in one or more services.

Security Services
➢ ITU-T (X.800) has defined five services related to the security goals and attacks

- It is easy to relate one or more of these services to one or more of the security goals.

- It is also easy to see that these services have been designed to prevent the security attacks
Security Services

Data Confidentiality
- designed to protect data from disclosure attack.

- The service encompasses confidentiality of the whole message or part of a message and
also protection against traffic analysis. That is, it is designed to prevent snooping and
traffic analysis attack.

Data Integrity
- designed to protect data from modification, insertion, deletion, and replaying by an
adversary.

- It may protect the whole message or part of the message.

Security Services
Authentication
- In connection-oriented communication, it provides authentication of the sender or
receiver during the connection establishment (peer entity authentication).
- In connectionless communication, it authenticates the source of the data (data origin
authentication).

Nonrepudiation
- protects against repudiation by either the sender or the receiver of the data.
- In nonrepudiation with proof of the origin, the receiver of the data can prove the
identity of the sender if denied.
- In nonrepudiation with proof of delivery, the sender of data can later prove that data
were delivered to the intended recipient.

Access Control
- provides protection against unauthorized access to data. The term access can involve
reading, writing, modifying, executing programs, and so on.
Security Mechanisms
❑ ITU-T (X.800) also recommends some security mechanisms to provide the
security services
Security Mechanisms

Encipherment
- hiding or covering data, can provide confidentiality.
- It can also be used to complement other mechanisms to provide other services.

Data Integrity
- mechanism appends to the data a short checkvalue that has been created by a specific
process from the data itself.
- The receiver receives the data and the checkvalue. Then creates a new checkvalue from
the received data and compares the newly created checkvalue with the one received. If
the two checkvalues are the same, the integrity of data has been preserved.
Security Mechanisms
Digital Signature

- a means by which the sender can electronically sign the data and the receiver can
electronically verify the signature.
- The sender uses a process that involves showing that she owns a private key related to
the public key that she has announced publicly.
- The receiver uses the sender’s public key to prove that the message is indeed signed by
the sender who claims to have sent the message.

Authentication Exchange

- two entities exchange some messages to prove their identity to each other. For example,
one entity can prove that she knows a secret that only she is supposed to know.
Security Mechanisms
Traffic padding
- means inserting some bogus data into the data traffic to prevent the adversary’s attempt
to use the traffic analysis.

Routing Control
- means selecting and continuously changing different available routes between the
sender and the receiver to prevent the opponent from eavesdropping on a particular
route.

Notarization
- means selecting a third trusted party to control the communication between two entities.
- This can be done, to prevent repudiation. The receiver can involve a trusted party to
store the sender request in order to prevent the sender from later denying that she has
made such a request.
Security Mechanisms

Access Control
- uses methods to prove that a user has access right to the data or resources owned by a
system. Examples of proofs are passwords and PINs.
Relation between Services and Mechanisms
Techniques for Security goals implementations

➢ The actual implementation of security goals needs some techniques. Two techniques are
prevalent today: one is very general (cryptography) and one is specific (steganography).

Cryptography
- refer to the science and art of transforming messages to make them secure and immune
to attacks.
- It is defined as involving three distinct mechanisms: symmetric-key encipherment,
asymmetric-key encipherment, and hashing.

Steganography
- The word steganography, with origin in Greek, means “covered writing”
- Cryptography means concealing the contents of a message by enciphering, whereas
steganography means concealing the message itself by covering it with something else.
Cryptography Classification
❑ Symmetric cryptography
- Also known as private key cryptography, this uses the same key for both encryption and decryption.
- Symmetric systems are faster than asymmetric systems, but each user needs access to the same private key.
- Examples of symmetric algorithms include Data Encryption Standard (DES) and Advanced Encryption
Standard (AES).
❑ Asymmetric cryptography
- Also known as public key cryptography, this uses a public key to encrypt and a related private key to decrypt.
- Asymmetric systems are more flexible because the public key can be shared, allowing parties to
communicate securely without a shared secret key.
- Examples of asymmetric algorithms include Rivest–Shamir–Adleman (RSA), Elliptic Curve Cryptography
(ECC), and Digital Signature Algorithm (DSA).
❑ Hash functions
- These are lightweight and are often used in more complex cryptographic protocols to ensure data integrity.
Question
▪ Define the type of security attack in each of the following cases:

1. A student breaks into a professor’s office to obtain a copy of the next day’s test.

This is snooping (attack to the confidentiality of stored data). Although the contents of
the test is not confidential on the day of the test, it is confidential before the test day.

2. A student gives a check for Rs.500 to buy a used book. Later she finds that the
check was cashed for Rs.5000.
This is modification (attack to the integrity of data). The value of the check is changed
(from Rs.500 to Rs.5000).
Question

❑ Which security mechanism(s) are provided in each of the following cases?

1. A school demands student identification and a password to let students log into the
school server.

This provide access control mechanism. The process is to prove that the student has right
to access the school resources.
Question
❑ Which security mechanism(s) are provided in each of the following cases?

2. A school server disconnects a student if she is logged into the system for more than
two hours.

This can provide routing control. The school may be doing this to prevent a student from
eavesdropping on a particular route.
Question

❑ Which security mechanism(s) are provided in each of the following cases?

3. A professor refuses to send students their grades by e-mail unless they provide student
identification that were pre-assigned by the professor.

This can be authentication exchange mechanism. The professor needs to authenticate the
student before sending the grade. The preassigned identification is a secret between the
student and the professor.
Question

❑ Which security mechanism(s) are provided in each of the following cases?

4. A bank requires the customer’s signature for a withdrawal.

The mechanism is similar to digital signature. It can be used for two purposes. If the
signature of the customer is checked against a signature on the file, it can provide
authentication. The signature on the withdrawal document definitely is served as the
nonrepudiation. The customer cannot later denies that she has not received the cash
Question
▪ Which technique (cryptography or steganography) is used in each of the following
cases for confidentiality?
1. A student writes the answers to a test on a small piece of paper, rolls up the paper, and
inserts it in a ball-point pen, and passes the pen to another student.

2. To send a message, a spy replaces each character in the message with a symbol that
was agreed upon in advance as the character’s replacement.

3. A company uses special ink on its checks to prevent forgeries.

1) This is steganography. The answers to the test has not been changed; they have been
only hidden.
2) This is cryptography. The characters in the message are not hidden; they are replaced
by another characters.
3) This is steganography. The special ink hides the actual writing on the check