CRYPTOGRAPHY AND NETWORK

SECURITY

MODULE 4 — EXAM PREPARATION NOTES

Subject Cryptography and Network Security (CNS)

Course Code 21IS71 / 21CS72

Module 4 — Network Security: IPSec, SSL/TLS, Kerberos,

Module
Firewalls

Total Questions 10 Questions Covered

Reference Books Stallings 6th Ed. | SVIT Digital Notes | Module 4 PPT

Topics Covered in This Document

1 Q1: IPSec Architecture

2 Q2: Authentication Header (AH) Protocol

3 Q3: Encapsulating Security Payload (ESP)

4 Q4: Transport Mode vs Tunnel Mode

5 Q5: SSL Architecture

6 Q6: SSL Record Protocol

7 Q7: TLS Handshake Protocol

8 Q9: IPSec Security Associations (SA)

9 Q10: Web Security Concepts

10 Q12: Firewall Characteristics and Types

 TABLE OF CONTENTS

12
Q1 IPSec Architecture
Marks

10
Q2 Authentication Header (AH) Protocol
Marks

10
Q3 Encapsulating Security Payload (ESP)
Marks

Q4 Transport Mode vs Tunnel Mode 8 Marks

10
Q5 SSL Architecture
Marks

10
Q6 SSL Record Protocol
Marks

12
Q7 TLS Handshake Protocol
Marks

Q9 IPSec Security Associations (SA) 8 Marks

6-8
Q10 Web Security Concepts
Marks

10
Q12 Firewall Characteristics and Types
Marks
CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

REFERENCE DIAGRAMS FROM MODULE 4 PDF

X.509 Certificate Format — Reference Diagram

Figure: X.509 Certificate Creation and Verification — Hash, Encrypt with CA private key, Signed Certificate (Source:
CNS_Module_4__.pdf, Page 1)

X.509 Certificate Structure (v1/v2/v3) and CRL Format

Cryptography & Network Security — Module 4 | Page 3 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Figure 14.4: X.509 Certificate Format (a) and Certificate Revocation List (b) (Source: CNS_Module_4__.pdf, Page 2)

X.509 CA Hierarchy

Figure: X.509 Hierarchical CA structure — Forward and Reverse certificates, chain from A to B (Source:
CNS_Module_4__.pdf, Page 5)

Cryptography & Network Security — Module 4 | Page 4 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Kerberos Version 4 — Message Exchange Summary

Table 14.1: Summary of Kerberos Version 4 Message Exchanges — (a) AS Exchange, (b) TGS Exchange, (c)
Client/Server Exchange (Source: CNS_Module_4__.pdf, Page 16)

Kerberos Overview — Full System Diagram

Cryptography & Network Security — Module 4 | Page 5 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Figure 14.1: Overview of Kerberos — Client, AS, TGS, Service Provider full message flow (Source:
CNS_Module_4__.pdf, Page 18)

Kerberos Realms — Inter-Realm Authentication

Cryptography & Network Security — Module 4 | Page 6 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Figure: Kerberos Realms — Realm A and Realm B cross-realm authentication (Source: CNS_Module_4__.pdf, Page
22)

Cryptography & Network Security — Module 4 | Page 7 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

MODULE 4 — NETWORK SECURITY: IPSec, SSL/TLS,

KERBEROS & FIREWALLS

QUESTION 1 (12 Marks — Network Security Protocol)

Explain IPSec Architecture

Introduction
IPSec (Internet Protocol Security) is a set of protocols used to provide security for IP communication.
It provides Authentication, Confidentiality, Integrity, and Access control at the network layer.

IPSec Architecture:

Application Layer → Transport Layer → IPSec Layer (AH / ESP) →

Internet Layer

Components of IPSec

1. Authentication Header (AH)

Provides: Authentication, Integrity. Does NOT provide encryption.

2. Encapsulating Security Payload (ESP)

Provides: Encryption, Authentication, Confidentiality.

3. Security Association (SA)

Defines: Security algorithms, Keys, Parameters.

4. Key Management

Handled using: IKE (Internet Key Exchange).

Modes of IPSec

1. Transport Mode:

Protects payload only. Original IP header visible. Used for end-to-end communication.

2. Tunnel Mode:

Protects entire IP packet. New IP header added. Used for VPNs, gateway-to-gateway.

Advantages Limitations

Cryptography & Network Security — Module 4 | Page 8 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

1. Strong security 2. Confidential communication 3. 1. Complex configuration 2. Processing overhead

VPN support

Applications: VPNs, Secure enterprise networks, Remote access systems

Conclusion: IPSec provides strong network-layer security using AH, ESP, and secure key
management mechanisms.

■ Common Mistakes

■ Saying AH provides encryption

✓ Correct: AH provides authentication only.

■ Memory Trick

AH = Authentication | ESP = Encryption + Security

Reference:

• Material Name: CNS_Module_4__.pdf — IPSec Section

• Material Name: CSIT_III-II_CRYPTOGRAPHY_DIGITAL_NOTES.pdf — IPSec Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 19

Cryptography & Network Security — Module 4 | Page 9 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 2 (10 Marks — IPSec Protocol)

Explain Authentication Header (AH) Protocol

Introduction
Authentication Header (AH) is an IPSec protocol providing: Authentication, Integrity, Data origin
verification. It does NOT provide confidentiality.

AH Protocol Diagram:

IP Header | AH Header | Payload Data

AH Header Fields

1. Next Header Identifies the type of payload following the AH header.

2. Payload Length Length of the AH header.

3. Security
Parameter Index Identifies the Security Association.
(SPI)

4. Sequence
Monotonically increasing counter — provides replay protection.
Number

5. Authentication
Contains the Integrity Check Value over the packet.
Data (ICV)

AH Working Steps

Step 1: Sender computes authentication value (ICV) over the entire packet.

Step 2: AH header inserted into packet between IP header and payload.

Step 3: Receiver verifies integrity by recomputing ICV and comparing.

AH Services
• 1. Authentication
• 2. Integrity
• 3. Replay protection

Advantages Limitations

1. Strong authentication 2. Data integrity verification 1. No encryption / confidentiality 2. NAT compatibility

issues

Applications: VPNs, Secure communication systems

Conclusion: AH provides authentication and integrity for IP packets using IPSec framework.

Cryptography & Network Security — Module 4 | Page 10 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

■ Memory Trick

AH = Authentication only (No Encryption)

Reference:

• Material Name: CNS_Module_4__.pdf — IPSec / AH Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 19

Cryptography & Network Security — Module 4 | Page 11 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 3 (10 Marks — IPSec Protocol)

Explain Encapsulating Security Payload (ESP)

Introduction
ESP (Encapsulating Security Payload) is an IPSec protocol providing: Confidentiality, Authentication,
and Integrity through encryption mechanisms.

ESP Packet Format:

IP Header | ESP Header | Encrypted Payload | ESP Trailer |

Authentication Data

ESP Services
• 1. Encryption (Confidentiality)
• 2. Authentication
• 3. Integrity
• 4. Replay protection

ESP Working Steps

Step 1: Payload (data) is encrypted using negotiated encryption algorithm.

Step 2: ESP header and trailer added around encrypted payload.

Step 3: Receiver decrypts payload and verifies authentication data.

ESP vs AH Comparison:

AH: Authentication + Integrity only — No Encryption

ESP: Encryption + Authentication + Integrity — Full Security

Advantages Limitations

1. Strong encryption 2. Supports authentication 3. 1. Computational overhead 2. Complex

VPN security configuration

Applications: VPNs, Secure IP communication

Conclusion: ESP provides confidentiality and secure payload protection in IPSec communication.

■ Memory Trick

ESP = Encryption + Security (Full protection)

Reference:

Cryptography & Network Security — Module 4 | Page 12 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

• Material Name: CNS_Module_4__.pdf — IPSec / ESP Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 19

Cryptography & Network Security — Module 4 | Page 13 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 4 (8 Marks — Comparison Question)

Differentiate Between Transport Mode and Tunnel Mode

Transport Mode vs Tunnel Mode Comparison Table

Feature Transport Mode Tunnel Mode

Protection Payload only Entire IP packet

Original IP Header Visible (not encrypted) Encrypted

Overhead Less More

Security Level Lower Higher

Usage End-to-end communication VPNs

New IP Header Not added Added (new outer header)

Processing Faster Slower

Applications Host-to-host Gateway-to-gateway

Transport Mode Packet:

IP Header | AH/ESP Header | Protected Payload

Tunnel Mode Packet:

New IP Header | AH/ESP Header | Encrypted (Original IP Header +

Payload)

Conclusion: Transport mode protects only payload data while tunnel mode protects the complete IP
packet and provides stronger security.

■ Common Mistakes

■ Confusing which mode is used for VPNs

✓ Tunnel Mode is used for VPNs (gateway-to-gateway)

■ Memory Trick

Tunnel = Entire packet hidden | Transport = Payload only

Reference:

• Material Name: CNS_Module_4__.pdf — IPSec Modes Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 19

Cryptography & Network Security — Module 4 | Page 14 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 5 (10 Marks — Network Security Architecture)

Explain SSL Architecture

Introduction
SSL (Secure Socket Layer) is a protocol providing secure communication over Internet networks. It
provides Confidentiality, Authentication, and Integrity between client and server.

SSL Architecture / Protocol Stack:

Application Layer → SSL Record Protocol → TCP → IP

SSL Components

SSL Record Protocol

Provides: Fragmentation, Compression, Encryption, MAC addition.

Handshake Protocol

Used for: Authentication, Cipher suite negotiation, Session key exchange.

Change Cipher Spec Protocol

Activates the negotiated security parameters.

Alert Protocol

Handles warnings and error notifications.

Features
• 1. Secure communication
• 2. Authentication
• 3. Encryption support

Advantages Limitations

1. Secure web communication 2. Data confidentiality 1. Older SSL versions insecure 2. Processing
3. Authentication overhead

Applications: HTTPS, E-commerce, Banking systems

Conclusion: SSL provides secure client-server communication using encryption and authentication
protocols.

■ Memory Trick

SSL = Secure Web Communication | 4 sub-protocols

Cryptography & Network Security — Module 4 | Page 15 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Reference:

• Material Name: CNS_Module_4__.pdf — SSL Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 20

Cryptography & Network Security — Module 4 | Page 16 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 6 (10 Marks — Security Protocol)

Explain SSL Record Protocol

Introduction
SSL Record Protocol provides secure communication services for SSL connections. It provides
Confidentiality and Integrity.

SSL Record Protocol Processing Pipeline:

Application Data → Fragmentation → Compression → MAC Addition →

Encryption → Transmission

SSL Record Protocol Working Steps

Step 1: Fragmentation

Message divided into manageable blocks (max 2^14 bytes each).

Step 2: Compression

Optional compression applied to reduce size.

Step 3: MAC Addition

Message Authentication Code (MAC) added for integrity check.

Step 4: Encryption

Data encrypted using negotiated session key and cipher algorithm.

Step 5: Transmission

Secure record transmitted with SSL record header.

Features
• 1. Integrity protection via MAC
• 2. Encryption for confidentiality
• 3. Secure transmission

Advantages Limitations

1. Secure communication 2. Confidentiality 3. 1. Processing overhead 2. Compression attacks

Reliable data transfer possible (CRIME attack)

Applications: HTTPS, Secure web communication

Cryptography & Network Security — Module 4 | Page 17 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Conclusion: SSL Record Protocol ensures confidentiality and integrity during secure
communication.

■ Memory Trick

Fragment → Compress → MAC → Encrypt → Transmit

Reference:

• Material Name: CNS_Module_4__.pdf — SSL Record Protocol Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 20

Cryptography & Network Security — Module 4 | Page 18 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 7 (12 Marks — Network Security Protocol)

Explain TLS Handshake Protocol

Introduction
TLS (Transport Layer Security) Handshake Protocol establishes secure communication between
client and server. It performs: Authentication, Cipher suite negotiation, and Session key exchange.

TLS Handshake Message Flow:

Client → ClientHello → Server

Client ← ServerHello, Certificate, ServerHelloDone ← Server

Client → ClientKeyExchange, ChangeCipherSpec, Finished → Server

Client ← ChangeCipherSpec, Finished ← Server

=== Secure Encrypted Communication Begins ===

TLS Handshake Steps

Step 1: ClientHello

Client sends: TLS version supported, random number, list of cipher suites supported.

Step 2: ServerHello

Server selects: cipher suite, TLS version, sends its own random number.

Step 3: Certificate Exchange

Server sends its digital certificate for client to authenticate the server.

Step 4: Key Exchange

Client generates premaster secret, encrypts with server public key, sends to server.

Step 5: Session Key Generation

Both client and server independently derive the same session key from premaster secret +
randoms.

Step 6: Secure Communication

ChangeCipherSpec sent, Finished messages exchanged. Encrypted communication begins.

Features

Cryptography & Network Security — Module 4 | Page 19 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

• 1. Authentication
• 2. Confidentiality
• 3. Integrity

Advantages Limitations

1. Secure communication 2. Strong authentication 3. 1. Handshake overhead (latency) 2. Complex

Session key establishment implementation

Applications: HTTPS, Secure banking, VPNs

Conclusion: TLS Handshake Protocol securely establishes encrypted communication using

authentication and session key negotiation.

■ Common Mistakes

■ Confusing SSL and TLS (TLS is newer, more secure successor to SSL)

■ Forgetting handshake order (ClientHello always first)

■ Memory Trick

Hello → Certificate → Key Exchange → Secure Communication

Reference:

• Material Name: CNS_Module_4__.pdf — TLS/SSL Handshake Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 20

Cryptography & Network Security — Module 4 | Page 20 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 9 (8 Marks — Network Security Protocol)

Explain IPSec Security Associations (SA)

Introduction
Security Association (SA) is a fundamental concept in IPSec that defines the security parameters
used for secure communication between two entities. It specifies: Encryption algorithm,
Authentication algorithm, Secret keys, Security protocols.

Security Association Flow:

Sender → Security Association (AH/ESP + Keys + Algorithms) →

Receiver

Components of Security Association

1. Security Parameter Index (SPI)

Unique 32-bit identifier for the SA — carried in AH/ESP header.

2. IP Destination Address

Address of the destination endpoint of the SA.

3. Security Protocol Identifier

Specifies whether AH or ESP is used.

SA Database (SAD)

SAD stores all active Security Associations and includes:

• Sequence number counter

• Encryption and authentication algorithms

• Secret keys

• SA lifetime

• IPSec protocol mode (Transport/Tunnel)

Working of SA
• 1. Sender and receiver establish SA (using IKE).
• 2. Security parameters agreed upon.
• 3. AH/ESP use SA information to secure packets.
• 4. Secure communication begins.

Cryptography & Network Security — Module 4 | Page 21 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Types of SA:

AH Association | ESP Association

Note: SA is UNIDIRECTIONAL — a separate SA is needed for each direction of

communication.

Advantages Limitations

1. Secure communication management 2. Flexible 1. Complex management 2. Additional overhead

security configuration 3. Supports auth & encryption

Applications: VPNs, IPSec communication, Secure enterprise networks

Conclusion: Security Association defines the security parameters required for secure IPSec
communication using AH and ESP protocols.

■ Common Mistakes

■ Saying one SA works both directions

✓ Correct: SA is UNIDIRECTIONAL — two SAs needed for bidirectional communication.

■ Memory Trick

SA = Security Rules for Communication | Unidirectional

Reference:

• Material Name: CNS_Module_4__.pdf — IPSec Security Association Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 19

Cryptography & Network Security — Module 4 | Page 22 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 10 (6/8 Marks — Web Security)

Explain Web Security Concepts

Introduction
Web security protects websites, web applications, and online services from attacks and unauthorized
access. It ensures: Confidentiality, Integrity, Authentication, and Availability.

Web Security Architecture:

User Browser → HTTPS / SSL / TLS → Web Server → Database

Common Web Security Threats

1. Phishing

Fake websites steal user credentials and sensitive information.

2. SQL Injection

Malicious SQL commands injected to attack and manipulate databases.

3. Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by users.

4. Session Hijacking

Attacker steals valid session tokens to gain unauthorized access.

Web Security Mechanisms

• 1. SSL/TLS — Encrypts data in transit
• 2. Firewalls — Filter malicious traffic
• 3. Authentication — Verify user identity
• 4. Encryption — Protect stored data
• 5. IDS/IPS — Detect and prevent intrusions

Advantages Limitations

1. Protects user data 2. Prevents unauthorized 1. Complex to implement 2. Evolving threat

access 3. Secure online transactions landscape

Applications: E-commerce, Online banking, Cloud services

Conclusion: Web security mechanisms protect online communication and web applications against
cyber attacks.

■ Memory Trick

Cryptography & Network Security — Module 4 | Page 23 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Web Security = Safe Online Communication (HTTPS + Firewall + Auth)

Reference:

• Material Name: CNS_Module_4__.pdf — Web Security Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 20

Cryptography & Network Security — Module 4 | Page 24 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

QUESTION 12 (10 Marks — Network Security)

Explain Firewall Characteristics and Types

Introduction
A firewall is a network security system that filters and monitors network traffic between trusted and
untrusted networks.

Firewall Architecture:

Internal Network ↔ Firewall ↔ External Network (Internet)

Firewall Characteristics

1. Single Entry Point

All traffic must pass through the firewall — single choke point.

2. Access Control

Allows only authorized traffic based on security policy.

3. Security Monitoring

Monitors and logs suspicious network activities.

4. Logging Facility

Records all network activity for audit and analysis.

5. Policy Enforcement

Implements and enforces centralized security policies.

Types of Firewalls

1. Packet Filtering Firewall

Filters packets based on: IP address, Port number, Protocol. Stateless — does not track
connection state. Fast but limited security.

2. Stateful Inspection Firewall

Tracks active sessions and connection states. More secure than packet filtering. Understands
context of connections.

3. Application-Level Gateway (Proxy Firewall)

Cryptography & Network Security — Module 4 | Page 25 of 26

CNS MODULE 4 — EXAM PREPARATION NOTES VTU | Cryptography & Network Security

Filters application-level traffic (HTTP, FTP). Acts as intermediary between client and server.
Deep packet inspection capability.

4. Circuit-Level Gateway

Monitors TCP connections and handshakes. Works at session layer. Does not inspect packet
content.

Firewall Types Comparison

Feature Packet Filter Stateful Application GW Circuit-Level

OSI Layer Network Transport Application Session

Speed Fastest Fast Slow Medium

Security Basic Moderate High Moderate

State Tracking No Yes Yes Yes

Content Check No No Yes No

Advantages Limitations

1. Prevents unauthorized access 2. Monitors 1. Cannot stop insider attacks 2. Complex

network traffic 3. Improves network security configuration

Applications: Enterprise networks, Banking systems, Cloud security

Conclusion: Firewalls provide traffic filtering, monitoring, and access control for secure network
communication.

■ Common Mistakes

■ Confusing packet filtering and stateful firewall

✓ Packet filtering → Checks packets only (stateless)

✓ Stateful → Tracks connection state

■ Memory Trick

Firewall = Network Traffic Security Guard

Reference:

• Material Name: CNS_Module_4__.pdf — Firewall Section

• Material Name: CSIT_III-II_CRYPTOGRAPHY_DIGITAL_NOTES.pdf — Firewall Section

• Material Name: W_Stallings_Cryptography_6th_ed.pdf — Chapter 21

Cryptography & Network Security — Module 4 | Page 26 of 26