Module 3.

NETWORK SECURITY
CRYPTOGRAPHY

Ali Kingston MWILA

Credit: Mr. Gershom Chishala
Official
 CRYPTOGRAPHY The message to be
The fundamental and
transmitted – which can be
classical task of
Cryptography is the science some text, numerical data,
cryptography is to provide
of keeping secrets secret. an executable program or
confidentiality by
any other kind of information
encryption methods.
– is called the plaintext.

The ciphertext c is
To decrypt the ciphertext,
transmitted over the
one needs some secret
The encrypted plaintext m communication channel, the
information, a secret
changes to ciphertext c. ciphertext is turned back into
decryption key here after
the plaintext by the receiver
referred to as key.
using decryption.

The intruder may still

intercept the ciphertext.

2
Official
 CRYPTOGRAPHY

• However, the encryption should guarantee secrecy and prevent her from deriving
any information about the plaintext from the observed ciphertext.

3
Official
 CRYPTOGRAPHY
• Transposition Ciphers.
• Substitution ciphers preserve the order of the plaintext
symbols but disguise them. Transposition ciphers, in contrast,
reorder the letters but do not disguise them.
• Columnar Transposition
• If the letters are not exact multiples of the transpositions
• This involves the rearrangement of characters on the plain
text into columns
• The following example shows how letters are transformed
• Transposition size there may be a few short letters in
the last column which can be padded with an
infrequent letter such as x or z

4
Official
 CRYPTOGRAPHY

5
Official
 CRYPTOGRAPHY
The most famous instances
Encryption and decryption
of cryptography occur in
Encryption and decryption are inverse operations
military history, beginning
date back thousands of because decryption must
with Julius Caesar of the
years. “undo” the encryption and
Roman Empire, who
reproduce the original text.
developed the Caesar cipher.

There are many

In classical encryption
encryption/decryption
schemes, both algorithms This key k is used for both
algorithms, and of course
depend on the same secret encryption and decryption.
both the sender and receiver
key k
must use the same system.

A symmetric encryption
algorithm requires the use of
a secret key identical to both
the sender and receiver.

6
Official
 In an asymmetric encryption
algorithm, also called a public
Person A can make an CRYPTOGRAPHY
encryption key public, and
key encryption algorithm, the
anyone can encrypt a message
key for encryption and the key
using A’s public key and send it
for decryption are quite
to A.
different, although related.

The relationship between the

decryption key and the
However only A has the encryption key must be
decryption key, so only A can sufficiently complex that it is
decrypt the message. not possible to derive the
decryption key from the public
encryption key.

We will use C = EK(P) to mean

It will often be useful to have a
that the encryption of the
notation for relating plaintext,
plaintext P using key K gives the
ciphertext, and keys.
ciphertext C.

7
Official
 CRYPTOGRAPHY
Similarly, P = DK(C) represents This notation suggests that E
It then follows that
the decryption of C to get the and D are just mathematical
DK(EK(P)) = P
plaintext again. functions

1. Data integrity. The receiver

of a message should be able No one should be able to
The Objectives of to check whether the message substitute a false message for
Cryptography was modified during the original message, or for
transmission, either parts of it.
accidentally or deliberately.

[Link]. The
receiver of a message should
be able to verify its origin. No
one should be able to send a
message to Bob and pretend
to be Alice (data origin
authentication).

8
Official
 CRYPTOGRAPHY
When initiating a
3. Non-repudiation. The
communication, Alice and
sender should not be able to
Bob should be able to
later deny that she sent a
identify each other (entity
message.
authentication).

All cryptographic algorithms

involve substituting one thing
SYMMETRIC KEY for another.
CRYPTOGRAPHY • for example, taking a piece of
plaintext and then computing and
substituting the appropriate cipher
text to create the encrypted message.

A cipher is a character-for- Code replaces one word with

character or bit-for-bit another word or symbol.
transformation, without Codes are not used any
regard to the linguistic more, although they have a
structure of the message. glorious history.

Cryptography by Mr. Chishala G KMU 2023 9

Official
 CRYPTOGRAPHY
In a substitution cipher,
One of the oldest known
each letter or group of
ciphers is the Caesar
Substitution Cipher letters is replaced by
cipher, attributed to Julius
another letter or group of
Caesar.
letters to disguise it.

This makes it easy to In addition the Caesar

The Caesar cipher is an
encode just by scanning the cipher is a substitution
example of a stream cipher;
plaintext and doing the cipher, whereby a single
that is, it encodes one
appropriate substitution at letter of plaintext generates
character at a time.
each character. a single letter of ciphertext.

The problem is that a

ciphertext message could
be decoded by brute force,
that is, by simply trying all
possible keys.

10
Official
 • The Caesar cipher would work by taking each letter in
CRYPTOGRAPGHY the plaintext message and substituting the letter that is
k letters later allowing wraparound; that is, having the
letter z followed by the letter a in the alphabet.
• For example if k = 3, then the letter a in plaintext
becomes d in ciphertext; b in plaintext becomes e in
ciphertext, and so on.
• Here, the value of k serves as the key.
• As an example, the plaintext message “bob, i love you.
Alice” becomes “ere, l oryh brx. dolfh” in ciphertext.
• While the ciphertext does indeed look like gibberish, it
wouldn’t take long to break the code if you knew that
the Caesar cipher was being used, as there are only 25
possible key values.

11
Official
 CRYPTOGRAPHY
• The general system of symbol-for-symbol
substitution is called a monoalphabetic
substitution cipher, with the key being the 26-
letter string corresponding to the full alphabet.
• Rather than substituting according to a regular
pattern (for example, substitution with an offset
of k for all letters), any letter can be substituted
for any other letter, as long as each letter has a
unique substitute letter, and vice versa.
• The plaintext message “bob, i love you. Alice”
becomes “nkn, s gktc wky. Mgsbc.”

12
Official
 CRYPTOGRAPHY • Techniques improving on monoalphabetic
encryption, known as polyalphabetic
encryption, were invented.
• The idea behind polyalphabetic encryption is to
use multiple monoalphabetic ciphers
• A polyalphabetic cipher using two Caesar
ciphers above
• It has two Caesar ciphers (with k = 5 and k = 19),
shown as rows.
• We might choose to use these two Caesar
ciphers, C1 and C2 , in the repeating pattern C1 ,
C2 , C2 , C1 , C2 .
• That is, the first letter of plaintext is to be
encoded using C1 , the second and third using
C2 , the fourth using C1 , and the fifth using C2 .
13
Official
 CRYPTOGRAPHY

The pattern then The plaintext Note that the first In this example,
repeats, with the message “bob, i b in the plaintext the encryption
sixth letter being love you.” is thus message is and decryption
encoded using encrypted “ghu, n encrypted using “key” is the
C1 , the seventh etox dhz.” C1 , while the knowledge of the
with C2 , and so second b is two Caesar keys
on. encrypted using (k = 5, k = 19) and
C2 . the pattern C1 ,
C2 , C2 , C1 , C2 .

an experienced Block Ciphers.

cryptanalyst The other broad
(code breaker) classes of
can use these symmetric
clues to recover encryption
the plaintext. techniques are
block ciphers.

14
Official
 CRYPTOGRAPHY
In a block cipher, the message to be encrypted is processed in blocks of k bits.

For example, if k = 64, then the message is broken into 64-bit blocks, and each block
is encrypted independently.

Each plaintext character in the block contributes to more than one ciphertext
character, and each ciphertext character is the result of more than one plaintext
letter.

It is as if each plaintext character in a block gets chopped into little pieces, and
these pieces are scattered among the ciphertext characters in the corresponding
block.

This tends to destroy the structure of the plaintext and make decryption more
difficult.

Cryptography by Mr. Chishala G KMU 2023 15

Official
 CRYPTOGRAPHY
• An example of block cipher is shown below.

16
Official
 CRYPTOGRAPHY
To encode a block, the cipher uses a one-to-one mapping to map the k-bit
block of clear text to a k-bit block of ciphertext.

Let’s look at an example. Suppose that k = 3, so that the block cipher maps 3-
bit inputs (clear text) to 3-bit outputs (ciphertext).

observe that a mapping is nothing more than a permutation of all the possible
inputs. There are 2^3 (= 8) possible inputs (listed under the input columns).

The block size of a block cipher refers to the number of bits that are processed
together.

Data Encryption Standard (DES) and Advanced Encryption Standard (AES) are
both symmetric block ciphers.

The DES block cipher was originally designed by IBM in 1975 and consisted of
64-bit blocks and a 56-bit key.

17
Official
 • This cipher is not considered secure anymore, due to
the short key size, and was replaced in 1998 by AES.
CRYPTOGRAPHY • AES uses a 128-bit block size and a 128-, 192- or 256-
bit key size.
• Both of the previous encryption algorithms are too
simplistic to provide much real security.
• DES (Data Encryption Standard) is a symmetric
encryption algorithm developed by IBM in the 1970s
for the then U.S. National Bureau of Standards.
• The DES algorithm actually uses very simple
operations—however, it uses them over and over.
• DES was designed to protect electronic information,
so the plaintext is a binary string of 0s and 1s, just as it
is stored in a computer.

18
Official
 CRYPTOHRAPHY
DES is a block cipher, and the blocks are 64 bits long, meaning that
64 plaintext bits at a time are processed into 64 ciphertext bits.

The key is a 64-bit binary key, although only 56 bits are actually used.

The algorithm begins by sending the plaintext 64-bit string through

an initial permutation (rearrangement).

The algorithm then cycles through 16 “rounds.” Each round i

performs the following steps:

1. The incoming 64-bit block is split into a left half Li and a right half
Ri . The right half Ri gets passed through unchanged to become the
left half of the next round, Li+1.

2. In addition, the 32 bits in the right half get permuted according to

a fixed formula and then expanded to 48 bits by duplicating some of
the bits

19
Official
 CRYPTOGRAPHY
• Meanwhile, the 56-bit key is also permuted (the result
is passed on as the key to the next round) and then
reduced to 48 bits by omitting some of the bits.
• These two 48-bit strings are matched bit by bit, using
an XOR (exclusive OR) gate for each bit.
• 3. The resulting 48-bit string undergoes a substitution
and reduction to emerge as a 32-bit string.
• This string is permuted one more time, and the
resulting 32-bit string is matched bit by bit, using XOR
gates, with the left half Li of the input.
• The result is passed to the next round as the new right
half Ri+1.
• After all 16 rounds are complete, the final left and
right halves are recombined into a 64-bit string that is
permuted one more time, and the resulting 64-bit
string is the cipher text.

20
Official
 CRYPTOGRAPHY
Summary of the Process:
1. Start with 64-bit plaintext.
2. Perform an initial permutation and split into left and
right halves.
3. Expand the right half to 48 bits and XOR it with a 48-
bit key.
4. Substitute and reduce the result to 32 bits, then
permute it.
5. XOR the result with the left half to create the new
right half.
6. Repeat the process for 16 rounds.
7. Combine the final left and right halves, permute, and
produce the ciphertext.

Cryptography by Mr. Chishala G KMU 2023 21

Official
 CRYPTOGRAPHY
• After all 16 rounds are complete, the final left and right halves are
recombined into a 64-bit string that is permuted one more time,
and the resulting 64-bit string is the cipher text.
• Two important points about the DES algorithm: The first is that
every substitution, reduction, expansion, and permutation is
determined by a well-known set of tables.
• So, given the same plaintext and the same key, everyone using
DES ends up with the same cipherext. The “secret” part is the
initial key.
• The second point is that the same algorithm serves as the
decryption algorithm—just start with the ciphertext and apply the
sequence of keys in reverse order, that is, the round-16 key first
and the original secret key last.
• Triple DES improves the security of DES; it requires two 56-bit
keys (which can be thought of as a 112-bit key length), and runs
the DES algorithm three times

22
Official
 CRYPTOGRAPHY • Encode using key 1, decode the result using key 2,
encode the result using key 1 again.
• Concerns about the eventual breakdown of DES in the
face of ever-increasing computing power prompted NIST
in 1997 to request proposals for a successor encryption
scheme.
• The result was AES (Advanced Encryption Standard),
which was adopted for use by the U.S. government in
2001.
• AES is based on the Rijndael (pronounced Rin-dahl)
algorithm.
• Like DES, AES uses successive rounds of computations
that mix up the data and the key.
• The key length can be 128, 192, or even 256 bits, and the
algorithm appears to be very efficient
23
Official
 CRYPTOGRAPHY
Symmetric-key systems are
simpler and faster; their main Key Management caused
Problems with Conventional drawback is that the two parties nightmare for the parties using
Cryptography must somehow exchange the the symmetric key
key in a secure way and keep it cryptography.
secure after that.

Thus, if the key was

They were worried about how to compromised, the entire coding
This gave the chance for third
get the keys safely and securely system was compromised and
parties to intercept the keys in
across to all users so that the a “Secret” would no longer
transit to decode the top-secret
decryption of the message remain a “Secret”. This is why
messages.
would be possible. the “Public Key Cryptography”
came into existence.

24
Official
 CRYPTOGRAPHY
• ASYMETRIC KEY ENCRYPTION
• Asymmetric cryptography, also known as Public-key
cryptography, refers to a cryptographic algorithm that
requires two separate keys, one of which is private and
one of which is public.
• The public key is used to encrypt the message and the
private one is used to decrypt the message.
• Messages encoded using public key can only be
decoded by the private key
• Secret transmission of key for decryption is not
required
• Every entity can generate a key pair and release its
public key

25
Official
 CRYPTOGRAPHY
• Public Key Cryptography is a very advanced form of
cryptography.
• Plain Text: Original message.
• Cipher Text: Encrypted message.
• Public Key: Used to encrypt the message (can be
shared openly).
• Private Key: Used to decrypt the message
(must be kept secret).

26
Official
 CRYPTOGRAPHY

Remember that the In a public key system, The most common

main difficulty with a the encryption key for public key encryption
symmetric algorithm is messages to go to a algorithm is RSA,
how to securely particular receiver is named for its
transmit the secret key. broadcast to everyone, developers, Ron Rivest,
but the decryption key Adi Shamir, and Len
cannot be derived from Adleman at MIT
it and is known only by founders of RSA
the receiver. Security.

This algorithm,
developed in 1977, is
based on results from
the field of
mathematics known as
number theory.

27
Official
 • Choose two large prime numbers p & q
• Compute n=pq and z=(p-1)(q-1)
• Choose number e, less than n, which has no common factor
(other than 1) with z
• Find number d, such that ed – 1 is exactly divisible by z
• Keys are generated using n, d, e
• Public key is (n,e)
• Private key is (n, d)
• Encryption: c = me mod n
• m is plain text
• c is cipher text
• Decryption: m = cd mod n
• Public key is shared and the private key is hidden

28
Official
 CRYPTOGRAPHY
The success of RSA encryption depends on the fact that it is extremely difficult to find the prime
factors for n if n is a large number.

So although information encrypted using RSA is technically not secure, it is secure in practice
because of the large amount of computation necessary to find the prime factors of the encoding key.

here’s how RSA works. Two large prime numbers p and q are chosen at − random, and their product n
= p x q is computed.

The product m = (p - 1) x(q - 1) is also computed.

Next, a large random number e is chosen in such a way that e and m have no common factors other
than 1.

29
Official
 CRYPTOGRAPHY
• This step guarantees the existence of a unique
integer d between 0 and m,
• such that when we compute e x d using the same
sort of wraparound arithmetic we used in the
block encoding scheme
• —that is, whenever we reach m, we start over
again counting from 0— the result is 1.
• There are computationally efficient ways to
produce p, q, e, and d. For example, suppose we
pick p = 3 and q = 7 (a trivially small case). Then,
• Students to finish it up…….

30
Official
 CRYPTOGRAPHY

• RSA Example.

31
Official
 CRYPTOGRAPHY

• RSA Decryption
• The decryption formula is:
m=cdmod nm=cdmodn
• mm: Plaintext (original message).
• cc: Ciphertext (encrypted message).
• dd: Private key exponent.
• nn: Modulus.
1. Given n=35n=35 and c=29c=29.
• This formula reverses the encryption
process, transforming ciphertext back 2. Assume e=5e=5 and calculate d=5d=5.
into plaintext. 3. Decrypt using m=cd mod nm=cd mod n:
m=295mod 35=4m=295mod35=4
4. Map m=4m=4 to the letter "D".

32
Official
 CRYPTOGRAPHY
Weaknesses of RSA

• Efficiency is lower than Symmetric Algorithms

• A 1024-bit asymmetric key is equivalent to 128-bit symmetric key
• Potential for man-in-the middle attack
• It is problematic to get the key pair generated for the encryption

Hacker could generate a key pair, give the public key away and tell
everybody, that it belongs to somebody else.

Now, everyone believing it will use this key for encryption, resulting
in the hacker being able to read the messages.

If he encrypts the messages again with the public key of the real
recipient, he will not be recognized easily.

33
Official
 • Session Key Encryption
CRYPTOGRAPHY
• We note here that the exponentiation required
by RSA is a rather time-consuming process.
• As a result, RSA is often used in practice in
combination with symmetric key cryptography.
• For example, if Alice wants to send Bob a large
amount of encrypted data, she could do the
following.
• First Alice chooses a key that will be used to
encode the data itself; this key is referred to as a
session key.
• and is denoted by KS .

34
Official
 CRYPTOGRAPHY
• Alice must inform Bob of the session key, since this is
the shared symmetric key they will use with a symmetric
key cipher (e.g., with DES or AES).
• Alice encrypts the session key using Bob’s public key,
• that is, computes c = (KS )^e mod n.
• Bob receives the RSA-encrypted session key, c, and
decrypts it to obtain the session key, KS .
• Bob now knows the session key that Alice will use for her
encrypted data transfer.
• Basically session key is used to improve efficiency
• Symmetric key is used for encrypting data
• Asymmetric key is used for encrypting the symmetric
key

35
Official
 CRYPTOGRAPHY

•Plaintext: Original •Ciphertext: Encrypted

message. message using DES.

•Session Key: Symmetric

•Encrypted Key: Session
key used for DES
key encrypted with RSA.
encryption.

This hybrid approach

ensures secure and
•Recipient's Public Key:
efficient communication
Used to encrypt the
by combining the strengths
session key.
of symmetric and
asymmetric encryption.

36
Official
 CRYPTOGRAPHY
One method for
achieving secure transfer This is a series of
Web Transmission
of information on the protocol developed by
Security
Web is SSL (Secure Netscape.
Sockets Layer).

TLS has a few technical

security improvements
The TLS (Transport Layer
Communications over SSL, but the major
Security) protocol, first
(Netscape was an early difference is that TSL is
defined in 1999, is based
Web browser) in the mid- nonproprietary and is a
on SSL and is nearly
1990s. standard supported by
identical to SSL.
the Internet Engineering
Task Force.
TLS/SSL allows a client
(the purchaser’s Web
browser) and a Web
server to agree on the
encryption methods to
be used, exchange the
necessary security keys,
and authenticate the
identity of each party to
the other

37
Official
 CRYPTOGRAPHY
• Now that we know a bit more about encryption, we might ask
what encryption algorithm TLS/SSL uses.
• is it DES encryption or the newer, stronger RSA encryption?
Surprisingly, it is both.
• One of the problems with the RSA algorithm is the
computational overload for encryption/decryption.
• What often happens is that RSA is used in the initial stage of
communication between client and server.
• The client, using RSA and the public key of the server,
encodes a short message containing the keys for a
symmetric encryption algorithm.
• Because only keys are being encrypted, the message is
short and the encryption can be done quickly with little
RSA overload.
38
Official
 • Encryption Protocols
CRYPTOGRAPHY
• Pretty Good Privacy (PGP)
• Used to encrypt e-mail using session key
encryption
• Combines RSA, TripleDES, and other algorithms
• Secure/Multipurpose Internet Mail Extension (S/MIME)
• Newer algorithm for securing e-mail
• Backed by Microsoft, RSA, AOL
• Secure Socket Layer(SSL) and Transport Layer
Socket(TLS)
• Used for securing TCP/IP Traffic
• Mainly designed for web use
• Can be used for any kind of internet traffic

39
Official
 CRYPTOGRAPHY
Key Agreement
• Key agreement is a method to create secret
key by exchanging only public keys.
• Example
• Bob sends Alice his public key
• Alice sends Bob her public key
• Bob uses Alice’s public key and his private
key to generate a session key
• Alice uses Bob’s public key and her private
key to generate a session key
• Using a key agreement algorithm both will
generate same key
• Bob and Alice do not need to transfer any
key 40
Official
 CRYPTOGRAPHY
Asymmetric encryption
(public/private keys) is used to
securely exchange a session key.

Symmetric encryption (DES) is

used for efficient communication
once the session key is shared.

This process ensures both

security and efficiency in
communication.

41
Official
 CRYPTOGRAPHY
Key Diffie-Hellman Mathematical Analysis

Diffie-Hellman allows two parties to securely generate a

shared secret key over an insecure channel.

The shared secret key is used for symmetric encryption

(e.g., AES) to ensure secure communication.

The security of the process relies on the difficulty of

solving the discrete logarithm problem.

42
Official
 CRYPTOGRAPHY

Diffie-Hellman is the first key No exchange of secret keys

agreement algorithm
Invented by Whitfield Diffie & Martin Hellman Man-in-the middle attack avoided
Provided ability for messages to be exchanged
securely without having to have shared some secret
information previously
Inception of public key cryptography which allowed
keys to be exchanged in the open

43
Official
 CRYPTOGRAPHY
• AUTHENTICATION
• Authentication is the process of validating the
identity of a user or the integrity of a piece of data.
• There are three technologies that provide
authentication
• Message Digests / Message Authentication Codes
• Digital Signatures
• Public Key Infrastructure
• There are two types of user authentication:
• Identity presented by a remote or application
participating in a session
• Sender’s identity is presented along with a message.

44
Official
 AUTHENTICATION • Message Digest
• A message digest is a fingerprint for a
document
• Purpose of the message digest is to provide
proof that data has not altered
• Process of generating a message digest
from data is called hashing
• Hash functions are one way functions with
following properties
• Infeasible to reverse the function
• Infeasible to construct two messages which
hash to same digest
• Commonly used hash algorithms are
• MD5 – 128 bit hashing algorithm by Ron Rivest of
RSA
• SHA & SHA-1 – 162 bit hashing algorithm
developed by NIST

45
Official
 AUTHENTICATION

• Message Authentication Code

• A message digest created with a key
• Creates security by requiring a secret
key to be possessed by both parties in
order to retrieve the message

46
Official
 AUTHENTICATION
Password
Authentication

Password is secret Message Digests

Stored hash of the Problems with
character string only commonly used for
password is a lesser password based
known to user and password
risk authentication
server authentication

Hacker can not reverse Attacker learns

the hash except by password by social
brute force attack engineering

Attacker cracks
password by brute-
force and/or guesswork

Eavesdrops password
if it is communicated
unprotected over the
network

Replays an encrypted
password back to the
authentication server

47
Official
 AUTHENTICATION
• Authentication Protocols
• Set of rules that governs the communication of
data related to authentication between the server
and the user
• Techniques used to build a protocol are
• Transformed password
• Password transformed using one way function before transmission
• Prevents eavesdropping but not replay
• Challenge-response
• Server sends a random value (challenge) to the client along with the
authentication request. This must be included in the response
• Protects against replay

48
Official
 AUTHENTICATION
• Authentication Protocols
• Time Stamp
• The authentication from the client to server must have
time-stamp embedded
• Server checks if the time is reasonable
• Protects against replay
• Depends on synchronization of clocks on computers
• One-time password
• New password obtained by passing user-password
through one-way function n times which keeps
incrementing
• Protects against replay as well as eavesdropping

49
Official
 AUTHENTICATION
Kerberos
• Kerberos is an authentication service that
uses symmetric key encryption and a key
distribution center.
Authentication Protocols Cont.. • Kerberos Authentication server contains
symmetric keys of all users and also
contains information on which user has
access privilege to which services on the
network

Personal Tokens are hardware

devices that generate unique
Personal Tokens strings that are usually used in
conjunction with passwords for
authentication

1/18/2023 50
Official
 AUTHENTICATION
• Different types of tokens exist
• Storage Token: A secret value that is stored on a token and is
available after the token has been unlocked using a PIN
• Synchronous one-time password generator: Generate a new
password periodically (e.g. each minute) based on time and
a secret code stored in the token
• Challenge-response: Token computes a number based on a
challenge value sent by the server
• Digital Signature Token: Contains the digital signature private
key and computes a computes a digital signature on a
supplied data value
• A variety of different physical forms of tokens exist
• e.g. hand-held devices, Smart Cards, PCMCIA cards, USB
tokens

51
Official
 • Biometric
• Uses certain biological characteristics for
AUTHENTICATION authentication
• Biometric reader measures
physiological indicia and compares
them to specified values
• It is not capable of securing information
over the network
• Different techniques exist
• Fingerprint Recognition
• Voice Recognition
• Handwriting Recognition
• Face Recognition
• Retinal Scan
• Hand Geometry Recognition

52
Official
 AUTHENTICATION

• Iris Recognition

53
Official
 AUTHENTICATION

Digital Signatures

A digital signature is a data item which

accompanies or is logically associated
with a digitally encoded message.

A guarantee of the source

of the data
It has two goals Proof that the data has not
been tampered with

54
Official
 AUTHENTICATION

55
Official
 AUTHENTICATION
• Digital Certificate
• A digital certificate is a signed statement by a
trusted party that another party’s public key
belongs to them.
• This allows one certificate authority to be
authorized by a different authority (root CA)
• Top level certificate must be self signed
• Any one can start a certificate authority
• Name recognition is key to some one
recognizing a certificate authority
• Verisign is industry standard certificate
authority

56
Official
 AUTHENTICATION
Identify Information: Sender's Public Key: Signature Algorithm:
Details about the The entity's public key Algorithm used to
entity (e.g., name, included in the create the digital
domain). certificate. signature.

Certificate Authority's Certificate: The digital

Private Key: Used by document binding the
the CA to sign the entity's public key to
certificate. their identity.

57
Official
 AUTHENTICATION
• Certificate Chaining
• Chaining is the practice of signing a certificate with
another private key that has a certificate for its
public key
• Similar to the passport having the seal of the
government
• It is essentially a person’s public key & some
identifying information signed by an authority’s
private key verifying the person’s identity
• The authorities public key can be used to decipher
the certificate
• The trusted party is called the certificate authority

58
Official
 CRYPTANALYSIS
Practice of analyzing and breaking cryptography

Resistance to crypt analysis is

With each extra byte strength of key doubles
directly proportional to the key size

A lot of the encryption algorithms use

Cracking Pseudo Random Number
PRNGs to generate keys which can also be
Generators cracked leading to cracking of algorithms

Variety of methods for safe guarding Encryption & computer access protection
keys (Key Management) Smart Cards

59
Official
 AUTHENTICATION
Bob receives A message from Alice, wants to ensure:
• message originally came from Alice
• message not changed since sent by Alice
Cryptographic Hash:
• takes input m, produces fixed length value, H(m)
• e.g., as in Internet checksum
• computationally infeasible to find two different
messages, x, y such that H(x) = H(y)
• equivalently: given m = H(x), (x unknown), can
not determine x.
• note: Internet checksum fails this requirement!

60
Official
 AUTHENTICATION
Internet checksum: poor crypto hash function

Internet checksum has some properties of hash function:

produces fixed length digest (16-bit sum) of message

is many-to-one

But given message with given hash value, it is easy to find another message with
same hash value:

61
Official
 AUTHENTICATION
• Message Authentication Code
• A shared secret key (s) is used to create
a hash (H(m + s)) for the message.
• The recipient verifies the message by
recomputing the hash and comparing it
to the received hash.
• This ensures the message is authentic
and has not been tampered with.

62
Official
 AUTHENTICATION
MACs in practice

computes 128-bit MAC in 4-step

process.
MD5 hash function arbitrary 128-bit string x, appears

widely used (RFC 1321) difficult to construct msg m whose

MD5 hash is equal to x
•recent (2005) attacks on MD5

US standard [NIST, FIPS PUB 180-1]

SHA-1 is also used 160-bit MAC

63
Official
 Questions

Official