Network Security and Cryptography Assignment

Prepared by: Student Submission Version (Original Rewrite)

Question 1: Message Authentication, MACs, Hash
Functions and SHA
Message authentication is a security service that ensures a received message is genuine and has
not been altered.
The major requirements are message integrity, source authentication, protection against replay
attacks,
detection of modification, and resistance to forgery.

Message Authentication Codes (MACs):

A MAC is generated using a message and a shared secret key. The receiver computes the MAC
again and
compares the result. Matching values prove integrity and authenticity.

Hash Functions:
A hash function converts data of arbitrary length into a fixed-size digest. Important properties
include:
1. Deterministic output
2. One-way property
3. Collision resistance
4. Avalanche effect
5. Fixed-length output

SHA Family:
SHA-224, SHA-256, SHA-384 and SHA-512 are widely used secure hash algorithms. SHA-256 is
commonly
used in digital signatures, certificates, blockchains and secure communication protocols.

Difference:
• Hash → Integrity only
• MAC → Integrity + Authentication
• HMAC-SHA256 → Strong practical solution combining both concepts

Answer:
Two users cannot achieve secure authentication using only a hash function because anyone can
generate
the same hash for a modified message. A secret key or digital signature is required.
Question 2: Digital Signatures and DSS
Digital signatures provide authentication, integrity and non-repudiation using public-key
cryptography.

Signature Generation:
1. Create a message digest.
2. Encrypt the digest using the sender's private key.
3. Attach the resulting signature to the message.

Verification:
1. Compute a fresh digest from the received message.
2. Decrypt the signature using the sender's public key.
3. Compare both digests.

If both values match:

• Sender is authenticated.
• Message integrity is preserved.
• Non-repudiation is achieved.

Digital Signature Standard (DSS):

DSS is a NIST standard that specifies DSA for digital signatures and SHA for hashing.

Advantages:
• Strong proof of origin
• Protection against tampering
• Legal validity in many electronic transactions

Answer:
If Alice denies sending a message, the receiver can present the signed message, digital signature,
and Alice's certified public key. Successful verification proves the signature originated from her
private key.
Question 3: Password, Biometric and
Challenge-Response Authentication
Authentication methods can be categorized as:
• Something you know (Password)
• Something you have (Token/Card)
• Something you are (Biometrics)

Password Authentication:
Simple and inexpensive but vulnerable to phishing, dictionary attacks and brute force attacks.

Biometric Authentication:
Uses fingerprints, iris scans, face recognition, voice recognition and behavioural patterns.
Advantages include convenience and uniqueness.

Challenge-Response Authentication:
The server sends a random challenge. The user computes a response using a secret value.
Since the secret is never transmitted, replay attacks become difficult.

Comparison:

Passwords
Advantages: Easy, cheap, familiar.
Limitations: Can be guessed or stolen.

Biometrics
Advantages: Convenient, unique.
Limitations: Privacy concerns and cannot easily be changed.

Challenge-Response
Advantages: Strong protection against replay attacks.
Limitations: More complex implementation.

Answer:
For banking systems, Multi-Factor Authentication (MFA) combining passwords, biometrics and
challenge-response
mechanisms provides the highest level of security.
Question 4: Kerberos and X.509 Certificates
Kerberos is a trusted third-party authentication protocol based on secret-key cryptography.

KERBEROS ARCHITECTURE

Client --> Authentication Server (AS)

Client <-- Ticket Granting Ticket (TGT)

Client --> Ticket Granting Server (TGS)

Client <-- Service Ticket

Client --> Service Server

Client <-- Access Granted

Components:
1. Client
2. Authentication Server (AS)
3. Ticket Granting Server (TGS)
4. Service Server
5. Key Distribution Center (KDC)

Advantages:
• Single Sign-On
• Mutual Authentication
• Passwords are not transmitted

Limitations:
• KDC is a critical component
• Time synchronization required

X.509 Certificates:
X.509 certificates bind identities to public keys using Public Key Infrastructure (PKI).

Certificate Structure:
• Version
• Serial Number
• Issuer Name
• Subject Name
• Public Key
• Validity Period
• Extensions
• Digital Signature

Validation Process:
1. Verify CA signature.
2. Check validity period.
3. Verify trust chain.
4. Check revocation status.
5. Confirm subject identity.

Answer:
Organizations still require X.509 certificates because they enable secure communication with
external users,
web browsers, cloud services and internet-based applications.
+--------------------+
| KDC |
| +----+ +------+ |
| | AS | | TGS | |
| +----+ +------+ |
+--------------------+
^
|
Client
|
v
Service Server
Question 5: PGP, S/MIME, IPsec and Web Security
PGP (Pretty Good Privacy)
PGP combines symmetric encryption, public-key encryption and digital signatures.
It follows a decentralized Web of Trust model.

S/MIME
S/MIME relies on X.509 certificates and Certificate Authorities.
It is widely used in enterprise environments.

Comparison:

PGP:
• Web of Trust
• Individual users
• Decentralized

S/MIME:
• Certificate Authorities
• Organizations
• Centralized management

IPsec Architecture:
IPsec secures communication at the network layer.

Main Components:
1. Security Association (SA)
2. Authentication Header (AH)
3. Encapsulating Security Payload (ESP)
4. Internet Key Exchange (IKE)

AH:
Provides authentication, integrity and anti-replay protection.

ESP:
Provides confidentiality, integrity, authentication and anti-replay protection.

Transport Mode:
IP Header | ESP/AH | Data

Tunnel Mode:
New IP Header | ESP/AH | Original IP Header | Data

Major Web Security Mechanisms:

• SSL/TLS
• HTTPS
• Digital Certificates
• Multi-Factor Authentication
• Secure Session Management
• Firewalls and WAFs
• Secure Cookies
• Content Security Policies

Case Study:
Email Security -> S/MIME
Internal Web Portals -> HTTPS + TLS
Branch Office Communication -> IPsec Tunnel Mode VPN
Security Threats and Attacks
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
Importance of Authentication
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
Applications of Digital Signatures
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
Benefits of IPsec VPNs
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.
This section is included to enrich the assignment. This section is included to enrich the assignment.