Unit 1: Security Trends, Legal, Ethical and Professional Aspects of Security

What is Information Security?

Information Security (InfoSec) is the practice of protecting information from unauthorized

access, modification, disclosure, destruction, or disruption.

Main Goals of Security (CIA Triad)

1. Confidentiality

o Information should be accessible only to authorized users.

o Example: Password-protected files.

2. Integrity

o Data should not be modified without authorization.

o Example: Bank transaction records.

3. Availability

o Information should be available when needed.

o Example: Online banking services available 24×7.

Security Trends

Modern security trends include:

 Cloud Security

 Artificial Intelligence in Security

 Zero Trust Architecture

 Multi-Factor Authentication (MFA)

 Internet of Things (IoT) Security

 Blockchain Security

 Cyber Threat Intelligence

Common Cyber Threats

 Malware

 Ransomware

 Phishing

1
  DDoS Attacks

 Insider Threats

Legal Aspects of Security

Legal aspects refer to laws governing cybersecurity.

Objectives

 Protect user privacy

 Prevent cyber crimes

 Define punishments for attackers

Examples

In India:

 Information Technology (IT) Act, 2000

 Digital Signature Laws

 Data Protection Regulations

Ethical Aspects of Security

Ethics means following moral principles while using computer systems.

Ethical Behavior

✔ Respect privacy

✔ Do not steal data

✔ Do not spread malware

✔ Use licensed software

Unethical Behavior

✘ Hacking without permission

✘ Data theft

✘ Software piracy

✘ Identity theft

2
Professional Aspects of Security

Security professionals should:

 Maintain confidentiality

 Follow company policies

 Be honest and responsible

 Protect organizational resources

 Follow legal requirements

Need for Security at Multiple Levels

Security should be applied at different layers.

1. Physical Security

Protects hardware.

Examples:

 CCTV

 Security guards

 Biometric access

2. Network Security

Protects network communication.

Examples:

 Firewall

 VPN

 IDS

3. Application Security

Protects software applications.

Examples:

 Authentication

 Secure coding

3
4. Data Security

Protects stored information.

Examples:

 Encryption

 Backup

5. User Security

Protects users through awareness.

Examples:

 Strong passwords

 Cybersecurity training

Security Policies

A security policy is a set of rules defining how resources should be protected.

Objectives

 Protect information assets

 Define user responsibilities

 Reduce security risks

Components

1. Purpose

2. Scope

3. Roles and Responsibilities

4. Access Control Rules

5. Incident Response Procedure

Types

 Organizational Security Policy

 Issue-Specific Security Policy

 System-Specific Security Policy

4
Model of Network Security

A network security model explains secure communication between sender and receiver.

Components

1. Sender

2. Message

3. Encryption Algorithm

4. Secret Key

5. Network

6. Decryption Algorithm

7. Receiver

Working

 Sender encrypts data.

 Encrypted data travels through network.

 Receiver decrypts data using key.

Benefits

 Confidentiality

 Integrity

 Authentication

Security Attacks, Services and Mechanisms

Security Attack

Any action that compromises security.

Types of Attacks

1. Passive Attack

Only monitors information.

Examples:

 Eavesdropping

 Traffic Analysis

5
Characteristics

 Difficult to detect

 No modification of data

2. Active Attack

Modifies information or disrupts services.

Examples:

 Masquerade

 Replay Attack

 Modification Attack

 Denial of Service (DoS)

Characteristics

 Easier to detect

 Difficult to prevent

Security Services

Security services protect information systems.

Types

1. Authentication

Verifies identity.

2. Access Control

Prevents unauthorized access.

3. Data Confidentiality

Keeps information secret.

4. Data Integrity

Protects data from modification.

5. Non-Repudiation

Sender cannot deny sending a message.

6
Security Mechanisms

Mechanisms implement security services.

Examples:

 Encryption

 Digital Signature

 Access Control

 Authentication Exchange

 Traffic Padding

OSI Security Architecture

OSI Security Architecture was developed by the International Telecommunication Union

(ITU-T).

It provides a framework for security attacks, services, and mechanisms.

Components

Security Attacks

Threats against information systems.

Security Services

Protection functions.

Security Mechanisms

Methods used to provide services.

Importance

 Standardized security framework

 Easy understanding of network security

Classical Encryption Techniques

Encryption converts plaintext into ciphertext.

7
1. Substitution Techniques

Characters are replaced with other characters.

Caesar Cipher

Each letter is shifted by a fixed number.

Example:

Plaintext:

HELLO

Shift = 3

Ciphertext:

KHOOR

Formula

𝐶 = (𝑃 + 𝐾) 𝑚𝑜𝑑 26

Where:

 C = Ciphertext

 P = Plaintext

 K = Key

Advantages

 Easy to implement

Disadvantages

 Easily broken

Monoalphabetic Cipher

One substitution alphabet is used throughout the message.

Example:

A→D
B→E
C→F

2. Transposition Techniques
8
Characters remain unchanged but positions change.

Rail Fence Cipher

Message:

HELLO

Arrange in zig-zag pattern.

Ciphertext:

HLOEL

Advantages

 Simple

Disadvantages

 Weak against modern attacks

Steganography

Steganography hides information inside another medium.

Examples:

 Images

 Audio files

 Videos

Difference Between Encryption and Steganography

Encryption Steganography

Hides content Hides existence

Visible ciphertext Hidden message

Easier to detect Harder to detect

Applications

 Secret communication

 Digital watermarking

9
Foundations of Modern Cryptography

Modern cryptography uses mathematics and algorithms.

Objectives:

 Confidentiality

 Integrity

 Authentication

 Non-repudiation

Perfect Security

A cryptosystem is perfectly secure if ciphertext reveals no information about plaintext.

Example

The One-Time Pad provides perfect security.

Conditions

1. Key is truly random.

2. Key length equals message length.

3. Key used only once.

Information Theory

Information Theory was introduced by Claude Shannon.

It studies:

 Information measurement

 Data transmission

 Communication efficiency

Importance

 Basis of modern cryptography

 Measures uncertainty and entropy

Product Cryptosystem

10
A product cryptosystem combines multiple encryption techniques.

Example:

Substitution + Transposition

Advantages

 More secure

 Harder to break

Example

Modern algorithms like AES use multiple rounds of substitution and permutation.

Cryptanalysis

Cryptanalysis is the study of breaking cryptographic systems.

Objectives

 Recover plaintext

 Find secret key

 Analyze weaknesses

Types

1. Ciphertext-Only Attack

Only ciphertext available.

2. Known Plaintext Attack

Some plaintext-ciphertext pairs known.

3. Chosen Plaintext Attack

Attacker chooses plaintext.

4. Chosen Ciphertext Attack

Attacker chooses ciphertext.

Important 10 Marks Questions with Answers

Q1. Explain Security Attacks, Security Services and Security Mechanisms with suitable
examples.

Answer

11
The OSI Security Architecture classifies security into three categories: Security Attacks,
Security Services, and Security Mechanisms.

1. Security Attacks

A security attack is any action that compromises the security of information.

Types of Security Attacks

A. Passive Attacks

The attacker only monitors data and does not modify it.

Examples:

 Eavesdropping

 Traffic Analysis

Characteristics:

 Difficult to detect

 No alteration of data

B. Active Attacks

The attacker modifies data or disrupts communication.

Examples:

 Replay Attack

 Masquerade Attack

 Denial of Service (DoS)

Characteristics:

 Easier to detect

 Harder to prevent

2. Security Services

Security services protect information systems.

Types:

 Authentication

 Access Control

12
  Confidentiality

 Integrity

 Non-Repudiation

3. Security Mechanisms

Mechanisms are techniques used to implement security services.

Examples:

 Encryption

 Digital Signature

 Authentication Exchange

 Access Control

Conclusion

Security attacks threaten systems, security services provide protection, and security
mechanisms implement those protections.

Q2. Explain the OSI Security Architecture in detail.

Answer

The OSI Security Architecture was developed by the International Telecommunication

Union to provide a standard framework for network security.

Objectives

 Identify security attacks

 Define security services

 Define security mechanisms

Components

1. Security Attacks

Actions that compromise information security.

Examples:

 Passive attacks
13
  Active attacks

2. Security Services

Functions that provide protection.

Examples:

 Authentication

 Confidentiality

 Integrity

 Access Control

 Non-Repudiation

3. Security Mechanisms

Methods used to provide security services.

Examples:

 Encryption

 Digital Signatures

 Access Control Mechanisms

Advantages

 Standardized framework

 Better understanding of threats

 Helps design secure networks

Conclusion

OSI Security Architecture provides a complete framework for understanding and

implementing network security.

Q3. Explain Classical Encryption Techniques: Substitution and Transposition Techniques.

Answer

14
Classical encryption techniques are traditional methods used to secure information.

1. Substitution Technique

In substitution ciphers, characters are replaced by other characters.

Caesar Cipher

Each letter is shifted by a fixed number.

Example:

Plaintext:

HELLO

Shift = 3

Ciphertext:

KHOOR

Formula:

𝐶 = (𝑃 + 𝐾) 𝑚𝑜𝑑 26

Advantages

 Easy to implement

Disadvantages

 Easily cracked

2. Transposition Technique

Characters remain unchanged, but their positions are rearranged.

Rail Fence Cipher

Plaintext:

HELLO

Ciphertext:

HLOEL

Advantages

 Simple implementation

15
Disadvantages

 Low security

Difference Between Substitution and Transposition

Substitution Transposition

Changes characters Changes positions

Meaning hidden by replacement Meaning hidden by rearrangement

Example: Caesar Cipher Example: Rail Fence Cipher

Conclusion

Classical ciphers form the foundation of modern cryptography.

Q4. Explain Security Policies and the Need for Security at Multiple Levels.

Answer

Security Policy

A security policy is a formal document containing rules and procedures for protecting
information resources.

Objectives

 Protect information assets

 Reduce risks

 Define responsibilities

Components

1. Purpose

2. Scope

3. User Responsibilities

4. Access Control Rules

5. Incident Response Plan

Need for Security at Multiple Levels

16
Security must be implemented at various levels.

Physical Security

Protects hardware.

Examples:

 CCTV

 Security Guards

Network Security

Protects communication networks.

Examples:

 Firewalls

 VPN

Application Security

Protects software applications.

Examples:

 Authentication

 Secure Coding

Data Security

Protects stored information.

Examples:

 Encryption

 Backup

User Security

Protects through awareness and training.

Examples:

 Strong Passwords

 Cybersecurity Education

Conclusion

Multiple layers of security provide stronger protection against cyber threats.

17
Q5. Explain the Model of Network Security with a neat diagram.

Answer

The Network Security Model describes secure communication between a sender and
receiver.

Diagram

Sender
|
Plaintext
|
Encryption Algorithm
|
Ciphertext
|
Network
|
Ciphertext
|
Decryption Algorithm
|
Plaintext
|
Receiver

Components

Sender

Originates the message.

Encryption Algorithm

Converts plaintext into ciphertext.

Secret Key

Used during encryption and decryption.

Network

Communication medium.

18
Decryption Algorithm

Converts ciphertext back to plaintext.

Receiver

Receives the original message.

Advantages

 Ensures confidentiality

 Maintains integrity

 Supports authentication

Conclusion

The model forms the basis of secure communication systems.

Q6. Explain Perfect Security, Information Theory and Product Cryptosystem.

Answer

Perfect Security

A cryptosystem is perfectly secure when ciphertext reveals no information about plaintext.

Example

One-Time Pad

Conditions:

1. Random key

2. Key length equals message length

3. Key used only once

Information Theory

Introduced by Claude Shannon.

It deals with:

 Information measurement

 Data transmission

19
  Entropy

 Communication systems

Importance

 Foundation of modern cryptography

 Measures uncertainty in information

Product Cryptosystem

A product cryptosystem combines multiple encryption techniques.

Example:

Substitution + Transposition

Advantages

 Stronger security

 Harder to break

Example

AES uses repeated substitution and permutation operations.

Conclusion

Perfect security, information theory, and product cryptosystems form the theoretical basis of
modern cryptography.

Q7. Explain Cryptanalysis and its various types.

Answer

Cryptanalysis is the science of breaking cryptographic systems without knowing the secret
key.

Objectives

 Recover plaintext

 Find secret key

 Discover weaknesses

Types of Cryptanalysis
20
1. Ciphertext-Only Attack (COA)

Only ciphertext is available.

Goal:

 Determine plaintext or key.

2. Known Plaintext Attack (KPA)

Attacker knows some plaintext-ciphertext pairs.

Goal:

 Determine encryption key.

3. Chosen Plaintext Attack (CPA)

Attacker chooses plaintext and obtains ciphertext.

Goal:

 Analyze encryption algorithm.

4. Chosen Ciphertext Attack (CCA)

Attacker chooses ciphertext and obtains corresponding plaintext.

Goal:

 Recover secret key.

Importance

 Evaluates cryptographic strength

 Helps design secure algorithms

Conclusion

Cryptanalysis is essential for testing and improving encryption systems.

Q8. Discuss Legal, Ethical and Professional Aspects of Security.

Answer

21
Legal Aspects

Legal aspects involve laws related to cybersecurity.

Examples:

 Information Technology Act, 2000

 Data Protection Laws

Purpose:

 Prevent cyber crimes

 Protect privacy

Ethical Aspects

Ethics refers to moral principles in computing.

Ethical Activities:

 Respect privacy

 Use authorized access

 Protect information

Unethical Activities:

 Hacking

 Piracy

 Data Theft

Professional Aspects

Security professionals should:

 Maintain confidentiality

 Follow policies

 Protect organizational assets

 Comply with laws

Importance

22
  Reduces cyber crime

 Protects user rights

 Promotes responsible computing

Conclusion

Legal, ethical, and professional practices are essential for maintaining a secure digital
environment.

Important 5 Marks Questions with Answers

Q1. Explain CIA Triad.

Answer:
The CIA Triad consists of:

1. Confidentiality – Prevents unauthorized access.

2. Integrity – Prevents unauthorized modification.

3. Availability – Ensures resources are accessible when needed.

These three principles form the foundation of information security.

Q2. Explain passive and active attacks.

Answer:

Passive Attack

 Monitors communication.

 No data modification.

 Examples: Eavesdropping, Traffic Analysis.

Active Attack

 Alters data or disrupts services.

 Examples: Replay Attack, DoS Attack.

Passive Active

Monitoring only Modification possible

23
Passive Active

Hard to detect Easier to detect

No data change Data change occurs

Q3. Explain OSI Security Architecture.

Answer:
OSI Security Architecture provides a framework for understanding security in
communication systems.

It consists of:

1. Security Attacks

2. Security Services

3. Security Mechanisms

Its purpose is to provide standardized security solutions for networks.

Q4. Explain substitution and transposition techniques.

Answer:

Substitution Technique

 Characters replaced by other characters.

 Example: Caesar Cipher.

Transposition Technique

 Characters remain unchanged.

 Their positions are rearranged.

 Example: Rail Fence Cipher.

Both are classical encryption methods used in cryptography.

Q5. Explain perfect security and One-Time Pad.

Answer:
Perfect security means ciphertext gives no information about plaintext.

24
One-Time Pad achieves perfect secrecy because:

 Key is random.

 Key length equals message length.

 Key is used only once.

Therefore, it is theoretically unbreakable.

Q6. Explain cryptanalysis and its types.

Answer:
Cryptanalysis is the study of breaking encryption systems.

Types:

1. Ciphertext-Only Attack

2. Known Plaintext Attack

3. Chosen Plaintext Attack

4. Chosen Ciphertext Attack

Its objective is to recover plaintext or secret keys.

Q7. Explain the model of network security.

Answer:
The network security model includes:

 Sender

 Encryption

 Secret Key

 Network Channel

 Decryption

 Receiver

The sender encrypts the message before transmission, and the receiver decrypts it using the
appropriate key. This ensures confidentiality and integrity.

UNIT:2 Symmetric Key Cryptography

25
What is Symmetric Key Cryptography?

Symmetric Key Cryptography is a method where the same key is used for both encryption
and decryption.

Working

Plaintext
↓
Encryption + Secret Key
↓
Ciphertext
↓
Decryption + Same Secret Key
↓
Plaintext

Examples

 DES

 3DES

 AES

 RC4

 S-DES

Advantages

 Fast

 Efficient for large data

 Easy implementation

Disadvantages

 Key distribution problem

 Less scalable

MATHEMATICS OF SYMMETRIC KEY CRYPTOGRAPHY

Mathematics forms the foundation of cryptography.

1. Algebraic Structures

26
An algebraic structure is a set of elements with one or more operations.

Examples:

 Integers

 Real Numbers

 Binary Numbers

Used in:

 Encryption

 Decryption

 Key Generation

2. Modular Arithmetic

Modular arithmetic is arithmetic based on remainders.

Formula

𝑎 𝑚𝑜𝑑 𝑛

Example

17 mod 5 = 2

Because:

17 = 5 × 3 + 2

Remainder = 2

Applications

 RSA

 DES

 AES

3. Euclid's Algorithm

Used to find the Greatest Common Divisor (GCD).

Example

Find GCD(48,18)

27
48 = 18×2 + 12
18 = 12×1 + 6
12 = 6×2 + 0

GCD = 6

Importance

 Key generation

 Modular inverse calculation

4. Congruence

Two numbers are congruent if they leave the same remainder when divided by a number.

Formula

𝑎 ≡ 𝑏(mod𝑛)

Example

17 ≡ 5 (mod 12)

Because both leave remainder 5.

5. Matrices in Cryptography

A matrix is a rectangular arrangement of numbers.

Example:

|1 2|
|3 4|

Used in:

 Hill Cipher

 AES transformations

Advantages:

 Faster encryption

 Multiple character processing

GROUPS, RINGS AND FIELDS

28
Group

A set with one operation satisfying:

1. Closure

2. Associativity

3. Identity Element

4. Inverse Element

Example:

Integers under addition.

Ring

A ring has two operations:

 Addition

 Multiplication

Properties:

 Addition forms a group.

 Multiplication is associative.

Example:

Integers (Z)

Field

A field is a ring where every non-zero element has a multiplicative inverse.

Examples:

 Rational Numbers

 Finite Fields

Importance

AES uses finite fields extensively.

29
Finite Fields

Finite field contains a finite number of elements.

Notation:

GF(n)

GF = Galois Field

Example:

GF(2)

Elements:

{0,1}

Applications

 AES

 Error Correction

 Cryptography

SYMMETRIC KEY CIPHERS

Simplified DES (S-DES)

S-DES is a simplified version of DES used for learning purposes.

Characteristics

 10-bit key

 8-bit plaintext

 Two rounds

Components

 Initial Permutation

 Expansion Permutation

 S-Boxes

 P4 Permutation

Advantages

30
  Easy to understand

Disadvantages

 Not secure for real applications

DES (Data Encryption Standard)

DES is a symmetric block cipher.

Developed by:
IBM and adopted by National Institute of Standards and Technology.

Features

 Block size = 64 bits

 Key size = 56 bits

 16 rounds

DES Structure

Plaintext
↓
Initial Permutation
↓
16 Feistel Rounds
↓
Final Permutation
↓
Ciphertext

Strength of DES

Advantages

 Strong for its time

 Well-tested algorithm

 Efficient hardware implementation

Weaknesses

31
  Small key size (56 bits)

 Vulnerable to brute-force attacks

Differential Cryptanalysis

A chosen plaintext attack.

Idea

Studies how differences in plaintext affect ciphertext.

Steps

1. Choose plaintext pairs.

2. Encrypt them.

3. Analyze output differences.

4. Recover key information.

Used Against

 DES

 Block ciphers

Linear Cryptanalysis

A known plaintext attack.

Idea

Uses linear approximations between:

 Plaintext

 Ciphertext

 Key bits

Objective

Recover secret key.

Advantage

More practical than differential cryptanalysis in some cases.

32
Block Cipher Design Principles

A secure block cipher should provide:

1. Confusion

Makes relationship between key and ciphertext complex.

Introduced by:
Claude Shannon

Example:

 Substitution

2. Diffusion

Spreads influence of each plaintext bit.

Example:

 Permutation

Design Goals

 Resistance to attacks

 Strong key dependency

 Efficient implementation

Block Cipher Modes of Operation

Modes allow encryption of large messages.

1. ECB (Electronic Code Book)

Each block encrypted independently.

P1 → C1
P2 → C2
P3 → C3

Advantage

Simple

33
Disadvantage

Pattern leakage

2. CBC (Cipher Block Chaining)

Each plaintext block depends on previous ciphertext.

P1 XOR IV → Encrypt
P2 XOR C1 → Encrypt

Advantage

Better security

3. CFB (Cipher Feedback)

Converts block cipher into stream cipher.

Applications:

 Network communication

4. OFB (Output Feedback)

Uses previous output instead of ciphertext.

Advantages:

 Error propagation reduced

5. CTR (Counter Mode)

Uses counter values.

Advantages:

 Fast

 Parallel processing

Evaluation Criteria for AES

While selecting AES, NIST considered:

34
 1. Security

2. Performance

3. Flexibility

4. Simplicity

5. Efficiency

AES (Advanced Encryption Standard)

AES is the most widely used symmetric encryption algorithm.

Selected by:
National Institute of Standards and Technology

Features

Property Value

Block Size 128 bits

Key Size 128,192,256 bits

Rounds 10,12,14

AES Structure

Steps:

1. SubBytes

2. ShiftRows

3. MixColumns

4. AddRoundKey

Advantages

 Very secure

 Fast

 Resistant to known attacks

35
RC4

RC4 is a stream cipher developed by Ron Rivest.

Features

 Variable key length

 Stream cipher

 Fast implementation

Advantages

 Simple

 Fast

Disadvantages

 Security weaknesses

 No longer recommended

Key Distribution

Key distribution is the process of securely sharing secret keys.

Challenges

 Key must remain secret.

 Secure communication required.

Methods

1. Physical Delivery

Key delivered manually.

2. Trusted Third Party

A trusted authority distributes keys.

3. Key Distribution Center (KDC)

Centralized key management.

4. Public-Key Assisted Distribution

36
Public key cryptography used to exchange symmetric keys.

Important 10 Marks Questions with Answers

Q1. Explain DES architecture, working and strength of DES.

Answer:

 DES is a symmetric block cipher.

 Block size = 64 bits.

 Key size = 56 bits.

 Uses 16 Feistel rounds.

 Includes Initial and Final Permutations.

Strengths:

 Proven design

 Strong confusion and diffusion

Weaknesses:

 Small key size

 Vulnerable to brute-force attacks

Conclusion: DES was important historically but has largely been replaced by AES.

Q2. Explain AES in detail with architecture and advantages.

Answer:
AES is the current encryption standard.

Features:

 128-bit block size

 Key sizes: 128, 192, 256 bits

 10, 12, or 14 rounds

Operations:

1. SubBytes

2. ShiftRows

37
 3. MixColumns

4. AddRoundKey

Advantages:

 High security

 Fast software and hardware implementation

 Resistant to known practical attacks

Q3. Explain Block Cipher Modes of Operation.

Answer:
Modes:

1. ECB

2. CBC

3. CFB

4. OFB

5. CTR

Explain each mode, its working, advantages, and disadvantages. CBC and CTR are commonly
used because they provide better security than ECB.

Q4. Explain Mathematics of Symmetric Key Cryptography.

Answer:
The mathematical foundations include:

 Algebraic Structures

 Modular Arithmetic

 Euclid's Algorithm

 Congruence

 Matrices

 Groups

 Rings

 Fields

38
  Finite Fields

These concepts are used in DES, AES, RC4, and modern cryptographic algorithms.

Q5. Explain Key Distribution and various methods of key distribution.

Answer:
Key distribution is the secure sharing of secret keys.

Methods:

1. Physical Delivery

2. Trusted Third Party

3. Key Distribution Center (KDC)

4. Public-Key Assisted Key Exchange

A secure key distribution method is essential because the security of symmetric

cryptography depends on keeping the secret key confidential.

Important 5 Marks Questions with Answers

Q1. Explain Modular Arithmetic with examples.

Answer:
Modular arithmetic is arithmetic based on remainders.

Example:

17 mod 5 = 2
22 mod 7 = 1

Applications:

 DES

 AES

 RSA

It is fundamental to modern cryptography.

Q2. Explain Groups, Rings and Fields.

Answer:

39
Group: Set with one operation satisfying closure, associativity, identity, and inverse.

Ring: Set with addition and multiplication operations.

Field: Ring in which every non-zero element has a multiplicative inverse.

Fields are important in AES and finite field arithmetic.

Q3. Explain DES and its structure.

Answer:
DES is a symmetric block cipher.

Features:

 64-bit block

 56-bit key

 16 rounds

Structure:

1. Initial Permutation

2. Feistel Rounds

3. Final Permutation

It was widely used before AES.

Q4. Explain Differential and Linear Cryptanalysis.

Answer:

Differential Cryptanalysis

 Chosen plaintext attack.

 Studies plaintext and ciphertext differences.

Linear Cryptanalysis

 Known plaintext attack.

 Uses linear relationships.

Both are used to analyze block cipher security.

40
Q5. Explain AES and its advantages.

Answer:
AES is a modern encryption standard.

Features:

 128-bit block size

 128/192/256-bit keys

 Multiple rounds

Advantages:

 High security

 Fast execution

 Worldwide acceptance

UNIT:3 Public Key Cryptography

What is Public Key Cryptography?

Public Key Cryptography (Asymmetric Cryptography) is a cryptographic system that uses two
different keys:

1. Public Key → Used for Encryption

2. Private Key → Used for Decryption

Working

Sender
↓
Encrypt using Receiver's Public Key
↓
Ciphertext
↓
Receiver
↓
Decrypt using Private Key
↓
Plaintext

Advantages

41
  Solves key distribution problem

 Supports digital signatures

 Better authentication

Disadvantages

 Slower than symmetric encryption

 Requires more computation

Examples

 RSA

 Diffie-Hellman

 ElGamal

 ECC (Elliptic Curve Cryptography)

MATHEMATICS OF ASYMMETRIC KEY CRYPTOGRAPHY

Public key cryptography is based on mathematical concepts.

1. Prime Numbers

A prime number is a number greater than 1 that has only two factors:

 1

 Itself

Examples

2, 3, 5, 7, 11, 13, 17

Non-prime Numbers

4, 6, 8, 9, 10

Importance

Prime numbers are used in:

 RSA

 Diffie-Hellman

 ElGamal

42
2. Primality Testing

Primality testing determines whether a number is prime.

Methods

1. Trial Division

2. Fermat Test

3. Miller-Rabin Test

Example

Check 17:

Factors:

1 and 17

Therefore, 17 is prime.

Applications

 RSA key generation

 Cryptographic protocols

3. Factorization

Factorization means expressing a number as a product of prime numbers.

Example

15 = 3 × 5
21 = 3 × 7
35 = 5 × 7

Importance

RSA security depends on the difficulty of factorizing very large numbers.

4. Euler's Totient Function

Euler's Totient Function counts the positive integers less than n that are relatively prime to n.

Notation:

φ(n)
43
Formula for Prime Number

𝜑(𝑝) = 𝑝 − 1

Example

For p = 11

φ(11)=10

Formula for Two Prime Numbers

𝜑(𝑝𝑞) = (𝑝 − 1)(𝑞 − 1)

Example:

p=3,q=11

φ(33)=20

Application

Used in RSA.

5. Fermat's Theorem

If p is prime and a is not divisible by p:

𝑎𝑝−1 ≡ 1(mod𝑝)

Example

2^10 mod 11 = 1

Uses

 RSA

 Primality Testing

6. Euler's Theorem

Generalization of Fermat's theorem.

If gcd(a,n)=1:

𝑎𝜑(𝑛) ≡ 1(mod𝑛)

Uses

44
  RSA encryption

 Key generation

7. Chinese Remainder Theorem (CRT)

CRT helps solve simultaneous congruence equations.

Example

Find x:

x ≡ 2 mod 3
x ≡ 3 mod 5

Solution:

x=8

Advantages

 Faster computations

 Used in RSA optimization

8. Exponentiation and Logarithm

Exponentiation

Repeated multiplication.

Example:

2^5 = 32

Modular Exponentiation

2^10 mod 7

Used heavily in:

 RSA

 Diffie-Hellman

 ElGamal

Logarithm

45
Inverse operation of exponentiation.

Example:

2^3=8

Therefore:

log₂8=3

Importance

Difficulty of discrete logarithm provides security for:

 Diffie-Hellman

 ElGamal

 ECC

ASYMMETRIC KEY CIPHERS

RSA Cryptosystem

RSA is the most widely used public key cryptosystem.

Developed by:

 Ron Rivest

 Adi Shamir

 Leonard Adleman

RSA Key Generation

Step 1

Choose two primes:

p=3
q=11

Step 2

Calculate:

n=p×q=33

46
Step 3

Calculate:

φ(n)=20

Step 4

Choose:

e=3

Step 5

Calculate:

d=7

RSA Encryption

𝐶 = 𝑀𝑒 𝑚𝑜𝑑 𝑛

RSA Decryption

𝑀 = 𝐶 𝑑 𝑚𝑜𝑑 𝑛

Advantages

 High security

 Digital signatures

 Secure key exchange

Disadvantages

 Slow

 Large key sizes

Key Distribution

Key distribution is the process of securely sharing keys.

Methods

47
 1. Manual Distribution

2. Trusted Third Party

3. Public Key Infrastructure (PKI)

Importance

Ensures secure communication.

Key Management

Key management includes:

 Key generation

 Storage

 Distribution

 Revocation

 Destruction

Objectives

 Protect keys

 Maintain confidentiality

 Prevent unauthorized access

Diffie-Hellman Key Exchange

Diffie-Hellman allows two users to establish a shared secret key.

Developed by:

 Whitfield Diffie

 Martin Hellman

Working

1. Public values chosen.

2. Users generate private values.

3. Exchange public values.

48
 4. Compute same secret key independently.

Advantages

 Secure key exchange

 No prior shared secret needed

ElGamal Cryptosystem

ElGamal is based on the discrete logarithm problem.

Developed by:

Taher ElGamal

Features

 Public key encryption

 Digital signatures

Advantages

 High security

 Flexible

Disadvantages

 Larger ciphertext size

Elliptic Curve Arithmetic

Elliptic Curve Arithmetic uses points on an elliptic curve.

General equation:

𝑦 2 = 𝑥 3 + 𝑎𝑥 + 𝑏

Operations

1. Point Addition

2. Point Doubling

3. Scalar Multiplication

Importance

Foundation of ECC.

49
Elliptic Curve Cryptography (ECC)

Elliptic Curve Cryptography is a modern public key cryptosystem.

Based on:

Elliptic Curve Discrete Logarithm Problem

Advantages

 Smaller key sizes

 Faster computation

 Lower memory requirements

Comparison

Algorithm Typical Key Size

RSA 2048 bits

ECC 256 bits

ECC provides security similar to RSA with much smaller keys.

Important 5 Marks Questions with Answers

Q1. Explain Euler's Totient Function with example.

Answer

Euler's Totient Function φ(n) counts positive integers less than n that are relatively prime to
n.

Formula for prime number:

𝜑(𝑝) = 𝑝 − 1

Example:

For p = 11

φ(11)=10
50
It is widely used in RSA key generation.

Q2. Explain Fermat's Theorem and Euler's Theorem.

Answer

Fermat's Theorem

For prime p:

𝑎𝑝−1 ≡ 1(mod𝑝)

Euler's Theorem

If gcd(a,n)=1:

𝑎𝜑(𝑛) ≡ 1(mod𝑛)

Applications:

 RSA

 Primality Testing

 Cryptography

Q3. Explain Diffie-Hellman Key Exchange.

Answer

Diffie-Hellman allows two parties to generate a common secret key.

Steps:

1. Select public values.

2. Choose private keys.

3. Exchange public values.

4. Compute common secret key.

Advantages:

 Secure key exchange

 No need to transmit secret key

Q4. Explain ElGamal Cryptosystem.

51
Answer

ElGamal is based on the discrete logarithm problem.

Features:

 Public key encryption

 Digital signatures

Advantages:

 Strong security

Disadvantages:

 Larger ciphertext

Q5. Explain ECC and its advantages.

Answer

ECC is based on elliptic curves.

Equation:

𝑦 2 = 𝑥 3 + 𝑎𝑥 + 𝑏

Advantages:

 Small key size

 Fast execution

 High security

Important 10 Marks Questions with Answers

Q1. Explain RSA Cryptosystem with key generation, encryption and decryption.

Answer

RSA is a public key cryptosystem.

Key Generation

1. Choose primes p and q.

2. Compute n = p × q.

52
 3. Compute φ(n).

4. Choose e.

5. Compute d.

Encryption

𝐶 = 𝑀𝑒 𝑚𝑜𝑑 𝑛

Decryption

𝑀 = 𝐶 𝑑 𝑚𝑜𝑑 𝑛

Advantages

 Security

 Digital signatures

Disadvantages

 Computationally expensive

Q2. Explain the Mathematics of Asymmetric Key Cryptography.

Answer

The mathematical foundations include:

1. Prime Numbers

2. Primality Testing

3. Factorization

4. Euler's Totient Function

5. Fermat's Theorem

6. Euler's Theorem

7. Chinese Remainder Theorem

8. Exponentiation

9. Logarithm

These concepts form the basis of RSA, Diffie-Hellman, ElGamal, and ECC.

Q3. Explain Diffie-Hellman Key Exchange in detail.

53
Answer

Diffie-Hellman is used to establish a shared secret key.

Steps:

1. Public values selected.

2. Users select private keys.

3. Public values exchanged.

4. Shared secret calculated.

Advantages:

 Secure key establishment

 No direct transmission of secret key

Disadvantages:

 Vulnerable to man-in-the-middle attack if not authenticated.

Q4. Explain Elliptic Curve Cryptography (ECC) and Elliptic Curve Arithmetic.

Answer

ECC is based on elliptic curves over finite fields.

Equation:

𝑦 2 = 𝑥 3 + 𝑎𝑥 + 𝑏

Arithmetic Operations:

1. Point Addition

2. Point Doubling

3. Scalar Multiplication

Advantages:

 Smaller keys

 Faster computation

 High security

ECC is widely used in mobile devices, banking, and secure communications.

54
Q5. Explain Key Distribution, Key Management and ElGamal Cryptosystem.

Answer

Key Distribution

Methods:

 Manual

 Trusted Third Party

 PKI

Key Management

Includes:

 Key generation

 Storage

 Revocation

ElGamal Cryptosystem

Based on discrete logarithms.

Advantages:

 Strong security

 Supports digital signatures

Disadvantages:

 Larger ciphertext

Together, these components ensure secure public-key cryptographic communication.

Unit: 4 MESSAGE AUTHENTICATION AND INTEGRITY

Introduction

In network communication, it is important to ensure that:

 The message comes from a legitimate sender.

 The message is not modified during transmission.

 The sender cannot deny sending the message.

These requirements are achieved through Message Authentication and Message Integrity.

55
Authentication Requirements

Authentication means verifying the identity of a user, device, or message.

Objectives

1. Data Origin Authentication

Ensures the message comes from the claimed sender.

2. Message Integrity

Ensures the message has not been modified.

3. Non-Repudiation

Sender cannot deny sending the message.

4. Protection Against Replay Attacks

Prevents attackers from reusing old messages.

Authentication Function

An authentication function verifies the authenticity and integrity of a message.

Methods

1. Message Encryption

2. Message Authentication Code (MAC)

3. Hash Function

4. Digital Signature

Message Authentication Code (MAC)

A MAC is a value generated using:

 Message

 Secret Key

Both sender and receiver know the secret key.

Working

Message + Secret Key

↓
MAC Algorithm
56
 ↓
MAC

Receiver calculates MAC again and compares it.

If both MACs match:

 Message is authentic.

 Message integrity is maintained.

Advantages

 Fast

 Efficient

 Provides authentication and integrity

Limitation

Does not provide non-repudiation.

Hash Function

A hash function converts a message of any size into a fixed-length value called a hash or
digest.

Properties

 Fixed-size output

 Fast computation

 One-way function

Example

Message
↓
Hash Function
↓
Hash Value (Digest)

Characteristics of Hash Functions

1. One-Way Property

Cannot recover original message from hash.

57
2. Deterministic

Same input always gives same output.

3. Fixed Length Output

Output size remains constant.

4. Avalanche Effect

Small change in input causes large output change.

Security of Hash Function

A secure hash function must satisfy:

Preimage Resistance

Given a hash value, finding the original message should be impossible.

Second Preimage Resistance

Finding another message with the same hash should be difficult.

Collision Resistance

Finding two different messages with the same hash should be computationally infeasible.

Security of MAC

A secure MAC should:

 Resist forgery.

 Resist key recovery attacks.

 Prevent message modification.

Security depends on:

 Secret key strength

 MAC algorithm strength

SHA (Secure Hash Algorithm)

SHA is a family of cryptographic hash functions developed by National Institute of Standards

and Technology.

58
SHA Family

Algorithm Output Size

SHA-1 160 bits

SHA-224 224 bits

SHA-256 256 bits

SHA-384 384 bits

SHA-512 512 bits

Advantages

 Strong security

 Fast processing

 Widely used

Applications

 Digital Signatures

 SSL/TLS

 Password Storage

 Blockchain

Digital Signature

A digital signature is an electronic equivalent of a handwritten signature.

It provides:

1. Authentication

2. Integrity

3. Non-Repudiation

59
Working

Sender

1. Calculate message hash.

2. Encrypt hash using private key.

3. Generate digital signature.

Receiver

1. Calculate message hash.

2. Decrypt signature using sender's public key.

3. Compare both hashes.

If both hashes match:

 Message is authentic.

 Integrity is maintained.

Advantages

 Authentication

 Integrity

 Non-repudiation

Authentication Protocols

Authentication protocols verify identity during communication.

Objectives

 Verify user identity

 Prevent impersonation

 Prevent replay attacks

Examples:

 Challenge Response Protocol

 Kerberos

 X.509

60
DSS (Digital Signature Standard)

Digital Signature Standard is a standard for digital signatures published by National Institute
of Standards and Technology.

Features

 Uses Digital Signature Algorithm (DSA)

 Provides authentication

 Provides integrity

 Supports non-repudiation

Applications

 Electronic Documents

 E-Governance

 Banking Systems

ENTITY AUTHENTICATION

Entity authentication verifies the identity of a user or system.

Biometrics Authentication

Authentication based on physical or behavioral characteristics.

Examples

 Fingerprint

 Iris Scan

 Face Recognition

 Voice Recognition

Advantages

61
  Difficult to forge

 Convenient

Disadvantages

 Expensive

 Privacy concerns

Password Authentication

Most common authentication method.

Types

1. Static Password

2. One-Time Password (OTP)

Good Password Characteristics

 Long length

 Combination of letters, numbers, symbols

 Difficult to guess

Challenge-Response Protocol

A protocol that verifies identity without transmitting passwords directly.

Working

1. Server sends challenge.

2. Client computes response using secret information.

3. Server verifies response.

Advantages

 Prevents replay attacks

 Password not transmitted

AUTHENTICATION APPLICATIONS

62
Kerberos

Kerberos is a trusted third-party authentication protocol.

Developed at:
Massachusetts Institute of Technology

Objectives

 Secure user authentication

 Single Sign-On (SSO)

 Prevent password transmission

Components

Authentication Server (AS)

Verifies users.

Ticket Granting Server (TGS)

Issues service tickets.

Client

User requesting service.

Service Server

Provides requested service.

Working

1. User logs in.

2. AS issues Ticket Granting Ticket (TGT).

3. User requests service ticket from TGS.

4. TGS provides service ticket.

5. User accesses service.

63
Advantages

 Strong authentication

 Single Sign-On

 Secure communication

X.509

X.509 is a standard for digital certificates.

Used in:

 SSL/TLS

 HTTPS

 PKI

Components of X.509 Certificate

1. Version Number

2. Serial Number

3. Subject Name

4. Issuer Name

5. Public Key

6. Validity Period

7. Digital Signature

Advantages

 Strong authentication

 Certificate-based security

 Widely accepted

Important 5 Marks Questions with Answers

64
Q1. Explain Message Authentication Code (MAC).

Answer

MAC is a cryptographic value generated using a message and a secret key.

Working:

1. Sender generates MAC using message and key.

2. Receiver generates MAC again.

3. Both MACs are compared.

Advantages:

 Provides authentication.

 Ensures integrity.

 Fast and efficient.

Limitation:

 Does not provide non-repudiation.

Q2. Explain Hash Functions and their security requirements.

Answer

A hash function converts a message into a fixed-size digest.

Security Requirements:

1. Preimage Resistance

2. Second Preimage Resistance

3. Collision Resistance

Properties:

 One-way

 Deterministic

 Fixed-length output

Applications:

 Digital signatures

 Password protection

65
Q3. Explain Digital Signature and its working.

Answer

A digital signature provides authentication, integrity, and non-repudiation.

Working:

1. Hash the message.

2. Encrypt hash using sender's private key.

3. Receiver decrypts using sender's public key.

4. Compare hashes.

If hashes match, the message is authentic.

Q4. Explain Kerberos Authentication Protocol.

Answer

Kerberos is a network authentication protocol based on trusted third-party authentication.

Components:

 Authentication Server (AS)

 Ticket Granting Server (TGS)

 Client

 Service Server

Advantages:

 Single Sign-On

 Strong security

 Prevents password transmission

Q5. Explain X.509 Certificate.

Answer

X.509 is a digital certificate standard used in PKI.

Contents:

66
  Subject Name

 Issuer Name

 Public Key

 Validity Period

 Digital Signature

Applications:

 SSL/TLS

 HTTPS

 Secure Email

Important 10 Marks Questions with Answers

Q1. Explain Message Authentication and Integrity. Discuss MAC and Hash Functions.

Answer

Message Authentication verifies the source of a message.

Message Integrity ensures the message has not been altered.

MAC

 Uses message and secret key.

 Provides authentication and integrity.

 Fast and efficient.

Hash Function

 Produces fixed-size digest.

 Provides integrity verification.

 One-way function.

Security Requirements

 Preimage Resistance

 Second Preimage Resistance

 Collision Resistance

67
Both MAC and hash functions are widely used in secure communication systems.

Q2. Explain Digital Signatures and DSS in detail.

Answer

Digital Signature is an electronic signature providing:

1. Authentication

2. Integrity

3. Non-Repudiation

Working:

1. Generate hash.

2. Encrypt hash with private key.

3. Receiver verifies using public key.

DSS

Digital Signature Standard defines methods for digital signatures.

Features:

 Uses DSA

 Supports integrity

 Supports authentication

 Provides non-repudiation

Applications:

 Banking

 E-commerce

 Government systems

Q3. Explain Entity Authentication Techniques.

Answer

Entity Authentication verifies user identity.

Biometrics

68
Examples:

 Fingerprint

 Iris

 Face Recognition

Advantages:

 Difficult to forge

Password Authentication

Types:

 Static Password

 OTP

Challenge-Response Protocol

Server sends challenge and user generates response.

Advantages:

 Prevents replay attacks

 Password not transmitted

These techniques are widely used for access control and identity verification.

Q4. Explain Kerberos Authentication Protocol with architecture and working.

Answer

Kerberos is a trusted third-party authentication protocol.

Components:

1. Client

2. Authentication Server (AS)

3. Ticket Granting Server (TGS)

4. Service Server

Working:

1. User logs in.

2. AS issues TGT.

69
 3. TGS issues service ticket.

4. User accesses service securely.

Advantages:

 Single Sign-On

 Secure authentication

 Password protection

Applications:

 Enterprise networks

 Distributed systems

Q5. Explain X.509 Certificate Standard and Authentication Applications.

Answer

X.509 is a digital certificate standard used in Public Key Infrastructure (PKI).

Certificate Components:

 Version

 Serial Number

 Subject Name

 Issuer Name

 Public Key

 Validity Period

 Digital Signature

Authentication Applications:

Kerberos

 Ticket-based authentication

X.509

 Certificate-based authentication

Advantages:

 Secure identity verification

70
  Supports HTTPS and SSL/TLS

 Widely used in Internet security

UNIT: 5 SECURITY PRACTICE AND SYSTEM SECURITY

ELECTRONIC MAIL SECURITY

Introduction

Electronic mail (E-mail) is one of the most widely used communication methods on the
Internet.

Security Threats in E-mail

 Eavesdropping

 Message Modification

 Spoofing

 Phishing

 Spam

Security Requirements

1. Confidentiality

2. Authentication

3. Integrity

4. Non-Repudiation

PGP (Pretty Good Privacy)

Pretty Good Privacy is an email security system developed by Phil Zimmermann.

It provides:

 Confidentiality

 Authentication

 Integrity

 Compression

71
Working of PGP

Step 1: Authentication

 Sender creates a hash of the message.

 Hash is encrypted using sender's private key.

Step 2: Confidentiality

 Message is encrypted using a symmetric session key.

 Session key is encrypted using receiver's public key.

Step 3: Transmission

 Encrypted message and encrypted session key are sent.

Advantages

 Strong security

 Supports digital signatures

 Widely used

S/MIME (Secure/Multipurpose Internet Mail Extensions)

S/MIME is a standard for secure email communication.

Uses:

 Public Key Cryptography

 Digital Signatures

 X.509 Certificates

Services Provided

1. Authentication

Verifies sender identity.

2. Integrity

Detects message modification.

72
3. Confidentiality

Encrypts message content.

4. Non-Repudiation

Prevents denial of sending messages.

Advantages

 Industry standard

 Certificate-based security

 Strong authentication

Difference Between PGP and S/MIME

PGP S/MIME

Uses web-of-trust Uses X.509 certificates

Individual user oriented Enterprise oriented

Flexible Standardized

Free versions available Common in organizations

IP SECURITY (IPSec)

IPsec is a collection of protocols used to secure IP communications.

Objectives

1. Authentication

2. Integrity

3. Confidentiality

4. Access Control

IPSec Services

73
  Data Authentication

 Data Integrity

 Encryption

 Replay Protection

IPSec Protocols

1. Authentication Header (AH)

Provides:

 Authentication

 Integrity

Does NOT provide:

 Encryption

2. Encapsulating Security Payload (ESP)

Provides:

 Confidentiality

 Authentication

 Integrity

Most commonly used protocol.

Modes of IPSec

Transport Mode

Only payload is encrypted.

IP Header | Encrypted Data

Tunnel Mode

Entire packet is encrypted.

New Header | Encrypted Original Packet

74
Applications

 VPNs

 Secure Communication

 Remote Access

WEB SECURITY

Introduction

Web security protects websites, web applications, and users from attacks.

Common Web Threats

1. Phishing

Fake websites steal sensitive information.

2. SQL Injection

Attacker injects malicious SQL commands.

3. Cross-Site Scripting (XSS)

Attacker injects malicious scripts.

4. Session Hijacking

Attacker steals user sessions.

Web Security Mechanisms

SSL/TLS

Transport Layer Security secures communication between browser and server.

HTTPS

Secure version of HTTP.

HTTP + SSL/TLS = HTTPS

Advantages

75
  Data Encryption

 Authentication

 Integrity Protection

SYSTEM SECURITY

System security protects computer systems from attacks and unauthorized access.

INTRUDERS

Definition

An intruder is a person who attempts unauthorized access to a computer system.

Types of Intruders

1. Masquerader

Pretends to be an authorized user.

Example

Using stolen passwords.

2. Misfeasor

Authorized user who misuses privileges.

Example

Employee stealing company data.

3. Clandestine User

Obtains administrator-level access secretly.

Example

Privilege escalation attacks.

Intrusion Detection

76
Methods used to detect intruders:

Host-Based IDS

Monitors a single system.

Network-Based IDS

Monitors network traffic.

MALICIOUS SOFTWARE (MALWARE)

Definition

Malware is software designed to damage or disrupt systems.

Types of Malware

1. Virus

Attaches itself to files and programs.

2. Worm

Self-replicates without user action.

3. Trojan Horse

Appears legitimate but performs malicious actions.

4. Ransomware

Encrypts user data and demands payment.

5. Spyware

Secretly collects user information.

6. Adware

Displays unwanted advertisements.

VIRUSES

Definition

A virus is a malicious program that attaches itself to a host program and spreads when the
host runs.

77
Working

1. Infection

2. Replication

3. Activation

4. Execution

Types of Viruses

Boot Sector Virus

Infects boot records.

File Virus

Infects executable files.

Macro Virus

Infects documents.

Polymorphic Virus

Changes its code to avoid detection.

Prevention

 Antivirus software

 Regular updates

 Safe browsing

 Email filtering

FIREWALLS

Definition

A firewall is a security system that monitors and controls incoming and outgoing network
traffic.

Acts as a barrier between:

78
Trusted Network ↔ Firewall ↔ Internet

Functions

 Access Control

 Traffic Filtering

 Monitoring

 Logging

Types of Firewalls

1. Packet Filtering Firewall

Filters packets based on IP address and ports.

Advantages:

 Fast

 Simple

2. Stateful Inspection Firewall

Tracks active connections.

Advantages:

 Better security

3. Application Gateway Firewall

Inspects application-level traffic.

Example:

 HTTP

 FTP

4. Proxy Firewall

Acts as intermediary between user and internet.

79
Advantages:

 High security

Advantages of Firewalls

 Prevent unauthorized access

 Monitor traffic

 Block attacks

 Protect internal networks

IMPORTANT 5 MARKS QUESTIONS WITH ANSWERS

Q1. Explain PGP and its working.

Answer

PGP (Pretty Good Privacy) is an email security system that provides confidentiality,
authentication, integrity, and digital signatures.

Working:

1. Create message hash.

2. Encrypt hash using sender's private key.

3. Encrypt message using session key.

4. Encrypt session key using receiver's public key.

5. Send encrypted data.

Advantages:

 Strong security

 Supports digital signatures

Q2. Explain S/MIME.

Answer

S/MIME is a secure email standard that uses public key cryptography and X.509 certificates.

80
Services:

 Authentication

 Integrity

 Confidentiality

 Non-Repudiation

Advantages:

 Industry standard

 Certificate-based security

Q3. Explain IPSec and its protocols.

Answer

IPSec secures IP communications.

Protocols:

Authentication Header (AH)

 Authentication

 Integrity

Encapsulating Security Payload (ESP)

 Confidentiality

 Authentication

 Integrity

Applications:

 VPNs

 Secure networking

Q4. Explain Intruders and their types.

Answer

Intruders are unauthorized users attempting access to systems.

Types:

81
 1. Masquerader

2. Misfeasor

3. Clandestine User

Detection:

 Host-Based IDS

 Network-Based IDS

Q5. Explain Firewalls and their types.

Answer

A firewall controls network traffic between trusted and untrusted networks.

Types:

1. Packet Filtering Firewall

2. Stateful Inspection Firewall

3. Application Gateway Firewall

4. Proxy Firewall

Advantages:

 Blocks unauthorized access

 Protects networks

IMPORTANT 10 MARKS QUESTIONS WITH ANSWERS

Q1. Explain Electronic Mail Security. Discuss PGP and S/MIME.

Answer

Electronic Mail Security protects emails from unauthorized access, modification, and
spoofing.

Security Requirements

1. Confidentiality

2. Integrity

82
 3. Authentication

4. Non-Repudiation

PGP

Provides:

 Encryption

 Authentication

 Digital Signatures

Working:

 Hash message

 Encrypt hash with private key

 Encrypt message with session key

 Encrypt session key with public key

S/MIME

Uses:

 Public Key Cryptography

 X.509 Certificates

Provides:

 Authentication

 Integrity

 Confidentiality

Comparison

PGP uses web-of-trust, while S/MIME uses certificate authorities.

Q2. Explain IPSec architecture, protocols, and modes of operation.

Answer

IPSec is a framework for securing IP communication.

Services

 Authentication

83
  Integrity

 Confidentiality

 Replay Protection

Protocols

AH

 Authentication

 Integrity

ESP

 Confidentiality

 Authentication

 Integrity

Modes

Transport Mode

Encrypts only payload.

Tunnel Mode

Encrypts entire packet.

Applications:

 VPNs

 Remote access security

Q3. Explain Web Security and common web attacks.

Answer

Web Security protects web applications and users.

Common Attacks

Phishing

Fake websites steal credentials.

SQL Injection

Malicious SQL commands manipulate databases.

84
Cross-Site Scripting (XSS)

Injects malicious scripts.

Session Hijacking

Steals active user sessions.

Protection Methods

 HTTPS

 TLS

 Secure coding

 Input validation

 Authentication mechanisms

Q4. Explain Malware and Viruses in detail.

Answer

Malware is software designed to harm systems.

Types

1. Virus

2. Worm

3. Trojan Horse

4. Ransomware

5. Spyware

6. Adware

Virus Life Cycle

1. Infection

2. Replication

3. Activation

4. Execution

Types of Viruses

 Boot Sector Virus

85
  File Virus

 Macro Virus

 Polymorphic Virus

Prevention

 Antivirus software

 Updates

 Safe browsing

Q5. Explain Firewalls and their role in System Security.

Answer

A firewall is a network security device that controls traffic between trusted and untrusted
networks.

Functions

 Traffic Filtering

 Access Control

 Monitoring

 Logging

Types

1. Packet Filtering Firewall

2. Stateful Inspection Firewall

3. Application Gateway Firewall

4. Proxy Firewall

Advantages

 Prevents unauthorized access

 Protects internal systems

 Detects suspicious activity

Firewalls are one of the most important components of system security.

86
87
88
89
90