NETWORK SECURITY
Complete Notes on Cryptography & Encryption
Topics Covered:
Encryption & Decryption | Cryptography Basics | Caesar Cipher
Symmetric & Asymmetric Encryption | RSA Algorithm
Authentication | Digital Signatures | Digital Certificates
M-Commerce | Online Payment Systems
CHAPTER 1: ENCRYPTION & DECRYPTION
1.1 What is Encryption?
Encryption is the process of encoding a message so that its meaning is not obvious to unauthorized
people. It attempts to make information unreadable by anyone who is not explicitly authorized to view
that data.
1.2 Key Definitions
Term Definition
Encryption Process of encoding a message so its meaning is not obvious. Also called
encoding or enciphering.
Decryption Process of decoding an encrypted message back to its original form. Also
called decoding or deciphering.
Cryptosystem A complete system for encryption and decryption.
Plaintext The original readable message before encryption.
Ciphertext The encrypted (scrambled) version of the message.
Key A value used to encrypt or decrypt data. Can be a password or a numeric
key.
1.3 How Encryption Works
The basic process:
➤ Sender has a plaintext message (e.g., 'Hello')
➤ Using an encryption key, the message is converted to ciphertext (e.g., '%fd$jh')
➤ Ciphertext is transmitted over the network
➤ Receiver uses a decryption key to convert ciphertext back to plaintext
➤ An interceptor who gets the ciphertext cannot read it without the key
1.4 Why is Encryption Important?
➤ Keeps outsiders from viewing important company documents
➤ Keeps information from being shared between users on the same server or network
➤ Creates 'keys' so only certain people can view or access a document
➤ Encryption was previously only used by governments — now it is essential for everyday
computing
1.5 Two Forms of Encryption
Form How it Works Examples
Substitutions One letter is exchanged for another Caesar Cipher, Monoalphabetic
letter or symbol cipher, Polyalphabetic cipher
Transpositions The order of the letters is rearranged Columnar transposition cipher
(Permutations) without changing the letters themselves
CHAPTER 2: CRYPTOGRAPHY TERMINOLOGY
Term Definition Person Involved
Cryptography The practice of using encryption to conceal text Cryptographer
and protect information
Cryptanalysis The study of encryption and encrypted messages Cryptanalyst
with the goal of finding hidden meanings — i.e.,
breaking codes
Cryptology The combined field of both Cryptography AND Both
Cryptanalysis
2.1 Cryptanalysis in Detail
A cryptanalyst attempts to break codes using:
➤ Intercepted messages and suspected ciphertext items
➤ Known encryption algorithms
➤ Mathematical and statistical tools and techniques
➤ Properties of languages and computers
➤ Ingenuity and luck
Three Goals of Cryptanalysis:
➤ Goal 1: Attempt to break a single message
➤ Goal 2: Attempt to recognize patterns in encrypted messages
➤ Goal 3: Attempt to find general weaknesses in an encryption algorithm
CHAPTER 3: HISTORY OF CRYPTOGRAPHY
Time Period Event
~1900 BC Egyptian scribe used non-standard hieroglyphs in an inscription — considered
the FIRST documented example of written cryptography
1500 BC Ancient Assyrian merchants used 'intaglio' (flat stone carved with images and
writing) to identify themselves in trading transactions
100–44 BC Julius Caesar used a simple substitution cipher (Caesar Cipher) — shifting
letters a fixed amount in the alphabet — for government communications
CHAPTER 4: CAESAR CIPHER (Substitution)
4.1 How Caesar Cipher Works
Each letter in the plaintext is replaced by a letter a fixed number of positions down the alphabet.
Formula: Ci = E(Pi) = Pi + 3
Plaintext Shift Ciphertext
Attack at dawn +3 (single key) Dwwdfn dw gdzq
Attack at dawn +3, +5, +7 (multiple keys) dya dhr dyk dbu (better but
frequency still present)
4.2 Advantages & Weaknesses
Advantage Weakness
Very simple to implement Can be cracked with close observation
Easy to understand Letter frequency is a big clue (e, t, a, o are most common English
letters)
Using a single key preserves frequency — easy to break
Solution: Use multiple keys, but frequency info is still present
CHAPTER 5: SYMMETRIC (PRIVATE KEY) ENCRYPTION
5.1 What is Symmetric Encryption?
Symmetric encryption is a cryptographic method in which the SAME KEY is used for both encrypting
AND decrypting the data. Both sender and receiver must know and share this key.
5.2 Key Characteristics
➤ Uses a single numeric key to encode and decode data
➤ Both sender and receiver must know the key
➤ DES (Data Encryption Standard) is the most widely used standard for symmetric encryption
➤ Mostly used by government entities
➤ Rarely used for e-commerce transactions over the Internet
➤ Requires a SECURE way to distribute the key to both parties — this is the main challenge
➤ It is FASTER than asymmetric encryption since only one key is used
5.3 Basic Password as Symmetric Encryption
Basic password protection can be seen as a form of symmetric encryption — the same password is
used to both encrypt and decrypt data. When a user creates a password for their account, it serves as
the shared secret key.
5.4 What Does a Private Key Look Like?
A private key is a long string of random letters and numbers. RSA private keys typically begin with:
-----BEGIN RSA PRIVATE KEY-----
...long string of random characters...
-----END RSA PRIVATE KEY-----
CHAPTER 6: ASYMMETRIC (PUBLIC KEY) ENCRYPTION
6.1 What is Asymmetric Encryption?
Asymmetric encryption uses TWO mathematically related but different keys — a PUBLIC key and a
PRIVATE key. What one key encrypts, only the other can decrypt.
6.2 How it Works
➤ Public Key: Available to ANYONE who wants to communicate securely with the key's owner.
Can be shared openly.
➤ Private Key: Available ONLY to the owner. Must never be shared.
➤ Both keys are able to encrypt and decrypt each other's messages
➤ It is computationally infeasible to deduce the private key from the public key
➤ Anyone with the public key can ENCRYPT information but CANNOT decrypt it
➤ Only the person with the corresponding private key can DECRYPT the information
6.3 Primary Benefit
The primary benefit of asymmetric cryptography is that it allows people who have NO PREEXISTING
SECURITY ARRANGEMENT to exchange messages securely. The need to share a secret key via a
secure channel is eliminated.
6.4 Example (Rohit & Virat)
➤ Rohit wants to send sensitive data to Virat
➤ Rohit encrypts the data using Virat's PUBLIC key
➤ Only Virat has access to his corresponding PRIVATE key
➤ Therefore, only Virat can decrypt and read the data
➤ Even if someone intercepts the data, they cannot read it without Virat's private key
6.5 Common Public Key Cryptosystems
➤ RSA — Named for inventors Ron Rivest, Adi Shamir, and Leonard Adleman
➤ Diffie-Hellman — Named for its inventors
➤ DSA — Digital Signature Algorithm, invented by David Kravitz
➤ PGP — Pretty Good Privacy — fairly popular and inexpensive
➤ SSL — Secure Sockets Layer — used for web browser security
CHAPTER 7: SYMMETRIC vs ASYMMETRIC ENCRYPTION
Feature Private Key (Symmetric) Public Key (Asymmetric)
Keys Used Same key for both parties Different keys — public + private
Key Sharing Key kept secret by both people One key publicly available, one
remains secret
If Key Lost File becomes unusable No loss risk (public key is always
available)
Common Use Protect disk drives, data storage Secure web sessions and emails
devices
Type Symmetrical encryption Asymmetrical encryption
Speed Faster — only one key needed Slower — two keys required
Complexity Simpler More complex but more flexible
Main Standard DES (Data Encryption Standard) RSA, Diffie-Hellman, DSA, PGP
Used By Mostly Government entities E-commerce, internet banking,
public
CHAPTER 8: RSA ALGORITHM
8.1 What is RSA?
RSA is the most widely used public key encryption algorithm. It is based on the principle that it is EASY
to multiply two large prime numbers, but HARD to factorize the product back into its factors.
8.2 Key Generation Steps
1. Generate two large prime numbers: p and q
2. Let n = p × q
3. Let m = φ(n) = (p-1)(q-1)
4. Choose a small number e, co-prime to m, with GCD(φ(n), e) = 1; 1 < e < φ(n)
5. Find d, such that: d × e mod φ(n) = 1
6. Publish e and n as the PUBLIC key. Keep d and m as the SECRET (PRIVATE) key.
8.3 Encryption & Decryption Formulas
Operation Formula Note
Encryption cipher = (message)ᵉ mod n Uses PUBLIC key (e, n)
Decryption message = (cipher)ᵈ mod n Uses PRIVATE key (d, n)
mod meaning x mod y Remainder of x divided by y
CHAPTER 9: AUTHENTICATION
9.1 What is Authentication?
Authentication is the process of ensuring that both ends of a connection are actually who they claim to
be. This applies to both:
➤ The entity trying to ACCESS a service (e.g., end user)
➤ The entity PROVIDING the service (e.g., file server or website)
9.2 Authentication & Encryption Together
Authentication and encryption are two intertwined technologies that help ensure data remains secure.
While each has its own responsibilities, maximum protection can only be achieved when both are
combined. For this reason, many security protocols contain both authentication AND encryption
specifications.
9.3 Three Types of Authentication
Type Factors Used Security Level Used For
Single Factor Password only Low — easy to Basic user accounts
remember but easy
to crack. People are
predictable (pet
names, birth dates)
Two Factor (2FA) Password + Token Medium — safer and Online banking, email
(security device) more complex than
single factor
Three Factor Password + Token + High — used for Government documents,
(3FA) Biometric (fingerprint, high security military
retinal scan) purposes
9.4 What is a Token?
A token is a security device for authorized users to keep in possession. Examples include:
➤ SecurID Card — generates a one-time code
➤ Challenge/Response Method — requires user to answer a challenge
➤ USB Token — physical device plugged into computer
9.5 Real-World Example: WhatsApp
WhatsApp messages are END-TO-END ENCRYPTED. This means that only the sender's device and
the recipient's device can decode the messages. The feature prevents messages from being
intercepted during transmission — even by WhatsApp/Meta themselves.
CHAPTER 10: DIGITAL SIGNATURES
10.1 What is a Digital Signature?
A digital signature is a cryptographic method of showing who created a digital asset and ensuring the
item has not been changed by another party. It is like a unique fingerprint embedded in a document.
10.2 How Digital Signatures Work
➤ Instead of encrypting information using someone ELSE's public key, you encrypt it with YOUR
OWN PRIVATE KEY
➤ If the information can be decrypted with YOUR PUBLIC KEY, it proves the message originated
from you
➤ This is the basis of non-repudiation — you cannot deny signing the document
10.3 How Digital Signatures Are Created
7. Get a Digital Certificate from a Certificate Authority (CA)
8. Apply a HASH FUNCTION to the data — creates a fixed-length hash value that masks the true
size of the input and ensures data integrity
9. Encrypt the hash value using your PRIVATE KEY
10. Attach the signature + certificate to the document
11. Recipient decrypts the hash using your PUBLIC KEY and verifies it matches — if yes, signature
is valid
10.4 Key Features of Digital Signatures
➤ Acts like a unique fingerprint embedded in the document
➤ Requires a digital certificate from a Certificate Authority (CA)
➤ CA is a publicly trusted third party that vets the signer's identity
➤ Digital signature is bound to the data being signed — cannot be detached and reused
➤ Secured documents can only be accessed by authorized persons for alterations
➤ More reliable than wet (handwritten) signatures because origins can be authenticated
10.5 What Digital Signatures Prove
➤ Authenticity of the document and its source
➤ The document has NOT been tampered with
➤ Personal identity of the signer has been verified
10.6 Algorithms Used
➤ SHA-1 or SHA-2 algorithms are used to generate digital signatures (hash functions)
➤ RSA algorithm is used when message encryption is required alongside the signature
➤ DSS (Digital Signature Standard) is the governing standard
10.7 Analogy for Digital Signatures
Sealing an envelope with a personal wax seal — the message can be opened by anyone, but the
presence of the unique seal authenticates the sender.
CHAPTER 11: DIGITAL vs ELECTRONIC SIGNATURES
Feature Digital Signature Electronic Signature
Purpose Used to SECURE a document Mainly used to VERIFY a document
Authorization Authorized and regulated by Usually NOT authorized by any CA
Certificate Authorities (CA)
Security More security features Fewer security features
Verification CAN be verified CANNOT be verified
Common Types Based on Adobe and Microsoft Verbal, electronic ticks, scanned
standards signatures
Trust Level Preferred — high levels of Easy to use but less authentic
authenticity
Concern Primarily concerned about securing Shows intent to sign the contract
the document
11.1 Paper vs Digital Signature
Parameter Paper Signature Digital/Electronic Signature
Authenticity May be forged Cannot be copied
Integrity Signature is independent of the Signature depends on the contents
document of the document
Non-Repudiation Handwriting expert needed; Error Any computer user; Error free
prone
CHAPTER 12: DIGITAL CERTIFICATES
12.1 What is a Digital Certificate?
A Digital Certificate is an electronic file that is tied to a cryptographic key pair and authenticates the
identity of a website, individual, organization, user, device or server. It is also known as a Public Key
Certificate or Identity Certificate.
12.2 What Security Does a Digital Certificate Provide?
Security Property Meaning
Identification / Confirms that the persons/entities communicating are really who
Authentication they say they are
Confidentiality Information within the message or transaction is kept confidential —
only intended sender and receiver can understand it
Integrity Information within the message is not tampered with accidentally or
deliberately — all parties are aware if tampering occurs
Non-Repudiation Sender cannot deny sending the message; receiver cannot deny
receiving it
Access Control Access to protected information is only realized by the intended
person or entity
All the above security properties can be achieved through the use of Public Key Infrastructure (PKI) —
in particular Digital Certificates.
12.3 Core Components of PKI (Public Key Infrastructure)
➤ Digital Certificate: Also known as a public key certificate. Cryptographically links a public key
with the entity that owns it.
➤ Certificate Authority (CA): The trusted party or entity that issues digital security certificates
(e.g., VeriSign, DigiCert).
➤ Registration Authority (RA): Also known as subordinate CA. Authenticates requests for digital
certificates and forwards them to the CA.
➤ Certificate Database / Certificate Store: A database or storage system that contains
information about keys and digital certificates that have been issued.
12.4 How Digital Certificates Are Used
➤ Credit and debit card chip-embedded certificates — connect with merchants and banks for
secure transactions
➤ Digital payment companies authenticate ATMs, kiosks, and POS equipment
➤ Websites use digital certificates for domain validation (HTTPS — the padlock icon in browsers)
➤ Secure email — sender digitally signs email, recipient verifies the signature
➤ Computer hardware manufacturers embed certificates in cable modems to prevent device
cloning
➤ IoT devices increasingly use certificates to prevent cyber threats
12.5 How Digital Certificates Increase Trust
Digital certificates increase trust by providing THIRD-PARTY VALIDATION of a user, device, server,
website, individual or organization. They are an added layer of protection for digital assets. DigiCert
SSL certificates are automatically trusted by all common browsers: Chrome, Firefox, Edge, Safari, and
Opera.
12.6 Famous Certificate Authorities
➤ VeriSign: One of the world's largest CAs — provides VeriSign Trust Seal
➤ DigiCert: Issues SSL certificates automatically trusted by all major browsers
CHAPTER 13: DIGITAL SIGNATURE vs DIGITAL
CERTIFICATE
Feature Digital Signature Digital Certificate
Definition Like a fingerprint/attachment to a A file that verifies the identity of the
digital document that verifies its holder and offers security
validity and integrity
Security Provided Offers non-repudiation, Offers security and authentication
authentication, and integrity
Process Asymmetric keys are used to Certificate is issued by a trusted CA
encrypt the document at sender end following key generation, verification,
and decode at receiver end registration, and creation
Works On Digital Signature Standard (DSS) Encryption securities and
cryptographic keys
Visibility Used to verify the validity of Installed on websites to verify the
documents owner's identity
Ensures Signer cannot repudiate their Client-browser communication is
signature encrypted and secure
Security Tool Uses Hashing Function (SHA-1, Uses Cryptographic Keys
SHA-2)
Creation Algorithm SHA-1 or SHA-2 X.509 format
Primary Purpose Ensure the document sent between Increase trust between the client and
sender and receiver has not been the site owner
altered
CHAPTER 14: M-COMMERCE (Mobile Commerce)
14.1 What is M-Commerce?
M-Commerce (Mobile Commerce) is the buying and selling of goods and services through wireless
handheld devices such as cellular telephones and personal digital assistants (PDAs). It is also known
as NEXT-GENERATION E-COMMERCE.
14.2 Technology Behind M-Commerce
M-Commerce is based on WAP (Wireless Application Protocol). Mobile devices equipped with Web-
ready micro-browsers assist buying and selling through handheld devices.
14.3 M-Commerce is More than Just Buying/Selling
M-Commerce also includes:
➤ Purchases on mobile web and apps
➤ Mobile payments
➤ Mobile money transfers and m-banking
➤ Mobile financial services
14.4 Types of M-Commerce Applications
Type Description
Mobile Banking Access bank accounts, transfer funds, pay bills via mobile phone
Mobile Shopping Purchase goods and services via mobile apps or websites
Mobile Payments Pay merchants using mobile wallets (e.g., Apple Pay, Google Pay)
Mobile Advertising & Targeted ads delivered to mobile devices based on location and
Marketing preferences
Mobile Entertainment Streaming music, video, games via mobile
Mobile Ticketing Purchase and show tickets for events, transport via mobile
14.5 Benefits of M-Commerce
➤ Ubiquity: Wireless devices enable users to receive information and conduct transactions
ANYWHERE, at ANY TIME
➤ Accessibility: Mobile devices allow users to be contacted virtually; users can limit accessibility
to particular persons or times
➤ Localization: Location-based apps enable users to receive relevant local information
➤ Convenience: Portability of mobile phones helps in accessing any information at any time
CHAPTER 15: SECURED ONLINE PAYMENT SYSTEMS
15.1 Key Players in Payment Processing
Player Role
Cardholder The person who owns and uses the credit/debit card
Merchant Any business that accepts credit/debit cards for goods or services.
Maintains a merchant account.
Acquiring Bank Registered member of card associations. Contracts with merchants to
(Merchant Bank) create merchant accounts. Provides equipment and software. Deposits
funds from sales into merchant's account.
Issuing Bank Issues cards to consumers. Pays acquiring banks for purchases their
(Cardholder Bank) cardholders make. Cardholder repays the issuing bank under their
card agreement.
Card Associations (Visa NOT banks — they act as custodians and clearing houses. Govern
& MasterCard) interchange fees and qualification guidelines. Maintain card networks.
15.2 Card Association Networks
➤ Visa: Uses VisaNet network to transmit data between association members
➤ MasterCard: Uses Banknet network
➤ Primary responsibilities: Govern members, set interchange fees, arbitrate between banks,
maintain card networks
15.3 How a Credit Card Transaction Flows
12. Consumer places order on merchant website — Consumer PC communicates with server
hosting the website
13. Transaction data sent (real-time) to Payment Processing Center via Internet, OR (non-real-time)
to Private Financial Network
14. Payment Processing Center communicates with Merchant Bank (or 3rd party processor)
15. Merchant Bank communicates with Cardholder's Bank (Issuing Bank) for authorization
16. Authorization response flows back through the chain to the consumer
15.4 Flow of Payment Gateway Process
➤ User places order → sent to Merchant's web server
➤ Merchant's web server sends Request to Payment Gateway
➤ Payment Gateway sends Request for Confirmation to Bank
➤ Bank sends Bank Response back to Payment Gateway
➤ Payment Gateway sends response to Merchant
➤ Server Response sent to user — order confirmed
➤ Funds Transferred to Merchant's Account
QUICK REVISION SUMMARY
Important Formulas & Facts
Topic Key Point
Caesar Cipher Ci = Pi + 3 (shift by 3). 'Attack' → 'Dwwdfn'
RSA Encryption cipher = (message)ᵉ mod n
RSA Decryption message = (cipher)ᵈ mod n
Symmetric Key Same key for encrypt + decrypt. Uses DES standard.
Asymmetric Key Public key encrypts, Private key decrypts. Uses RSA.
Digital Signature Encrypt with PRIVATE key, verify with PUBLIC key
Cryptology = Cryptography + Cryptanalysis
1 Factor Auth Password only
2 Factor Auth Password + Token
3 Factor Auth Password + Token + Biometric
M-Commerce Mobile Commerce — based on WAP protocol
PKI Public Key Infrastructure — includes CA, RA, Certificate DB
Hash Algorithm SHA-1 or SHA-2 used for digital signatures
Certificate Format X.509 format used to create digital certificates
WhatsApp Uses End-to-End Encryption — even Meta cannot read
messages
First Cryptography ~1900 BC by Egyptian scribe (non-standard hieroglyphs)