PRINCIPLES OF CRYPTOGRAPHY
➢ Cryptography
⚫ refers to the encryption/decryption of coded
language
⚫ only the sender and intended recipient can
decipher.
⚫ is the practice and study of techniques for
secure communication in the presence of third
parties called adversaries
➢ Security
1
PRINCIPLES OF
CRYPTOGRAPHY
➢ Cryptography
⚫ Art of devising ciphers
➢ Cryptanalysis
⚫ Art of breaking ciphers
2
TYPES OF SECURITY
➢ COMPUTER SECURITY - CIA
➢ NETWORK SECURITY
➢ INTERNET SECURITY
➢ CYBER SECURITY
3
CYBER SECURITY
➢ Cybersecurity
⚫ procedures implemented to secure networks,
programs, and devices from unauthorized
users.
4
Computer Security
➢ Computer is secure if it behaves as u expect-
H/W and S/W
➢ the protection afforded to an automated
information system in order to attain the
applicable objectives of preserving
➢ CIA (Confidentiality , Integrity, and
Availability) of information system resources
➢ includes hardware, software, firmware,
information/data, and telecommunications) 5
Key Security Concepts
6
Examples of Security
Requirements
➢ Confidentiality –
❖ Data Confidentiality
❖ Confidential information
❖ Privacy
Individuals
7
Examples of Security
Requirements
➢ Confidentiality –
❖ Data Confidentiality
❖ Confidential information – unauthorized
access - Eg. Question paper
❖ Privacy
Individuals - student grades
8
Examples of Security
Requirements
➢ Integrity – Protection /guard
➢ Data integrity
➢ System integrity
9
Examples of Security
Requirements
➢ Availability
➢ No DoS
10
Levels of Impact
➢ can define 3 levels of impact from a
security breach
⚫ Low
⚫ Moderate
⚫ High
11
Challenges-Computer Security
1. not simple
2. must consider potential attacks – 26/11, Twin towers,
Paris attack
3. procedures used counter-intuitive
4. involve algorithms and secret info
5. must decide where to deploy mechanisms
6. battle of wits between attacker / admin
7. not perceived on benefit until fails
8. requires regular monitoring
9. too often an after-thought
10. regarded as an impediment to using system
12
OSI Security Architecture
➢ ITU-T X.800 “Security Architecture for OSI”
➢ defines a systematic way of defining and
providing security requirements
➢ it provides an useful, if abstract, overview
of concepts
13
CYBER SECURITY
➢ Cybersecurity
⚫ procedures implemented to secure networks,
programs, and devices from unauthorized
users.
14
Aspects of Security
➢ consider 3 aspects of information security:
⚫ security attack
⚫ security mechanism
⚫ security service
➢ terms
⚫ threat – a potential for violation of security
⚫ attack – an assault on system security, a
deliberate attempt to evade security services
15
Security Service
⚫ enhance security of data processing systems
and information transfers of an organization
⚫ intended to counter security attacks
⚫ using one or more security mechanisms
⚫ often replicates functions normally associated
with physical documents
• for example, have signatures, dates; need
protection from disclosure, tampering, or
destruction; be notarized or witnessed; be
recorded or licensed
16
Security Services
➢ X.800:
“a service provided by a protocol layer of
communicating open systems, which ensures
adequate security of the systems or of data
transfers”
➢ RFC 2828:
“a processing or communication service
provided by a system to give a specific kind of
protection to system resources”
17
Security Services (X.800)
➢ Authentication - assurance that communicating
entity is the one claimed
⚫ have both peer-entity & data origin authentication
➢ Access Control - prevention of the
unauthorized use of a resource
➢ Data Confidentiality –protection of data from
unauthorized disclosure
➢ Data Integrity - assurance that data received is
as sent by an authorized entity
➢ Non-Repudiation - protection against denial by
one of the parties in a communication
➢ Availability – resource accessible/usable 18
Security Mechanism
➢ feature designed to detect, prevent, or
recover from a security attack
➢ no single mechanism that will support all
services required
➢ Security services make use of 1/ more
security mechanisms
➢ however one particular element underlies
many of the security mechanisms in use:
⚫ cryptographic techniques
19
Security Mechanisms (X.800)
➢ specific security mechanisms:
➢ Protocol layer
➢ Encipherment --- ??? service
⚫ digital signatures
⚫ access control
⚫ data integrity
⚫ authentication exchange
⚫ traffic padding
⚫ routing control
⚫ notarization 20
Security Mechanisms (X.800)
➢ pervasive security mechanisms:
➢ broad
⚫ trusted functionality – ID, UID
⚫ security label - Symantec
⚫ event detection
⚫ security audit trail
⚫ security recovery
21
Model for Network Security
22
Model for Network Security
➢ using this model requires us to:
1. design a suitable algorithm for the security
transformation
2. generate the secret information (keys) used
by the algorithm
3. develop methods to distribute and share the
secret information
4. specify / propose a protocol for secret
communication
23
Model for Network Access
Security
24
Model for Network Access
Security
➢ using this model requires us to:
1. select appropriate gatekeeper functions to
identify users
2. implement security controls to ensure only
authorised users access designated
information or resources
25
Roadmap
➢ Cryptographic algorithms
⚫ symmetric ciphers
⚫ asymmetric encryption
⚫ hash functions, etc.,
➢ MutualTrust
➢ Network Security
➢ Computer Security
26
27
Standards Organizations
➢ National Institute of Standards &
Technology (NIST)
➢ Internet Society (ISOC)
➢ International Telecommunication Union
Telecommunication Standardization
Sector (ITU-T)
➢ International Organization for
Standardization (ISO)
28