Chapter 1

Introduction to
Computer Security
Basic Concepts of Computer Security
• Computer security is the protection of computer systems and networks from
information disclosure, theft of or damage to their hardware, software, or electronic data,
as well as from the disruption or misdirection of the services they provide.
• It includes physical security to prevent theft of equipment, and information security to
protect the data on that equipment. It is sometimes referred to as "cyber security" or "IT
security“.
• Computer facilities have been physically protected for three reasons:
• To prevent theft of or damage to the hardware
• To prevent theft of or damage to the information
• To prevent disruption of service
• Computer security rests on confidentiality, integrity, and availability.
Terms used in computer security
• Threats is a potential violation of security. It is a new or newly discovered
incident that has the potential to harm a system or your company overall.
• Vulnerabilities is a weakness which can be exploited by a threat actor, such as an
attacker, to cross privilege boundaries within a computer system.
• Controls are safeguards or countermeasures to avoid, detect, counteract, or
minimize security risks to computer systems, or other assets.
• Risk is defined as the potential for loss or damage when a threat exploits a
vulnerability. The common formula is:
Risk = Threat x Vulnerability x Consequence
Terms used in computer security
• Security policy is a statement of what is, and what is not, allowed.
• Security mechanism is a method, tool, or procedure for enforcing given a security
policy's specification of "secure" and "non-secure" actions, these security
mechanisms can prevent the attack, detect the attack, or recover from the attack.
• Prevention means that an attack will fail. For example, if one attempts to break into a
host over the Internet and that host is not connected to the Internet, the attack has
been prevented.
• Detection is most useful when an attack cannot be prevented, but it can also indicate
the effectiveness of preventative measures.
• Detection mechanisms accept that an attack will occur; the goal is to determine that
an attack is underway, or has occurred, and report it.
• Assurance is provide a basis for determining "how much" to trust a system.
Goal of
Computer
Security
Goal of Computer Security
• Confidentiality: is the protection of information or resources. The need for keeping information
secret arises from the use of computers in sensitive fields such as government and industry.
• Ensure that assets are viewable only by authorized parties.
o Example: Abebe peeks at Almaz’s password when she is logging in.
o Abebe copies a file from Almaz’s account.
• Integrity: Integrity refers to the trustworthiness of data or resources, and it is usually phrased in
terms of preventing improper or unauthorized change.
• Ensure assets are usable by and accessible to all authorized parties.
o Example: There is a process running in Almaz’s machine, which is updating
adatabase from a remote machine. Abebe interrupts the process, results
ininconsistent databases.
Goal of Computer Security

• Availability: Assures that systems work promptly and service is not denied to authorized
users.
• Ensure that assets are usable by and accessible to all authorized parties.
o Example: Abebe deletes the file from Almaz’s directory.
Computer Security and Privacy/Attacks
• Interruption (Attack on Availability): System destroyed or becomes unavailable
(DoS).
• Interception (Attack on Confidentiality): Unauthorized party gains access
(eavesdropping).
• Modification (Attack on Integrity): Unauthorized party alters information.
• Fabrication (Attack on Authenticity): Unauthorized party inserts counterfeit
objects (spoofing).
• Passive vs. Active Attacks:
• Passive: Eavesdropping/monitoring without alteration (hard to detect).
• Active: Involve modification or disruption (easier to detect).
Computer
Security and
Privacy/Attacks
Software Security Assurance
• Goal: To create software that is fundamentally secure and resistant to attack.
• Integrating security early in the Software Development Life Cycle (SDLC).
• Key Practices:
• Secure design principles (e.g., least privilege)
• Threat modeling
• Secure coding standards
• Code reviews (static analysis)
• Security testing (dynamic analysis, penetration testing)
• Outcome: Reduced vulnerabilities, lower cost of fixing flaws.
Chapter 2
Computer Threats
Malicious Code: Introduction
• Malicious Code/Malware: Software designed to
harm, disrupt, or gain unauthorized access to
computer systems
• Common Characteristics:
• Requires a host or propagation mechanism
• Often includes payload (malicious action)
• Can be persistent or non-persistent
• Propagation Methods: Email, websites, removable
media, networks
Viruses
• Self-replicating code that attaches to legitimate programs/files
• Characteristics:
• Requires user action to execute
• Attaches to host files
• Spreads through file sharing
• Types:
• Boot sector viruses
• File infectors
• Macro viruses
• Polymorphic/metamorphic viruses
• Examples: ILOVEYOU, Melissa, CIH
Trojan Horses
• Malicious program disguised as legitimate software
• Characteristics:
• Appears useful or harmless
• Does not self-replicate
• Requires user deception to install
• Common Payloads:
• Backdoor creation
• Data theft
• System corruption
• Botnet recruitment
• Examples: Zeus banking Trojan, FakeAV
Worms
• Self-replicating malware that spreads autonomously across networks
• Characteristics:
• No host file needed
• Spreads without user interaction
• Exploits network vulnerabilities
• Impact:
• Network congestion
• System resource exhaustion
• Payload delivery
• Examples: Code Red, Slammer, Conficker, WannaCry (worm component)
Spyware and Other Malware
• Spyware: Secretly monitors and collects user information
• Keyloggers
• Screen capture
• Data miners
• Adware: Displays unwanted advertisements
• Ransomware: Encrypts files and demands payment
• Rootkits: Hides malware presence from detection
• Botnets: Networks of compromised devices controlled remotely
Classes of Attacks
• Attack Lifecycle: Reconnaissance → Weaponization →
Delivery → Exploitation → Installation → Command &
Control → Actions
• Classification by Intent:
• Information theft
• System disruption
• Resource theft
• Unauthorized access
Reconnaissance Attacks
• Purpose: Gather information about target before launching attack
• Types:
• Passive: Eavesdropping, traffic analysis
• Active: Port scanning, DNS queries, OS fingerprinting
• Tools:
• Nmap (port scanning)
• Wireshark (packet sniffing)
• Whois, DNS enumeration tools
• Countermeasures: Firewalls, IDS, minimal information disclosure
Access Attacks
• Purpose: Gain unauthorized access to systems or data
• Methods:
• Password attacks (brute force, dictionary, rainbow tables)
• Social engineering (phishing, pretexting)
• Exploiting software vulnerabilities
• Session hijacking
• Man-in-the-middle attacks
• Goals:
• Privilege escalation
• Data exfiltration
• System compromise
 Denial of Service (DoS) Attacks
• Make resources unavailable to legitimate users
• Types:
• Flooding Attacks: Overwhelm with traffic (SYN flood, UDP flood)
• Crash Attacks: Exploit vulnerabilities to crash systems
• Distributed DoS (DDoS): Multiple systems attack single target
• Amplification Attacks: Use reflection to magnify attack traffic
• Impact: Service disruption, financial loss, reputation damage
• Examples: Mirai botnet, DNS amplification attacks
Program Flaws
• Software Vulnerabilities: Weaknesses that can be exploited
• Common Causes:
• Programming errors
• Design flaws
• Configuration mistakes
• Impact: Security breaches, data loss, system compromise
 Buffer Overflows
• Definition: Writing data beyond allocated buffer boundaries
• Types:
• Stack-based overflow: Overwrites return addresses
• Heap-based overflow: Corrupts dynamic memory
• Integer overflow: Arithmetic operations exceed variable capacity
• Exploitation:
• Execute arbitrary code
• Privilege escalation
• System crash
• Protection: ASLR, DEP/XN, stack canaries, bounds checking
Time-of-Check to Time-of-Use (TOCTTOU) Flaws

• Definition: Condition changes between check and use

• Race Condition: Two processes access shared data
• Impact: Unauthorized access, privilege escalation
• Protection: Atomic operations, file locking, secure coding practices
 • Definition: Failure to validate all input
parameters
• Examples:
• Web forms accepting invalid data
• Missing parameter validation
Incomplete • Bypassing client-side validation
• Impact: Data corruption, unauthorized access,
Mediation SQL injection
• Protection:
• Input validation (server-side)
• Parameter checking
• Least privilege principle
 • Operating System Protection Mechanisms:
• Process isolation
• Memory protection
• Access control lists
• User/privilege separation
Controls Against • Hardware Support:
• Memory Management Units (MMU)
Program Flaws in • No-execute (NX) bit
Execution • Address Space Layout Randomization
(ASLR) support
• Administrative Controls:
• Least privilege principle
• Regular patching
• Configuration hardening
 • Memory Protection:
• Virtual memory
• Segmentation/paging
Operating • Read/execute permissions
• Process Management:
System • Process isolation

Support • Inter-process communication controls

• Resource quotas
Details • File System Security:
• Permissions (DAC, MAC)
• Encryption
• Auditing
 • Defense in Depth: Multiple layers of
security
• Secure Development Lifecycle
Program (SDL): Security integrated throughout
• Principles:
Security • Least privilege
• Defense in depth
Defenses • Fail securely
• Separation of duties
• Economy of mechanism
 • Design Phase:
• Threat modeling
• Security architecture review
• Secure design patterns

Software • Implementation Phase:

• Secure coding standards
Development • Peer code reviews
• Static analysis tools
Controls • Testing Phase:
• Dynamic analysis
• Penetration testing
• Fuzz testing
 • Static Application Security Testing
(SAST): Analyze source code
• Dynamic Application Security Testing
(DAST): Test running applications

Testing
• Fuzz Testing: Input malformed data to find
crashes

Techniques • Penetration Testing: Simulate real attacks

• Code Review: Manual inspection for
vulnerabilities
• Tools: OWASP ZAP, Burp Suite, Metasploit,
various SAST tools
 • Database Security Challenges:
• Data concentration
• Multiple access paths
• Complex privilege management
Database • Security Mechanisms:

Management • Authentication and authorization

• Encryption (at rest and in transit)
Systems • Audit logging
• Backup and recovery
Security • Common Threats:
• SQL injection
• Privilege escalation
• Data leakage
• Denial of service
 • Access Control:
• Role-based access control (RBAC)
• View-based access control

Database • Fine-grained access control

• Data Protection:

Security • Encryption (TDE, column-level)

• Data masking

Controls • Tokenization
• Monitoring:
• Database activity monitoring
• Audit trails
• Intrusion detection for databases
Chapter 3
Cryptography and
Encryption Techniques
What is Cryptography?
Cryptography: Art of secret writing (Greek: "kryptos" hidden +
"graphein" writing)

Cryptography is associated with the process of converting ordinary

plain text into cipher text and cipher text into plain text.

It is a method of storing and transmitting data in a particular form

so that only those for whom it is intended can read and process it.
 • Symmetric key cryptography: sender, receiver keys
identical
The language of • Public-key cryptography: encryption key public,
cryptography decryption key secret (private)
 • Well-known in network security world
Friends and • Biruk, Almaz (lovers!) want to communicate “securely”
enemies: Almaz, • Hellen (or Trudy, intruder) may intercept, delete, add messages
Biruk, Hellen
 • Plaintext: This is the original intelligible message
• Encryption: is a process of coding information
into a form that is unreadable without a decoding
Basic key.
o It requires two things key and encryption
Cryptography algorithm.
o This is a process in which a plaintext is
terms converted to a cipher text.
o It takes places at the sender’s side.
• Encryption algorithm: the encryption algorithm
performs various substitutions and
transformations on the plaintext.
 • Secret key: is a value that is used to encrypt or decrypt a
message.
o It is a numeric or alpha numeric text or may be special
symbols also.
o In cryptography the selection of key is important as security

Basic
depends on it.
o It can use symmetric or asymmetric algorithms.

Cryptography • Ciphertext: This is the scrambled message produced as output.

o It depends on the plaintext and the secret key.

terms • Decryption: is a process of converting a cipher text back into

a plaintext that the user can read and this happens at the receiver’s
side
o This also requires two things a key and decryption algorithm.
o It is a reverse process of encryption.
• Decryption algorithm: This is essentially the encryption algorithm
run in reverse.
o It takes the ciphertext and the secret key and produces the
original plaintext.
 • Symmetric Algorithm: is one in which the
encryption and decryption key are the same.
o It can also be a key that is easily calculated
Basic from the other.
o Before sending or communicating with each
Cryptography other the sender and the receiver must agree to
the key.
terms • Asymmetric Algorithm: is an algorithm in which
the key used in encryption is different from that of
the key used decryption.
o It is also known as public key cryptography.
• Private key: is normally known only to the owner.
o Messages can be encrypted using public key
and decrypted using private key.
 Cipher Techniques

• There are two basic cipher techniques: substitution and transposition.

• The goal of substitution is confusion; the transposition method is an attempt to make it
difficult(diffusion).
1. Substitution Cipher
• It is one in which the letters of plaintext are replaced by other letters or by numbers or
symbols.
• Replaces each letter in the message with a different letter, following some established
mapping.
• The following are example of a substitution cipher:-
[Link] cipher
[Link] cipher
[Link] cipher
 • In this approach, each letter is replaced with a letter some fixed
A. Caesar number of positions later in the alphabet. For example, if we
use a shift of 3, then the letter A would be replaced with D, the
cipher(shift cipher) letter 3 positions later in the alphabet.

Example 1: Use the Caesar cipher with shift of 3 to encrypt the message: “We ride
atnoon”
Solution: We use the mapping above to replace each letter. W gets replaced with
Z,and so forth, giving the encrypted message: ZH ULGH DW QRRQ.
 • Decrypt the message GZD KNK YDX MFW JXA if it
was encrypted using a shift cipher with shift of 5.
• Solution
• We start by writing out the character mapping by shifting
the alphabet, with A mapping to F, five characters later in
the alphabet.
A. Caesarcipher(shift
cipher)
• We now work backwards to decrypt the message. The
first letter G is mapped to by B, so B is the first character
of the original message. Continuing, our decrypted
message is
• BUY FIF TYS HAR ESA.
 • Relationship between cipher text symbol and plain
text symbol is 1:1.
• Key value is added to plain text and numeric value
of key ranges from 0 – 25.

B. Additive • Example:
Plain text(P) = H E L L

cipher O (H=7,E=4,L=11,L=11,O=14)
Key (K)=15
Cipher text (C)= 7+15,4+15,11+15,11+15,14+15
= 22,19,26,26,(29%26)=3
= W T A AD
 • The key stream is the repetition of the initial secret
key stream of length m. (1<=m<=26)
• •Example:
• Plaintext- A B C D E F G H
C. Vigener • K= 0, 5, 8

cipher • ABCDE FGH

• 0 58 0 5 8 0 5
(B=1 =>1+5=6=>G)

• 0 6 10 3 9 13 6 12
• A G K D J N G M <= ciphertext
[Link] Cipher
• Write the plaintext horizontally in fixed number columns and read
vertically to encrypt.
• The ancient Spartans used a form of transposition cipher.
• The following are transposition cipher:
[Link] transposition cipher
[Link] transposition cipher
A. Keyless transposition cipher
• Method-1: Text is written into the table row by row and then
transmitted column by column.
Example-1:
P = ‘meet me near the clock tower at twelve midnight
tonite’.

C =‘metowteioenhcewmgneeekreihitactaldttmrlotvnte’
A. Keyless
transposition
cipher
• Method-2: Text is written
into a table column by
column and transmitted
row by row
• Example-2:

Exercise: Apply transposition cipher and find the ciphertext message

using method-1 and method-2? plain-text message= meet me at the
park
 • Plaintext is divided into groups and permutes the
character in each group.
• Example:
Plaintext- “enemy attack at night”
Keys:
encryption 31452 decryption
B. Keyed 12345
transposition enemy attac katni ghtyz
(Group of 5 characters)
cipher
• Encryption: e e m y n t a a c t t k n i k t g y z h
• Decryption: e n e m y a t t a c k a t n i g h t y z
• Note:-the characters exceeding the length of
plaintext are discarded.
• Like y and z two characters are discarded
Cryptanalysis - The Art of Codebreaking

Types of Attacks: Attack Goals:

Ciphertext-only: Attacker has only ciphertext Total break (recover key)
Known-plaintext: Attacker has some Global deduction (find decryption algorithm)
plaintext-ciphertext pairs Instance deduction (decrypt specific
Chosen-plaintext: Attacker can encrypt message)
chosen plaintexts Information deduction (gain some plaintext
Chosen-ciphertext: Attacker can decrypt information)
chosen ciphertexts
Related-key: Attacker knows keys with
mathematical relationship
Cryptanalysis Techniques
• Frequency Analysis: Count letter frequencies (effective against monoalphabetic)
• Kasiski Examination: Find repeating patterns to determine key length (Vigenère)
• Index of Coincidence: Measure probability two random letters are same
• Differential Cryptanalysis: Study how differences in input affect output differences
• Linear Cryptanalysis: Find linear approximations of nonlinear components
• Side-channel Attacks: Measure timing, power consumption, electromagnetic leaks
Cryptographic
Systems
Overview
• Symmetric Key
Cryptography: Same key for
encryption and decryption
• Fast, efficient for bulk
encryption
• Key distribution problem
• Public Key Cryptography: Different
keys for encryption and decryption
• Solves key distribution
problem
• Slower, suitable for key
exchange and digital
signatures
Cryptographic Systems Overview
Symmetric Key Cryptography
• In symmetric-key cryptography, the same key is used by both parties(sender and
receiver).
• The sender uses this key and an encryption algorithm to encrypt data; the receiver uses
the same key and the corresponding decryption algorithm to decrypt the data.
• Requirements:
• Strong encryption algorithm
• Sender/receiver must have same secret key
• Key must be kept secret
• Types:
• Stream Ciphers: Encrypt bit-by-bit (RC4, Salsa20)
• Block Ciphers: Encrypt fixed-size blocks (DES, AES)
Stream Cipher
• Encrypts one bit or byte at a time using a keystream generated from
a key.
• Think of a stream cipher as a one-time pad with a pseudorandom
generator
• One-time pad: Truly random key, mathematically unbreakable
• Stream cipher: Pseudorandom key, computationally secure

Key → Keystream Generator → Keystream

↓
Plaintext (bit by bit) → XOR → Ciphertext

• Why It Works

Property: (A ⊕ B) ⊕ B = A
Encrypt: C = P ⊕ K
Decrypt: P = C ⊕ K
Block Cipher
• Encrypts fixed-size blocks of data (typically 64 or 128
bits) using the same algorithm and key.
• Analogy: Think of a block cipher as a strongbox with a
complex lock
• Fixed size input → fixed size output
• Same key opens/closes the box
• How It Works

Plaintext Block (n bits) → [Block Cipher] →

Ciphertext Block (n bits)
Key →────┘
Symmetric Key Cryptography Algorithms
• Data Encryption Standard (DES)
o Developed by IBM and adopted by NIST in 1977.
o Plaintext is processed in 64-bit blocks and 56-bit key length.
o It is block cipher and most widely used encryption algorithm.
• Triple DES (3DES)
o Nested application of DES with three different keys KA, KB, and KC.
o Effective key length of 168 bits (3 *56), making exhaustive search attacks unfeasible.
o C = EKC(DKB(EKA(P))); P = DKA(EKB(DKC(C)))
• Advanced Encryption Standard (AES)
o Selected by NIST in 2001 through open international competition and public discussion.
o 128-bit blocks and several possible key lengths: 128, 192 and 256 bits.
o Exhaustive search attack not currently possible.
o AES-256 is the symmetric encryption algorithm of choice.
General Structure
of DES
• Initial permutation
• 16 identical “rounds” of
function application, each
using different 48 bits of key
• Final permutation
The Advanced Encryption Standard (AES)
• In 1997, the U.S. National Institute for Standards and Technology (NIST) put out a public
call for a replacement to DES.
• It narrowed down the list of submissions to five finalists and chose an algorithm that is
now known as the Advanced Encryption Standard (AES).
• AES is a block cipher that operates on 128-bit blocks. It is designed to be used with keys
that are 128, 192, or 256 bits long, yielding ciphers known as AES-128, AES-192, and
AES-256.
AES Round
Structure
• The 128-bit version of the AES encryption
algorithm proceeds in ten rounds.
• Each round performs an invertible
transformation on a 128-bit array, called state.
• The initial state X0 is the XOR of the plaintext
P with the key K:
X0 = P XOR K.
• Round i (i = 1, …, 10) receives state Xi-1 as
input and produces state Xi.
• The ciphertext C is the output of the final
round: C = X10.
AES Rounds
• Each round is built from four basic steps:
1. SubBytes step: an S-box substitution step
2. ShiftRows step: a permutation step
3. MixColumns step: a matrix multiplication step
4. AddRoundKey step: an XOR step with a round key derived from the 128-bit
encryption key
Asymmetric Key
Cryptography

• In asymmetric or public-
key cryptography, there
are two keys: a private key
and a public key.
• The private key is kept by
the receiver. The public
key is announced to the
public.
Asymmetric Key Cryptography(Cont'd)
• In asymmetric (public key) cryptography, both communicating parties (i.e. both Almaz
and Biruk) have two keys of their own four keys total.
• Each party has their own public key, which they share with the world, and their
own private key
• The magic of public key cryptography is that a message encrypted with the public key can
only be decrypted with the private key.
• Almaz will encrypt her message with Biruk's public key, and even though Hellen knows
she used Biruk's public key, and even though Hellen knows Biruk's public key herself,
she is unable to decrypt the message. Only Biruk, using his secret key, can decrypt the
message assuming he's kept it secret, of course.
Asymmetric Key Cryptography(Cont'd)

• The key used to encrypt a message

is not the same as the key used to
decrypt it. Each user has a pair of
cryptographic keys – a public
encryption key and a private
decryption key.
• There are two public key
cryptography algorithms most
commonly used.
[Link]
[Link] Hellman
1. RSA(Rivest , Shamir , and Adelman
• The encryption and decryption uses modular exponentiation.
• Public key is more advance and being used for many years.
• RSA uses mathematical computation.
• RSA encryption uses a block cipher in which the plaintext and cipher text are integers between 0 and and n-1 for some n.
Key generation
• Step-1- Choose large prime numbers called p and q.
• Step-2- Calculate the value of n, n=p*q
• Step-3-Choose public key as e, such e is not the factor of (p-1)*(q-1)
• Step-4- Choose private key as d, such d*e mod (p-1) *(q-1)=1
Encryption
C= P^e mod n
Decryption
P= C^d mod n
Example
Key Generation
Step 1- For example small value of p and q are selected. But in real time p and q are very big prime
number.
p= 3 and q= 11
Step-2- Calculate the value of n
n=3*11= 33
Step-3- (p-1) *(q-1) = 2*10 = 20 Let public keys(e) =7
Step-4- d*e mod n , one solution is d= 3, [3*7 mod 20 = 1] Let private key(d) = 3
Encryption
C= 2^(7) mod 33 = 29
Decryption
P= 29^(3)mod 33 = 2
2. Diffie Hellman
• Diffe Hellman cryptography is based on key exchange. The both parties need to exchange
secrets key to encrypt message.
• It is based on difficulty of computing discrete logarithms.
• Example: Suppose the two parties Alice and Bob would to communicate and they have
decided to Diffe Hellman cryptography.
• Alice select prime modulus p=23 and g= 7.
• The two parties publishes p and g public meaning p and q are known to both parties.
• Alice randomly selects number x = 3
• Bob randomly selects number y= 6.
2. Diffie Hellman
• Alice will calculate the secret number (r1) as r1 = g^x mod p and sends to Bob.
=7^3 mod 23 = 21.
• Then, Alice will have r1 = 21 and send to Bob.
• Bob will calculate the secret number (r2) as r2 = g^y mod p and sends to Alice.
= 7^6 mod 23 = 4.
• Then, Bob will have r2 = 4 and send to Alice.
• Now they will both calculate the share or symmetric key (k).
• Alice will calculate k = 〖r1〗^x mod p,
= 4^3 mod 23 and k = 18.
• •Bob will calculate k = 〖r1〗^y mod p,
= 〖21〗^6 mod 23 and k = 18.
• The key k = 18 is same and both will use this key to send and receive data
 • When we use block cipher modes of operation?
Block Cypher o Block cipher only allow to encrypt entire blocks.
o When message is longer/shorter than the block size, we use
modes mode of operations.
o Algorithms that exploit a block cipher to provide a service
e.g. confidentiality.
Electronic Codebook Book (ECB)
• It is the simplest mode of operation.
• The plaintext is divided into N blocks and the block size is n bits.
• Same key is used to encrypt and decrypt each block.
• Each block is encoded independently of the other blocks
Ci = EK (Pi)

• Uses: secure transmission of single values

ECB
Scheme
Cipher Block Chaining (CBC)
• In CBC mode, each block of plaintext is XORed with the previous ciphertext block before
being encrypted.
• Solve security deficiencies in ECB
• Repeated same plaintext block result different ciphertext block
• Each previous cipher blocks is chained to be input with current plaintext block.
• To make each message unique, an Initial Vector (IV) must be used in the first block.
Ci = EK (Pi XOR Ci-1)
C0 = IV
• Uses: bulk data encryption, authentication
CBC
scheme
Example
Cipher FeedBack (CFB)
• Use Initial Vector to start process.
• Encrypt previous ciphertext , then combined with the plaintext block using X-OR
to produce the current ciphertext.
• Cipher is fed back (hence name) to concatenate with the rest of IV.
• Plaintext is treated as a stream of bits.
• Any number of bit (1, 8 or 64 or whatever) to be feed back (denoted CFB-1, CFB-
8, CFB-64).
• Relation between plaintext and ciphertext
Ci = Pi XOR SelectLeft(EK (ShiftLeft(Ci-1)))
C0 = IV
• Uses: stream data encryption, authentication.
CFB
Scheme
Output FeedBack (OFB)
• Very similar to CFB with one difference: each bit in the ciphertext is
independent of the previous bit or bits.
• It avoid error propagation and if an error is occur in transmission, it
doesn’t affect the bits that follow.
• Like CFB, both the sender and receiver use the encryption algorithm.
• Relation between plaintext and ciphertext.
Ci = Pi XOR Oi
Oi = EK (Oi-1)
O0 = IV
• Uses: stream encryption over noisy channels
OFB
Scheme
Counter (CTR)
• Encrypts counter value with the key.
• In this mode, no feedback.
• Counter for each plaintext will be different.
• An n bit counter is initialized to predetermined value(IV) and
incremented based on a predefined rule.
• Relation
Ci = Pi XOR Oi
Oi = EK (i)
• Uses: high-speed network encryptions
CTR
Scheme
Cryptographic Hash
Functions - The Digital
Fingerprint

• What is a Hash Function?

o A mathematical function that takes an input (message, file)
of any size.
o Produces a fixed-size output called a hash value, digest,
or "fingerprint."
o For cryptography, it must be a one-way function: easy to
compute, infeasible to reverse.
• Core Properties (The Security Trinity):
o Pre-image Resistance: Given a hash h, it's infeasible to
find any input m such that hash(m) = h.
o Second Pre-image Resistance: Given input m1, it's
infeasible to find a different input m2 with the same hash.
o Collision Resistance: It's infeasible to find any two distinct
inputs that produce the same hash.
MD4 Family
• MD4 (Message Digest 4): Designed by Ronald Rivest (1990). Fast, but serious
cryptographic weaknesses were found. Now obsolete and insecure.
• MD5 (Message Digest 5): Successor to MD4 (1991). Very fast and was widely used
for file integrity checks and password hashing (with salt).
• Status: Cryptographically broken. Collision vulnerabilities demonstrated (e.g.,
Flame malware). Not recommended for any security application.
• Legacy Use: Sometimes still used for non-cryptographic checksums (e.g., to
detect non-malicious file corruption).
SHA Family -
The Standard
ALGORITHM OUTPUT SIZ E STATUS

• Secure Hash Algorithm - Developed and standardized by SHA-1 160 bits Deprecated/Insecure
NIST.
Secure &
• SHA-0/SHA-1: Early versions. SHA-1 (160-bit output) was SHA-256 256 bits
widely used (TLS, SSL, PGP, Git). Now considered Recommended
insecure due to practical collision attacks.
• SHA-2 Family: The current workhorse. Defined by output Secure & Future-Proof
length:
SHA-3-256 256 bits
• SHA-256, SHA-384, SHA-512 (also SHA-224, SHA-
512/224, SHA-512/256).
• Strong, well-vetted, and widely adopted (TLS
certificates, blockchain).
• SHA-3 Family (Keccak): Winner of a public competition
(2006-2012). Based on a different sponge construction,
not an evolution of SHA-2. Provides an alternative for
long-term security.
RIPEMD Family
• RIPEMD (RACE Integrity Primitives Evaluation Message Digest): Developed in the
EU, similar in design to MD4/MD5.
• Variants: RIPEMD-128, RIPEMD-160, RIPEMD-256, RIPEMD-320.
• Key Feature: RIPEMD-160 produces a 160-bit hash. Less common than SHA-2, but
considered secure and is used in some specialized applications (e.g., Bitcoin uses
RIPEMD-160 within its address generation).
• Not as universally adopted as SHA-2, but a solid, niche alternative.
Public Key Infrastructure (PKI) - Managing
Digital Trust
• How do we trust that a public key truly belongs to the entity it claims to belong to
(e.g., [Link])?
• PKI is the Answer: A framework of policies, roles, hardware, software, and
procedures to create, manage, distribute, use, store, and revoke Digital
Certificates.
• Analogy: PKI is the digital equivalent of a passport issuance system.
• The Certificate Authority (CA) is the passport office.
• The Digital Certificate is the passport.
• The user's public key is the holder's identity inside the passport.
The Trusted Third Party (TTP)
• The cornerstone of PKI is the Trusted Third Party (TTP).
• In PKI, the primary TTP is the Certification Authority (CA).
• Role of the CA: To vouch for the binding between an identity (a person, server,
organization) and their public key.
• How? By digitally signing the entity's certificate. Everyone must trust the CA's root
certificate pre-installed in their browser/OS
Certification - The Digital ID Card
• What is a Digital Certificate?
o An electronic document that binds a public key to an identity.
o Follows the X.509 standard.
o Contents: Subject name, issuer (CA) name, subject's public key, validity period, issuer's
digital signature, and more.
• The Certification Process:
o Enrollment: Entity generates a key pair, sends a Certificate Signing Request (CSR) with
its public key and identity to a CA.
o Verification: The CA validates the applicant's identity (varies by assurance level:
Domain Validation, Organization Validation, Extended Validation).
o Signing: The CA creates the X.509 certificate and signs it with the CA's private key.
o Issuance: The signed certificate is delivered to the applicant.
Key Distribution - The Trust Chain
• PKI solves the key distribution problem for asymmetric crypto.
• Distribution Method: Public keys are distributed inside certificates.
• Verification: A client (like your browser) receives a server's certificate.
• It uses the CA's well-known, pre-distributed public key to verify the CA's
signature on the certificate.
• If the signature is valid and the certificate is trusted/not revoked, the server's
public key is trusted.
PKI Topology - Models of Trust
• How are CAs organized? Common trust models:
• Single/Monolithic CA: One CA issues all certificates. Simple but a single point of failure.
• Hierarchical PKI: A Root CA (offline, highly protected) signs Intermediate CAs, which issue
end-entity certificates. Scales well, allows delegation. (Most common web model).
• Mesh/Cross-Certification: Multiple CAs sign each other's certificates, creating a web of
trust. Complex but decentralized.
• Bridge CA (BCA): A central CA that acts as a hub to connect different hierarchical PKIs.
•
Enrollment & Revocation Procedures
• Enrollment: The process of requesting and obtaining a certificate (CSR -> Validation -> Issuance).
• Why Revocation? A certificate may need to be invalidated before its expiry due to:
o Private key compromise.
o Change of entity information.
o CA compromise.
• Revocation Mechanisms:
o Certificate Revocation List (CRL): A CA-published, signed list of serial numbers of revoked
certificates. Clients must check this list periodically.
o Online Certificate Status Protocol (OCSP): A protocol for a client to query a CA's server in
real-time: "Is certificate X valid?" Gets a signed response.
o OCSP Stapling: The server itself gets a fresh OCSP response from the CA and "staples" it to
the TLS handshake, improving privacy and performance.
Chapter 4
Network Security
What is Network Security?
• Network security is any activity designed to protect the usability and integrity(unity) of
network and data.
• It includes both hardware and software technologies.
• Today's network architecture is complex and is faced with a threat environment that is
always changing and attackers that are always trying to find and exploit vulnerabilities.
• Vulnerabilities can exist in a broad number of areas, including devices, data, applications,
users and locations.
• In network security, three common terms are used as:
[Link]
[Link]
[Link]
Network Security Components
• Essential Security Elements:
o Perimeter Security (Firewalls, Gateways)
o Network Segmentation (VLANs, Subnets)
o Access Control (NAC, AAA)
o Monitoring & Detection (IDS/IPS, SIEM)
o Encryption (Data in transit)
o Policies & Procedures
Threats on Network
• Threat Classification:
• By Intent:
• Malicious (Hacking, Malware)
• Accidental (Misconfiguration, Human Error)
• Environmental (Natural Disasters)
• By Source:
• External (Internet-based)
• Internal (Insider threats)
• Supply Chain
Threats on Network
• The people eager, willing and qualified to take
advantage of each security vulnerability, and they
continually search for new exploits and weaknesses.
• There are four main classes of threats on network:
[Link] threats
[Link] threats
[Link] threats
[Link] threats
Threats on Network
[Link] threats: implemented by a technically skilled person who is trying to gain
access to your network.
[Link] threats: created by an inexperienced/non-technical person who is trying to
gain access to your network.
[Link] threats : occurs when someone from inside your network creates a security
threat to your network.
[Link] threats: occurs when someone from outside your network creates a security
threat to your network.
Common Network Threats

Threat Category Examples Impact

Malware Viruses, Worms, Ransomware Data loss, system compromise

Eavesdropping Packet sniffing, MITM Confidentiality breach

DoS/DDoS SYN floods, UDP amplification Service disruption

Spoofing IP, MAC, DNS spoofing Unauthorized access

Social Engineering Phishing, Baiting Credential theft

Advanced Threats APTs, Zero-days Long-term compromise

Trust, Weaknesses, Risk & Vulnerabilities
• Trust: Assumption that system/components will behave as expected
• Weakness: Internal fault or deficiency in system
• Vulnerability: Weakness that can be exploited
• Risk: Potential for loss/damage due to threat exploiting vulnerability

• Relationship:
Weakness → Vulnerability → (Threat + Exploit) → Risk → Impact
 • Primary vulnerabilities in network
are:
1. Vulnerabilities in [Link] vulnerabilities
network [Link] vulnerabilities
[Link] policy vulnerabilities
1. Vulnerabilities in network
A. Technological Vulnerabilities
• Computer and network technologies have intrinsic(built-in) security weakness.
• TCP/IP protocol vulnerabilities- (HTTP, FTP are inherently unsecure)
• Operating system vulnerabilities- (Windows, Linux have security problems)
• Network equipment vulnerabilities - (routers, switches have security weaknesses)
B. Configuration Vulnerabilities
Network administrator need to correctly configure their computing and network devices to compensate.
• Unsecured user accounts - (information transmitted insecurely across network)
• System account with easily guessed passwords
• Unsecured default settings within products
• Misconfigured internet services - (untrusted sites on dynamic webpages)
• Misconfigured network equipment - (misconfiguration itself cause security problem)
1. Vulnerabilities in network
C. Security Policy Vulnerabilities
• The network can pose security risk if users do not follow the security policies.
• Lack of written security policy - (policies in booklet)
• Politics - (political battles makes it difficult to implement security policies)
• Lack of continuity - (easily cracked or default password allows unauthorized access)
• Logical access control - (imperfect monitoring allows unauthorized access)
• Disaster recovery plan nonexistent - (lack of disaster recovery plan allows panic (a
sudden fear) when someone attacks the enterprise.)
Risk Management Framework
• Identify Assets → Assess Vulnerabilities → Evaluate Threats → Calculate Risk →
Implement Controls → Monitor
• Risk Calculation: Risk = Threat × Vulnerability × Impact

• Control Types:
o Preventive (Firewalls, Encryption)
o Detective (IDS, Logging)
o Corrective (Patches, Backups)
o Deterrent (Warning banners, Policies)
TCP/IP Suite Weaknesses
• Inherent Protocol Vulnerabilities:
• IP Protocol:
• No authentication (IP spoofing)
• No encryption (eavesdropping)
• Predictable sequence numbers
• TCP Weaknesses:
• SYN flood attacks
• Session hijacking
• TCP sequence prediction
• UDP Issues:
• No connection state (DoS amplification)
• No verification
Specific TCP/IP Vulnerabilities

Protocol Weakness Attack Mitigation

ARP No authentication ARP poisoning Static ARP, DHCP

snooping

DNS Cache poisoning DNS spoofing DNSSEC, DNS over

TLS
ICMP Error reporting Smurf attack Rate limiting, filtering

HTTP Plaintext data Sniffing, MITM HTTPS (TLS/SSL)

SNMP Weak auth (v1,v2) Unauthorized SNMPv3, Firewall

access rules
 • What is a Buffer Overflow?
o Writing more data to buffer than it can hold
o Overwrites adjacent memory
o Can execute arbitrary code

Buffer
• Types:
o Stack-based
o Heap-based
Overflow o Integer overflow
o Format string
Attacks • Network Impact:
o Remote code execution
o Service disruption
o Privilege escalation
Network Security Protocols
OSI Model with Security Protocols:
7. Application → PGP, S/MIME, HTTPS
6. Presentation → SSL/TLS (initial)
5. Session → SSL/TLS
4. Transport → TLS, WTLS
3. Network → IPsec, VPNs
2. Data Link → WEP, WPA2, MAC filtering
1. Physical → Locks, CCTV, Faraday cages
Application Layer Security
• Purpose:
o Protect application-specific data
o End-to-end encryption
o User authentication
• Common Protocols:
o SSH (Secure Shell)
o HTTPS (HTTP over TLS)
o SFTP/FTPS (Secure file transfer)
o Secure LDAP
 • Core Technologies:
• SSL/TLS:
• Handshake protocol
• Record protocol
• Certificate verification

Web
• HTTP Security Headers:
• HSTS (Strict Transport Security)
• CSP (Content Security Policy)
Security • X-Frame-Options
• Web Application Firewalls (WAF)
• Common Vulnerabilities:
• Cross-Site Scripting (XSS)
• SQL Injection
• CSRF (Cross-Site Request Forgery)
 • Challenges:
o Store-and-forward architecture
o Multiple intermediaries
o Legacy protocols (SMTP plaintext)
• Solutions:

Email o PGP/GPG (End-to-end encryption)

o S/MIME (Certificate-based)

Security o STARTTLS (Opportunistic encryption)

o DMARC/DKIM/SPF (Anti-spoofing)
• Threats Mitigated:
o Eavesdropping
o Spoofing/phishing
o Malware distribution