Authentication protocols developed for PPP Point-to-Point Protocol

It established point to point / direct connection between two networking nodes.

Example, computer - to VPN, mobile to wifi device. The PPP protocol is used primarily

It support multiple authentication like

1. PAP (Password Authentication Protocol)

2. CHAP( Challenge Handshake Authentication protocol)

Password Authentication Protocol (PAP):

PAP is simple authentication protocol used to verify a user's identity over network using a
username and password

It is used in Dial-up, VPN

Weakness of PAP: Password is sent in plain text

Vulnerable to interception: Anyone eavesdropping on the connection can read the password

No protection against replay attacks: Someone can capture and resend valid credentials

Used in

Dial up connection, legacy systems

CHAP Challenge Handshake Authentication protocol

1. Client (Supplicant) wants to connect to the network.

2. Authenticator (e.g., Wi-Fi access point) sends a request for identity.

3. Client responds with identity.

4. Authenticator forwards this to a back-end server (usually RADIUS). Remote

Authentication Dial-in User Service

5. exchange begins

6. If authentication is successful, access is granted.

3. EAP Extensible Authentication Protocol

It is framework used for network access authentication. It provides support for wide range of
authentication methods like passwords, smart cards, certificates or bio metrics. It is widely
used in wifi, VPNs, PPP connections

Features of EAP

Extensible - adopt various authentication method

Flexible : can work with different devices ( wired, wireless, dial-up, VPN)

Easily integrate with RADIUS

A. Supplicant connects to the network.

B. Authenticator requests identity.

C. Supplicant sends identity.

D. Authenticator forwards it to the RADIUS server.

E. The RADIUS server selects an EAP method (e.g., EAP-TLS) and challenges the client.

F. Client responds.

G. Server verifies and sends EAP-Success or EAP-Failure.

H. Access is granted or denied.

Digital Signatures , Authentication and Application

Friday, July 18, 2025

4:25 PM

Authentication Process -

It is of verifying the identity of user, device or system before granting access to resources in a
secure environment

Key steps of the process

1. Identification: The user provides unique identifier (like user name, email, ID number,
etc.

2. Authentication ( Verification) : The system validates the identity by verifying

credentials like passwords, OTP, etc.

3. Access Grant or Denial: If the credentials are correct, access is granted otherwise
denied

Producing a secure authentication process that keep user safe online, only right people
should enter and wrong people should be kept out

In authentication, generally user name and password are asked to enter in order to validate
the user but it is not sufficient as they can be hacked. Digital signature is the process to
ensure authentication is well protected.

Authentication Protocol-

It is defined as how credentials are securely transmitted and validated, key protocols are

1. Password Authentication Protocol (PAP), very weak, sends user name and password
in the pain text

2. Challenge Handshake protocol / Point to Point protocol

3. Kerberos protocol

4. Oauth 2.0

Digital Signature

It is the process / technique which is used to validated the authenticity and integrity of the
message.
There are 4 aspects of a security : privacy, authentication, integrity and non-repudiation/
non-denial. The digital signatures takes care of last three

Basic concepts is to sign a document sign a whole document or is digest ( output of has
function)

Message Authentication protects two parties who exchange the messages from any third
part but does not protect two parties against each other

What MAC / Hash good at providing integrity, message is not altered and Authentication(
identification of sender)

What can't do: Non-repudiation

A and B are sharing key,

A sends message to B

Possible scenarios (limitation of MAC or hash)

B changed the message and hash code, A can't prove it rather no way to prove which
message has sent, it is possible both A and B share the same key

No Non -repudiation. There is no trust between sender and receiver. In order or gain the
trust digital signatures are introduced. They are analogous to hand written signature.

Digital signature should have following properties

1. It must verify the author, date and time of the signature

2. It must authenticate the contents at the time of signature

3. It must be verifiable by third parties to resolve the disputes

4. Digital function should include Authentication function

Requirements of the digital signatures

1. The signature must be a bit pattern that depends upon the message

1. Signature should change if the message changed

2. Prevents someone from reusing the same signature on a different message

3. Message : A pays $1000 to B, generates X1 as digital signature will change if

the message is changed
 2. The signature must use information unique to the sender to prevent forgery and
denial

1. This is achieved using sender's private key in the signature

3. Relatively easy to generate the signature( simple process)

1. Using RSA, it is sufficiently fast

4. It should relatively easy to recognize and verify the digital signature

1. Anyone with the public key should be able to verify the digital signature

5. It must be computationally infeasible to forge a digital signature

1. Should not create valid signature for different message

2. It should be one way function, no reverse engineer the private key

3. B message signed by A and signature, B should use the same signature and
recreate another message

6. It must back up the digital signature in order to retrieve it.

Process to
Genrate a key for Message Digest instead of whole message in order to get the good
efficiency

Digital Signature Standard : First draft came in 1991 and it is revised multiple times 1996,
2000. It was published by NIST National Institute of Standard and Technology. Last revision
came in the year 2009 and latest digital signature algos based on RSA

Their Approach : they uses algorithm that are designed to provide the digital signature not
for encryptions or key exchange. The algo uses public key technique

1. DSS is specifically designed for authentication and integrity, not confidentiality

2. Its job is to prove the origin and integrity of a message, not to hide it.

3. DSS is not a general-purpose cryptosystem like RSA which can do both encryption
and signing.
Global public key: These are global parameters present in the public key. In Difiie Hellman
(DH) we have prime number in public domain, g generator (primitive root modulo n). It is
160 bit prime number

Q is the prime divisor of (p-1)

If p is prime number, then (p-1)/q = 0

G = h pow ((p-1)/q) mod p ( h is integer between 1< h<p-1

--------------------------------------------------------------------------------------------------------------------------
-------------------

Sign(s,r) combines proves the message come from owner of the private key

Use Difiie Hellman algorithm to compute public and private key

1. Select x as private key

2. Generate public key X and Y X = g pow x mod q

X = g pow x mod q // public key

K is any integer 0<k<q

Signature

r = ((g pow k) mod p) mod q

S = k inverse * (H(M)+x.r) mod q

--------------------------------------------------------------------------------------------------------------------------
-------------------------------------

Verifying Function

Compute H = Hash(M') ; H' message received by receiver

Compute w = s' inverse mod q ; s' signature received at receiver end

Compute u1 = (H*W) mod q

Compute u2 = (r*W) mod q

Compute v = ((g pow u1 * X pow u2) mod p) mod q

v== r

Authentication Application

1. Kerberos

Kerberos authentication is currently the default authorization technology used by Microsoft

Windows,

Kerberos has made the internet and its denizens more secure, and enables users to do more
work on the Internet and in the office without compromising safety.

Kerberos protocol overview

Here are the principal entities involved in the typical Kerberos workflow:

Protocol overview

Core components

Client. The client acts on behalf of the user and initiates communication for a service
request Server.

The server hosts the service the user wants to access

Authentication Server (AS). The AS performs the desired client authentication. If the
authentication happens successfully, the AS issues the client a ticket called TGT (Ticket
Granting Ticket). This ticket assures the other servers that the client is authenticated

Key Distribution Center (KDC). In a Kerberos environment, the authentication server

logically separated into three parts: A database (db), the Authentication Server (AS), and the
Ticket Granting Server (TGS). These three parts, in turn, exist in a single server called the Key
Distribution Center
Ticket Granting Server (TGS). The TGS is an application server that issues service tickets as a
service

Three secret keys are used in the protocol

Client/user. Hash derived from the user's password

TGS secret key. Hash of the password employed in determining the TGS

Server secret key. Hash of the password used to determine the server providing the service.

1. Client request for an authentication ticket

2. KDC verifies the credentials and return encrypted TGT

3. The TGT is encrypted using the Ticket Granting Service (TGS) secret key

4. Client Stores TGT, on expiry it again request for TGT

5. Client sends the current TGT to TGS with server princiapl name (SPN) of the service
of the resource that client wants to access it

6. TGC sends a valid session key

7. Client forward valid session key to server to access it

FIPS - Federal Information Processing Standards

Monday, August 11, 2025

10:59 AM

US government standard that specifies the Digital Signature Standard

Purpose

1. Authenticity

2. Integrity

3. Use government approved algorithms

4. Use standard parameters like key size, parameter generation, signature

creation/verification process
X509

Tuesday, August 5, 2025

10:53 PM

Certificate Structure

• Version: Indicates the version of the X.509 standard being used (usually 1, 2,
or 3).

• Serial Number: A unique integer assigned by the certificate authority (CA) to

identify each certificate.

• Signature Algorithm: Specifies the algorithm used by the CA to sign the

certificate.

• Issuer: The distinguished name (DN) of the CA that issued the certificate.

• Validity Period: The time interval (Not Before, Not After) for which the
certificate is valid.

• Subject: The distinguished name (DN) of the entity for whom the certificate is
issued.

• Subject Public Key Info: Contains details of the subject's public key, including
the algorithm and the actual public key value.

• Certificate Signature: The digital signature of the certificate, ensuring its

authenticity. - Version 1

• Issued Unique Id

• Subject Unique Id - Version 2

• Extensions - Version 3
Certificate Details

Issuer Details
Serial Number Details

Public Key and Digital signature information

Extensions

Subject Alternative Names

All URLs can be used the same certificate.

Public Key usage - how key is used to encrypt data or another keys etc.

Basic Constraints - CA Authority - YES/ NO

Certificate Chains

Why multiple certificate are required or rather need for intermediate certificates

One of the main reason is to protect the CA private key ( CA certificate).

Trust path verification: Adding extra layer of authentication, makes it more secure.

Intermediate certificate mitigate the risk of compromising the large number of clients
authentication

Keeping CA root private key in the secure place and not getting expose on the network.
Hierarchy chain

Revocation:

X.509 certificates that must be invalidated before their Not Valid After date may be revoked.
As mentioned above, RFC 5280 profiles certificate revocation lists (CRLs), time-stamped lists
of revoked certificates that can be queried by browsers and other client software.

PKI - Public Key Infrastructure

PKI - public key infrastructure : It is framework of technologies, policies , and processes

Refers to Asymmetric cryptography. The “public key” is central because it enables

encryption, authentication, and digital signatures without sharing private secrets. It is
backbone SSL/TLS, digital certificates and code signing etc

Components present in the PKI

Certifying Authority (CA) As discussed above, the CA issues certificate to a client and assist
other users to verify the certificate. The CA takes responsibility for identifying correctly the
identity of the client asking for a certificate to be issued, and ensures that the information
contained within the certificate is correct and digitally signs it.

Key Functions of CA The key functions of a CA are as follows −

• Generating key pairs − The CA may generate a key pair independently or

jointly with the client.

• Issuing digital certificates − The CA could be thought of as the PKI equivalent

of a passport agency − the CA issues a certificate after client provides the
credentials to confirm his identity. The CA then signs the certificate to prevent
modification of the details contained in the certificate.

• Publishing Certificates − The CA need to publish certificates so that users can

find them. There are two ways of achieving this. One is to publish certificates
in the equivalent of an electronic telephone directory. The other is to send
your certificate out to those people you think might need it by one means or
another.

• Verifying Certificates − The CA makes its public key available in environment

to assist verification of his signature on clients’ digital certificate.

• Revocation of Certificates − At times, CA revokes the certificate issued due to

some reason such as compromise of private key by user or loss of trust in the
client. After revocation, CA maintains the list of all revoked certificate that is
available to the environment.

Classes of Certificates

There are four typical classes of certificate −

Class 1 − These certificates can be easily acquired by supplying an email address.

Class 2 − These certificates require additional personal information to be supplied.

Class 3 − These certificates can only be purchased after checks have been made about the
requestor’s identity.

Class 4 − They may be used by government

Registration Authority:
(RA) CA may use a third-party Registration Authority (RA) to perform the necessary checks
on the person or company requesting the certificate to confirm their identity. The RA may
appear to the client as a CA, but they do not actually sign the certificate that is issued.

Certificate Management System (CMS):

It is the management system through which certificates are published, temporarily or

permanently suspended, renewed, or revoked. Certificate management systems do not
normally delete certificates because it may be necessary to prove their status at a point in
time, perhaps for legal reasons. A CA along with associated RA runs certificate management
systems to be able to track their responsibilities and liabilities.

Private Key Tokens:

Digital Signatures and Authentication and While the public key of a client is stored on the
certificate, the associated secret private key can be stored on the key owner’s computer. This
method is generally not adopted. If an attacker gains access to the computer, he can easily
gain access to private key. For this reason, a private key is stored on secure removable
storage token access to which is protected through a password. Different vendors often use
different and sometimes proprietary storage formats for storing keys. For example, Entrust
uses the proprietary .epf format, while Verisign, GlobalSign, and Baltimore use the standard
.p12 format.

Key Management

Thursday, July 10, 2025

12:16 PM

Explain different types of algorithm modes in details.

Explain with neat diagram working of DES algorithm.

Explain the process involved in AES.

Explain multiple DES.

Keys are very sensitive entity in the data / information cryptography

One has the ensure that keys are remain the safe hands and stored in the safe place to
ensure the privacy
Key management forms the basis of all data security. Any mis use of key leads to exposure to
illegal access to the data and network

Key management is the process putting certain standards in place to ensure the security of
cryptography

Key management is the to deal with creation, exchange, storage , deletion and refreshing of
the keys, life of cycle of the key.

DIFFIE - HeLLMAN (DH) key exchange

First of all is to share symmetric key not asymmetric keys

In symmetric sender and receive uses only one key for both encryption and decryption. It
needs to pass securely

As per this algo

User A is sender and User B is a receiver

They agree on two number g and n 1<g<n

User A choose random number x ( this number only A knows it and does not share even with
B

Calculates X = g pow x mod n

Similary B choose number y, b does not share with the A

X and Y are exchanged between two users

Calculates Y = g pow y mod n

A computes k1 = Y pow x mod n

B computes k2 = X pow y mode n

You will always get k1 and k2 are same. Hence it is key

Here only numbers are shared between two users, keys are generated in house

This algorithm is only for generate key and not for encryption and decryption

OSI Security Architecture

Saturday, June 21, 2025

8:41 PM

Security Attacks --> Security Mechanisms -->Security Service

Security Attacks

The action which compromised / break information security of the organization

Mechanism: It is process by which prevent the attacks, identify the attacks, or recover from
the attacks

Service : like a tool or process to prevent the attacks, planned to counter security trends etc

Passive Attacks

Attacks which are learn or make use of information from the system but does not affect the
resource of the system

The goal of the attacker is to get information that being transmitted. Attackers passively
monitors the data being passed through network. Eavesdropping where attacker listen in on
the network

Release of the message content: Monitoring email, phone calls, text messages, stealing
sensitive information from the network
Traffic Analysis: In case attackers observe the amount of the data being sent, frequency of
the data being passed, location of sender and receiver. This information is also valuable for
attackers.

Active Attacks

Permutations and Substitutions

Thursday, July 17, 2025

7:39 PM

Substitution :

It replaces one symbol, bit or byte with another

A->M

B-.>9

1->0

Examples of substitutions

Ceaser Cipher, S-Box (Substitution Boxes) DES and AES

Swap the value for something

Permutation:

Rearranges the position of the elements without change the value

Original bits 1 0 1 1

Rule / key 3412

After 1110

Used in : DES, AES MixColumns, ShiftRows

DES - Data Encryption Standard

Saturday, June 21, 2025

10:50 PM

DES Overall Block Diagram

Symmetric Block Cipher

Data Encryption Standard A.K.A

Next generation algorithm is Advance Encryption Standard

It is based on Feistel Structure Design

Block Size fixed 64 bits

Output 64 bits Cipher

Main Key - 64 bits

Sub key - 56 bits (8 bits parity)

Round Key - 48 bits

Number of Rounds 16

Data Encryption Standard

Round details - Mangler Function (F) Expansion Permutation, XOR, Keyed Substitution,
Transposition
Expansion Permutation ( 32 bits input converted to 48 bits output)

48 bits after expansion permutations

S1 - Substitution Box total 8 S-boxes, each box takes 6 bits as an input and return it 4 bits (48
bits gets converted to 32 bits)

Input - 101010

1st and last bit is the row 10

0101 is the column

000 000 001 010 010 011 011 011 011 011 011 011 011 011 011 011
0 1 0 0 1 1 1 1 1 1 1 1 1 1 1 1

0 12 11 12 11 12 11 12 11 12 11 12 11 12 11 12 11
0

0 3 2 3 2 3 2 3 2 3 2 3 2 3 2 3 2
1

1 1 6 1 5 6 6 1 6 1 6 1 6 1 6 1 6
0

1 5 7 5 7 5 7 5 7 5 7 5 7 5 7 5 7
1

Number 6 is converted to binary 0110

Transposition / Permutation

Same as Initial Permutation only difference is that it is taking 32 bits input instead of 64 bits

Since Substitution and Transposition present then it is adding confusion and diffusion there
in the DES

DES Key Expansion

Bring down 64 bits to 56 bits, get rid parity bits(last bit of every byte)

Key generation for every round

Divide 56 bits key into 2 blocks LF and RF

Each half goes through Left Shift process ( For rounds 1,2,9,16 left shift will be 1 and
remaining rounds LS will be 2 bytes)
DES Decryption

It is reverse of the encryption, cipher text as input and plain text as output and we change
the order of keys

For Round 1 - pass key16, round 2 - key15 …. Round 16 - key1

P-Box

DES - Data Encryption Standard Example

Saturday, June 21, 2025

10:50 PM
Example

Plain Text = HELLOWORD

Block 1 HELLOWOR, BLOCK 2 = 2 DXXXXXXX

HELLOWOR

01001000 01000101 01001100 01001100 01001111 01010111 01001111 01010010

Block 2

01000100 01011000 01011000 01011000 01011000 01011000 01011000 01011000

Step 1 Initial Permutation

+----+----+----+----+----+----+----+----+

| 58 | 50 | 42 | 34 | 26 | 18 | 10 | 2 |

+----+----+----+----+----+----+----+----+

| 60 | 52 | 44 | 36 | 28 | 20 | 12 | 4 |

+----+----+----+----+----+----+----+----+

| 62 | 54 | 46 | 38 | 30 | 22 | 14 | 6 |

+----+----+----+----+----+----+----+----+

| 64 | 56 | 48 | 40 | 32 | 24 | 16 | 8 |

+----+----+----+----+----+----+----+----+

| 57 | 49 | 41 | 33 | 25 | 17 | 9 | 1 |

+----+----+----+----+----+----+----+----+

| 59 | 51 | 43 | 35 | 27 | 19 | 11 | 3 |

+----+----+----+----+----+----+----+----+

| 61 | 53 | 45 | 37 | 29 | 21 | 13 | 5 |

+----+----+----+----+----+----+----+----+

| 63 | 55 | 47 | 39 | 31 | 23 | 15 | 7 |

+----+----+----+----+----+----+----+----+

Before - Plain Text

01001000 01000101 01001100 01001100 01001111 01010111 01001111 01010010

After

11111111 10100000 01111110 01110010 00000000 00000000 01011101 11110000

Step 2 : Divide the string into 2 parts ( LTP Left Plain Text, RTP Right Plain Text)

LTP = 11111111 10100000 01111110 01110010

RTP = 00000000 00000000 01011101 11110000

Step 3 : Key Transformation

Key= SECRET12. This is 64 bits key, to make it 56 bits( this by taking first 7 bits in each byte

01010011 01000011 01000101 01010010 01000101 01010100 00110001 00110010

56 - bits

0101001 0100001 0100010 0101001 0100010 0101010 0011000 0011001

Divide into 2 parts 28 bits for each part

0101001010000101000100101001

0100010010101000110000011001

One more time bits shuffle, rotating the bits by 1 e.f 1010 become 0101 pick any 48 bits ask
key. In DES key size if fixed 48 bits

1010010100001010001001010010

1000100101010001100000110010

101001010000101000100101 This process is called compression permutation

100010010101000110000011

Step 4 Expansion Permutation , this is required because Key length is 48 and input is 32 bits (
right half of the plain text) to match 32 bits with 48 bits we need this process so that they
can be XORed

We need to add 2 bits in each byte in RPT so that it can extend to 48

RTP=00000000 00000000 01011101 11110000

Divide it into 4 bits block

0000 0000 0000 0000 0101 1101 1111 0000

Last bit of previous block, insert to next block first bit

0000 00000 00000 00000 00101 11101 11111 10000

Next byte 1 st bit insert into previous byte last bit

RTP 48 bits = 000000000000000000000000001011111011111111100000

RTP XORed 48 bit key

000000000000000000000000001011111011111111100000

101001010000101000100101100010010101000110000011

101001010000101000100101101001101110111001100011

S- Box Substitution

After applying S-box substitution 48 bits will reduce to 32 bits , each box will produce and
combine all the value, we get

10100101000010100010010110100110

p-box permutations

It is similar to step1. In step1 w have 64 bits p-table, in this process we will take 32 bits p-
table

p-table

00000000110000100110011011111001

Step 5

We have LPT which is have not process and it is 32 bits

LPT is XORed with above output and

11111111011000100001100010001011
RPT1 = 11111111011000100001100010001011

LTP1 = 00000000000000000101110111110000 // Old RTP

This process continues for round 16

Final Permutation: After all round 16, Final permutation is performed only once, simple
transposition is performed only once.

Multiple Encryptions

Saturday, June 28, 2025

9:01 PM

Potential weakness of DES

1. Using brute force method, it can be broken and with modern hardware, high power
CPUs, it can be easily broken

Methods to enhance it

Multiple encryption means encrypting the data multiple times, often using multiple keys or
algorithms

Most common cases are

1. Double Encryption

2. Triple Encryption

3. Cascade Encryption

Double encryption : data encrypted multiple time using two different keys
Triple encryption with three keys (K1,K2 and K3)

Why is still symmetric cryptography?

Plain Text = 10

Key1 = 3

Key2 = 8

Key3 =9

Encryption

C1 = E(K1,PI) = PI+K1

C1= (3,10) = 13

C2=D(Key2,C1) = C2= C1-key2 = 13-8=5 5

C2 = D(8,13) = 13-8 - 5

C3 = E(Key3,C2)

C3 = C2+key3 = 5+9 = 14

Final CT = 14
Decryption

P1 = D(CT,key3) Ct-Key = 14-9 = 5

P2 = E(P1, Key2) = P1+Key2 = 5+8 = 13

P3 = D(P2,key3) P3 = P2-Key1 = 13-3 = 10

Triple DES with two keys ( Key1 is used in multiple encryptions instead key3)

Encryption - Decryption - Encryption ( Encryption)

Decryption - Encryption - Decryption ( Decryption)

AES - Advanced Encryption Standard

Saturday, June 28, 2025

10:33 PM

AES-128 has 10 rounds and 1 initial round

It requires 11 keys ( 10 keys for each round and 1 for initial round)

In AES, plain text length = 128 bits

Key is also 128 bits

Key length can be 128,192,256.

AES operates on words, generally

1 word = 32 bits in most of the cases but in some cases 64 bits or 16 bits

Word is natural unit of the data

In AES, key length = 128 bits = 4 words

Key expansions

Key size is 128 bits, this process generate 10 keys for each round and 1 key for initial phase
AES Advanced Encryption Standard

Sunday, July 6, 2025

7:26 PM

Advance Encryption Standard

1.

2. Block cipher encryption

standard

3. Symmetric key algorithm

4. Plain Text block size 128

bits(16 bytes)

5. Key - three types of keys

a. 128 bits
 b. 192 bits

c. 256 bits

6. It is multi round encryption

algorithm, its round depends
om key size

Key Size Rounds

128 bits 10

192 bits 12

256 bits 14

7. 1 byte - 8 bits

8. 32 bits - 4 bytes - 1 word

9. Word is new type used in AES

extensively

10. It supersedes the DES ( Data

encryption standard)

11. AES is used in Scan disk (USB

and hard disk)

12. Western Digital store uses 256

bits AES

13. Apple website has references

of using AES

14. Round 1 to N-1

a. Substitute Bytes

b. Shift Rows

c. Mix Columns

d. Add Round Key

15. Round N

a. Substitute Bytes

b. Shift Rows
 c. Add Round Key

16. Step 1 - Substitute Key

a. Input State array (o/p

pre round add round
key

17. Step 2: Shift rows

a. Input = o/p of
substitution

2: Shift Rows

3. Column Mix
 4. Add Round Key

Message Authentication

Saturday, July 12, 2025

6:00 PM

Message Authentication and Hash functions

In this chapter we will cover

1. Importance of a message authentication

2. what is message authentication?

3. Types of message authentication

 4. Hash Function

Cryptography provides good encryption or decryption to a data so data is very much remain
secure between two parties. Hackers intentions is not about reading in the information but
creating disrupt by stealing, delay in sending the data, corrupting the data, changing the
data. Encryption / decryption does not prevent it.

What is the solution?

Solution lies in the authenticating the message. What is authentication? Person is carrying
the identity and mechanism to verify the identify. Combining these it is called authentication

In the context of the message, how is the authentication works. Sender generate the
message identity and passes along with message, receiver also has a capability to generate
same identity and verify the identity that is coming along with the message and compare it.
If both are same message is authenticated otherwise failed to authenticate

Why need of this requirement ? The following attacks were discovered or observed

1. Disclosure: Release of message contents to any person or process not possessing the
appropriate cryptographic key.

2. Traffic analysis: Discovery of the pattern of traffic between parties. In a connection

oriented application, the frequency and duration of connections could be
determined. In either a connection-oriented or connectionless environment, the
number and length of messages between parties could be determined.

3. Message insertion: Insertion of messages into the network from a fraudulent source.
This includes the creation of messages by an opponent that are purported to come
from an authorized entity. Also included are fraudulent acknowledgments of
message receipt or non-receipt by someone other than the message recipient.

4. Content Modification: Changes to the contents of a message, including insertion,

deletion, transposition, or modification.

5. Sequence modification: Any modification to a sequence of messages between

parties, including insertion, deletion, and reordering.

6. Timing modification: Delay or replay of messages. In a connection orientated

application, an entire session or sequence of messages could be a replay of some
previous valid session, or individual messages in the sequence could be delayed or
replayed.
 7. Denial of receipt: Denial of receipt of message by destination or denial of
transmission of message by source.

Message Authentication is the process to verify that received messages come from valid
source and have not modified. It is one step ahead of cryptography where it checks the
message integrity

Any Message Authentication mechanism can be viewed having two fundamental levels

1. Low level: At low level there is some sort of function that produces an authenticator:
value to be used to authenticate a message

2. protocol (SSL,TLS) uses the same function at receiver end verify the authenticity of a
message

Authentication Functions

1. Message Encryption

2. Message Authentication Code

3. A Hash Function

Message Encryption limitations, why need arises to have separate authentication method
other than just a encryption and decryption. Two main challenges in symmetrical encryption

1. Key management, sender and receiver both should know the key before any data
transmit, it requires secure key establishment.

2. Trust: Since the sender and the receiver use the same symmetric key, there is an
implicit requirement that the sender and the receiver ‘trust’ each other. For example,
it may happen that the receiver has lost the key to an attacker and the sender is not
informed. These two challenges are highly restraining for modern day
communication. Today, people need to exchange information with non familiar and
non-trusted parties. For example, a communication between online seller and
customer. These limitations of symmetric key encryption gave rise to asymmetric key
encryption schemes.

3. Public-key cryptosystems have one significant challenge − the user needs to trust
that the public key that he is using in communications with a person really is the
public key of that person and has not been spoofed by a malicious third party.
 4. To solve the problem multi-layer authentication is used with two sets public and
private keys (EOB)

Message Authentication Code, is called MAC

1. MAC algorithm is symmetric key cryptography technique to provide message

authentication

2. For establishing MAC process, sender and receiver share a symmetric key K

3. Essentially, a MAC is an encrypted checksum generated on the underlying message

that is sent along with a message to ensure message authentication. Checksum is
value calculated from the block of the data to detect the errors during data
transmission or storage

1. The sender uses some publicly known MAC algorithm, inputs the message and the
secret key K and produces a MAC value.

2. Similar to hash, MAC function also compresses an arbitrary long input into a fixed
length output. The major difference between hash and MAC is that MAC uses secret
key during the compression.

3. The sender forwards the message along with the MAC. Here, we assume that the
message is sent in the clear, as we are concerned of providing message origin
authentication, not confidentiality. If confidentiality is required then the message
needs encryption.

4. On receipt of the message and the MAC, the receiver feeds the received message
and the shared secret key K into the MAC algorithm and re-computes the MAC value.

5. The receiver now checks equality of freshly computed MAC with the MAC received
from the sender. If they match, then the receiver accepts the message and assures
himself that the message has been sent by the intended sender.
 6. If the computed MAC does not match the MAC sent by the sender, the receiver
cannot determine whether it is the message that has been altered or it is the origin
that has been falsified. As a bottom-line, a receiver safely assumes that the message
is not the genuine.

Limitation of MAC

1. Establishment of Shared Secret.

a. It can provide message authentication among pre-decided legitimate users

who have shared key.

b. This requires establishment of shared secret prior to use of MAC.

2. Inability to Provide Non-Repudiation

a. Non-repudiation is the assurance that a message originator cannot deny any

previously sent messages and commitments or actions.

b. MAC technique does not provide a non-repudiation service. If the sender and
receiver get involved in a dispute over message origination, MACs cannot
provide a proof that a message was indeed sent by the sender.

c. Though no third party can compute the MAC, still sender could deny having
sent the message and claim that the receiver forged it, as it is impossible to
determine which of the two parties computed the MAC.

Hash Function

A hash function is a mathematical process or formula that holds a critical role in public key
cryptography

1. It securely store the database passwords

2. Ensuring the data integrity by ensuring the data has not been altered

3. Hash is like fingerprint. It converts plain data of any size convert it to unique cipher
text of a specific length

4. Make secure authentication

Plain Text ------------------------>> SHA-2 -----------------------> fee76hhshsuth (hash code)

Properties of strong hash algorithm

Determinism — A hash algorithm should be deterministic, meaning that it always gives you
an output of identical size regardless of the size of the input you started with. This means
that if you’re hashing a single sentence, the resulting output should be the same size as one
you’d get when hashing an entire book.

Pre-Image Resistance — The idea here is that a strong hash algorithm is one that’s preimage
resistance, meaning that it’s infeasible to reverse a hash value to recover the original input
plaintext message. Hence, the concept of hashes being irreversible, one-way functions.

Collision Resistance — A collision occurs when two objects collide. Well, this concept carries
over in cryptography with hash values. If two unique samples of input data result in identical
outputs, it’s known as a collision. This is bad news and means that the algorithm you’re
using to hash the data is broken and, therefore, insecure. Basically, the concern here is that
someone could create a malicious file with an artificial hash value that matches a genuine
(safe) file and pass it off as the real thing because the signature would match. So, a good and
trustworthy hashing algorithm is one that is resistant to these collisions.

Avalanche Effect — What this means is that any change made to an input, no matter how
small, will result in a massive change in the output. Essentially, a small change (such as
adding a comma) snowballs into something much larger, hence the term “avalanche effect.”

Hash Speed — Hash algorithms should operate at a reasonable speed. In many situations,
hashing algorithms should compute hash values quickly; this is considered an ideal property
of a cryptographic hash function. However, this property is a little more subjective. You see,
faster isn’t always better because the speed should depend on how the hashing algorithm is
going to be used. Sometimes, you want a faster hashing algorithm, and other times it’s
better to use a slower one that takes more time to run through. The former is better for
website connections and the latter is better for password hashing.

Usage of hash in real world ( examples)

1. Ensure data integrity

User A sends an digitally signed email to User B over public network.

These public networks are very insure

Attacker fetches the email and make the changes and resend it (At this point), document is
tampered and hash got changed, since the document modified after it signed it can't be
trusted so data integrity is ensures
 2. Secure Against Unauthorized Modifications

Hashing is used to does not prevent from the modification of the data but it detects the
modification has happened and alert user. Think about it as smoke detector, it detects but
does not prevent it

3. Helps in securely store the password

Typically websites converts the passwords to hash code and store it securely. Nowadays,
almost all websites stores user passwords

4. Different speeds as per the purpose

Different hash functions serve different purpose depending upon their design and hash
algorithm

Password hashing - slow speed password where security is most important

Cryptographic hashing : medium, less secure nut requires more speed as data flows over the
net

Data structure, hash table, load balancing. Least secure but requires faster processing.

How hashing works

If the message is more than specified block length still it is going to create only 1 hash.

SHA -512, block size length is say 256, and message is around 10 MB , still there is going to
only one single hash.
Security of Hash Functions and MAC

Brute-Force Attacks

These attacks don’t rely on any weakness in the algorithm but rather try all possible
combinations until a desired result found, for Hash functions and Mac this includes.

Good hash function makes it:

Easy to compute the hash from input

Very hard to guess the input from the hash (One way)

Very hard to find two inputs with the same output(Collision resistance)

1. One-way:

a. Given a hash value h, find a message m

such that H(m) = h

b. For an n-bit hash, it takes about 2^n attempts

2. Weak collision resistance:

a. Given message m1, we need find out another message m2,such that H(m1) =
H(m2)

b. Same difficulty level 2^n

3. Strong collision resistance:

a. It is computationally infeasible to find any pair(x,y) such that H(x) = H(y) by

2^n/2

b. It provides strong encryption but at same time it is harder to protect.

c. 128 bit code in adequate n = 7, it will be break in 16 rounds so harder to

protect

Attacks on MAC

1. Brute Force ( Key recovery Attack)

a. Find the secrete key used in the MAC generation , try all possible keys and
find one which is generating the same MAC code for known message

b. 128 bits keys, it requires 2^128 attempts, very hard to break

 2. MAC forgery ( guessing MAC)

a. Guess the MAC randomly, chance of success is 1/(2^n). Almost infeasible for
128 bits

3. Strongest resistance:

a. Try to find out two messages that generate the same mac code. Requires
2^n/2 attempts to break

b. 64 bits mac is not safe.

Common Cryptographic Hash Functions by Output Size

Different types of hash functions in sizes

1. Output Size - 64, 128,160,256, 384,512 bits

2. Design Family - MD, SHA, BLAKE, RIPMD

3. Purpose - Cryptography vs Non- Cryptography

Output Size Hash Functions(Examples) Details

64. Bits Earlier version, not safe for Low security, used hashing in
cryptography hash table

128 bits MD5 Broken, not secure for

cryptography

160 bits SHA-1 Weak, collision found

256 bits SHA-256 Secure, widely used

384 bits SHA- 384 Advance version of SHA-256

512 bits SHA - 512 Stronger hashes, used for

higher security

Secure Hash Algorithm (SAH - A)

It is developed by National Institute of Standard and Technology. SHA - 1 produces 160 bit
output

Block Size = 512 bits

The message is divided in the following blocks

1. Message

2. Append Padding

3. Append Message length

Message length 512 bits, words = 512/32 = 16 words

Initialize 5 32 bits registers(A,B,C,D,E) and their values are

A = 67452301 B = EF CDAB89 C = 98BADCF E D = 10325476 E = C3D2E1F0

In each round buffer gets updated and store the intermediate results and o/p of previous
round is input to the next round

Initial Buffer A (32 bits) B (32 bits) C (32 bits) D (32 bits) E (32 bits)

Value 67452301 EFCDAB89 98BADCFE 10325476 C3D2E1F0

Constants K1t(R0-R19) K2t(R20-R39) K3t(R40-R59) K4t(R60-R79)

Value 5A827999 6ED9EBA1 8F1BBCDC CA62C1D6

The module consists of 4 steps and each step has 20 rounds

Step 1 0 -19 rounds

Step 2 20-39 rounds

Step 3 40-59 rounds

Step 4 60-79 rounds

Message ---> MSA(Message Scheduling Algorithm) ------> word

It converts 512 bits to 16 words

W0 to W15 will directly come from the message

Wt16= Wt-16 XOR Wt14 XOR Wt-8 XOR Wt-3

W16 = W0 XOR W2 XOR W8 XOR W13

F(1) = (b AND c) OR ((NOT b) AND d)

F(2) = b XOR c XOR d

F(3) = (b AND c) OR (b AND d) OR (c AND d)

F(4) = b XOR c XOR d

HMAC - Hash MAC function

We apply hash function on MAC, we will get HMAC

We will be using SHA -256

Block size : 512 bits - 64 bytes

Key Size : 64 bytes

Case

Key < 512, append 0s

Key = 512, no change

Key > 512, hash(key) = 160 bits and append 0 till 512 bits

Message "abc" 616263

Key : "key" 6b6579

iPad = 0x36 repeat 64 times

oPad = 0x56 repeat 64 times

Compute Inner Key s1 = iPad xor key

Compute Outer Key s2 = oPad xor key

innerInput = s1 || message = s1 || abc ( or means append abc to s1)

InnerHash = hash(innerInput) = output 160 bits ( 20 bytes)

outerInput = s2 || innerHash

outerHash = hash(outerInput)

HMAC = outerHash = 160 bits

Examples different hash functions by their sizes

Output Size Hash Functions(Examples) Details

 64. Bits Earlier version, not safe for Low security, used hashing in
cryptography hash table

128 bits MD5 Broken, not secure for

cryptography

160 bits SHA-1 Weak, collision found

256 bits SHA-256 Secure, widely used

384 bits SHA- 384 Advance version of SHA-256

512 bits SHA - 512 Stronger hashes, used for

higher security

Elgamal Algorithm

Monday, June 30, 2025

8:18 PM

It is asymmetric key algo

It uses two keys, public and private key

It generate two cipher texts for one plain text

It is heavily used digital signature encyption

One way function same as RSA

It uses separate functions for encryption and decryption

Sender A - sends data to user B

Packets goes across insecure n/a

it generates 2 Cipher Texts for one plain text. It is better than RSA in decryption
Size is twice of the plain text

Single plain text, it creates different cipher text

1. Assume large number p = 13

2. Power(g,1) mod

3. Generator g = 2, primitive root {1,2,3,4,5,6…18}

4. Gcd(g,p) =1

5. Select d 2<d < p-2

6. d = 3 , sender only knows this number

7. E = power(g,d) mod p

8. Power(2,3) mod 13

9. E = 8

10. Public key for ( p,g,e) = (13,2,8) shared in the public domain

11. Private key = 3

How sender A sends the data

He wants to send data M = 4

Select random integer ( k = 7)

Encryption is 2 step process

Y1 = power(g,k) mod p

Y1 = power(2,7) mod 13

Y1 = 11

Y2 = M* power(e,k) mod p

Y2 = 4* power(8,7) mod 13

Y2 = 7
Step2 to decrypt

Plain Text = Y2*inv(pow(Y1,d)) mod p

Power(Y1,D) mod p

Power(11,3) mod 13

11*11*11 mod 13 = 5

Y2 * Inv(5) mod 13

Inv(5) mod 13 , find out the number mod 13 which will give reminder 1

x= 8

7*8 mod 13

56 mod 13 = 4

It is asymmetric cryptography having 2 keys public and private

Public key has three parts ( e1, e2 , p)

Private key = d which is user selected

e1, g and d are user choice

P is any large prime number

Public key are of two parts E1 and E2

E1 - user defined
E2 - E1 pow g mod p

Public key ( E1, E3, q)

Private key = g user defined

Choose random number k

M is message ( converted into int)

C1 = g pow k log q

C2 = M

ECC : Elliptical Curve Function

Trapdoor Function

Functions are easy to one direction but going in the direction is not possible

Block Cipher

Sunday, June 22, 2025

3:56 PM

Basic three components

1. Key generation - each block is used different key for each block for encryption and
same key is used for decryption. It is called symmetric cipher as both encryption and
decryption uses the same key

2. Encryption is permutation (shuffle) b-bit string

 3. For b b-bit blocks

Possibility of 2 power b plain texts

same amount of cipher text and

total permutation combinations is 2 to power b!

K = number of keys, k possible combinations that can be used to encrypt the plain text

Typically k is much smaller than b

Block Cipher means large collection of an electronic code book

One side plain text elements and other side associated cipher text elements.

Which code book is used at any given point is depends on function of key and key is secrete

So eavesdropper has the ability of reconstruct the family of code books, but there are so
many of them so it is difficult to break. They don’t know which one you choose.

If block ciphers act on short block, how to encrypt a long message

Cipher mode of operations : it is method , take a block cipher and combine it with large
amount of data

Simplest mode of operation Electronic code mode

It takes plain takes and divides it into individual blocks and encrypt each block separately
with same key

It is good for shorter message but not for longer messages. ECB simply relies on substitution
so when two blocks of plain text are identical, they are result into two corresponding cipher
texts. Some kind of pattern which attackers try to infer it
Chiper block chaining

To address security vulneraries present in electronic code book, next mode is Cipher block
chaining.

IV is initialization Vector and then XOR with plain text and then it encrypt with round key and
get the cipher text and this is acts as cipher text to round 1 ad it becomes IV for round 2.

IV : It is not secret and its set along with cipher text value. It should use only once and must
not be predictable.

It is random or unique value used in combination with secret key to initialize the encryption
process. It ensure that same plain text encrypted multiple times will produce different cipher
text, enhancing security by preventing patterns from emerging

Randomized Encryption
Same plain text is encrypted with same key but different IV, it going to generate new cipher
text

Counter Mode:

The counter mode or CTR is simple counter based block cipher implementation

In this case, counter is encrypted using and key and it is given as input to XOR with plain text
which results in cipher text, no input from previous step so it can be run in the parallel

Since there is a different counter value for each block, the direct plain text and cipher text
relationship is avoided

Parallel execution of encryption and decryption is possible as all blocks are independent

User can build the encryption can build ahead of time since plain text is not involved in the
encryption, it can make the process faster

Major drawback.

Synchronization of counter between sender and receiver is crucial to get correctly decrypt
the plan text, the results are inaccurate if synchronization failed
Decryption is exactly same as encryption, counter encrypt with key and pass the input to
XOR function and cipher text is another input to XOR.

Example:
Cipher Feedback Mode:
Giving the feedback of cipher text of previous to the next step. One can directly assign
output or do shift register (shifting the bits)

It is mainly used in the steaming

First Step : IV + Key encrypt

B = IV + Key (Encryption)

Output is splits ( s bits, b-s bits)

S bits XOR plain text \

Block Cipher Counter

Monday, June 23, 2025

7:12 PM

Secret Key = "SECRET12"

Binary value:

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

Counter ( 00000001), converted to 64 bits, by adding zeros

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001

Encrypt the counter using XOR

Key

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

Counter

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001

------------------------------------------------------------------------------------------------------------------

Encrypted Counter

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110011

HELLO WORLD

HELLOWOR

Binary

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

---------------------------------------------------------------------------------------------------------------------

Encrypted Counter XOR HELLOWOR

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110011

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

Cipher Text

00011011 00000000 00001111 00011110 00001111 00000011 01101110 01100001

Output in the binary

00011011 → 27 (ESC - Escape character)

00000000 → 0 (NULL)

00001111 → 15 (Shift In)

00011110 → 30 (Record Separator)

00001111 → 15 (Shift In)

00000011 → 3 (End of Text)

01101110 → 110 (n)

01100001 → 97 (a)

Secret Key = "SECRET12"

Binary value:

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

Counter ( 00000010), converted to 64 bits, by adding zeros

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000010

Encrypt the counter using XOR

Key

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

Counter

00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000010

------------------------------------------------------------------------------------------------------------------

Encrypted Counter

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110000

HELLO WORLD

HELLOWOR

Binary

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

---------------------------------------------------------------------------------------------------------------------
Encrypted Counter XOR HELLOWOR

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110000

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

Cipher Text

00011011 00000000 00001111 00011110 00001111 00000011 01101110 01100010

Output in the binary

00011011 → 27 (ESC - Escape character)

00000000 → 0 (NULL)

00001111 → 15 (Shift In)

00011110 → 30 (Record Separator)

00001111 → 15 (Shift In)

00000011 → 3 (End of Text)

01101110 → 110 (n)

01100001 → 97 (b)

Electronic Code Book - Mode

HELLO WORLD

HELLOWOR

01001000 01000101 01001100

01001100 01001111 01010111

01001111 01010010
Secret

01001000

Block Cipher Chain

Monday, June 23, 2025

8:10 PM

Plain Text = HELLOWORLD

IV = 00001111 00001111 00001111 00001111 00001111 00001111 00001111 00001111

Secret Key = "SECRET12"

Binary value:

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

HELLOWORD - Binary

HELLOWO

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

RD######

01001100 01000100 00100011 00100011 00100011 00100011 00100011 00100011

IV (Initialization Vector)

00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000

Step1 = Block 1 (HELLOWOR) XOR IV

00000001 00000010 00000011 00000100 00000101 00000110 00000111 00001000

01001000 01000101 01001100 01001100 01001111 01010111 01010111 01010010

Encrypt with secrete key ( XOR / another technique bitwise NOT)

01001001 01000111 01001111 01001000 01001010 01010001 01010000 01011010

01010011 01000101 01000011 01010010 01000101 01010100 00110001 00110010

Cipher Text for HELLOWOR

00011010 00000010 00001100 00011010 00001111 00000101 01100001 01101000

IV for LD######

00011010 00000010 00001100 00011010 00001111 00000101 01100001 01101000

XOR = Block2 XOR IV1

01001100 01000100 00100011 00100011 00100011 00100011 00100011 00100011

00011010 00000010 00001100 00011010 00001111 00000101 01100001 01101000

Cipher Text for LD#######

01010110 01000110 00101111 00111001 00101100 00100110 01000010 01001011

Concatenate C0||C1 to get final output