SCHOOL OF COMPUTING

DEPARTMENTOFCOMPUTERSCIENCEANDENGINEERING

UNIT-1
SCS1316-NETWORKSECURITY
 UNIT-1 NETWORKSECURITYANDNUMBERTHEORYBASICS
Syllabus:
Network security- Examples of security violations - Computer security concepts-
confidentiality-Integrity-Availability-Accountability, Challenges of computer security-
Hacking-Vulnerability-threats-attacks-passive attacks-types-Active attacks-types-Denial of
service attacks-Model for network security. Modular arithmetic- Addition-Inversedivisibility-
prime numbers-Euler’s theorem-Fermat’s theorem
1. Introduction:

With the introduction of the computer, the need for automated tools for
protecting files and other information stored on the computer became evident. This is
especially the case for a shared system, and the need is even more acute for systems that can
beaccessedoverthe [Link] data
and to thwart hackers is computer security.
Network security: Introduction of distributed systems and the use ofnetworks
and communications facilities for carrying data between terminal user andcomputer and
between computer and computer. Network security measures are needed to protect data
during their transmission. The term network security in general refers to internet security.

EXAMPLESOFSECURITYVIOLATIONS

1. User A transmits a file to user B. The file contains sensitive information

(e.g.,payrollrecords)thatistobeprotectedfrom [Link],whoisnotauthorizedto read the
file, is able to monitor the transmission and capture a copy of the file during its transmission.

Fig1.1Example1
 2. A network manager, D, transmits a message to a computer, E, under its
management. The message instructs computer E to update an authorization file to include the
identities of a number of new users who are to be given access to that computer. User F
intercepts the message, alters its contents to add or delete entries, and then forwards the
message to E, which accepts the message as coming from manager D and updates its
authorization file accordingly.

Fig1.2Example2

3. Rather than intercept a message, user F constructs its own message withthe
desired entries and transmits that message to E as if it had come from manager D. Computer
E accepts the message as coming from manager D and updates its authorizationfile
accordingly.
4. A message is sent from a customer to a stockbroker with instructions for
various transactions. Subsequently, the investments lose value and the customer denies
sending the message.
Althoughthislistbynomeansexhauststhepossibletypesofsecurity violations, it
illustrates the range of concerns of network security.

COMPUTERSECURITYCONCEPTS
ADefinitionofComputer Security

TheNISTComputerSecurityHandbook[NIST95]definesthetermcomputersecurityas follows
COMPUTER SECURITY
 The protection afforded to an automated information system in order to attain
the applicable objectives of preserving the integrity, availability, and confidentiality of
information system resources (includes hardware, software, firmware, information/ data, and
telecommunications).

Thisdefinitionintroducesthreekeyobjectivesthatareattheheartofcomputer
security.
1) Confidentiality:Thistermcoverstwo relatedconcepts:

Data confidentiality: Assures that private or confidential information is not made

available or disclosed to unauthorized individuals.

Privacy: Assures that individuals control or influence what information related to

themmaybecollectedand stored andby whomandtowhomthatinformationmaybe
disclosed.
2) Integrity:Thistermcoverstworelated concepts:

Data integrity: Assures that information and programs are changed only in a specified
andauthorized manner.

Systemintegrity:Assuresthatasystemperformsitsintendedfunctioninanunimpaired manner,
free from deliberate or inadvertent unauthorized manipulation of the system.

3) Availability:Assuresthatsystemsworkpromptlyandserviceisnotdeniedtoauthorized users.

These three concepts form what is often referred to as the CIA triad (Figure 1.1). The three
concepts embody the fundamental security objectives for both data and for information and
computing services.

Fig1.3SecurityRequirementsTRIAD
 • Confidentiality: Preserving authorized restrictions on information access and disclosure,
including means for protecting personal privacy and proprietary information. A loss of
confidentiality is the unauthorized disclosure of information.
• Integrity: Guarding against improper information modification or destruction,including
ensuring information nonrepudiation and authenticity. A loss of integrity is the unauthorized
modification or destruction of information.

• Availability: Ensuring timely and reliable access to and use of information. A loss of
availability is the disruption of access to or use of information or an information system.
Although the use of theCIA triadto define security objectives iswell established, some inthe
security field feel that additional concepts are needed to present a complete picture. Two of
the most commonly mentioned are,
• Authenticity: The property of being genuine and being able to be verified and trusted;
confidence in the validity of a transmission, a message, or message originator. This means
verifying that users are who they say they are and that each input arriving at the system came
from a trusted source.
• Accountability: The security goal that generates the requirement for actions of an entity to
be traced uniquely to that entity. This supports non-repudiation, deterrence, fault isolation,
intrusion detection and prevention, and after-action recovery and legal action. Because truly
secure systems are not yet an achievable goal, we must be able to trace a security breach to a
responsible party. Systems must keep records of their activities to permit later forensic
analysis
totracesecuritybreaches ortoaidintransactiondisputes.

THECHALLENGESOFCOMPUTER SECURITY

[Link] reasons
include:

1. Security is not as simple as it might first appear to the novice. The

requirements seem to be straightforward; indeed, most of the major requirements for security
services can be given self-explanatory, one-word labels: confidentiality, authentication, non-
repudiation, integrity. But the mechanisms used to meet those requirements can be quite
complex, and understanding them may involve rather subtle reasoning.
2. In developing a particular security mechanism or algorithm, one must
always considerpotentialattacks onthose securityfeatures. Inmany cases, successful attacks
are designed by looking at the problem in a completely different way, therefore exploiting an
unexpected weakness in the mechanism.
3. Having designed various security mechanisms, it is necessary to decide
where to use them. This is true both in terms of physical placement (e.g., at what points in a
network are certain security mechanisms needed) and in a logical sense [e.g., at what layer or
layers of an architecture such as TCP/IP (Transmission Control Protocol/Internet Protocol)
should mechanisms be placed].
4. Security mechanisms typically involve more than a particular algorithm or
[Link](e.g.,
 an encryption key), which raises questions about the creation, distribution, and protection of that
secret information.
5. Computer and network security is essentially a battle of wits between a
perpetrator who tries to find holes and the designer or administrator who tries to close them.
The great advantage that the attacker has is that he or she need only find a single weakness,
while the designer must find and eliminate all weaknesses to achieve perfect security.
6. Securityrequiresregular,evenconstant,monitoring,andthisisdifficultin
today‟s short-term, overloaded environment.
7. Securityisstilltoooftenanafterthoughttobeincorporatedintoasystem after
the design is complete rather than being an integral part of the design process.
8. Many users (and even security administrators) view strong security as an
impediment to efficient and user-friendly operation of an information system or use of
information.

VULNERABILITYANDHACKING

Vulnerability

Incomputer security, avulnerabilityis a weakness which can beexploitedby

athreatactor, such as an attacker, to cross privilege boundaries (i.e. perform unauthorized
actions) within a computer system. To exploit vulnerability, an attacker must have at least
one applicable tool or technique that can connect to a system weakness. In this frame,
vulnerabilities are also known as the attack surface.

Hacking

Hacking is an attempt to exploit a computer system or a private network inside a

computer. Simply put, it is the unauthorised access to or control over computer network
security systems for some illicit purpose. One can easily assume them to be intelligent and
highly skilled in computers.

SECURITYATTACKS
Threat
A potential for violation of security, which exists when there is a circumstance,
capability, action, or event that could breach security and cause harm. That is, a threat is a
possible danger that might exploit vulnerability.
Attack
An assault on system security that derives from an intelligent [Link] is, an
intelligent act that is adeliberate attempt (especially in thesenseofa method ortechnique) to
evade security services and violate the security policy of a system.
Securityattack:Anyactionthatcompromisesthesecurityofinformationownedbyan
organization.

A useful means of classifying security attacks is interms of passive attacks and active
attacks.A passive attack attempts to learn or make use of information from the system but
does not affect system [Link] active attack attempts to alter system resources or affect
their operation.
PassiveAttacks
Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions
as shown in Fig 1.4. The goal of the opponent is to obtain information that is being
transmitted. Two types of passive attacks are the release of message contents and trafficanaly
s

Fig1.4PassiveAttacks
The release of message contents is easily understood (Figure 1.5). A telephone
conversation, an electronic mail message, and a transferred file may contain sensitive or
confidential information. We would liketo prevent an opponent from learning thecontents of
these transmissions.
 Fig1.5Releaseof Message

A second type of passive attack, traffic analysis, is subtler (Figure 1.6). Suppose that
we had a way of masking the contents of messages or other information traffic so that
opponents, even if they captured the message, could not extract the information from the
message. The common technique for masking contents is encryption.

Fig1.6Trafficanalysis

Passive attacks are very difficult to detect, because they do not involve any alteration
of the data. Typically, the message traffic is sent and received in an apparently normal
fashion, and neither the sender nor the receiver is aware that a third party has read the
[Link],itisfeasibletopreventthesuccessof
theseattacks,[Link],theemphasisindealingwithpassive attacks is
on prevention rather than detection.

ActiveAttacks

Active attacks involve some modification of the data stream or the creation of a false
stream and can be subdivided into four categories: masquerade, replay, modification of
messages, and denial of service.

A masquerade takes place when one entity pretends to be a different entity (Figure
1.7). A masquerade attack usually includes one of the other forms of active attack. For
example, authentication sequences can be captured and replayed after a valid authentication
sequence has taken place, thus enabling an authorized entity with few privileges to obtain
extra privileges by impersonating an entity that has those privileges.

Replayinvolvesthepassivecaptureofadataunitanditssubsequent retransmissionto
produce an unauthorized effect (Figure 1.8).

Modification of messages simply means that some portion of a legitimate message is

altered, or that messages are delayed or reordered, to produce an unauthorized effect (Figure
1.9). For example, a message meaning “Allow John Smith to read confidential file accounts”
is modified to mean “Allow Fred Brown to read confidential file accounts.”

The denial of service prevents or inhibits the normal use or management of

communications facilities (Figure 1.10). This attack may have a specific target; for example,
an entity may suppress all messages directed to a particular destination (e.g., the securityaudit
service). Another form of service denial is the disruption of an entire network—eitherby
disabling the network or by overloading it with messages so as to degrade performance.

Security aspects come into play when it is necessary or desirable to protect the
information transmission from an opponent who may present a threat to confidentiality,
authenticity, and so on. All of the techniques for providing security have two components:

A security-related transformation on the information to be sent. Examples include the

encryption of the message, which scrambles the message so that it is unreadable by the
opponent, and theaddition ofacodebased on thecontents ofthemessage, which can beused to
verify the identity of the sender.

Somesecret information shared by the two principals and, it is hoped, unknownto the
opponent. An example is an encryption key used in conjunction with the transformation to
scramble the message before transmission and unscramble it on reception.
Fig1.7Masquerade

Fig1.8Replay
 Fig1.8Modificationof messages
DenialofServiceAttacks

WithaDoSattack,ahackerattemptstorenderanetworkoran Internetresource,such as a
web server, worthless to users. A DoS attack typically achieves its goal by sending large
amounts of repeated requests that paralyze the network or a server.

A common form of a DoS attack is a SYN flood, where the server is overwhelmed by
embryonic connections. A hacker sends to a server countless Transmission Control Protocol
(TCP) synchronization attempts known as SYN requests. The server answers each of those
requests with a SYN ACK reply and allocates some of its computing resources to servicing
thisconnectionwhenitbecomesa"fullconnection." Connectionsaresaidtobeembryonicor half-
opened until the originator completes the three-way handshake with an ACK for each request
originated. A server that is inundated with half-opened connections soon runs out of
resources to allocate to upcoming connection requests, thus the expression "denial of service
attack."

The following sidebars provide the anatomy of DoS attacks and distributed DoS
(DDoS) attacks.
 Fig1.9DOS

Those handlers in turn scan their own corporate network, hunting for workstationsto
compromise and turn into DDoS agents. Those agents are also referred to as bots, thusthe
expression of botnets.

When his army of agents is strategically in place, the hacker launches the attack.
He transmits his orders for the mission to the handlers and agents; these orders usually
cause each of these hosts to send large quantities of packets to the same specific
destination, at a precise time, thus overwhelming the victim and the path to it. It also
creates significant congestion on corporate networks that are infected with handlers and
agents when they all simultaneously launch their attack on the ultimate victim.
AMODELFORNETWORK SECURITY:
A Network Security Model exhibits how the security service has been designed over
the network to prevent the opponent from causing a threat to the confidentiality or
authenticity of the information that is being transmitted through the network.
Foramessagetobesent orreceivetheremustbe [Link] receiver
must also be mutually agreeing to the sharing of the message. Now, the transmission
ofamessagefromsendertoreceiverneedsamediumi.e. Informationchannel whichis an Internet
service.

A logical route is defined through the network (Internet), from sender to the receiver and
using thecommunication protocolsboth the sender and the receiver established
communication.

Anysecurity servicewould havethe threecomponentsdiscussed below:

1. Transformation of the information which has to be sent to the receiver. So, that any
[Link] the
encryption of the message.

Italsoincludestheadditionofcodeduringthetransformationoftheinformationwhichwill be used
in verifying the identity of the authentic receiver.

2. Sharing of the secret information between sender and receiver of which the opponent must
[Link],wearetalkingoftheencryptionkeywhichisusedduringtheencryptionof the
message at the sender’s end and also during the decryption of message at receiver’s end.

3. There must be atrusted third partywhich should take the responsibility of distributing the
secret information(key) to both the communicating parties and also prevent it from any
opponent.

Fig1.11AModelforNetwork Security
 Thenetworksecuritymodelpresentsthetwocommunicating
[Link] has
information to share with the receiver.
But sender cannot send the message on the information cannel in the readable form as
it will have a threat of being attacked by the opponent. So, before sending the message
through the information channel, it should betransformedinto an unreadable format. Secret
informationis used while transforming the message which will also be required when the
message will be retransformed at the recipient side. That’s why a trusted third party is
required which would take the responsibility of distributing this secret information to both
the parties involved in communication.
So, considering this general model of network security, one must consider the following four
tasks while designing the security model.

1. Totransform a readable message at the sender side into an unreadable format, an

appropriate algorithm should be designed such that it should be difficult for an opponent to
crack that security algorithm.

2. Next, the network security model designer is concerned about the generation of the secret
information which is known as a key.

This secret information is used in conjunction with the security algorithm in order to
transform the message.

3. Now, the secret information is required at both the ends, sender’s end and receiver’s end.
At sender’s end, it is used to encrypt or transform the message into unreadable form and
atthereceiver’send,itisusedtodecryptorretransformthemessageintoreadableform. So, there
must be atrusted third partywho will distribute the secret information to bothsender and
receiver. While designing the network security model designer must also
concentrateondevelopingthemethodstodistributethekeytothesenderandreceiver. An
appropriate methodology must be used to deliver the secret information to the communicating
parties without the interference of the opponent.
It is also taken care that thecommunication protocols that are used by the communicating
parties should be supporting the security algorithm and the secret key in order to achieve the
security service.
NETWORKACCESSSECURITYMODEL
Networkaccesssecuritymodelwhichisdesignedtosecuretheinformationsystemwhichcan be
accessed by the attacker through the network.
Attackers who attack your system that is accessible through the internet. These attackers fall
into two categories:

1. Hacker:The one who is only interested in penetrating into your system. They do not cause
any harm to your system they only get satisfied by getting access to your system.
2. Intruders:These attackers intend to do damage to your system or try to obtain the
information from the system which can be used to attain financial gain.
 Theattackercanplacealogicalprogramonyoursystemthroughthenetworkwhichcan affect the
software on your system. This leads to two kinds of risks:
a. Informationthreat:Thiskindofthreatsmodifies dataontheuser’sbehalf towhichactually user
should not access. Like enabling some crucial permission in the system.
b. Servicethreat: Thiskindofthreat disablesthe userfromaccessingdata onthe system.

Fig1.12Networkaccess securitymodel
Therearetwowaystosecureyoursystemfromattackerofwhichthefirstistointroduce
[Link] login-id and
passwords which would keep away the unwanted access.
In case the unwanted user gets access to the system the second way to secure your system is
introducinginternalcontrolwhichwoulddetecttheunwantedusertryingto accessthesystem by
analyzing system activities. This second method we call as antiviruswhich we install on our
system to prevent the unwanted user from accessing your computer system through the
internet.

MODULAR ARITHMETIC
Modulo,[Link] arithmeticof remainders.
Ifanyintegeracanbeexpressedas a=b+knthen inmoduloarithmeticitcan be
stated asa mod n = b. F or example a=33 and n=5 then 33 mod 5= 3. (should be read
as 3 mod 5)
[Link] the
successive subtraction is as shown below.

Thequotientremainder theorem
 Toprovesomepropertiesaboutmodulararithmeticweoftenmakeuseof the
quotient remainder theorem.
 Itisasimpleideathatcomesdirectlyfromlongdivision. The
quotient remainder theorem says:
GivenanyintegerA,andapositiveintegerB,thereexistuniqueintegersQand R such that

A= B * Q + R where0≤ R<B

WhenwedivideA by Bin long division,Q is thequotient and R is theremainder.

[Link]-DIVIDEND
B-DIVISOR/MODULUS Q-
QUOTIENT
R-REMINDER/RESIDUE

IfwecanwriteanumberinthisformthenAmodB=R Examples

A= 7,B = 2

7 =2 * 3 +1
7 mod 2 =1

A= 8,B = 4

8 =4 * 2 +0
8 mod 4 =0

A= 13,B = 5

13 =5* 2 +3
13 mod 5 =3

A=-16,B = 26

-16=26 *-1 +10

-16mod 26 =10
Modularadditionandsubtraction

(A+ B) mod C= (A mod C +B mod C)mod C

Example:

LetA=14,B=17, C=5

Let'sverify:(A+B)mod C=(AmodC+BmodC)modC LHS = Left

Hand Side of the Equation
RHS=Right HandSide ofthe Equation

LHS = (A + B) mod C
LHS=(14 +17) mod 5
LHS=31 mod 5
LHS=1

RHS = (A mod C + B mod C) mod C

RHS = (14 mod5 + 17mod5) mod 5
RHS= (4 +2) mod 5
RHS =1

LHS=RHS = 1

Multiplication

(A*B)modC=(AmodC*BmodC)modC Example for

Multiplication:

LetA=4,B=7, C=6

Let'sverify: (A* B)modC =(AmodC* B modC) mod C

LHS= Left Hand Side of the Equation

RHS=RightHandSideoftheEquation LHS

= (A * B) mod C
LHS=(4 *7)mod 6

LHS=28 mod 6

LHS=4

RHS=(AmodC*BmodC)modC RHS

= (4 mod 6 * 7 mod 6) mod 6

RHS= (4 *1) mod 6

RHS =4 mod6

RHS =4

LHS=RHS = 4

Exponentiation
A^BmodC= ((AmodC)^B )modC

Example
 CONGRUENCE MODULO

Thissays thatA iscongruent to B modulo C

MULTIPLICATIVEINVERSES
SOLVEDEXAMPLES
 PRIME NUMBERS

Primenumbersarethepositiveintegershavingonlytwofactors,1andtheintegeritself For

example,

Factorsof6are1,2,3and6,whicharefourfactorsintotal. But

factors of 7 are only 1 and 7, totally two

Hence,7 isaprimenumberbut 6is not, insteadit isacompositenumber.

**Alwaysrememberthat 1isneitherprimenorcomposite

Another way of defining Prime Number is - It is a positive number or integer, which is not a
product of any other two positive integers.
RelativePrime Numbers

Thenumbers‘a’&‘b’aresaidtobeRelativePrimenumbersif‘a’&‘b’doesnothavea common factor

i.e.,GCD(a, b)=1

GCD– GreatestCommon Divisor

Forexample,

Assumea=15&b=28 Factors

of 15 are 1,3,5

Factorsof28are1,2,4,7,14

GCDis thelargest numberthatdivides bothof them.

Inthis case1 isthecommon divisor

SoGCD(15,28)=1,Hence15&28arerelativelyPrimenumbers Practice

Problem: Find GCD of 36 and 60

EULERSANDFERMATS THEOREM

Euler’sTotient Function

Euler’sTotientfunction isalso knownasPHIfunction (φ(n))orϕ(n)

Euler’sTotientfunctionforanygivennumber‘n’isdefinedastheTotalcountofthe numbers
which are relatively Prime to ‘n’ and are less than ‘n’.

Example1:

Assume‘n’=10

Considerthenumberswhicharelesserthann(inthiscase10).ThentheRelative Prime
numbers for10 are 1,3,7,9.

Henceφ(n))orϕ(n)=4 (SinceRelativePrimefor10is1,3,7,9)(Total4Numbers). If the

given number ’n’ is a Prime number then, ϕ(p) = P-1

Example2:

Considern=7 (Since7 isaprimenumberEuler’sTotient functionφ(7)=7-1 =6.

Example3: n=13. Find φ(13).

φ(13)=?

Example4: n=[Link] φ(11).

Example5:(nonprimenumber)
 n=14. Find φ(14)=?

Hint:Count ofRelativePrimenumbers for14.

Example6:

Determineφ(37)andφ(35).

Because37isprime,allofthepositiveintegersfrom1through36arerelativelyprimeto37. Thus

φ(37) = 36.

Todetermineφ(35),welistallofthepositiveintegerslessthan35thatarerelativelyprimeto it:

1, 2, 3, 4, 6, 8, 9, 11, 12, 13, 16, 17, 18, 19, 22, 23, 24, 26, 27, 29, 31, 32, 33, 34.

Thereare24 numbers onthe list, soφ(35)= 24.

Euler’sTheorem

Euler'stheoremstates thatforeveryaandn thatarerelatively prime:

aφ(n)≡1 mod n
φ(n)isthetotientfunctionisdefinedasthenumberofpositiveintegerslessthannthatareco prime to n.
(n>=1)
φ(5)={ 1 2 3 4}

Proof:
aφ(n)≡ 1 mod n is true if n is prime, because in that case φ(n) = (n 1) and Fermat's theorem
holds. However, it also holds for any integer n. Recall that φ(n) is the number of positive
integers less than n that are relatively prime to n. Consider the set of such integers, labeled as
follows:

Thatis,eachelementxi ofRisauniquepositiveintegerlessthannwith gcd(xi, n)

= 1. Now multiply each element by a, modulo n:

Theset Sisa permutation ofR, by thefollowing lineof reasoning:

1. Because ais relatively primeto n and xiis relatively primeto n, aximust also berelatively
prime to n. Thus, all the members of S are integers that are less than n and that are relatively
prime to n. 2. There are no duplicates in S.

.Ifaximodn=axjmodnthenxi=xjAlterna

tive form

Euler’sTheoremstatesthat,If‘p’&‘q’aretwo primenumberssuchthat p≠q&n=pq, Then ϕ(n) ≡

(p-1)*(q-1).

Example1:

Assume‘p’=2&‘q’=5 n =

pq

=2*5

=10

Soϕ(10)≡(2-1)*(5-1)

=4

Example2:

Considerp=7&q=11,n=7*11=[Link]φ(77). φ(77) ≡

(7-1)*( 11-1) =6*10 =60

Fermat’sTheorem

Fermat'stheoremstatesthefollowing:Ifpisprimeandaisapositiveintegernotdivisibleby p, then

Proof:

Proof:Considerthesetofpositiveintegerslessthanp:{1,2,...,p1}andmultiplyeachelement by a,
modulo p, to get the set X = {a mod p, 2a mod p, . . . (p 1)a mod p}.
 None of the elements of X is equal to zero because p does not divide a. Furthermore no two
of the integers in X are equal. To see this, assume that

ja ≡ka(mod p) where 1 j < k p 1. Because a is relatively prime[5] to p, we can eliminate a

from both sides of the equation ,resulting in:

j≡ k(mode p). This last equality is impossible because j and k are both positive integers less
than p. Therefore, we know that the (p 1) elements of X are all positive integers, with no two
elements equal. We can conclude the X consists of the set of integers {1,2,..., p 1} in some
order. Multiplying the numbers in both sets and taking the result mod p yields

ax2ax...x(p1)≡[(1 x2x...x(p1)](modep) ap1(p 1)! ≡(p

1)!(mod p)

Wecan cancelthe(p 1)!term becauseit is relativelyprimeto p

AnalternativeformofFermat'stheoremisalsouseful:Ifpisprimeandaisapositive integer, then

Fermat’sTheorem/Fermat’sLittleTheoremStatesthatif‘P’isaPrimenumberand‘a’isa Positive
Integer which is not Divisible by ‘P’ then

aP-1 ≡1 mod P

Example:Leta =3and P =7

aP-1≡1mod P

3 7-1≡1mod7 ≡ 36mod 7

(32)3mod 7 ≡(9mod 7)3

≡(2 mod7)3

≡23mod7≡8mod7=1

Hence proved.

Key Points

● A prime number is an integer that can only be divided without remainder by positive and
[Link] in
cryptography.

● Twotheoremsthatplayimportantrolesinpublic-keycryptographyareFermat'stheorem and
Euler's theorem.

● An important requirement in a number ofcryptographic algorithms is the ability to choose

[Link] for
determining if a randomly chosen large integer is a prime number.

Solved Examples

SolveusingFermats Theorem
Ifn is primeand x is apositive integer notdivisible by n then
xn-1≡1modn
n-primeno.
x-isnotdivisiblebyn x

and n---------coprime
Example1:

x=3n=5

3 5-1≡34=81

81 =1 mod 5

Anotherformoffermats x
n
≡ x mod n

Example2:

x=3n=5

x n=35=243

243≡3 mod 5

Example3:
2 16mod17
Byfermats
x n-1 = 1mod n

217-1=1 mod 17

2 16mod 17=1

Example4:

761mod31
x=7n=31

x n-1=modn

7 31-1=1 mod 31
730mod31=1Now,

761=7(30x2)+1
 =(7 30)2. 71
761 mod 31 =(7 30)2. 7 1mod 31
[(7 30)2mod 31x71mod 31]mod31
[1 x71 mod 31]mod31
7

REVIEW QUESTIONS:

1. ProveFermat’sTheorem .Considera=2,P=5

i. aP-1 =1 mod P

2. ProveFermat’sTheorem Usinga=3,P=7

3. Solve31-1mod37
4. Solve5-1mod96

5. Solve 16-1mod 23

6. InferEulerstotientfunction

7. Comparepassiveandactive attack

8. Interpretavailabilityandauthenticity

9. Distinguishthreatandattacks.

10. InterpretConfidentialityandIntegrity

11. Provecongruencemodulo using an example.

12. Mentionthe typesof activeattacks.

13. Statenon repudiation.

14. Determineφ(37)andφ(35).

15. Explaincomputersecurity challenges.

16. Elaborateaboutsecurity attackswithneatdiagrams

17. DiscusstheKeysecurityconceptswiththeTRIAD diagram

18. StateandprovetheEulers andFermats theoremusing examples.

19. Withaneatsketchexplain networksecurity model.

 SCHOOL OF COMPUTING

DEPARTMENTOFCOMPUTERSCIENCEANDENGINEERING

UNIT-2
SCS1316-NETWORKSECURITY
 UNIT-II CRYPTOGRAPHYBASICS
Syllabus:
Terminologies – Cryptography – Classification: based on operation, number of keys used,
Processing - Crypt analysis: Types - Classical Encryption - Substitution Cipher: Ceaser
Cipher, Brute Force attack, Vignere Cipher, One time pad, Transposition Cipher: Rail fence
Cipher, Simple row column Transfer, Play Fair Cipher, 2X2 Hill cipher - Stream cipher -
Block Cipher - Modes of operation – DES – AES - RSA algorithm

Terminologiesof Cryptography:
Cryptography
Themany schemesusedforencryptionconstitute theareaof studyknownas cryptography

Crypt analysis
Techniquesused fordecipheringa messagewithout any knowledgeofthe enciphering details fall
into the area of cryptanalysis. Cryptanalysis is what the layperson calls “breaking the code.”

Cryptology
Theareasof cryptographyandcryptanalysistogetherarecalled cryptology

Cipher
Encryptionscheme isknown asacryptographic systemor a cipher

PlainText
Thisisthe originalintelligiblemessageor datathat isfed intothe algorithmas input.

CipherText
This is the scrambled message produced as output. It depends on the plaintext and the secret
key. For a given message, two different keys will produce two different cipher texts. The
cipher text is an apparently random stream of data and, as it stands, is unintelligible.

Secretkey
Thesecretkeyis [Link] avalueindependentofthe plaintext
and of the algorithm. The algorithm will produce a different output depending onthe specific
key being used at the time. The exact substitutions and transformationsperformed by the
algorithm depend on the key.

Encryption
Theprocessofconvertingfromplaintexttocipher text

Decryption
Theprocess of restoring theplaintext from the cipher text

EncipheringAlgorithm
Theencryptionalgorithmperformsvarioussubstitutionsand transformationsontheplaintext
DecipheringAlgorithm
[Link] secret key
and produces the original plaintext.

Threat
A potential for violation of security which exists when there is a circumstance, capability,
action, or event, that could breach security and cause harm. That is, a threat is a possible
danger that might exploit vulnerability.

Attack
An assault on system security that derives from an intelligent threat; that is, an intelligent act
that is a deliberate attempt (especially in the sense of a method or technique) to evadesecurity
services and violate the security policy of a system.

Security attack: Any action that compromises the security of information owned by an
organization.

Security mechanism: A process (or a device incorporating such a process) that is designedto
detect, prevent, or recover from a security attack.

Security service: A processing or communication service that enhances the security of the
data processing systems and the information transfers of an organization. The services are
intended to counter security attacks, and they make use of one or more security mechanisms
to provide the service.

Principles of Security
SymmetricCipherModel
[Link],EncryptionAlgorithm,
Secret Key, Decryption Algorithm, Cipher Text
Therearetworequirementsforsecureuseof conventionalencryption:
• Weneed astrong encryption algorithm. At aminimum, wewould likethe algorithm to be
such that an opponent who knows the algorithm and has access to one or more ciphertexts
would be unable to decipher the cipher text or figure out the key.
• Sender and receiver must have obtained copies of the secret key in a secure fashion and
must keep the key secure. If someone can discover the key and knows the algorithm, all
communication using this key is readable.

Fig.2.1ModelofSymmetricEncryption
 Fig.2.2ModelofSymmetricCryptosystem
Confidentiality:Thistermcoverstworelatedconcepts:
• Dataconfidentiality:Assuresthatprivateorconfidentialinformationisnotmade
available or disclosed to unauthorized individuals.

• Privacy: Assures that individuals control or influence what information related to

themmaybecollectedandstoredandbywhomandtowhomthatinformationmaybe
disclosed.

Authentication:Theassurancethat thecommunicatingentity is theonethat itclaims to be.

• Peer Entity Authentication: Used in association with a logical connection to provide
confidence in the identity of the entities connected.
• Data-Origin Authentication: In a connectionless transfer, provides assurance that the
source of received data is as claimed.
Integrity:Thistermcoverstworelatedconcepts:
• Data integrity: Assures that information and programs are changed only in a specified
and authorized manner.

• System integrity: Assures that a system performs its intended function in an

unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of
the system.

Non-repudiation
Providesprotectionagainstdenialbyoneoftheentitiesinvolvedinacommunicationof having
participated in all or part of the communication.
• Nonrepudiation,Origin:Proofthatthemessagewassentby thespecified party
 • Nonrepudiation,Destination:Proofthatthemessagewasreceivedbythespecified party

AccessControl
The prevention of unauthorized use of a resource (i.e., this service controls who can have
accesstoaresource,underwhatconditionsaccesscanoccur,andwhatthoseaccessingthe resource
are allowed to do). DATA

Availability
Assuresthatsystemsworkpromptlyandserviceisnotdeniedto
authorized users.

CryptographyClassifications:

Types of cryptanalysis: Cryptanalysis is the science of recovering the plaintext of a

message without access to the key. Successful cryptanalysis may recover the plaintext or the
key. The two basic categories of cryptanalysis are 1. Linear Cryptanalysis and 2. Differential
cryptanalysis
Linear Cryptanalysis: Linear cryptanalysis is a known plaintext attack, in which theattacker
studies probabilistic linear relations known as linear approximations between parity bits of
the plaintext, the Ciphertext and the secrete key. In this technique, the attacker obtains high
probability approximations for the parity bit of the secrete key by analysing the parity bits of
the known plaintexts and cipher texts. By use of several techniques such as the auxiliary
technique, the attacker can extend the attack to find more bits of the secret key.
Differential Cryptanalysis: Differential cryptanalysis can be described as a general form of
cryptanalysis that is primarily applicable to block ciphers, cryptographic hash functions. In
otherwords, itentails acarefulanalysisofhowdifferences ininformationinputcan affectthe
resulting difference at the output. In block cipher, differential analysis can be described as a
set of techniques for tracing differences through the network of transformation, discovering
wherethecipherexhibitswhatisknownasnon-randombehaviourandexploitingsuchdetails to
recover the secrete key (cryptography key). In the process, observing the desired output
difference between the two chosen or unknown plaintext inputs suggests possible key values.
ClassicalEncryption Techniques
SubstitutionCipher
Asubstitutiontechniqueisoneinwhich thelettersofplaintext arereplacedbyotherlettersor by
numbers or symbols. If the plaintext is viewed as a sequence of bits, then substitution
involves replacing plaintext bit patterns with cipher text bit patterns.

CaesarCipher
The earliest known use of a substitution cipher, and the simplest, was by Julius Caesar. The
Caesar cipher involves replacing each letter of the alphabet with the letter standing three
places further down the alphabet.

Forexample,
Plain text : meet me after the toga party
Cipher Text: PHHWPHDIWHU WKHWRJDSDUWB

Note that the alphabet is wrapped around, so that the letter following Z is A. We can define
the transformation by listing all possibilities, as follows:

PlainText:a b cd ef g hi j k lmn o pq rs t u v w x y z
CipherText:D E F GH I J K L MN OP Q R S T U VW X YZ A B C

Letusassignanumericalequivalenttoeach letter:
A b c d e F g h i j k l m
0 1 2 3 4 5 6 7 8 9 10 11 12
N o p q r s t u v w x y z
13 14 15 16 17 18 19 20 21 22 23 24 25

Thenthealgorithmcanbeexpressedasfollows.
Foreachplaintextletterp,substitutetheciphertextletterC C =
E(3, p) = (p + 3) mod 26

Ashiftmaybeofanyamount,sothatthegeneralCaesaralgorithmis C =
E(k, p) = (p + k) mod 26
wherek takes onavaluein therange1to 25.

Thedecryptionalgorithmissimply p
= D(k, C) = (C k) mod 26
If itisknown thatagivenciphertextisaCaesarcipher,thenabrute-forcecryptanalysisis easily
performed: Simply try all the 25 possible keys.

Threeimportant characteristicsof thisproblem enabledusto useabrute-forcecryptanalysis:

• Theencryption and decryptionalgorithms areknown.
• Thereareonly25 keystotry.
• Thelanguageof theplaintextis known and easilyrecognizable.
 Play Fair Cipher
The best-known multiple-letter encryption cipher is the Play fair, which treats digrams in the
plaintext as single units and translates these units into cipher text digrams. The Play fair
algorithm is based on the use of a 5 x 5 matrix of letters constructed using a keyword.

M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z

Inthiscase,thekeywordismonarchy.

The matrix is constructed by filling in the letters of the keyword (minus duplicates) from left to
right and from top to bottom, and then filling in the remainder of the matrix with the
remaining letters in alphabetic order. The letters I and J count as one letter.

Plaintextisencrypted twolettersat atime,according tothefollowing rules:

• Repeating plaintext letters that are in the same pair are separated with a filler letter,
such as x, so that balloon would be treated as ba lx lo on
• Two plaintext letters that fall in the same row of the matrix are each replaced by the
letter to the right, with the first element of the row circularly following the last. For
example, ar is encrypted as RM
• Two plaintext letters that fall in the same column are each replaced by the letter
beneath, with the top element of the column circularly following the last. Forexample,
mu is encrypted as CM
• Otherwise, each plaintext letter in a pair is replaced by the letter that lies in its own
row and the column occupied by the other plaintext letter. Thus, hs becomes BP and
ea becomes IM (or JM, as the encipherer wishes)

Hill cipher
Another interesting multi-letter cipher is the Hill cipher, developed by the mathematician Lester
Hill in 1929. The encryption algorithm takes m successive plaintext letters and substitutes for
them m cipher text letters.

The substitution is determined by m linear equations in which each character is assigned a

numerical value (a = 0, b = 1 ... z = 25).
Form =3, thesystemcanbedescribedas follows:

c1=(k11P1+k12P2 +k13P3)mod26
c2=(k21P1+k22P2+k23P3)mod26
c3=(k31P1+k32P2+k33P3)mod 26
 Thiscanbeexpressedintermofcolumnvectorsand matrices:
C1 k11 k1 k13
  2
C P P k k  mod26
 P3k21
2 1 2 22 23
 C k k k 
3 31 32 33

Or

C = PK mod 26
where C and P are column vectors of length 3, representing the plaintext and cipher text, and
K is a 3 x 3 matrix, representing the encryption key. Operations are performed in mod 26.

P= D(K, C)= CK-1mod 26 = PKK-1= P

One Time Pad

An Army Signal Corp officer, Joseph Mauborgne suggested using a random key that is as
long as the message, so that the key need not be repeated. In addition, thekey is to be usedto
encrypt and decrypt a single message, and then is discarded. Each new message requires a
new key of the same length as the new message. Such a scheme, known as a one-time pad, is
unbreakable.

It produces random output that bears no statistical relationship to the plaintext. Because the
cipher text contains no information whatsoever about the plaintext, there is simply no way to
break the code.

An example should illustrate our point. Suppose that we are using a 27 characters in whichthe
twenty-seventh character is the space character, but with a one-time key that is as long as the
message.

Considerthe
ciphertext:ANKYODKYUREPFJBYOJDSPLREYIUNOFDOIUERFPLUYTS
Wenowshowtwodifferentdecryptionsusingtwodifferent keys:

key1:pxlmvmsydofuyrvzwctnlebnecvgdupahfzzlmnyih
plain text: mr mustard with the candlestick in the hall
key2:mfugpmiydgaxgoufhklllmhsqdqogtewbqfgyovuhwt
plain text: miss scarlet with the knife in the library

If the actual key were produced in a truly random fashion, then the cryptanalyst cannot say
[Link],thereisnowaytodecidewhich key is
correct and therefore which plaintext is correct. Therefore, the code is unbreakable.

TranspositionCipher
Akindofmappingisachievedbyperformingsomesortofpermutationontheplaintext letters. This
technique is referred to as a transposition cipher.
RailFence Technique
The simplest transposition cipher is the rail fence technique, in which the plaintext is written
down as a sequence of diagonals and then read off as a sequence of rows.

Forexample,
toencipherthemessage"meetmeafterthetogaparty"witharailfenceofdepth2,we write the
following:
m e m a t r h t g p r y
e t e f e t e o a a t

Theencrypted messageis“MEMATRHTGPRYETEFETEOAAT”

SimpleColumnar Technique
A more complex scheme is to write the message in a rectangle, row by row, and read the
message off, column by column, but permute the order of the columns. The order of the
columns then becomes the key to the algorithm.
For example,
Key:3421567
Plaintext: a t ta ck p o s t p o ned u n t i l t woa mx y z

1 2 3 4 5 6 7
1a
 t t a c k p
2o s t p o n e
3d u n t i l t
 
4w o a m x y z

Ciphertext: TTNAAPTMTSUOAODWCOIXKNLYPETZ

A pure transposition cipher is easily recognized because it has the same letter frequencies as
the original plaintext.

For the type of columnar transposition just shown, cryptanalysis is fairly straightforward and
involves laying out the cipher text in a matrix and playing around with column positions.
Digram and trigram frequency tables can be useful.

The transposition cipher can be made significantly more secure by performing more than one
stage of transposition. The result is a more complex permutation that is not easily
reconstructed.
Thus,iftheforegoingmessageisre-encryptedusingthesamealgorithm, Key:

3421567

1 2 3 4 5 6 7
 1t t m
t n a p 
2t t s u o a o
3d w c o i
x k
 
4n l y p e t z

Ciphertext: NSCYAUOPTTWLTTDNPOIETAXTMOKZ

Comparison ofStream CiphersandBlock Ciphers

A stream cipher is one that encrypts a digital data stream one bit or one byte at a time.
Examples of classical stream ciphers are the autokeyed Vigenère cipher and the Vernam
cipher.

In the ideal case, a one-time pad version of the Vernam cipher would be used, in which the
keystream is as long as the plaintext bit stream. If the cryptographic keystream is random,
then this cipher is unbreakable by any means other than acquiring the keystream. However,
the keystream must be provided to both users in advance via some independent and secure
channel. This introduces insurmountable logistical problems if the intended data traffic isvery
large.
Accordingly, for practical reasons, the bit-stream generator must be implemented as an
algorithmic procedure, so that the cryptographic bit stream can be produced by both users. In
this approach, the bit-stream generator is a key-controlled algorithm and must produce a bit
stream that is cryptographically strong. Now, the two users need only share the generating
key, and each can produce the keystream.

Fig.2.1Stream Cipherusing algorithmicbit-stream generator

Ablock cipher is an encryption/decryption schemein which ablock ofplaintext is treated as a

whole and used to produce a cipher text block of equal length. Typically, a block size of 64 or
128 bits is used. In general, they seem applicable to a broader range of applications than
stream ciphers. The vast majority of network-based symmetric cryptographic applications
make use of block ciphers.
 Fig.2.2BlockCipher
FeistelBlockCipher
Feistel proposed that we can approximate the ideal block cipher by utilizing the concept of a
product cipher, which is the execution of two or more simple ciphers in sequence in such a
way that the final result or product is cryptographically stronger than any of the component
ciphers The essence of the approach is to develop a block cipher with a key length of k bits
and a block length of bits, allowing a total of 987possible transformations, rather than the !
transformations available with the ideal block cipher.
In particular, Feistel proposed the use of a cipher that alternates substitutions and
permutations, where these terms are defined as follows:
• Substitution: Each plaintext element or group of elements is uniquely replaced by a
corresponding ciphertext element or group of elements.
• Permutation: A sequence of plaintext elements is replaced by a permutation of that
sequence. That is, no elements are added or deleted or replaced in the sequence, rather the
order in which the elements appear in the sequence is changed.

In fact, Feistel’s is a practical application of a proposal by Claude Shannon to develop a

product cipher that alternates confusion and diffusion functions.

Diffusion: A cryptographic technique that seeks to obscure the statistical structure of the
plaintext by spreading out the influence of each individual plaintext digit over many cipher
text digits.

Confusion: A cryptographic technique that seeks to make the relationship between the
statistics oftheciphertext and thevalueoftheencryption key as complex as [Link] is
achievedbytheuseofa complex scramblingalgorithmthat dependson the key andthe input.

Figure 2.3 depicts the structure proposed by Feistel. The inputs to the encryption algorithm
are a plaintext block of length 2w bits and a [Link] plaintext block is divided into two halves
L0and R0. The two halves of the data pass through rounds of processing and then
combinetoproducethe [Link]-1and Ri-1derivedfrom
theprevious round, as well as asubkey K iderived from theoverall K. In general, thesubkeys
Kiare different from K and from each other. In Figure 2.3, 16 rounds are used, although any
number of rounds could be implemented.

All rounds have the same structure. A substitution is performed on the left half of the data.
This is done by applying a round function F to the right half of the data and then taking the
exclusive-OR of the output of that function and the left half of the data. The round function
has the same general structure for each round but is parameterized by the round subkey K i.
AnotherwaytoexpressthisistosaythatFisafunctionofright-halfblockofwbitsanda
subkey of y bits, which produces an output value of length w bits: F(REi, Ki+1).
Followingthis substitution, a

Fig.2.3FeistelEncryptionandDecryption

TheexactrealizationofaFeistelnetworkdependsonthechoiceofthefollowing
parameters and design features:
• Block size: Larger block sizes mean greater security (all other things being equal) but
reduced encryption/decryption speed for a given algorithm. The greater security is achieved
[Link],ablocksizeof64bitshasbeenconsideredareasonable
 trade off and was nearly universal in block cipher design. However, the new AES uses a 128- bit
block size.
• Key size: Larger key size means greater security but may decrease encryption/ decryption
speed. Thegreatersecurity is achieved by greater resistance to brute-force attacks and greater
confusion. Key sizes of 64 bits or less are now widely considered to be inadequate, and 128
bits has become a common size.
• Number of rounds: The essence of the Feistel cipher is that a single round offers
inadequate security but that multiple rounds offer increasing security. A typical size is 16
rounds.
• Subkey generation algorithm: Greater complexity in this algorithm should lead to greater
difficulty of cryptanalysis.
• Round function F: Again, greater complexity generally means greater resistance to
cryptanalysis.

TherearetwootherconsiderationsinthedesignofaFeistelcipher:
• Fast software encryption/decryption: In many cases, encryption is embedded in
applications or utility functions in such a way as to preclude a hardware implementation.
Accordingly, the speed of execution of the algorithm becomes a concern.
• Ease of analysis: Although we would like to make our algorithm as difficult as possible to
cryptanalyze, there is great benefit in making the algorithm easy to analyze. That is, if the
algorithm can be concisely and clearly explained, it is easier to analyze that algorithm for
cryptanalytic vulnerabilities and therefore develop a higher level of assurance as to its
strength. DES, for example, does not have an easily analyzed functionality.

BlockCipherModesofOperation
When multiple blocks of plaintext are encrypted using the same key, a number of security
[Link] ablockcipherinavarietyofapplications,fivemodesofoperationhave
beendefinedbyNIST. Inessence,amode ofoperationisatechniqueforenhancingtheeffect of a
cryptographic algorithm or adapting the algorithm for an application, such as applying a
block cipher to a sequence of data blocks or a data stream.

(i) ElectronicCodeBook(ECB)Mode
This modeis a most straightforward way ofprocessing aseries ofsequentially listedmessage
blocks.
Operation
 The user takes the first block of plaintext and encrypts it with the key to produce the
first block of cipher text.
 He then takes the second block of plaintext and follows the same process with
samekey and so on so forth.
The ECB mode is deterministic, that is, if plaintext block P1, P2,…, Pm are encrypted twice
under the same key, the output cipher text blocks will be the same.
In fact, for a given key technically we can create a codebook of cipher texts for all possible
plaintext blocks. Encryption would then entail only looking up for required plaintext and
select the corresponding cipher text. Thus, the operation is analogous to the assignment of
code words in a codebook, and hence gets an official name: Electronic Codebook mode of
operation (ECB). It is illustrated as follows:
 Fig.2.4ECB-Encryptionand Decryption
(ii) CipherBlockChaining(CBC)Mode
CBC mode of operation provides message dependence for generating ciphertext and
makesthe system non-deterministic.
Operation
Theoperation ofCBC modeis depictedin thefollowing [Link] as follows:
 Loadthen-bitInitializationVector(IV)inthetopregister
 XORthe n-bitplaintext blockwith datavalue intop register
 Encrypttheresultof XORoperationwithunderlying blockcipherwithkeyK.
 Feed cipher text block into top register and continue the operation till all plaintext
blocks are processed
 For decryption, IV data is XORed with first cipher text block decrypted. The first
cipher text block is also fed into to register replacing IV for decrypting next ciphertext
block
 Fig.2.5CBC-EncryptionandDecryption

(iii) CipherFeedback(CFB)Mode
Inthismode,eachciphertextblockgets‘fedback’intotheencryptionprocessinorderto encrypt the
next plaintext block.
Operation
The operation of CFB mode is depicted in the following illustration. For example, in the
present system, a message block has a size ‘s’ bits where 1 < s < n. The CFB mode requires
an initialization vector(IV)as theinitial random n-bit input [Link] IV need not be secret.
Steps of operation are:
 Loadthe IVinthetop register
 Encryptthedatavalueintopregister withunderlyingblockcipherwithkeyK
 Take only ‘s’ number of most significant bits (left bits) of output of encryptionprocess
and XOR them with ‘s’ bit plaintext message block to generate cipher text block
 Feed cipher text block into top register by shifting already present data to the left and
continue the operation till all plaintext blocks are processed
 Essentially, the previous cipher text block is encrypted with the key, and then the
result is XORed to the current plaintext block
 [Link]-decidedIVisinitiallyloadedatthestart of
decryption
 Fig.2.6CFB-EncryptionandDecryption

(iv) OutputFeedback(OFB)Mode
It involves feeding the successive output blocks from the underlying block cipher back to it.
Thesefeedbackblocksprovidestringofbitstofeedtheencryptionalgorithmwhichactasthe key-
stream generator as in case of CFB mode.

The key stream generated is XOR-ed with the plaintext blocks. The OFB mode requires anIV
as the initial random n-bit input block. The IV need not be secret.

Theoperation isdepictedinthefollowing illustration:

 Fig.2.7OFB-Encryptionand Decryption

(v) Counter(CTR)Mode
It can be considered as a counter-based version of CFB mode without the feedback. In this
mode, both the sender and receiver need to access to a reliable counter, which computes a
new shared value each time a cipher text block is exchanged. This shared counter is not
necessarily a secret value, but challenge is that both sides must keep the countersynchronized.
Operation
Both encryption and decryption in CTR mode aredepicted in the following [Link]
in operation are:
 Loadthe initialcounter value inthe topregister isthe same for boththe sender and the
receiver. It plays the same role as the IV in CFB (and CBC) mode
 Encryptthecontentsofthecounterwiththekeyandplacetheresultinthebottom register
 Takethefirst plaintextblock P1and XORthis tothecontentsof thebottomregister
 Theresult ofthis is [Link] C1 tothereceiverand update thecounter. Thecounter
 updatereplacestheciphertextfeedbackinCFBmode
 Continueinthismanneruntilthelastplaintextblockhasbeenencrypted.
 Thedecryption is the reverseprocess. The cipher text block is XORed with the output
of encrypted contents of counter value. After decryption of each cipher text block
counter is updated as in case of encryption

Fig.2.8CTR-Encryptionand Decryption
 Table2.1: Block CipherModes of Operation

DataEncryption Standard

The Data Encryption Standard (DES) is a symmetric-key block cipher published by the
National Institute of Standards and Technology (NIST).

DES is an implementation of a Feistel Cipher. It uses 16 round Feistel structure. The block
size is 64-bit. Though, key length is 64-bit, DES has an effective key length of 56 bits, since
8 of the 64 bits of the key are not used by the encryption algorithm (function as check bits
only). General Structure of DES is depicted in the following illustration:
 Fig.2.9DESStructure

SinceDESisbasedontheFeistelCipher,allthatisrequiredtospecifyDES is:

 Round function
 Key schedule
 Anyadditionalprocessing−Initialandfinalpermutation
InitialandFinalPermutation
TheinitialandfinalpermutationsarestraightPermutationboxes(P-boxes)thatareinverses
[Link] permutations are
shown as follows:

Fig.2.10Initial Permutation
 Fig.2.11Final Permutation
DetailsofoneroundinDES

Fig.2.12OneRoundin DES

RoundFunction(F):
The heart of this cipher is the DES function, f. The DES function applies a 48-bit key to the
rightmost 32 bits to produce a 32-bit output.
 Fig.2.13Roundfunction

 Expansion Permutation Box − Since right input is 32-bit and round key is a 48-bit,
we first need to expand right input to 48 bits. Permutation logic is graphically
depicted in the following illustration

Fig.2.14Expansion Permutation

 The graphically depicted permutation logic is generally described as table in DES

specification illustrated as shown:

Fig.2.15ExpansionPermutation Table
  XOR (Whitener).− After the expansion permutation, DES does XOR operation on
the expanded right section and the round key. The round key is used only in this
operation.

 Substitution Boxes.− The S-boxes carry out the real mixing (confusion). DES uses8
S-boxes, each with a 6-bit input and a 4-bit output. Refer the following illustration

Fig.2.16 Substitution

TheS-boxrule isillustrated below

Fig.2.17S-boxrule

 There are a total of eight S-box tables. The output of all eight s-boxes is then
combined in to 32-bit section.
Fig.2.18S-boxes
  StraightPermutation −The32-bitoutputofS-boxesisthensubjectedtothe straight
permutation with rule shown in the following illustration:

Fig.2.19Permutation Table

KeyGeneration
Theround-keygeneratorcreatessixteen 48-bitkeysoutofa56-bit [Link] key
generation is depicted in the following illustration

Fig.2.20Key Generation
AdvancedEncryptionStandard
The more popular and widely adopted symmetric encryption algorithm likely to be
encountered nowadays is the Advanced Encryption Standard (AES). It is found at least six
time faster than triple DES.
A replacement for DES was needed as its key size was too small. With increasing computing
power, it was considered vulnerable against exhaustive key search attack. Triple DES was
designed to overcome this drawback but it was found slow.
Thefeaturesof AESareas follows:
 Symmetrickeysymmetricblockcipher
 128-bitdata,128/192/256-bit keys
 Strongerandfasterthan Triple-DES
 Providefullspecificationanddesigndetails
 Softwareimplementable inCandJava

Operationof AES
AES is an iterative rather than Feistel cipher. It is based on ‘substitution–permutation
network. It comprisesofaseriesoflinkedoperations,someofwhich involvereplacinginputs by
specific outputs (substitutions) and others involve shuffling bits around (permutations).
Interestingly, AES performs all its computations on bytes rather than bits. Hence, AES treats
the 128 bits of a plaintext block as 16 bytes. These 16 bytes are arranged in four columns and
four rows for processing as a matrix: Unlike DES, the number of rounds in AES is variable
and depends on the length of the key.
AES uses 10 rounds for 128-bit keys, 12 rounds for 192-bit keys and 14 rounds for 256-bit
keys. Each of these rounds uses a different 128-bit round key, which is calculated from the
original AES key. The schematic of AES structure is given in the following illustration:

Fig.2.21AESStructure
EncryptionProcess
Here,[Link] comprises of four
sub-processes. The first-round process is depicted below:
 Fig.2.21Oneroundin AES
ByteSubstitution (SubBytes)
The 16inputbytesare substitutedby lookingup a fixedtable (S-box) [Link] result is
in a matrix of four rows and four columns.

Shiftrows
[Link]‘falloff’are reinserted on the
right side of row. Shift is carried out as follows:
 Firstrowisnot shifted
 Secondrowis shiftedone(byte)position totheleft
 Thirdrow isshifted twopositions tothe left
 Fourthrow is shifted threepositions to the left
 The result is a new matrix consisting of the same 16 bytes but shifted with respect to
each other

MixColumns
Each column of four bytes is now transformed using a special mathematical function. This
function takes as input the four bytes of one column and outputs four completely new bytes,
which replace the original column. The result is another new matrix consisting of 16 new
bytes. It should be noted that this step is not performed in the last round.

Addroundkey
The 16 bytes of the matrix are now considered as 128 bits and are XORed to the 128 bits of
the round key. If this is the last round then the output is the ciphertext. Otherwise, the
resulting 128 bits are interpreted as 16 bytes and we begin another similar round.

DecryptionProcess
TheprocessofdecryptionofanAESciphertextissimilartotheencryptionprocessinthe reverse
order. Each round consists of the four processes conducted in the reverse order:
 Addroundkey
 Mix columns
 Shift rows
 Byte substitution
Since sub-processes in each round are in reverse manner, unlike for a Feistel Cipher, the
encryption and decryption algorithms needs to be separately implemented, although they are
very closely related

2.7 RSA Algorithm:

Diffie and Hellman challenged cryptologists to come up with a cryptographic algorithm that met
the requirements for public-key systems.
One of the first successful responses to the challenge was developed in 1977 by Ron Rivest, Adi
Shamir, and Len Adleman at MIT and first published in 1978. The Rivest-Shamir-
Adleman(RSA)scheme has sincethat timereigned supremeas themost widely acceptedand
implemented general-purpose approach to public-key encryption.
The RSA scheme is a block cipher in which the plaintext and ciphertext are integers between 0
and n - 1 for some n. A typical size for n is 1024 bits, or 309 decimaldigits. That is, n
[Link],beginning withanexplanation of the
algorithm. Then we examine some of the computational and cryptanalytical implications of
RSA

Descriptionofthe Algorithm
RSA makes use of an expression with exponentials. Plaintext is encrypted in blocks, with each
block having a binary value less than some number n. That is, the block size must beless than
or equal to log2(n) + 1; in practice, the block size is i bits, where 2i<n ≤ 2i+1. Encryption and
decryption are of the following form, for some plaintext block M and ciphertext block C.

Both sender and receiver must know the value of n. The sender knows the value of e, andonly the
receiver knows the value of d. Thus, this is a public-key encryption algorithm with a public
key of PU = {e, n} and a private key of PR = {d, n}.

For this algorithm to be satisfactory for public-key encryption, the following requirements must
be met.

1. Itis possibleto find valuesof e,d, n suchthatMed modn =Mforall M<n.

2. Itisrelativelyeasy tocalculateMemod nandCdmod nforallvalues ofM<n.
3. Itisinfeasibletodeterminedgiveneand n.

Weneed to find arelationship of theform

Medmod n =M

The preceding relationship holds if e and d are multiplicative inverses modulo φ(n), where φ(n) is
the Euler totient function.

Forp,qprime,φ(pq)=(p-1)(q-1). Therelationship between eandd canbeexpressed as

edmod φ(n) = 1
Thisisequivalentto saying

That is, e and d are multiplicative inverses mod(n). Note that, according to the rules of
modular arithmetic, this is true only if d (and therefore e) is relatively prime to (n).
Equivalently, gcd((n), d) = 1.

Theingredients arethe following:

The private key consists of {d, n} and the public key consists of {e, n}. Suppose that user A
has published its public key and that user B wishes to send the message M to A. Then B
calculates C = Memod n and transmits C. On receipt of this ciphertext, user A decrypts by
calculating M = Cdmod n.

Table2.2 : RSA algorithm

ExampleofRSA algorithm

Fig.2.22Example
ReviewQuestions:
Part-A:
1. Whataretheessential ingredientsof asymmetriccipher?
2. BrieflydefinetheCaesar cipher.
3. WhatismeantbyBruteforceattack?
4. [Link].
5. BrieflydefinethePlayfair cipher.
6. Whataretwo problemswith theone-time pad?
7. Whatisatranspositioncipher?
8. Whyisitimportant tostudytheFeistel cipher?
9. Whatisthedifferencebetweenablock cipherandastream cipher?
10. Whatisthedifferencebetweendiffusionandconfusion?
11. Whichparameters anddesignchoicesdeterminetheactualalgorithmofaFeistel cipher?
12. Whatis thepurposeof theS-boxes in DES?
13. BrieflydescribeSubBytes.
14. BrieflydescribeShiftRows.
15. BrieflydescribeMixColumns.
16. Whydosomeblockciphermodesofoperationonlyuseencryptionwhileothersuseboth
encryption and decryption?
Part-B
1. [Link]“Mustseeyou after
coming’.
2. Encrypt the message “meet me at the usual place at ten rather than eight” using the Hill
[Link]
corresponding decryption of the cipher text to recover the original plaintext.
3. Explainsecurityattacksindetail.
4. Discussaboutsymmetric cryptosystem.
5. DrawFeistelcipherstructureandexplain.
6. Compareandexplaindifferentmodesofblockcipher operation.
7. Discussin detailabout oneround in DES.
8. How16 Keysaregenerated inDES?Explain theprocess in detail.
9. ExplainAES in detail
10. ExplainRSAalgorithmwithan example.
 SCHOOL OF COMPUTING

DEPARTMENTOFCOMPUTERSCIENCEANDENGINEERING

UNIT-3
SCS1316-NETWORKSECURITY
 UNIT- III SECURITYFUNCTIONSANDDATASECURITY

Syllabus:

Public Key Crypto system- Diffie-Helmann Key Exchange-Key management Techniques-

Hash Functions- Requirements-Hash Algorithm-MD5,SHA_1-Message Authentication Code
(MAC)- HMAC-Digital Signature-User Authentication-Kerbroes-X.509 Certificates,X.509
Formats, Public Key Infrastructure- PKIX Architecture-Model-Management Functions.

:PUBLICKEYCRYPTO SYSTEM:

The concept of public-key cryptography evolved from an attempt to attack two of

the most difficult problems associated with symmetric encryption. The first problem is that of
key distribution, and the second one related to digital signature. Asymmetric algorithms rely
on one key for encryption and a different but related key for decryption. These algorithms
have the following important characteristic.

It is computationally infeasible to determine the decryption key given only

knowledge of the cryptographic algorithm and the encryption key. A public-key encryption
scheme has six ingredients Plaintext: This is the readable message or data that is fed into the
algorithm as input.

Fig3.1:EncryptionwithPublickey
Encryptionalgorithm:Theencryptionalgorithmperformsvarioustransformationsonthe plaintext.
• Public and private keys: This is a pair of keys that have been selected so that if one is used
for encryption, the other is used for decryption. The exact transformations performed by the
algorithm depend on the public or private key that is provided as input.

• Cipher text: This is the scrambled message produced as output. It depends on the plaintext
and the key. For a given message, two different keys will produce two different cipher texts.

• Decryption algorithm: This algorithm accepts the cipher text and the matching key and
produces the original plaintext.

1. Each user generates a pair of keys to be used for the encryption and decryption of
messages.

2. Each user places one of the two keys in a public register or other accessible file. This is the
public key. The companion key is kept private. As Figure 3.1, suggests, each user maintains a
collection of public keys obtained from others.

3. If Bob wishes to send a confidential message to Alice, Bob encrypts the message using
Alice’s public key.

4. When Alice receives the message, she decrypts it using her private key. No other recipient
can decrypt the message because only Alice knows Alice’s private key. With this approach,all
participants have access to public keys, and private keys are generated locally by each
participant and therefore need never be distributed.

As long as a user’s private key remains protected and secret, incoming communication is
secure. At any time, a system can change its private key and publish the companion publickey
to replace its old public key.

:DIFFIE-HEILMANKEYEXCHANGE/AGREEMENTALGORITHM:

Whitefield Diffie and Martin Hellman devised an amazing solution to the problem of
key agreement, or key exchange in 1976. This solution is called as the Diffie-Hellman Key
Exchange /Agreement Algorithm. The beauty of this scheme is that the two parties, who want
to communicate securely, can agree-on a symmetric key using this technique.

Itmightcomeasasurprise,butKlisactuallyequaltoK2!ThismeansthatKl
=K2=Kisthesymmetrickey,whichAliceandBobmustkeepsecretandcanhenceforth
usefor encrypting/decrypting their messages with. The mathematics behind this is quite
interesting.

Let us try to understand what this actually means, in simple terms. (a) Firstly,
take a look at what Alice does in step 6. Here, Alice computes: K1 = BX mod n. What is B?
From step 4, we have: B = gYmod n. Therefore, if we substitute this value of B in step 6, we
will have the following equation: Kl = (g)yr mod n =( g)YXmod n. (b) Now, take a look at
what Bob does in step 7. Here, Bob computes: K2 = AY mod n. What is A? From step 2, we
have: A = gX mod n. Therefore, if we substitute this value of A in step 7, we will have the
following equation: K2 = (gX)Y mod n = gXY' mod n. Now, basic mathematics says that:
KYX = KXY Therefore, in this case, we have: K I = K2 = K.

Fig3.2: Diffie-HellmanKey Exchangealgorithm

 Fig3.3: Exampleof Diffie-HellmanKey exchange

KEY MANAGEMENT:

Key management refers to management of cryptographic keys in a cryptosystem.

This includes dealing with the generation, exchange, storage, use and replacement of keys.
Once keys are inventoried, key management typically consists of three steps: exchange,
storage and use. Key exchange (also key establishment) is any method in cryptography by
which cryptographic keys are exchanged between two parties, allowing use of acryptographic
algorithm. If the cipher is a symmetric key cipher, both will need a copy of the same key. If
an asymmetric key cipher with the public/private key property, both will needthe other's
public key.

: Key storage: However distributed, keys must be stored securely to maintain

communications security. Security is a big concern[4] and hence there are various techniques
in use to do so. Likely the most common is that an encryption application manages keys for

theuser anddepends onan accesspassword tocontroluseof thekey.

Key use : The major issue is length of time a key is to be used, and therefore frequency of
replacement. Because it increases any attacker's required effort, keys should be frequently
changed. This also limits loss of information, as the number of stored encrypted messages
which will become readable when a key is found will decrease as the frequency of

keychangeincreases.

Challenges

SeveralchallengesITorganizationsfacewhentryingtocontrolandmanagetheir encryption
keys are:

1. Scalability:Managing alargenumberofencryption keys.

2. Security:Vulnerabilityofkeysfromoutsidehackers,maliciousinsiders.

3. Availability:Ensuringdataaccessibilityforauthorizedusers.

4. Heterogeneity:Supportingmultipledatabases,applicationsandstandards.

5. Governance:Definingpolicy-drivenaccess controlandprotectionfordata

DistributionofpublicKeys:

Severaltechniques havebeen proposedforthe distributionofpublickeys.

Virtuallyalltheseproposalscanbegroupedintothe followinggeneral schemes:

• Publicannouncement• publiclyavailabledirectory

• Public-keyauthority.•Public-keycertificates

:PUBLICANNOUNCEMENTOFPUBLIC KEYS:

On the face of it, the point of public-key encryption is that the public key is public. Thus, if
there is some broadly accepted public-key algorithm, such as RSA, any participant can send
his or her public key to any other participant or broadcast the key to the community at large
(Refer fig below)
 Fig3.4:Uncontrolledpublickeydistributions

PubliclyAvailableDirectory

A greater degree of security can be achieved by maintaining a publicly availabledynamic

directory of public keys. Maintenance and distribution of the public directory would have to
be the responsibility of some trusted entity or organization (Figure below). Such a scheme
would include the following elements:

Fig3.5: Public-Key Publication

1. Theauthoritymaintains adirectory with a{name, publickey}entryforeach participant.

2. Each participant registers a public key with the directory authority. Registration would
have to be in person or by some form of secure authenticated communication.

3. A participant may replace the existing key with a new one at any time, either because of
the desire to replace a public key that has already been used for a large amount of data, or
because the corresponding private key has been compromised in some way.

4. Participants could also access the directory electronically. For this purpose, secure,
authenticated communication from the authority to the participant is mandatory.

:PUBLIC-KEY AUTHORITY:

Strongersecurityforpublic-keydistributioncanbeachievedbyprovidingtighter
[Link] in
Figure below.

Fig3.6: PublicKey Distribution Scenario

1. Asendsatimestampedmessagetothepublic-keyauthoritycontainingarequestforthe current

public key of B.
 2. Theauthorityrespondswithamessagethatisencryptedusingtheauthority’s

private key, PR Thus, A is able to decrypt the message using the authority’s public key.

Therefore,[Link] the

following:

• B’spublickey,PUb, whichAcan usetoencryptmessagesdestinedfor B

• The original request used to enable A to match this response with the corresponding

earlierrequestandtoverifythattheoriginalrequestwasnotalteredbeforereceptionbythe

authority

• TheoriginaltimestampgivensoAcandeterminethatthisisnotanoldmessagefrom the

authority containing a key other than B’s current public key

3. AstoresB’spublickeyandalsousesittoencryptamessagetoBcontainingan identifier of A

(IDA) and a nonce (N), which is used to identify this transaction uniquely.

4,[Link]’spublickeyfromtheauthorityinthesamemanner as A retrieved B’s

public key. At this point, public keys have been securely delivered to A and B, and they may

begin their protected exchange. However, two additional steps are desirable:

7.AreturnsN2,whichisencryptedusingB’spublickey,toassureBthatitscorrespondent is A.

Thus,atotal ofseven messagesarerequired.

:PUBLIC-KEYCERTIFICATES:

The public key certificate relies on certificates that can be used by participants to
exchange keys without contacting a public-key authority, in a way that is as reliable as if the
keys were obtained directly from a public-key authority. In essence, a certificate consists of a
publickey, anidentifierofthekey owner,and the wholeblock signedby a trusted thirdparty.
 Typically, the third party is a certificate authority, such as a government agency or a
[Link] herpublic key to
the authority in a secure manner and obtain a certificate. The user can then publish the
certificate. Anyone needing this user’s public key can obtain the certificate andverify that it is
valid by way of the attached trusted signature.

Wecanplacethefollowingrequirements onthis scheme:

1. Anyparticipantcanreadacertificatetodeterminethenameandpublickeyofthecertificate’s
owner.

2. Any participant can verify that the certificate originated from the certificate authority andis
not counterfeit.

3. Onlythe certificateauthority cancreateandupdate certificates.

4. Anyparticipantcan verifythecurrency ofthe certificate.

Fig3.7:Exchangeofpublickey exchange

AcertificateschemeisillustratedinFigureabove. Eachparticipantappliestothecertificate
authority,[Link] or by
some form of secure authenticated communication.
Forparticipant A,the authorityprovides acertificateofthe form

wherePRauth is the privatekey used by the authority and T isa timestamp. A may

thenpassthis certificateon toany otherparticipant,who readsand verifiesthe certificate

asfollows:

The recipient uses the authority’s public key, PUauth, to decrypt the certificate. Because the
certificate is readable only using the authority’s public key, this verifies that the certificate
camefromthecertificate authority. Theelements IDAand PUaprovidetherecipient with the
nameand publickeyofthecertificate’[Link] validatesthecurrencyofthe
certificate.

Oneschemehasbecomeuniversallyacceptedforformattingpublic-keycertificates:the
X.509 standard. X.509 certificates are used in most network security applications, including
IP security, transport layer security (TLS), and S/MIME.

:Message digest:

Message digest (also called as hash) is a fingerprint or the summary of a message. It is usedto
verify the integrity of the data (i.e. to ensure that a message has not been tampered with after
it leaves the sender but before it reaches the receiver).

IdeaofaMessage Digest:

Theconceptofmessage digestsisbasedonsimilarprinciples. However,itisslightlywiderin scope.

For instance, suppose we have a number 4000 and we divide it by 4 to get 1000, 4 becomes a
fingerprint of the number 4000. Dividing 4000 by 4 will always yield 1000. If we change
either 4000 or 4, the result will not be 1000. Another important point is, if we are simply
given the number 4, but are not given any further information, we would not be ableto trace
back the equation 4 x 1000 =4000. Thus, we have one more important concept here. The
fingerprint of a message (in this case, the number 4) does not tell anything about the original
message (in this case, the number 4000). This is because there are infinite other possible
equations, which can produce the result 4.

Anothersimpleexample of messagedigestis shownin Fig. below.

 Fig3.8:Example ofmessage digest

Letus assumethat wewant to calculate themessagedigest of a number

[Link],wemultiplyeachdigit inthenumberwiththenextdigit(excludingitifitis 0) and

disregarding the first digit of the multiplication operation, if the result is a two-digit

number.

:RequirementsofaHashfunction(Messagedigest):

1. It should be a one way function. That means given the message it should be easy to findout
its digest, and the reverse should be impossible.(getting back the message from its digest
must be infeasible)

2. No two different messages should produce a same digest. This requirement is stated as
collision free property.

:MD5:

MD5isamessagedigestalgorithmdevelopedbyRonRivest.MD5isquitefast andproduces 128-bit

message digests. Over the years, researchers have developed potential weaknesses in MD5.
However, so far, MD5 has been able to successfully defend itself against collisions. This may
not be guaranteed for too long, though.
After some initial processing, the input text is processed in 512-bit blocks (which are further
divided into 16 32-bit sub-blocks). The output of the algorithm is a set of four 32-bit blocks,
which make up the 128-bit message digest.

3.5.4How MD5 Works?

Step 1: Padding :The first step in MD5 is to add padding bits to the original message. The
aim of this step is to make the length of the original message equal to a value, which is 64bits
less than an exact multiple of 512. For example, if the length of the original message is 1000
bits, we add a padding of 472 bits to make the length of the message 1472 bits. This is
because, ifweadd64to 1472,weget1536, whichisamultipleof512(because1536 =512x 3).

Thus, after padding, the original message will have a length of 448 bits (64 bits less than
512), 960 bits (64 bits less than 1024), 1472 bits (64 bits less than 1536), etc. The padding
consists of a single 1-bit, followed by as many 0-bits, as required. Note that padding isalways
added, even if the message length is already 64 bits less than a multiple of 512. Thus, if the
message were already of length say 448 bits, we will add a padding of 512 bits to make its
length 960 bits. Thus, the padding length is any value between 1 and 512.

Fig3.9:Message Digest
Step 2: Append length After padding bits are added, the next step is to calculate the original
length of the message and add it to the end of the message, after padding. The length of the
message is calculated, excluding the padding bits. This length of the original message is now
expressedasa64-bitvalueandthese64bitsareappendedtotheendoftheoriginalmessage
+padding.

Step 3: Divide the input into 512-bit blocks Now, we divide the input message into blocks,
each of length 512 bits. (Refer fig )

Step 4: Initialize chaining variables In this step, four variables (called as chaining variables)
are initialized. They are called as A, B, C and D. Each of these is a 32-bit number. The initial
hexadecimal values of these chaining variables are shown in Fig. below.

Fig3.10:ChainingVariables

ep5:Processblocks:

Copy the four chaining variables into four corresponding variables, a, b, c and d.
After all the initializations, the real algorithm begins. There is a loop that runs for as many
512-bit blocks as are in the message. Now, we have four rounds. In each round, we processall
the 16 sub-blocks belonging to a block. The inputs to each round are: (a) all the 16 sub-
blocks, (b) the variables a, b, c, d and (c) some constants, designated as t.

All the four rounds vary in one major way: Step 1 of the four rounds has different
processing. The other steps in all the four rounds are the same. • In each round, we have 16
inputsub-blocks,namedM[0],M[1],…,M[15]oringeneral,M[i],whereivariesfrom0to
[Link] weknow, eachsub-block consistsof 32bits.

• Also, t is an array of constants. It contains 64 elements, with each element

[Link] ast[1],t[2],…t[64]oringeneral as t[k],
where k varies from 1 to 64. Since there are four rounds, we use 16 out of the 64 values of t
in each round.
 Let us summarize these iterations of all the four rounds. In each case, the output
of the intermediate as well as the final iteration is copied into the register abcd. Note that we
have 16 such iterations in each round.

Fig3.11: OneMD5 operation

1. A process P is first performed on b, c and d. This process P is different in all the four
rounds.
2. Thevariableais addedto theoutput ofthe processP ([Link] theregister abcd).
3. Themessagesub-blockM[i]is added to theoutput of Step 2 (i.e. to theregister abcd).
4. Theconstant t[k]is added to theoutputof Step 3 (i.e. to theregisterabcd).
5. TheoutputofStep4(i.e. thecontentsofregisterabcd)iscircular-leftshiftedbysbits. (The
value of s keeps changing).
6. Thevariableb isadded to theoutput of Step5 (i.e. totheregister abcd).
7. Theoutput of Step 6 becomes thenew abcd for thenext step.

3. 5:SECURE HASHALGORITHM (SHA):

TheNationalInstituteofStandardsandTechnology(NIST)alongwithNSA
developed the Secure Hash Algorithm (SHA). In 1993. SHA is a modified version of
[Link] less than 2

[Link],whichis160bitsinlength(32 bits more

than the message digest produced by MD5). The word Secure in SHA was decided based
on two features. SHA is designed to be computationally infeasible to:

(a) Obtaintheoriginalmessage, givenitsmessage digest and

(b) Findtwo messages producingthesame messagedigest

Step1to 3MD5 andSHA [Link] step4andprocess SHAdiffers from MD5.

Step 4: Initialize chaining variables Now, five chaining variables A through E are
[Link] chainingvariables,eachof32bitsinMD5 (which made
the total length of the variables 4 x 32 = 128 bits). Recall that we stored the intermediate
as well as the final results into the combined register made up of these four

chaining variables, i.e. abcd. Since in the case of SHA, we want to produce a message
digest of length 160 bits, we need to have five chaining variables here (5x32 = 160 bits).
In SHA, the variables A through D have the same values as they had in MD5.
Additionally, E isinitialized to Hex C3 D2 E1 F0.

Step 5: Process blocks Now the actual algorithm begins. Here also, the steps are
quitesimilar to those in MD5. SHA has four rounds, each round consisting of 20 steps.
Each round takes the current 512- bit block, the register abcde and a constant K[t] (wheret
= 0 to 79) as the three inputs. It then updates the contents of the register abcde using the
SHA algorithm steps. Also notable is the fact that we had 64 constants defined as t in
MD5. Here, we have only four constants defined for K[t], one used in each of the four
rounds.
 Fig.3.12:Single SHA-1iteration
Table3.1:ComparisonofMD5andSHA-1
MESSAGEAUTHENTICATIONCODE(MAC):

The concept of Message Authentication Code (MAC) is quite similar to that of a

message digest. However, there is one difference. As we have seen, a message digest is
simply a fingerprint of a message. There is no cryptographic process involved in the case of
message digests. In contrast, a MAC requires that the sender and the receiver should know a
shared symmetric (secret) key, which is used in the preparation of the MAC. Thus, MAC
involves cryptographic processing. Let us assume that the sender A wants to send a message
M to a receiver B. How the MAC processing works is shown in Fig. below.

Fig.3.13:MessageAuthentication Code
1. AandBshareasymmetric(secret)keyK,whichisnotknowntoanyoneelse.A

calculates the MAC by applying key K to the message M.

2. Athen sends theoriginalmessageM and the MAC H1 to B.

3. WhenBreceives the message,B alsouses Ktocalculate itsownMACH2over M.

4. BnowcomparesH1 [Link], B concludesthatthemessageMhasnot

[Link],ifH1≠H2,Brejectsthemessage,realizingthatthe message

was changed during transit.

 HMAC

HMAC stands for Hash-based Message Authentication Code. HMAC has been chosen
as a mandatory security implementation for the Internet Protocol (IP) security and is alsoused
in the Secure Socket Layer (SSL) protocol, widely used on the Internet. Thefundamental idea
behind HMAC is to reuse the existing message digest algorithms, such as MD5 or [Link]
treats the message digest as a black box. Additionally, it uses the shared
symmetrickeytoencryptthemessagedigest,[Link] in
figure below.

Fig.3.14:HMACConcept
HowHMAC Works?

Let us now take a look at the internal working of HMAC. For this, let us start with
the various variables that will be used in our HMAC discussion. MD = The message
digest/hash function used (e.g. MD5, SHA-1, etc.) M = The input message whose MAC is to
be calculated L = The number of blocks in the message M b = The number of bits in each
blockK=ThesharedsymmetrickeytobeusedinHMACipad=Astring 00110110repeated b/8 times
opad = A string 01011010 repeated b/8 times
Step1:MakethelengthofKequalto b

Fig.3.14: Step1of HMAC

Step2:XORKwithipadtoproduceS1WeXORK(theoutputofStep1)andipadto produce a
variable called as S1.

Step3:AppendMtoS1 Wenowtaketheoriginalmessage(M)andsimplyappendittothe end of S1

(which was calculated in Step 2).

Step4:MessagedigestalgorithmNow,theselectedmessagedigestalgorithm(e.g.MD5, SHA-
1, etc)is applied to the output of Step 3 (i.e. to the combination of S1 and M). Let us call
the output of this operation as H.

Step5:XORKwithopad toproduceS2Now, weXORK(theoutputofStep1)withopad to produce

a variable called as S2.

Step6:AppendHtoS2In thisstep,wetakethemessagedigestcalculatedinstep4(i.e.H) and simply

append it to the end of S2 (which was calculated in Step 5).

Step 7: Message digest algorithm Now, the selected message digest algorithm (e.g. MD5,
SHA-1,etc)isappliedto theoutputofStep6(i.e.totheconcatenationofS2andH).Thisis the final
MAC that we want.
 Fig.3.15:CompleteHMACOperation
:DIGITALSIGNATURES:
These are the public-key primitives of message authentication. In the physical
world, it is common to use handwritten signatures on handwritten or typed messages. They
are used to bind signatory to the message. Similarly, a digital signature is a technique that
binds a person/entity to the digital data. This binding can be independently verified by
receiveras well as any [Link] signatureis acryptographicvaluethat is calculated
from the data and a secret key known only by the signer.

The exchange of data is authenticated by signing a mutually obtainable hash;

each party encrypts the hash with its private key. The hash is generated over important
parameters, such as user IDs and nonces. In real world, the receiver of message needs
assurance that the message belongs to the sender and he should not be able to repudiate the
origination of that message. This requirement is very crucial in business applications, since
likelihood of a dispute over exchanged data is very high.

As mentioned earlier, the digital signature scheme is based on public key

cryptography. The model of digital signature scheme is depicted in the following illustration.
 Fig3.16: Adigital SignatureModel

Thefollowingpoints explain the entireprocessindetail −

 Eachpersonadoptingthisschemehasapublic-privatekeypair.
 Generally, the key pairs used for encryption/decryption and signing/verifying are
different. The private key used for signing is referred to as the signature key and the
public key as the verification key.
 Signerfeedsdata tothehash functionandgenerates hashof data.
 Hash value and signature key are then fed to the signature algorithm which produces
the digital signature on given hash. Signature is appended to the data and then
[Link] the
verification algorithm. The verification algorithm gives some value as output.
 Verifieralsorunssamehashfunctiononreceived datatogeneratehashvalue.
 For verification, this hash value and output of verification algorithm are compared.
Based on the comparison result, verifier decides whether the digital signature is valid.
 Since digital signature is created by ‘private’ key of signer and no one else can have
this key; the signer cannot repudiate signing the data in future.
It should be noticed that instead of signing data directly by signing algorithm, usually a hash
of data is created. Since the hash of data is a unique representation of data, it is sufficient to
sign the hash in place of data. The most important reason of using hash instead of data
directly for signing is efficiency of the scheme.
 Let us assume RSA is used as the signing algorithm. As discussed in public key encryption
chapter, the encryption/signing process using RSA involves modular exponentiation.

Signing large data through modular exponentiation is computationally expensive and time
consuming. The hash of the data is a relatively small digest of the data, hence signing a hash
is more efficient than signing the entire data.

:DIGITALSIGNATUREREQUIREMENTS

Wecanformulatethe following requirementsforadigital signature.

• Thesignaturemustbea bit patternthat dependson themessagebeing signed.

• The signature must use some information unique to the sender to prevent both forgery
and denial.

• Itmustberelativelyeasy toproducethedigitalsignature.

• Itmustberelativelyeasy torecognizeand verifythedigitalsignature.

• It must be computationally infeasible to forge a digital signature, either by constructing

a new message for an existing digital signature or by constructing a fraudulent digital
signature for a given message.

• Itmustbe practicalto retainacopyofthedigital signaturein storage.

: KERBEROS

Many real-life systems use an authentication protocol called as Kerberos, to allow

theworkstationsto allownetwork resourcesin [Link] Kerberos signifies a
multi-headed dog in the Greek mythology (apparently used to keep outsiders away).Version 4
of Kerberos is found in most practical. implementations. However, Version 5 is also in use
now.

HowdoesKerberosWork?

Therearefourpartiesinvolvedin the Kerberos protocol:

Alice:Theclientworkstation

AuthenticationServer(AS):Verifies(authenticates)theuserduringlogin

TicketGrantingServer (TGS):Issuesticketstocertifyproofof identity

Bob:Theserverofferingservicessuchasnetworkprinting,filesharingoranapplication program

[Link] password with

every user.

The job of TGS is to certify to the servers in the network that a user is really what she claims
to be. For proving this, the mechanism of tickets (which allow entry into a

Server,just asaticketallows parkingacaror enteringamusicconcert)is used.

Step 1: Login To start with, Alice, the user, sits down at an arbitrary public workstation and
enters her name. The work station sends her name in plain text to the AS.

In response, the AS performs several actions. It first creates a package of the user name
(Alice) and a randomly generated session key (KS). It encrypts this package with the
symmetric key that the AS shares with the Ticket Granting Server (TGS). The output of
this step is called as the Ticket Granting Ticket (TGT). Note that the TGT can be opened
onlybytheTGS,sinceonlyit possessesthecorrespondingsymmetric keyfor decryption.
The AS then combines the TGT with the session key (KS), and encrypts the two together
using a symmetric key derived from the password of Alice (KA). Note that the final output
can, therefore, be opened only by Alice.

Fig 3.17: Kerberos

Step 2: Obtaining a service granting ticket (SGT) Now, let us assume that after a successful
login,AlicewantstomakeuseofBob–theemailserver,[Link] this,
Alice would inform her workstation that she needs to contact Bob. Therefore, Alice needs a
ticket to communicate with Bob. At this juncture, Alice’s workstation creates a message
intended for the Ticket Granting Server (TGS), which contains the following items:

• TheTGTasinstep 1

• Theidof theserver (Bob)whoseservicesAliceisinterested in

• Thecurrenttimestamp,encryptedwiththesame sessionkey (KS)

Asweknow,theTGTisencryptedwiththesecretkeyoftheTicketGrantingServer (TGS).
Therefore, only the TGS can open it. This also serves as a proof to the TGS that the message
indeed came from Alice. Why? This is because, if you remember, the TGT was created by
the AS (remember that only the AS and the TGS know the secret key of TGS). Furthermore,
the TGT and the KS were encrypted together by the AS with the secret key derived from the
password of Alice. Therefore, only Alice could have opened that package and retrieved the
TGT. Once the TGS is satisfied of the credentials of Alice, the TGS creates a session key
KAB, for Alice to have secure communication with Bob. TGS sends it twice to Alice: once
combined with Bob’s id (Bob) and encrypted with the session key (KS) and a second time,
combined with Alice’s id (Alice) and encrypted with Bob’s secret key (KB). This is shown in
Fig. below.

Fig3.8:KerberosWorking
Step 3: User contacts Bob for accessing the server Alice can now send KAB to Bob in order
to enter into a session with him. Since this exchange is also desired to be secure, Alice can
simply forward KAB encrypted with Bob’s secret key (which she had received from the TGS
in the previous step) to Bob. This will ensure that only Bob can access KAB. Furthermore, to
guard against replay attacks, Alice also sends the timestamp, encrypted with KAB to Bob.
Since only Bob has his secret key, he uses it to first obtain the information (Alice + KAB).
From this, it gets the key KAB, which he uses to decrypt the encrypted timestamp value.

Now how would Alice know if Bob received KAB correctly or not? In orderto
satisfy this query, Bob now adds 1 to the timestamp sent by Alice, encrypts the result with
KAB and sends it back to Alice. This is showninFig. above. Sinceonly Aliceand Bob know
KAB, Alice can open this packet and verify that the timestamp incremented by Bob was
indeed the one sent by her to Bob in the first place. Now, Alice and Bob can communicate
securely with each other. They would use the shared secret key KAB to encrypt messages
before sending and also to decrypt the encrypted messages received from each other.

Fig.3.19: Acknowledgement
 :X.509 CERTIFICATES
X.509definesa framework fortheprovisionofauthenticationservicesbytheX.500
directory to its users. The directory may serve as a repository of public-key certificates. Each
certificate contains the public key of a user and is signed with the private key of a trusted
certification authority. In addition, X.509 defines alternative authentication protocols basedon
the use of public-key certificates. X.509 is an important standard because the certificate
structure and authentication protocols defined in X.509 are used in a variety of contexts. For
example, the X.509 certificate format is used in S/MIME, IP Security, and SSL/TLS
Certificates The heart of the X.509 scheme is the public-key certificate associated with each
user. These user certificates are assumed to be created by some trusted certification authority
(CA) and placed in the directory by the CA or by the user. The directory server itself is not
responsible for the creation of public keys or for the certification function; it merely provides
an easily accessible location for users to obtain certificates

Fig3.20:Generalformofa certificate
The above figure shows the general format of a certificate, which includes the following
elements.

• Version: Differentiates among successive versions of the certificate format; the default is
version 1. If the Issuer Unique Identifier or Subject Unique Identifier are present, the value
must be version 2. If one or more extensions are present, the version must be version 3.

• Serial number: An integer value, unique within the issuing CA, that is unambiguously
associated with this certificate.

• Signature algorithm identifier: The algorithm used to sign the certificate, together with
any associated parameters. Because this information is repeated in the Signature field at the
end of the certificate, this field has little, if any, utility.

• Issuername:X.500name oftheCAthat createdandsignedthis certificate.

• Periodofvalidity:Consists oftwodates: thefirstand lastonwhich thecertificateis valid.

• Subject name: The name of the user to whomthis certificate refers. That is,this certificate
certifies the public key of the subject who holds the corresponding private key.

• Subject’s public-key information: The public key of the subject, plus an identifier of the
algorithm for which this key is to be used, together with any associated parameters.

• Issuer unique identifier: An optional bit string field used to identify uniquely the issuing
CA in the event the X.500 name has been reused for different entities.

• Subjectuniqueidentifier: Anoptionalbitstringfieldusedtoidentifyuniquelythesubject in the

event the X.500 name has been reused for different entities.

• Extensions: A set of one or more extension fields. Extensions were added in version 3 and
are discussed later in this section.

• Signature: Covers all of the other fields of the certificate; it contains the hash code of the
other fields encrypted with the CA’s private key. This field includes the signature algorithm
identifier.
 :PUBLIC-KEYINFRASTRUCTURE:

Public-key infrastructure (PKI) is the set of hardware, software, people,

policies, and procedures needed to create, manage, store, distribute, and revoke digital
certificates based on asymmetric cryptography. The principal objective for developing a PKI
is to enable secure, convenient, and efficient acquisition of public keys. The Internet
Engineering Task Force (IETF) Public Key Infrastructure X.509 (PKIX) working group has
been the driving force behind setting up a formal (and generic) model based on X.509 that is
suitable for deploying a certificate-based architecture on the Internet. This section describes
the PKIX model.

• End entity:Ageneric term used to denote end users,devices (e.g., servers,routers), orany
other entity that can be identified in the subject field of a public key certificate. End entities
typically consume and/or support PKI-related services.

• Certification authority (CA): The issuer of certificates and (usually) certificate revocation
lists (CRLs). It may also support a variety of administrative functions, although these are
often delegated to one or more registration authorities.

• Registration authority (RA): An optional component that can assume a number of

administrative functions from the CA. The RA is often associated with the end entity
registration process, but can assist in a number of other areas as well

.•CRLissuer:Anoptionalcomponent thataCA can delegatetopublish CRLs.

Fig.3.21:PKIXArchitecturalModel
Figure 3.21 shows the interrelationship among the key elements of the PKIX model. These
elements are

• Repository:AgenerictermusedtodenoteanymethodforstoringcertificatesandCRLsso that
they can be retrieved by end entities. PKIX Management Functions PKIX identifies a number
of management functions that potentially need to be supported by management protocols.
These are indicated in Figure 3 and include the following:

• Registration:Thisistheprocesswhereby auserfirstmakesitselfknown toaCA(directly, or

through an RA), prior to that CA issuing a certificate or certificates for that user. Registration
begins the process of enrolling in a PKI. Registration usually involves some off- line or
online procedure for mutual authentication. Typically, the end entity is issued one or more
shared secret keys used for subsequent authentication.

• Initialization: Before a client system can operate securely, it is necessary to install key
materials that have the appropriate relationship with keys stored elsewhere in the
infrastructure. For example, the client needs to be securely initialized with the public key and
other assured information of the trusted CA(s) to be used in validating certificate paths.

• Certification: This is the process in which a CA issues a certificate for a user’s public key
and returns that certificate to the user’s client system and/or posts that certificate in a
repository.

• Key pair recovery: Key pairs can be used to support digital signature creation and
verification, encryption and decryption, or both. When a key pair is used for
encryption/decryption, it is important to provide a mechanism to recover the necessary
decryption keys when normal access to the keying material is no longer possible, otherwise it

will not be possible to recover the encrypted data. Loss of access to the decryption key can
result from forgotten passwords/PINs, corrupted disk drives, damage to hardwaretokens, and
so on. Key pair recovery allows end entities to restore their encryption/decryption key pair
from an authorized key backup facility (typically, the CA that issued the end entity’s
certificate).

• Keypairupdate:Allkeypairsneedtobeupdatedregularly(i.e.,replacedwithanewkey

pair)[Link] as a

result of certificate revocation.

 • Revocationrequest: Anauthorized personadvisesaCA of an abnormal situation requiring
certificate revocation. Reasons for revocation include private key compromise, change in
affiliation, and name change.

• Crosscertification:TwoCAsexchangeinformationusedinestablishingacrosscertificate.

Across-certificateisacertificateissuedbyoneCAtoanotherCAthatcontainsa CA
signature key used for issuing certificates.

ReviewQuestions:
Part-A
1. ListOuttheapplicationsofpublicKey Cryptosystem
2. DefineHashFunction
3. DifferentiateMD5and SHA1
4. AnalyzeMACFunction
5. DefineDigitalsignatureand listoutits uses
6. Differentiatefirewalland Kerberos
7. Listouttheadvantages anddisadvantagesof Kerberos
8. Discusspublickeycryptography
9. SketchthebasicentitiesofPublickeyInfrastructure
10. ListouttheKeyManagement steps
11. Whataretheproperties adigitalsignaturescheme satisfy?
12. ListthebasicarithmeticandlogicalfunctionsusedinMD5

Part-B
1. ExplainDifffieHelman keyexchangealgorithm in detail
2. CreateaMessageAuthenticationcodeandexplaintheprocedureforcheckingtheintegrity of the
message
3. ExplaintheVarious Hashalgorithmsin detail
4. Analyzethegeneration ofdigitalsignatureanditsvarious applications
5. ExplainKerberousand X.509authenticationservice
 SCHOOL OF COMPUTING

DEPARTMENTOFCOMPUTERSCIENCEAND ENGINEERING

UNIT-4
SCS1316-NETWORKSECURITY
 UNIT- IV INTERNETSECURITY

Syllabus:

Email Security-PGP-S/MIME- Secured Electronic Transaction-IP Security Overview- IPSec

Documents-IPSecServices, IPSecArchitecture, IPTrafficProcessing-EncapsulatingSecurity
Payload-Internet key Exchange- Firewalls- Stateful Packet Inspection- Application
Gateways/Proxies- Hybrid Systems

Electronic Mail Security

Overview
 Pretty Good Privacy(PGP)
 S/MIME
 Domain Keys Identified Mail (DKIM)

Email Security Enhancements

 Confidentiality: Protection from disclosure
 Authentication: Of sender of message
 Message integrity: Protection from modification
 Non-repudiation of origin: Protection from denial by sender

PGP–Authentication and Confidentiality

2013, when the NSA (United States National Security Agency) scandal was leaked to the
public, people started to opt for the services which can provide them a strong privacy for their
data. Among the services people opted for, most particularly for Emails, were different plug-
ins and extensions for their browsers. Interestingly, among the various plug-ins and
extensions that people started to use, there were two main programs that were solely
responsible for the complete email security that the people needed. One was S/MIME which
we will see later and the other was PGP.
 As said, PGP (Pretty Good Privacy), is a popular program that is used to provide
confidentiality and authentication services for electronic mail and file storage. It was
designed by Phil Zimmer man n way back in 1991. He designed it in such a way, that the best
cryptographic algorithms such as RSA, Diffie -Hellman key exchange, DSS are used for the
public-key encryption (or) asymmetric encryption; CAST-128, 3DES, IDEA are used for
symmetric encryption and SHA-1 is used for hashing purposes. PGP software is an open
source one and is not dependent on either of the OS (Operating System)or the processor. The
application is based on a few commands which are very easy to use.
The following are the services offered by PGP:
 Authentication
 Confidentiality
 Compression
 Email Compatibility
 Segmentation
Authentication:
Authenticationbasicallymeanssomethingthatisusedtovalidatesomethingastrueorreal. To
login into some sites sometimes we give our account name and password that is an
authentication verification procedure.
In the email world, checking the authenticity of an email is nothing but to check whether it
actually came from the person it says. In emails, authentication has to be checked as there are
some people who spoof the emails or some spasm and sometimes it can cause a lot of
inconvenience. The Authentication service in PGP is provided as follows:

Figure4.1Authentication
As shown in the above figure, the Hash Function (H) calculates the Hash Value of the
[Link],SHA-1isusedanditproducesa160-bitoutputhashvalue. Then,
using the sender’s private key (KPa),it is encrypted and it’s called as Digital Signature. The
Message is then appended to the signature. All the process happened till now, is sometimes
described assigning the message. Then the message is compressed to reduce the transmission
overhead and is sent over to the receiver.
At the receiver’s end, the data is decompressed and the message, signature are obtained. The
signature is then decrypted using the sender’s public key (PU a) and the hash value isobtained.
The message is again passed to hash function and it’s hash value is calculated and obtained.
Both the values, one from signature and another from the recent output of hash function are
compared and if both are same, it means that the email is actually sent from a known one and
is legit, else it means that it’s not a legit one.
2. Confidentiality:
Sometimes we see some packages labeled as ‘Confidential’, which means that those
packages are not meant for all the people and only selected persons can see them. The same
applies to the email confidentiality as well. Here, in the email service, only the sender and the
receiver should be able to read the message, that means the contents have to be kept secret
from every other person, except for those two.
PGP provides that Confidentiality service in the following manner:

Figure4.2Confidentiality
The message is first compressed and a 128-bit session key (K s), generated by the PGP, is
used to encrypt the message through symmetric encryption. Then, the session key (K s) itself
gets encrypted through public key encryption (EP) using receiver’s public key(KU b) . Both
the encrypted entities are now concatenated and sent to the receiver.
As you can see, the original message was compressed and then encrypted initially and hence
even if anyone could get hold of the traffic, he cannot read the contents as they are not in
readable form and they can only read them if they had the session key (K s). Even though
session key is transmitted to the receiver and hence, is in the traffic, it is in encrypted form
and only the receiver’s private key (KP b)can be used to decrypt that and thus our message
would be completely safe.
At the receiver’s end, the encrypted session key is decrypted using receiver’s private key
(KPb) and the message is decrypted with the obtained session key. Then, the message is
decompressed to obtain the original message (M).
RSA algorithm is used for the public-key encryption and for the symmetric jey encryption,
CAST-128(or IDEA or 3DES) is used.
Practically,boththeAuthenticationandConfidentialityservicesareprovidedinparallelas follows:
 Figure4.3AuthenticationandConfidentiality
Note:
M – Message
H–Hash Function
Ks–A random Session Key created for Symmetric Encryption purpose
DP – Public-Key Decryption Algorithm
EP – Public-Key Encryption Algorithm
DC–Asymmetric Encryption Algorithm
EC – Symmetric Encryption Algorithm
KPb–A private key of user B used in Public-key encryption process
KPa–A private key of user A used in Public-key encryption process
PUa– A public key of user A used in Public-key encryption process
PUb– A public key of user B used in Public-key encryption process
||– Concatenation
Z–Compression Function
Z-1–Decompression Function

[Link]/Multipurpose Internet Mail Extensions(S/MIME)

What is S/MIME?
S/MIME is a protocol for the secure exchange of e-mail and attached documents originally
developed by RSA Security. Secure/Multipurpose Internet Mail Extensions (S/MIME) adds
security to Internet e-mail based on the Simple Mail Transfer Protocol (SMTP) method and
adds support for digital signatures and encryption to SMTP mail to support authentication of
the sender and privacy of the communication. Note that because HTTP messages can
transport MIME data, they can also use S/MIME.
How It Works
S/MIME is an extension of the widely implemented Multipurpose Internet Mail Extensions
(MIME) encoding standard, which defines how the body portion of an SMTP message is
structured and formatted. S/MIME uses the RSA public key cryptography algorithm along
with the Data Encryption Standard (DES) or Rivest-Shamir-Adleman (RSA) encryption
algorithm. In an S/MIME message, the MIME body section consists of a message in
PKCS#7format that contains an encrypted form of the MIME body parts. The MIME content
type for the encrypted data is application/pkcs7-mime.
 Figure4.4S/Mime Structure

Understanding Digital Signatures

Digital signatures are the more commonly used service of S/MIME. As the name suggests,
digital signatures are the digital counterpart to the traditional, legal signature on a paper
document. As with a legal signature, digital signatures provide the following security
capabilities:
 Authentication A signature serves to validate an identity. It verifies the answer to
“who are you” by providing a means of differentiating that entity from all others and proving
its uniqueness. Because there is no authentication in SMTP e-mail, there is no way to know
who actually sent a message. Authentication in a digital signature solves this problem by
allowing a recipient to know that a message was sent by the person or organization who
claims to have sent the message.
 Non repudiation The uniqueness of a signature prevents the owner of the signature
from disowning the signature. This capability is called non repudiation. Thus, the
authentication that a signature provides gives the means to enforce non repudiation. The
concept of non repudiation is most familiar in the context of paper contracts: a signed
contract is a legally binding document, and it is impossible to disown an authenticated
signature. Digital signatures provide the same function and, increasingly in some areas, are
recognized as legally binding, similar to a signature on paper. Because SMTP e-mail does not
provide a means of authentication, it cannot provide non repudiation. It is easy for a sender to
disavow ownership of an SMTP e-mail message.
 Data integrity An additional security service that digital signatures provide is data
integrity. Data integrity is a result of the specific operations that make digital signatures
[Link],whentherecipientofadigitallysignede-mailmessage
validates the digital signature, the recipient is assured that the e-mail message that is received is,
in fact, the same message that was signed and sent, and has not been altered while in transit.
Any alteration of the message while in transit after it has been signed invalidates the
signature. In this way, digital signatures are able to provide an assurance that signatures on
paper cannot, because it is possible for a paper document to be altered after it has beensigned.
Secure Electronic Transaction(SET) Protocol
Secure Electronic Transaction or SET is a system which ensures security and integrity of
electronic transactions done using credit cards in a scenario. SET is not some system that
enables payment but it is a security protocol applied on those payments. It uses different
encryption and hashing techniques to secure payments over internet done through creditcards.
SET protocol was supported in development by major organizations like Visa, Mastercard,
Microsoft which provided its Secure Transaction Technology (STT) and NetScape which
provided technology of Secure Socket Layer (SSL).
SET protocol restricts revealing of credit card details to merchants thus keeping hackers and
thieves at bay. SET protocol includes Certification Authorities for making use of standard
Digital Certificates like X.509 Certificate.
BeforediscussingSETfurther,let’sseeageneralscenarioofelectronictransaction,which includes
client, payment gateway, client financial institution, merchant and merchant financial
institution.

Figure4.5SET protocol
Requirements in SET:
SET protocol has some requirements to meet ,some of the important requirements are:
 Ithastoprovidemutualauthenticationi.e.,customer(orcardholder)authenticationby
confirming if the customer is intended user or not and merchant authentication.
 It has to keep the PI (Payment Information)and OI (Order Information)confidential by
appropriate encryptions.
  It has to be resistive against message modifications i.e., no changes should be allowed
in the content being transmitted.
 SETalsoneedstoprovideinteroperabilityandmakeuseofbestsecurity mechanisms.
ParticipantsinSET :
Inthegeneralscenarioof onlinetransaction,SETincludessimilarparticipants:
 Cardholder–customer
 Issuer–customerfinancialinstitution
 Merchant
 Acquirer–Merchantfinancial
 Certificateauthority–Authoritywhichfollowscertainstandardsandissues certificates
(like X.509V3) to all other participants.
SETfunctionalities:
o ProvideAuthentication
 Merchant Authentication – To prevent theft, SET allows customers to check
previous relationships between merchant and financial institution. Standard
X.509V3 certificates are used for this verification.
 Customer / Cardholder Authentication – SET checks if use of credit card is
done by an authorized user or not using X.509V3 certificates.
o Provide Message Confidentiality: Confidentiality refers to preventing unintendedpeople
from reading the message being transferred. SET implements confidentiality by using
encryption techniques. Traditionally DES is used for encryption purpose.
o Provide Message Integrity: SET doesn’t allow message modification with the help of
[Link]
signatures with SHA-1 and some using HMAC with SHA-1,
Dual Signature:
The dual signature is a concept introduced with SET, which aims at connecting two information
pieces meant for two different receivers:
o OrderInformation(OI)formerchant
o PaymentInformation(PI)for bank.
You might think sending them separately is an easy and more secure way, but sending them in a
connected form resolves any future dispute possible. Here is the generation of dual signature:
 Figure4.6Generationof dual signature
Where,
PIstandsforpaymentinformation OI
stands for order information
PIMDstandsforPaymentInformationMessageDigest
OIMD stands for Order Information Message Digest
POMD stands for Payment Order Message Digest
Hstands for Hashing
Estandsforpublickeyencryption
KPc is customer's private key
||stands forappend operation
Dualsignature,DS=E(KPc, [H(H(PI)||H(OI))])

PurchaseRequest Generation:
Theprocessofpurchase requestgenerationrequiresthreeinputs:
 PaymentInformation(PI)
 Dual Signature
 OrderInformationMessageDigest(OIMD)

The purchase request is generated as follows:

Figure4.7PurchaseRequestGeneration
Here,
PI,OIMD,OIallhavethesamemeaningsasbefore. The
new things are :
EPwhichissymmetrickeyencryption Ks
is a temporary symmetric key KUbank
is public key of bank
CAisCardholderorcustomerCertificate
Digital Envelope = E(KUbank, Ks)
PurchaseRequestValidation onMerchantSide :
TheMerchantverifiesbycomparingPOMDgeneratedthroughPIMDhashingwithPOMD
generated through decryption of Dual Signature as follows:

Figure4.8POMDgeneratedthroughdecryption of Dual Signature

Since we used Customer private key in encryption here we use KUc which is public key of
customer or cardholder for decryption ‘D’.

PaymentAuthorizationandPaymentCapture:
Payment authorization as the name suggests is the authorization of payment information by
merchant which ensures payment will be received by merchant. Payment capture is the
process by which merchant receives payment which includes again generating some request
blocks to gateway and payment gateway in turn issues payment to merchant.
[Link](IPSec)
TheIP sec4rity (IPSec) is an Internet Engineering Task Force (IETF) standard suite of
protocols between 2 communication points across the IP network that provide data
authentication, integrity, and confidentiality. It also defines the encrypted, decrypted and
authenticated packets. The protocols needed for secure key exchange and key management
are defined in it.
UsesofIPSecurity–
IPseccan beused to do thefollowing things:
 Toencryptapplicationlayerdata.
 Toprovide securityforrouterssending routingdata acrossthe publicinternet.
 To provide authentication without encryption, like to authenticate that the data
originates from a known sender.
 To protect network data by setting up circuits using IPsec tunneling in which all data is
being sent between the two endpoints is encrypted, as with a Virtual Private
Network(VPN) connection.
ComponentsofIPSecurity –
Ithas thefollowing components:
o EncapsulatingSecurityPayload(ESP):Itprovidesdataintegrity,encryption,
authentication and anti-replay. It also provides authentication for payload.
o Authentication Header (AH) : It also provides data integrity, authentication and anti-
[Link]-replayprotection,protectsagainst
unauthorized transmission of packets. It does not protect data’s confidentiality.

Figure4.9Authentication Header
• InternetKeyExchange(IKE)
It is a network security protocol designed to dynamically exchange encryption keys and finda
way over Security Association (SA) between 2 devices. The Security Association (SA)
establishes shared security attributes between 2 network entities to support secure
[Link](ISAKMP)andInternetSecurityAssociation
which provides a framework for authentication and key exchange. ISAKMP tells how the
setup of the Security Associations (SAs) and how direct connections between two hosts that
are using IPsec.
InternetKeyExchange(IKE)providesmessagecontentprotectionandalsoanopenframefor
implementing standard algorithms such as SHA and MD5. The algorithm’s IP sec users
produces aunique identifierfor each packet. This identifierthen allows adeviceto determine
whether a packet has been correct or not. Packets which are not authorized are discarded and
not given to receiver.
 Figure4.10InternetKeyExchange
WorkingofIPSecurity –
• The host checks if the packet should be transmitted using IPsec or not. These packet
traffic triggers the security policy for themselves. This is done when the system
sending the packet apply an appropriate encryption. The incoming packets are also
checked by the host that they are encrypted properly or not.
• Then the IKE Phase 1starts in which the 2 hosts( using IPsec ) authenticate
[Link] modewhich
provides the greater security and the Aggressive modewhich enables the host to
establish an IPsec circuit more quickly.
• The channel created in the last step is then used to securely negotiate the way the IP
circuit will encrypt data accross the IP circuit.
• Now, the IKE Phase 2is conducted over the secure channel in which the two hosts
negotiate the type of cryptographic algorithms to use on the session and agreeing on
secret keying material to be used with those algorithms.
• Then the data is exchanged across the newly created IPsec encrypted tunnel. These
packets are encrypted and decrypted by the hosts using IPsec SAs.
• When the communication between the hosts is completed or the session times outthen
the IPsec tunnel is terminated by discarding the keys by both the hosts.
IPSecArchitecture
IPSec (IP Security) architectureuses two protocols to secure the traffic or data flow.
These protocols are ESP (Encapsulation Security Payload) and AH (Authentication Header).
IPSec Architecture include protocols, algorithms, DOI, and Key Management. All these
components are very important in order to provide the three main services:
 Confidentiality
 Authentication
 Integrity
IPSecurity Architecture:

Figure4.11IPSecurity Architecture
• Architecture:
ArchitectureorIPSecurityArchitecturecoversthegeneralconcepts,definitions, protocols,
algorithms and security requirements of IP Security technology.
• ESP Protocol:
ESP(EncapsulationSecurityPayload)[Link] Security
Payload is implemented in either two ways:
 ESPwith optional Authentication.
 ESP with Authentication.

PacketFormat:

Figure4.12PacketFormat
  SecurityParameterIndex (SPI):
[Link] the
connection build between Client and Server.
 SequenceNumber:
UniqueSequencenumberareallottedtoeverypacketsothatatthereceiverside packets can
be arranged properly.
 PayloadData:
[Link] encrypted
format to achieve confidentiality.
 Padding:
Extrabitsorspaceaddedtotheoriginalmessageinordertoensureconfidentiality. Padding
length is the size of the added bits or space in the original message.
 Next Header:
Nextheadermeansthenext payloadornextactualdata.
 AuthenticationData
ThisfieldisoptionalinESPprotocolpacketformat.
 Encryption algorithm:
Encryptionalgorithmisthedocumentthatdescribesvariousencryptionalgorithmusedfor
Encapsulation Security Payload.
 AHProtocol:
AH(AuthenticationHeader)ProtocolprovidesbothAuthenticationandIntegrityservice.
Authentication Header is implemented in one way only: Authentication along with
Integrity.

Figure4.13 AH Protocol
AuthenticationHeadercoversthepacketformat andgeneralissuerelatedtotheuseofAHfor packet
authentication and integrity.
 AuthenticationAlgorithm:
AuthenticationAlgorithmcontainsthesetofthedocumentsthatdescribeauthentication
algorithm used for AH and for the authentication option of ESP.
 DOI(Domain ofInterpretation):
[Link] for
documentation related to each other.
 KeyManagement:
KeyManagementcontainsthedocumentthatdescribeshowthekeysareexchanged between
sender and receiver.
4.5EncapsulatingSecurityPayload (ESP)
Encapsulating Security Payload(ESP) is a member of the Internet Protocol Security(IPsec) set
of protocols that encrypt and authenticate the packets of data between computers using a
VirtualPrivateNetwork (VPN).Thefocusandlayeronwhich ESPoperatesmakesit possible for
VPNs to function securely.
Being one of the most popular tools used in network security,Encapsulating
SecurityPayload(abbreviated as ESP) offers the help we need in keeping the integrity,
authenticity and confidentiality of the information we send across networks. Keep reading to
learn more!
With the technological advancements, the way we conduct our business processes has
changed immensely. Now, we heavily rely on the internet technologies and transfer massive
amounts of data daily. For this data traffic, we often employ wireless and wired networks. As
a result, network security and necessary cybersecurity measures gain importance each day.
Beingoneofthemostpopulartoolsusedinnetworksecurity,EncapsulatingSecurityPayload
(abbreviated asESP) offers the help we need in keeping the integrity, authenticity and
confidentiality of the information we send across networks. In this article, we will take a
closer look at what Encapsulating Security Payload is. Keep reading to learn more.
WhatisEncapsulatingSecurityPayload?
EncapsulatingSecurityPayload([Link]) isaprotocolwithin thescope of theIPSec.
The information traffic on a network is provided with packets of data. In other words, when
you want to send orreceive a data through a network, it is turned into packets of information
so that it can travel within the network. Similar to the data packages, payload is also sent
through the network and it contains the ‘actual’ information, the intended message.
The Encapsulating Security Payload aims to offer necessary security measures for these
packets of data and/or payloads. With the help of Encapsulating Security Payload,
confidentiality, integrity and authentication of payloads and data packets in IPv4and IPv6
networks.
Howdoes theEncapsulating SecurityPayload work?
Also known as atransport layer security protocol, the Encapsulating Security Payload is able
to function with both theIPv6 and IPv4 protocols. The way ESP operates is pretty
straightforward: It is inserted between the Internet Protocol/IP header and upper layer
protocols such as UDP, ICMP or TCP. In this position, the ESP takes the form of a header.
Howcan the Encapsulating SecurityPayload beused?
Although the Encapsulating Security Payload offers many benefits, it can be applied in only
two ways: Tunnel mode and transport mode.
In thetunnel mode, a new IP header is created and used as the outermost IP header. It is
followed by theEncapsulating Security Payload Headerand original datagram. Tunnel mode
is a must for the gateways.
In the transportation mode, the IP header is neither authenticated nor encrypted. As a result,
your addressing information can potentially be leaked during the datagram [Link]
modeoften uses less processing, that is why most hosts prefer Encapsulating SecurityPayload
in transport mode.
Whatarethe benefits oftheEncapsulating Security Payload?
The Encapsulating Security Payload offers all the functions of theAuthentication Header,
whichareanti-replayprotection,[Link],theESP differs
from the Authentication Header in terms of data confidentiality: the ESP can provide data
confidentiality while the Authentication Header cannot.
Moreover, the Encapsulating Security Protocol Payload aims to provide various services
including but not limited to:
 Maintainingtheconfidentialityofdatagramswithencryption
 Usingsecuritygatewaystolimit thetrafficflowconfidentiality
 Authenticatingtheorigin ofdatausing a publickey encryption
 Providing antireplay services with the help of the sequence number mechanism given
by the Authentication Header
In business environments, we usenetwork technologiesvery often. They allow us to share
resources and files, set communication protocols and such. As much as they streamline and
accelerate our business processes, they can also pose a serious vulnerability for our cyber
security. An intruder or a hacker can infiltrate into our networks, steal our valuable
information or lock us out of our systems. That is why network security is one of the most
important practices in cybersecurity.
Most organizations rely on firewalls for theirnetwork security needs. A firewall can be
defined as anetwork security system that allows the cybersecurity professionals to monitor
and control thenetwork traffic. In other words, a firewallsets the boundary between the
internal and external network. There are two main types of firewalls:
 Network-based firewalls: They are often positioned on the LANs, intranets or WANs
of the gateway computers.
  Host-based firewalls: They are implemented on the network host itself in order to
protect the entire network traffic. Host-based firewallscan be a part of the operating systemor
an agent application in order to offer an additional layer of security.
Whatisstatefulinspection?
Thetermstatefulinspection(alsoknownasthedynamicpacketfiltering)refersto adistinguished
firewall technology. It aims to monitor the active connections on a network. Moreover, the
process of stateful inspection determines which network packets should be allowed through
the firewall by utilizing the information regarding active connections.
Stateful inspection keeps track of each connection and constantly checks if they are valid. That is
why it offers a better protection than its predecessors.
Inafirewallwherethestatefulinspectionisimplemented,thenetworkadministrator can customise the
parameters in order to meet the unique needs of the organization.
Whatisthebenefit ofimplementingstateful inspection?
Before stateful inspection has become mainstream, similar technology called static packet
filteringwas in use. This older alternative only checks the headers of the packets in order to
determine whether they should be allowed through the firewall. As a result, a hacker can
simply indicate“reply”in theheaderin ordertoextract information from thenetwork. Onthe
contrary, stateful inspection aims to carry out a more sophisticated investigation. That is why
it analyses the application layer of the packets. A dynamic packet filter like statefulinspection
can offer abetter security posturefor networks through recording the session information like
port numbers or IP addresses.
In other words, stateful inspection is better at keeping the intruders away from your network
since it uses a more refined technology.
4.6Internetkey Exchange-
Internet Key Exchange (IKE) is a key management protocol standard used in conjunctionwith the
Internet Protocol Security (IPSec) standard protocol. It provides security for virtual private
networks' (VPNs) negotiations and network access to random hosts. It can also be described
as a method for exchanging keys for encryption and authentication over an unsecured
medium, such as the Internet.

IKEisahybridprotocolbasedon:
 ISAKMP (RFC2408): Internet Security Association and Key Management Protocols
are used for negotiation and establishment of security associations. This protocol establishesa
secure connection between two IPSec peers.
 Oakley (RFC2412): This protocol is used for key agreement or key exchange. Oakley
defines the mechanism that is used for key exchange over an IKE session. The default
algorithm for key exchange used by this protocol is the Diffie-Hellman algorithm.
 SKEME:Thisprotocol isanotherversion forkeyexchange.
IKE enhances IPsec by providing additional features along with flexibility. IPsec, however, can
be configured without IKE.
IKE has many benefits. It eliminates the need to manually specify all the IPSec security
parameters at both peers. It allows the user to specify a particular lifetime for the IPsec
security association. Furthermore, encryption can be changed during IPsec sessions.
Moreover, it permits certification authority. Finally, it allows dynamic authentication ofpeers.
The IKE works in two steps. The first step establishes an authenticated communication channel
between the peers, by using algorithms like the Diffie-Hellman key exchange, which
generates a shared key to further encrypt IKE communications. The communication channel
formed as a result of the algorithm is a bi-directional channel. The authentication of the
channelisachievedbyusingasharedkey,signatures,orpublickeyencryption.

There are two modes of operation for the first step: main mode, which is utilized to
protecttheidentity ofthepeers, and aggressivemode,whichis used when thesecurity
oftheidentity of the peers is not an important issue. During the second step, the peers use the
secure communication channel to set up security negotiations on behalf of other services like
IPSec. These negotiation procedures give rise to two unidirectional channels of which one
isinbound and the other outbound. The mode of operation for the second step is the Quick
mode.

IKE provides three different methods for peer authentication: authentication using a pre- shared
secret, authentication using RSA encrypted nonces, and authentication using RSA signatures.
IKE uses the HMAC functions to guarantee the integrity of an IKE session. When an IKE
session lifetime expires, a new Diffie-Hellman exchange is performed and the IKESA is re-
established.

4.7. Firewalls
IntroductionofFirewall
Firewallisanetworkdevicethatisolatesorganization'sinternalnetworkfromlarger
outsidenetwork/Internet. It can be a hardware, software, or combined system that prevents
unauthorized access to or from internal network.
A firewall is a network security device, either hardware or software-based, which monitorsall
incoming and outgoing traffic and based on a defined set of security rules it accepts,rejects or
drops that specific traffic.
Accept: allowthe traffic
Reject:blockthetrafficbutreplywithan“unreachableerror” Drop :
block the traffic with no reply
Afirewallestablishesabarrierbetweensecuredinternalnetworksandoutsideuntrusted network, such
as the Internet.
 Figure4.14Basic StructureofFirewall

HistoryandNeedforFirewall
Before Firewalls, network security was performed by Access Control Lists (ACLs) residing
on routers. ACLs are rules that determine whether network access should be granted ordenied
to specific IP address.
But ACLs cannot determine the nature of the packet it is blocking. Also, ACL alone does not
have the capacity to keep threats out of the network. Hence, the Firewall was introduced.
Connectivity to the Internet is no longer optional for organizations. However, accessing the
Internet provides benefits to the organization; it also enables the outside world to interactwith
the internal network of the organization. This creates a threat to the organization. In order to
secure the internal network from unauthorized traffic, we need a Firewall.
HowFirewall Works
Firewall match the network traffic against the rule set defined in its table. Once the rule is
matched, associate action is applied to the network traffic. For example, Rules are defined as
any employee from HR department cannot access the data from code server and at the same
time another rule is defined like system administrator can access the data from both HR and
[Link] policies
of the organization.
Fromtheperspectiveof aserver,network traffic can be eitheroutgoing orincoming. Firewall
maintains a distinct set of rules for both the cases. Mostly the outgoing traffic, originatedfrom
the server itself, allowed to pass. Still, setting a rule on outgoing traffic is always better
inordertoachievemoresecurityandpreventunwantedcommunication. Incoming traffic is treated
differently. Most traffic which reaches on the firewall is one of these three major Transport
Layer protocols- TCP, UDP or ICMP. All these types have a
[Link],[Link] uses type
code instead of port number which identifies purpose of that packet.
Default policy: It is very difficult to explicitly cover every possible rule on the firewall. For
this reason, the firewall must always have a default policy. Default policy only consists of
action (accept, reject or drop).

Suppose no rule is defined about SSH connection to the server on the firewall. So, it will
follow the default policy. If default policy on the firewall is set toaccept, then any computer
outside of your office can establish an SSH connection to the server. Therefore, settingdefault
policy as drop (or reject) is always a good practice.
Generationof Firewall
Firewallscanbecategorizedbasedonitsgeneration.
 First Generation- Packet Filtering Firewall:Packet filtering firewall is used to control
network access by monitoring outgoing and incoming packet and allowing them to passor
stop based on source and destination IP address, protocols and ports. It analyses traffic
atthetransportprotocollayer(butmainlyusesfirst3layers). Packet firewalls treat each packet
in isolation. They have no ability to tell whether a packet is part of an existing stream of
traffic. Only It can allow or deny the packets based on unique packet headers.
 Packetfilteringfirewallmaintainsafilteringtablewhichdecideswhetherthepacketwill be
forwarded or discarded. From the given filtering table, the packets will be Filtered
according to following rules:


 Figure4.15SamplepacketFilterFirewall Rule
o Incomingpacketsfrom network192.168.21.0areblocked.
o Incomingpacketsdestinedforinternal TELNETserver (port23)are blocked.
o Incomingpacketsdestinedforhost192.168.21.3are blocked.
o Allwell-known servicestothe network192.168.21.0 are allowed.
 Second Generation- Stateful Inspection Firewall:Stateful firewalls (performs Stateful
Packet Inspection) are able to determine the connection state of packet, unlike Packet
filtering firewall, which makes it more efficient. It keeps track of the state of networks
connection travelling across it, such as TCP streams. So the filtering decisions would not
 onlybe basedon definedrules,but alsoon packet’shistory inthestatetable.
 Third Generation- Application Layer Firewall:Application layer firewall can inspect and
filter the packets on any OSI layer, up to the application layer. It has the ability to block
specific content, also recognize when certain application and protocols (like HTTP, FTP)
are being misused.
 In other words, Application layer firewalls are hosts that run proxy servers. A proxy
firewallpreventsthedirectconnectionbetween eithersideofthefirewall,eachpackethas to pass
through the proxy. It can allow or block the traffic based on predefined rules.
 Note:Applicationlayer firewallscanalsobeusedasNetworkAddressTranslator(NAT).
 NextGenerationFirewalls(NGFW):NextGenerationFirewallsarebeing deployed these
daystostopmodern securitybreacheslike advancemalware attacks and application-layer
attacks. NGFW consists of Deep Packet Inspection, Application Inspection, SSL/SSH
inspection and many functionalities to protect the network from these modern threats.

Firewallsaregenerallyoftwotypes:Host-basedandNetwork-based.
 Host- based Firewalls:Host-based firewall is installed on each network node which
controls each incoming and outgoing packet. It is a software application or suite of
applications, comes as a part of the operating system. Host-based firewalls areneeded
because network firewalls cannot provide protection inside a trusted network. Host
firewall protects each host from attacks and unauthorized access.
 Network-basedFirewalls:[Link], these
firewalls filter all incoming and outgoing traffic across the network. It protects the
internal network by filtering the traffic using rules defined on the firewall. A
Networkfirewallmighthave twoormore network interface cards (NICs). Anetwork-
based firewall is usually a dedicated system with proprietary software installed.
Bothtypesoffirewallhavetheirownadvantages.
Firewall is categorized into three basic types
 Packetfilter(Stateless&Stateful)
 Application-levelgateway
 Circuit-levelgateway
These three categories, however, are not mutually exclusive. Modern firewalls have a mix of
abilities that may place them in more than one of the three categories.
 Figure4.16Typesoffirewall
Stateless & Stateful Packet Filtering Firewall
In this type of firewall deployment, the internal network is connected to the external
network/Internet via a router firewall. The firewall inspects and filters data packet-by-packet.
Packet-filtering firewalls allow or block the packets mostly based on criteria such as source
and/ordestination IPaddresses,protocol,source and/ordestinationportnumbers,andvarious other
parameters within the IP header.
The decision can be based on factors other than IP header fields such as ICMP message type,
TCP SYN and ACK bits, etc.
Packetfilterrulehastwo parts−
 Selection criteria− It is a used as a condition and pattern matching for decision
making.
 Action field−This partspecifies action to betaken ifan IP packet meets theselection
criteria. The action could be either block (deny) or permit (allow) the packet across the
firewall.
Packet filtering is generally accomplished by configuring Access Control Lists (ACL) on routers
or switches. ACL is a table of packet filter rules.
As traffic enters or exits an interface, firewall applies ACLs from top to bottom to each incoming
packet, finds matching criteria and either permits or denies the individual packets.

Figure4.17Statelessfirewall
Stateless firewall is a kind of a rigid tool. It looks at packet and allows it if its meets the criteria
even if it is not part of any established ongoing communication.
Hence, such firewalls are replaced by stateful firewallsin modern networks. This type of firewalls
offer a more in-depth inspection methodover the only ACL based packet inspection methods
of stateless firewalls.
Stateful firewall monitors the connection setup and teardown process to keep a check on
connections at the TCP/IP level. This allows them to keep track of connections state and
determine which hosts have open, authorized connections at any given point in time.
They reference the rule base only when a new connection is requested. Packets belonging to
existing connections are compared to the firewall's state table of open connections, and
decision to allow or block is taken. This process saves time and provides added security as
well. No packet is allowed to trespass the firewall unless it belongs to already established
connection. It can timeout inactive connections at firewall after which it no longer admit
packets for that connection.
Application Gateways
An application-level gateway acts as a relay node for the application-level traffic. They intercept
incoming and outgoing packets, run proxies that copy and forward information across the
gateway, and function as aproxy server, preventing any direct connection between a trusted
server or client and an untrusted host.
The proxies are application specific. They can filter packets at the application layer of theOSI
model.
Application-specificProxies

Figure4.18Application-specific Proxies

An application-specific proxy accepts packets generated by only specified application for

which they are designed to copy, forward, and filter. For example, only a Telnet proxy can
copy, forward, and filter Telnet traffic.
If a network relies only on an application-level gateway, incoming and outgoing packets
cannot access services that have no proxies configured. For example, if a gateway runs FTP
and Telnet proxies, only packets generated by these services can pass through the [Link]
other services are blocked.
Application-levelFiltering
An application-level proxy gateway, examines and filters individual packets, rather than
simply copying them and blindly forwarding them across the gateway. Application-specific
proxies check each packet that passes through the gateway, verifying the contents of the
packet up through the application layer. These proxies can filter particular kinds ofcommands
or information in the application protocols.
Application gateways can restrict specific actions from being performed. For example, the
gateway could be configured to prevent users from performing the ‘FTP put’ command. This
can prevent modification of the information stored on the server by an attacker.
Transparent
Although application-level gateways can be transparent, many implementations require user
authentication before users can access an untrusted network, a process that reduces true
transparency. Authentication may be different if the user is from the internal network or from
the Internet. For an internal network, a simple list of IP addresses can be allowed to connectto
external applications. But from the Internet side a strong authentication should be
implemented.
An application gateway actually relays TCP segments between the two TCP connections in
the two directions (Client ↔ Proxy ↔ Server).
For outbound packets, the gateway may replace the source IP address by its own IP address.
The process is referred to as Network Address Translation (NAT). It ensures that internal IP
addresses are not exposed to the Internet.
Circuit-LevelGateway
The circuit-level gateway is an intermediate solution between the packet filter and the
application gateway. It runs at the transport layer and hence can act as proxy for any
application.
Similar to an application gateway, the circuit-level gateway also does not permit an end-to-
end TCP connection across the gateway. It sets up two TCP connections and relays the TCP
segments from one network to the other. But, it does not examine the application data like
application gateway. Hence, sometime it is called as ‘Pipe Proxy’.
4.8 Hybrids Systems: In an attempt combine the security of the application layer gateways
with the flexibility and speed of packet filtering; some vendors have created systems that use
the principle of both.
Insomeofthesesystems,newconnectionsmustbeauthenticatedandapprovedattheapplication
[Link] has been done, the remainderoftheconnection is passeddownto the session
layer, where packet filters watch the connection to ensure that only packets thatare part of an
on-going (already authenticated and approved) conversation are-being passed.
[Link]
benefitshereincludeprovidingameasureofprotectionagainstthemachinesthatprovide
servicestotheinternet(suchasapublicwebserver),aswellasprovidethesecurityofan
[Link],usingthismethod,an
attacker,inordertogettoservicesontheinternalnetwork,willhavetobreakthroughthe access router,
the bastion host, and the choke router.

4.9ImportantAspectsofEffective Firewalls
Regardless of which security design logic or packet screening method is chosen, two
important aspects of the firewall's implementation can determine whether or not a firewall
solution will be effective:
First, the device or host system on which the firewall solution resides must be secure. If the
system can be compromised, then the firewall can also be compromised. If the firewalls you
choose is based on a well-known network operating system, make sure the operating systemis
fully patched and all security updates have been applied. .
Second, for a firewall to be effective, all traffic to and from your network must passthrough
it. If a firewall can be physically or logically bypassed, there is no guarantee that the trusted
network is safe. The architecture used for the firewall solution is very important.
Since firewall solutions can be configured using a single system or multiple systems, the
architecture used to implement the solution can be simple or complex. When deciding on a
specific architecture keep in mind that the most effective firewall solutions are implemented
to all network traffic passes through them. This implementation characteristic is evident inthe
following commonly identified firewall architectures.
REFERENCES
1. WillliamStallings,”NetworkSystemEssentials“-4thEditionCopyright©2011 Pearson
education, Inc., publishing as [Prentice Hall,
2. AtulKhahate,“Cryptographyandnetworksecurity”,3rdEdition,Copyright©2013 TMH
Publishing
3. KuldeepSinghKohar”,NetworkSecurity”,[Link] India,
New [Link], 1983.

ReviewQuestions:
PartA
1. ListtheservicesofferedbyPGP
2. DefineisS/MIME
3. ExplaintherequirementsinSETprotocol
4. Listthe components ofIP Security
5. DrawtheIPSecurityArchitecture
6. WhatisEncapsulatingSecurityPayload?
7. Howdoes theEncapsulating SecurityPayload work?
8. Howcanthe EncapsulatingSecurityPayloadbe used?
9. Whatisstatefulinspection?
10. Whatisthebenefit ofimplementingstateful inspection?
11. DefineInternetKey Exchange
12. Explaindifferentmethodsforpeerauthenticationof IKE.
13. ExplaintheNeed for Firewall
14. Define Firewall
15. Whatarethecategoriesof Firewall

PartB
1. DemonstrateSECUREELECTRONICTRANSACTION(SET)withsuitable example
2. Illustratethestepsinvolved inworkingof PGP
3. ExplainindetailaboutMultipurposeInternetMailExtensions
4. Organisethearchitecture ofIPSecurityOverviewandexplain
5. DistinguishdifferenttypesofFirewalls
 SCHOOL OF COMPUTING

DEPARTMENTOFCOMPUTERSCIENCEANDENGINEERING

UNIT-5
SCS1316-NETWORKSECURITY
 UNIT-V COMPUTERSYSTEMSECURITY

Syllabus:
Malicious Software- Types-Backdoor-Worms-Logic bomb -Trojan Horses-Viruses-
Classifications-VirusKits-EmailViruses-AntivirusApproach-
DistributedDenialofServiceAttacks-CounterMeasures-
IntrusionDetectionSystem(IDS),NetworkBased IDS-Host based IDS- Steps involved in
deploying IDS

Malicious Software: The most sophisticated types of threats to computer systems are
presented by programs that exploit vulnerabilities in computing systems. Such threats are
referred to as malicious software, or malware. In this context, we are concerned with threatsto
applicationprograms aswell as utility programs,such as editors and compilers, andkernel- level
programs.
Malicious software is software that is intentionally included or inserted in a system fora
harmful purpose.
Malicious software can be divided into two categories: those that need a host program, and
those that are independent.
 Theformer,referredtoasparasitic,areessentiallyfragmentsofprogramsthatcannot
existindependentlyof some actualapplicationprogram,utility,or systemprogram.
Viruses, logic bombs, and backdoors are examples.
 Independentmalwareisaself-containedprogramthatcanbescheduledandrunby
[Link] andbotprogramsare examples.

Backdoor:
A backdoor, also known as a trapdoor, is a secret entry point into a program that allows
someone who is aware of the backdoor to gain access without going through the usualsecurity
access procedures. Programmers have used backdoors legitimately for many years to debug
and test programs; such a backdoor is called a maintenance hook. This usually is done when
the programmer is developing an application that has an authentication procedure, or a long
setup, requiring the user to enter many different values to run the application. To debug the
program, the developer may wish to gain special privileges or to avoid all the necessary setup
and authentication. Backdoors become threats when unscrupulous programmers use them to
gain unauthorized access. It is difficult to implement operating system controls for backdoors.
Security measures must focus on the program development and software update activities.

LogicBomb:
One of the oldest types of program threat, predating viruses and worms, is the logic [Link]
logic bomb is code embedded in some legitimate program that is set to “explode” when
certain conditions are met. Examples of conditions that can be used as triggers for a logic
bomb are the presence or absence of certain files, a particular day of the week or date, or a
particular user running the application. Once triggered, a bomb may alter or delete data or
entire files, cause a machine halt, or do some other damage.
 Table5.1TerminologyofMaliciousPrograms

Name Description
Malwarethat,whenexecuted,triestoreplicateitselfintoother
Virus executablecode;whenitsucceedsthecodeissaidtobeinfected. When the
infected code is executed, the virus also executes.
Acomputerprogramthatcanrunindependentlyandcanpropagatea
Worm
completeworking versionof itselfonto otherhosts onanetwork.
A program inserted into software by an intruder. A logic bomb
LogicBomb liesdormantuntilapredefinedconditionismet;theprogramthen
triggersaunauthorized act.
A computer program that appears to have a useful function, but also
has a hidden and potentially malicious function that evades security
TrojanHorse
mechanisms,sometimesbyexploitinglegitimateauthorizationsofa
systementitythat invokestheTrojanhorseprogram.
Anymechanismthatbypassesanormalsecuritycheck;itmayallow
Backdoor(trapdoor)
unauthorizedaccesstofunctionality.
Software(e.g: script, macro,orotherportable instruction)that can be
Mobilecode shippedunchangedtoaheterogenouscollectionorplatformsand
executewithidenticalsemantics.
Exploits Codespecifictoasinglevulnerabilityorsetof vulnerabilities.
Programthatinstallsotheritemsonamachinethatisunderattack.
Downloaders
Usually,adownloader issentin e-mail.

Auto-rooter Malicioushacker toolsused tobreak intonew machines remotely.

Kit (virus generator) Setoftoolsforgeneratingnewviruses automatically.

Spammer programs Usedtosendlargevolumesofunwanted e-mail

Usedtoattacknetworkedcomputersystemswithalargevolumeof
Flooders
traffictocarryoutadenial-of-service (DoS)attack
Keyloggers Captureskeystrokeson acompromisedsystem
Setofhackertoolsusedafterattackerhasbrokenintoacomputer
Rootkit
systemandgainedroot-levelaccess
Programactivatedonaninfectedmachinethatisactivatedtolaunch
Zombie,Bot
attacksonothermachines.
Softwarethatcollectsinformationfromacomputerandtransmitsit
Spyware
toanother system.
[Link]-up
Adware
adsorredirectionofabrowser toacommercial site.
 TrojanHorses:
A Trojan horse is a useful, or apparently useful, program or command procedure containing
hidden code that, when invoked, performs some unwanted or harmful function. Trojan horse
programs can be used to accomplish functions indirectly that an unauthorized user could not
accomplish directly. For example, to gain access to the files of another user on a shared
system, auser could createaTrojan horseprogram that, when executed, changes theinvoking
user’s file permissions so that the files are readable by any user.
Another common motivation for the Trojan horse is data destruction. The program appears to
be performing a useful function (e.g., a calculator program), but it may also be quietlydeleting
the user’s files.
Trojanhorsesfitintoone ofthreemodels:
 Continuingtoperformthefunctionoftheoriginalprogramandadditionallyperforming a
separate malicious activity
 Continuing to perform the function of the original program but modifying the function
to perform malicious
 Performing a malicious function that completely replaces the function of the original
program.

Viruses:
A computer virus is a piece of software that can “infect” other programs by modifying them;
the modification includes injecting the original program with a routine to make copies of the
virus program, which can then go on to infect other programs. A virus can do anything that
other programs do. The difference is that a virus attaches itself to another program and
executes secretly when the host program is run. Once a virus is executing, it can perform any
function, such as erasing files and programs that is allowed by the privileges of the current
user. An unconventional acronym of virus in IT industry is Vital Information ResourcesUnder
Siege.
Acomputervirushasthreeparts
• Infection mechanism: The means by which a virus spreads, enabling it to replicate.
Themechanism is also referred to as the infection vector.
• Trigger:Theeventorconditionthatdetermineswhenthepayloadisactivatedor delivered.
• Payload:Whatthevirusdoes,[Link] may
involve benign but noticeable activity.

Duringits lifetime,atypical virusgoes through thefollowing four phases:

 Dormant phase: The virus is idle. The virus will eventually be activated by someevent,
such as a date, the presence of another program or file, or the capacity of the disk
exceeding some limit. Not all viruses have this stage.
 Propagation phase: Thevirus places a copy of itselfinto otherprograms orinto certain
[Link];
 viruses often morph to evade detection. Each infected program will now contain a clone of
the virus, which will itself enter a propagation phase. • Triggering phase: The virus is
activated to perform the function for which it was intended. As with the dormant
phase, the triggering phase can be caused by a variety of system events, including a
count of the numberof times that this copy of the virus has made copies of itself. •
Execution phase: The function is performed. The function may be harmless,
suchasamessageonthe screen,ordamaging,suchasthedestructionofprograms and data
files. Most viruses carry out their work in a manner that is specific to a particular
operating system and, in some cases, specific to a particular hardware platform. Thus,
they are designed to take advantage of the details and weaknesses of particular
systems.
VirusesClassification
Therehasbeen a continuousarms racebetween viruswriters and writers of antivirussoftware since
viruses first appeared. As effective countermeasures are developed for existing types of
viruses, newer types are developed. There is no simple or universally agreed upon
classification scheme for viruses. In this section, we classify viruses along two orthogonal
axes: the type of target the virus tries to infect and the method the virus uses to conceal itself
from detection by users and antivirus software. A virus classification by target includes the
following categories:
• Bootsectorinfector:Infectsamasterbootrecordorbootrecordandspreadswhena system is
booted from the disk containing the virus.
• Fileinfector: Infectsfilesthattheoperatingsystemorshellconsidertobeexecutable.
• Macrovirus:Infectsfileswithmacrocodethatisinterpretedby anapplication.

Avirusclassificationbyconcealmentstrategyincludesthefollowingcategories:
• Encrypted virus: A typical approach is as follows. A portion of the virus creates a
random encryption key and encrypts the remainder of the virus. The key is stored with
the virus. When an infected program is invoked, the virus uses the stored random key to
decryptthe virus. When thevirus replicates, adifferent random key is [Link]
the bulk of the virus is encrypted with a different key for each instance, there is no
constant bit pattern to observe.
• Stealth virus: A form of virus explicitly designed to hide itself from detection by
antivirus software. Thus, the entire virus, not just a payload is hidden.
• Polymorphic virus: A virus that mutates with every infection, making detection by the
“signature” of the virus impossible.
• Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with
every infection. The difference is that a metamorphic virus rewrites itself completely at
each iteration, increasing the difficulty of detection. Metamorphic viruses may change
their behaviour as well as their appearance.

VirusKits
Another weapon in the virus writers’ armory is the virus-creation toolkit. Such a toolkit
[Link]
createdwithtoolkitstendtobelesssophisticatedthanvirusesdesignedfromscratch,thesheer number
of new viruses that can be generated using a toolkit creates a problem for antivirus schemes.
E-Mail Viruses
A more recent development in malicious software is the e-mail virus. The first rapidly
spreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro embedded in
[Link] opensthee-mailattachment,the Wordmacro isactivated. Then
 Thee-mailvirussendsitselftoeveryoneonthemailinglistintheuser’se-mail
package.
 Thevirusdoeslocaldamageontheuser’ssystem.
In 1999, a more powerful version of the e-mail virus appeared. This newer version can be
activated merely by opening an e-mail that contains the virus rather than opening an
attachment. The virus uses the Visual Basic scripting language supported by the e-mail
package.
It arrives via e-mail and uses e-mail software features to replicate itself across the Internet.
The virus propagates itself as soon as it is activated (either by opening an e-mail attachmentor
by opening the e-mail) to all of the e-mail addresses known to the infected host. Thismakes it
very difficult for antivirus software to respond before much damage is done. Ultimately, a
greater degree of security must be built into Internet utility and application software on PCs to
counter the growing threat.

AntivirusApproaches
The ideal solution to the threat of viruses is prevention: Do not allow a virus to get into the
system in the first place, or block the ability of a virus to modify any files containing
executable code or macros. This goal is, in general, impossible to achieve, althoughprevention
can reduce the number of successful viral attacks. The next best approach is to be able to do
the following:
• Detection: Once the infection has occurred, determine that it has occurred and locate the
virus.
• Identification: Once detection has been achieved, identify the specific virus that has infected
a program.
• Removal: Once the specific virus has been identified, remove all traces of the virus from the
infected program and restore it to its original state. Remove the virus from all infectedsystems
so that the virus cannot spread further.
Ifdetection succeeds but eitheridentification orremoval is not possible,thenthealternativeis to
discard the infected file and reload a clean backup version. Advances in virus and antivirus
[Link] couldbe
identified and purged with relatively simple antivirus software packages. As the virus arms
race has evolved, both viruses and, necessarily, antivirus software have grown more complex
and sophisticated.
• Firstgeneration:simplescanners
• Secondgeneration:heuristicscanners
• Thirdgeneration:activitytraps
 • Fourthgeneration:full-featuredprotection
A first-generation scanner requires a virus signature to identify a virus. The virus may contain
“wildcards”[Link]- specific
scanners are limited to the detection of known viruses. Another type of first- generation
scanner maintains a record of the length of programs and looks for changes in length.

A second-generation scanner does not rely on a specific signature. Rather, the scanner uses
heuristic rules to search for probable virus infection. One class of such scanners looks for
fragments of code that are often associated with viruses. For example, a scanner may look for
the beginning of an encryption loop used in a polymorphic virus and discover the encryption
key. Once the key is discovered, the scanner can decrypt the virus to identify it, then remove
the infection and return the program to service. Another second-generation approach is
integrity checking. A checksum can be appended to each program. If a virus infects the
program without changing the checksum, then an integrity check will catch the change. To
counter a virus that is sophisticated enough to change the checksum when it infects aprogram,
an encrypted hash function can be used.

Third-generation programs are memory-resident programs that identify a virus by its actions
rather than its structure in an infected program. Such programs have the advantage that it is
not necessary to develop signatures and heuristics for a wide array of viruses. Rather, it is
necessary only to identify the small set of actions that indicate an infection is being attempted
and then to intervene.

Fourth-generation products are packages consisting of a variety of antivirus techniques usedin

conjunction. These include scanning and activity trap components. In addition, such a
package includes access control capability, which limits the ability of viruses to penetrate a
system and then limits the ability of a virus to update files in order to pass on the infection.

The arms race continues. With fourth-generation packages, a more comprehensive defence
strategy is employed, broadening the scope of defence to more general-purpose computer
security measures.

DISTRIBUTEDDENIALOFSERVICE(DDoS)ATTACKS
A denial of service (DoS) attack is an attempt to prevent legitimate users of a service from using
that service. When this attack comes from a single host or network node, then it is simply
referred to as a DoS attack. A more serious threat is posed by a DDoS attack. In a DDoS
attack, an attacker is able to recruit a number of hosts throughout the Internet to
simultaneously or in a coordinated fashion launch an attack upon the target.
DDoSattacksmakecomputersystemsinaccessiblebyfloodingservers,networks, orevenend user
systems with useless traffic so that legitimate users can no longer gain access to those
resources. In a typical DDoS attack, a large number of compromised hosts are amassed tosend
useless packets.
DDoSAttack Description
A DDoS attack attempts to consume the target’s resources so that it cannot provide service.
One way to classify DDoS attacks is in terms of the type of resource that is consumed.
Broadly speaking, the resource consumed is either an internal host resource on the target
system or data transmission capacity in the local network to which the target is attacked.
A simple example of an internal resource attack is the SYN flood attack. Figure 10.9a shows
the steps involved:
a. Theattackertakes controlofmultiplehostsovertheInternet,instructing themtocontact the
target Web server.
b. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with
erroneous return IP address information, to the target.
c. Each SYNpacket is a request to open aTCP connection. For each such packet, theWeb
serverrespondswithaSYN/ACK(synchronize/acknowledge)packet,tryingtoestablish
aTCP connection with a TCP entity at a spurious IP address. The Web servermaintains a
data structure for each SYN request waiting for a response back and becomes bogged
[Link] the
victim machine is waiting to complete bogus “half-open” connections.

Fig.5.1Distributed SYNflood attack

Fig.5.2DistributedICMPattack

Figure illustrates an example of an attack that consumes data transmission resources. The
following steps are involved:
i. The attacker takes control of multiple hosts over the Internet, instructing them to send
ICMP ECHO packets with the target’s spoofed IP address to a group of hosts that act as
reflectors, as described subsequently.
ii. Nodes at the bounce site receive multiple spoofed requests and respond by sending echo
reply packets to the target site.
iii. The target’s router is flooded with packets from the bounce site, leaving no data
transmission capacity for legitimate traffic

Another way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a direct
DDoS attack, the attacker is able to implant zombie software on a number of sites distributed
throughout the Internet. Often, the DDoS attack involves two levels of zombie machines:
master zombies and slave zombies. The hosts of both machines have been infected with
malicious code. The attacker coordinates and triggers the master zombies, which in turn
coordinate and trigger the slave zombies. The use of two levels of zombies makes it more
difficult to trace the attack back to its source and provides for a more resilient network of
attackers.

Fig.5.3DirectDDoSattack

Fig.5.4ReflectorDDoSattack

A reflector DDoS attack adds another layer of machines (Figure 10.10b). In this type
ofattack,theslavezombiesconstructpacketsrequiringaresponsethatcontainsthetarget’sIP
address as the source IP address in the packet’s IP header. These packets are sent touninfected
machines known as reflectors. The uninfected machines respond with packets directed at the
target machine. A reflector DDoS attack can easily involve more machines and
moretrafficthan adirect DDoS attack and hence bemoredamaging. Further,tracing back the
attack or filtering out the attack packets is more difficult because the attack comes from
widely dispersed uninfected machines.

DDoSCountermeasures
Ingeneral,therearethreelinesofdefenseagainstDDoS attacks.
 Attack prevention and pre-emption (before the attack): These mechanisms enable the
victim to endure attack attempts without denying service to legitimate clients.
Techniques include enforcing policies for resource consumption and providing backup
[Link],preventionmechanisms modifysystemsand
protocols on the Internet to reduce the possibility of DDoS attacks.
 Attack detection and filtering (during the attack): These mechanisms attempt to detect
theattack as it begins and respond immediately. This minimizes theimpact oftheattack
on the target. Detection involves looking forsuspicious patterns of behaviour. Response
involves filtering out packets likely to be part of the attack.
 Attacksourcetracebackandidentification(duringandaftertheattack):Thisisan
attempt to identify the source of the attack as a first step in preventing future attacks.
However, this method typically does not yield results fast enough, if at all, to mitigatean
on-going attack.

INTRUDERS
One of the two most publicized threats to security is the intruder (the other is viruses), often
referred to as a hacker or cracker. In an important early study of intrusion, it had been
identified three classes of intruders:
• Masquerader: An individual who is not authorized to use the computer and who penetrates a
system’s access controls to exploit a legitimate user’s account.
• Misfeasor:Alegitimateuserwhoaccessesdata,programs,orresourcesforwhichsuch access is not
authorized, orwhois authorized for such access but misuses his orherprivileges
• Clandestine user: An individual who seizes supervisory control of the system and uses this
control to evade auditing and access controls or to suppress audit collection
Themasqueraderislikelytobeanoutsider;themisfeasorgenerallyisaninsider;andthe clandestine user can be
either an outsider or an insider.
Someoftheexamples forintrusion are,
• Performingaremoteroot compromiseofan e-mail server
• DefacingaWebserver
• Guessingandcrackingpasswords
• Copyingadatabase containingcreditcard numbers
• Viewingsensitivedata,includingpayrollrecordsandmedicalinformation,without authorization
• Runningapacketsniffer onaworkstationto captureusernamesand passwords
 Intrusiondetection systems
These have been developed to provide early warning of an intrusion so that defensive action can
be taken to prevent or minimize damage.
Intrusion detection involves detecting unusual patterns of activity or patterns of activity that are
known to correlate with intrusions.
Consumers commonly mistake an intrusion detection system (IDS)with a computer firewall.
Although both applications have a similar goal to protect end-users from nefarious hackers
and computer malware, an IDS differs from a firewall in that it can be either a device or
software program created to monitor an individual computer, computing device, or network
for either security policy violations or malicious activity. Once this type of behaviour is
observed, the intrusion detection system makes a report to a centralized management
component or station.
What is an Intrusion Detection System? Intrusion detection systems are designed to analyse
network traffic for potentially malicious behaviour and to report possible “intrusions” to a
centralized management node. Some IDSs are designed to take action to prevent these
attempts from being successful; however, stopping malicious attacks is not a required
component of an IDS. Many times, an organization will install an IDS to help document
existing threats to company networks, to identify existing issues with violations of security
policy, or to deter end-users from consistently violating company or organization security
policies. Since IDSs were first introduced, they have become a critical component to most
major organization’s security infrastructures.
The concept of an intrusion detection system dates to 1984 when Fred Cohen determined that it
was possible to detect network intrusions based on information available to network
administrators if enough computing resources were devoted to the task. By taking a hard look
at file access logs, user access logs, and system event logs, most unauthorized network
intrusions could be detected.

Fig.
5.5
IntrusionDetectionExpertSystem
In 1986, Dorothy E. Denning assisted by Peter G. Neumann, published a new IDS model that
continues to serve as the basis for intrusion detection systems in use today. Her model from
themid-1980’s madeuse ofstatistical analysis for detecting network anomalies. The resulting
implementation of this work was the Intrusion Detection Expert System (IDES) implemented
at SRI International that ran on Sun work stations. This implementation made use of bothrules
set as well as a statistical anomaly detection system that looked at host systems, target
systems, and end-users. Later, Lunt added an artificial neural network as a third component to
the system which all made reports to a resolver application. The resulting work was deployed
in the Next generation Intrusion Detection Expert System, or NIDES.

TypesofIntrusionDetectionSystems
There are three types of intrusion detection systems on the market today: network instruction
detectionsystems(NIDSs),host-basedinstructiondetectionsystems(HIDSs),andstackbased
intrusion detection systems (SIDS). Network Intrusion Detection System A network intrusion
detection system analyses network traffic and hosts to locate potential intrusions. The NIDS
system connects to a network hub, network tap, or network switch that is configured to allow
monitoring of network traffic. When setting up a network intrusion detection system, the
monitoringpointsaresetupathigh-trafficareasonthenetworktoexaminethenetworkdata
packetsforpotentiallymalicious actions.
 Host-BasedIntrusionDetection System:
Host-based intrusion detection systems (HBIDs)are designed to have one network host
agent that uses application logs, file-system modifications, and system call analysis to
locate intrusions to the network. The sensors in a host-based intrusion detection system
normallyconsistofsoftwareagent(s).AcommonexampleofaHIDSareOSSECand
Tripwire.
 Stack-BasedIntrusionDetectionSystem:
Stack-based intrusion detection systems (SIDS) were developed as a succeeding
technology to HBIDs. SIDS examine network packets as they travel through the network
stack (TCP/IP). As a result, the SIDS technology does not incur the overhead of having to
communicate with the network interface in promiscuous mode.
What are the Differences Between Statistical and Signature-Based Intrusion Detection
Systems?
Statistics-based intrusion detection systems have been deployed for a number of years. This
type of IDS will record normal network activity such as the types of protocols commonly
used, devices connected to the network, ports used, and overall bandwidth. When network
activity is detected that is out of the ordinary, the IDS will provide an alert to the network
administrator or end-user regarding the event(s). A signature-based intrusion detection system
compares network data packets with pre-determined network attack patterns or signatures.
Unfortunately, there can be a significant delay in identifying new threat signatures to uploadto
the IDS. This makes signature-based IDSs vulnerable to emerging threats.
HowDoesanIntrusionDetectionSystemDiffer fromaFirewall?
A common misconception amongst end-users is that firewalls and intrusion detection systems
[Link],
they have distinct functions. Firewalls are designed to limit access from origins outside of the
network to stop attacks from occurring. They are unable to identify malicious actions that
being inside of the network. Intrusion detection systems are designed to identify attacks once
they have gained access to the network and can evaluate potentially malicious actions which
originate from within the network. As technologies have matured; however, a hybrid system
referred to as an intrusion prevention system has been developed. The IPS is designed to stop
malicious network connections and is also considered to be a firewall residing in the
application layer of the OSI network model.

Honeypot:
Inafullydeployed IDS,someadministrators maychoosetoinstalla“honeypot,”essentiallya system
component set up as bait or decoy for intruders. Honeypots can be used as early warning
systems of an attack, decoys from critical systems, and data collection sources for attack
analyses. Many IDS vendors maintain honeypots for research purposes, and to develop new
intrusion signatures. Note that a honeypot should only be deployed when theorganization has
the resources to maintain it. A honeypot left unmanaged may become a significant liability
because attackers may use a compromised honeypot to attack other systems.
LimitationsofIntrusionDetection Systems:
Intrusion detection systems are not perfect. Depending on the design of the system, a number
of false-positive results can be generated. These “false alarms” can originate from bad
software, corrupt domain name server information, or local network traffic. As a result, a real
network attack can be missed if the IDS is not properly configured for the defended network.
Another vulnerability of IDSs that rely on signature files is updating the signature library to
include the latest threats. When left undone, the network can be open to attack from the most
current threats.
FreeIntrusionDetection Systems:
There are several freely available intrusion detection / prevention systems available on the
marketplace today. Some of the better-known projects include Snort, File System Saint, and
AIDE.
 Snort:
One of the most downloaded and installed intrusion detection and prevention systems in the
world today is Snort. Originally published in 1998 by CTO Martin Roesch, the application is
designed to perform real-time packet logging and traffic analysis on IP-based networks. Atthe
time of this writing, Snort has been downloaded more than four million times since initial
release and has more than 400,000 registered users of the software. The application is based
on a rule-based language that combines several additional IDS technologies to include
protocol, anomaly-based, and signature detection methods.
 FileSystem Saint:
File System Saint (FSS) is another open-source intrusion detection system written in the Perl
programming language. The software project is designed to be lightweight, fast, and easy to
use. FSS works on thebasicpremiseofstoring an image ofthelivefilesystem ofthenetwork
[Link]
application also stores data about file owner, permissions, file size, mtime, and ctime and
reports changes to the computer owner via email report. To guard against tampering, FSS
saves a cryptographic hash file to ensure legitimate data is being used while in operation.
 AIDE:
AIDE (Advanced Intrusion Detection Environment) is deployed as a free replacement for the
commercially available Tripwire IDS. The software application is designed to check the
integrity of the system’s file and directories. To achieve this functionality, AIDE creates a
database from the regular expression rules contained in the software’s configuration files.
After the database is created, it is used to validate the file integrity of the protected computer.
Additional application features include support for the following message digest algorithms:
sha1, rmd160, md5, crc32, sha256, sha512, tiger, and whirlpool. AIDE also supports gzip
database compression if zlib support is installed on the protected computer.

IDS DEPLOYMENT (SNORT as example) Snort is logically divided into multiple

components. These components work together to detect particular attacks and to generate
output in a required format from the detection system. A Snort-based IDS consists of the
following major components.

Table5.2Components of anIDS

Name Description

PacketDecoder Preparespacketfor processing

Usedtonormalizeprotocolheaders,detectanomalies,
Pre-processorsorInput Plugins
assembly and TCP stream re-assembly
DetectionEngine Appliesrules to packets
LoggingandAlertingSystem Generatesalertandlogmessages
Output Modules Processalertsandlogsandgeneratefinaloutput

PacketDecoder:
Packet decoder takes packets from different types of network interfaces and prepares packets
to be pre-processed or to be sent to the detection engine. The interfaces may be Ethernet,
SLIP, PPP, and so on.

Pre-processors:
Pre-processors are components or plug-ins that can be used with Snort to arrange or modify
data packets before the detection engine does some operation to find out if the packet is being
used by an intruder.

TheDetectionEngine:
The detection engine is the most important part of snort. Its responsibility is to detect if any
intrusion activity exists in apacket. Thedetection engine employs snort rules forthis purpose.
Loggingand AlertingSystem:
Dependinguponwhatthedetectionenginefindinsideapacket maybeusedtologtheactivity or
generate an alert. Logs are kept in simple text files, tcp-dump-style files or some otherform.

OutputModules:
Output modules or plug-ins can do different operations depending on how you want to save
outputgeneratedby theloggingandalertingsystemofSnort. Basically,thesemodules control the
type of output generated by the logging and alerting system.

Figure below shows how these components are arranged. Any data packet coming from the
Internet enters the packet decoder. On its way towards the output modules, it is eitherdropped,
logged or an alert is generated.

Fig.5.6 Componentsof Snort

ReviewQuestions:
1. Differentiatewormsandviruses.
2. Whatarecalledasmalicioussoftware?
3. Whatdoyoumeanby backdoor?
4. Defineintruder.
5. Specifytheantivirus approaches.
6. Definelogic bomb.
7. Distinguishtrojanhorsesandviruses.
 8. Listthetypes ofintrusiondetection systems.
9. WhatisDDoS attack?
10. Givethecountermeasures ofDDoS attack.
11. Whatarethe variousComputerSystemsSecuritytools? ExplainMalicious Software.
12. Whatis aVirus and Explain arethe varioustypesof Virus?
13. Howis thecomputersystem Securityachievedusing Virus &Antivirus?
14. Whatisdenialof Service attackand Howisitcountered?
15. WhatisthedifferencebetweenNetworkbased&HostbasedIDS?AlsoExplainthe steps
for deploying the IDS?
REFERENCES:

1. WillliamStallings,”NetworkSystemEssentials“-4thEditionCopyright©2011
Pearson education, Inc., publishing as Prentice Hall

2. AtulKhahate,“Cryptographyandnetworksecurity”,3rdEdition,Copyright©2013
TMH Publishing

3. KuldeepSinghKohar,“NetworkSecurity”,[Link]
India, New Delhi.