EXAM 2 SECTION A

Q1. What are three broad categories of applications of public-key cryptosystems?

Explain one of them.

Public-key cryptography (asymmetric cryptography) uses two keys:

• A public key for encryption

• A private key for decryption

It solves the major problems of key distribution and provides security services not possible
with symmetric keys alone.

Public-key cryptosystems are used in three major application categories:

1. Encryption / Decryption (Confidentiality)

This is where the public key is used to encrypt a message, and the private key is used to
decrypt it.

✔ How it works:

• Sender encrypts using receiver’s public key

• Only receiver can decrypt using private key

• Ensures confidentiality

✔ Example:

When you send an encrypted WhatsApp message or bank communication, sometimes RSA
is used to encrypt the symmetric session key.

2. Digital Signatures (Authentication + Non-repudiation)

Used to prove who sent the message, and that the message has not been changed.

Provides:

• Authentication (sender identity verified)

• Integrity (no modification)

• Non-repudiation (sender cannot deny)

✔ Real-life example:

Signing PDFs, university documents, government e-services.

 3. Key Exchange (Session Key Establishment)

Public-key algorithms like Diffie-Hellman or RSA help two users agree on a symmetric
session key securely.

✔ Example:

When you open a website:

Your browser uses RSA or DH to securely exchange a key → then uses AES for actual
communication.

Now Explain ONE of Them (Digital Signatures)

Digital signatures are one of the most important applications of public-key cryptography.
They replace physical signatures in the digital world.

A. What is a Digital Signature?

A digital signature is a mathematical technique that allows a sender to “sign” a message so

that the receiver can verify:

1. The sender is authentic

2. The message has not been altered

3. The sender cannot deny sending it

It provides authentication, integrity, and non-repudiation at the same time.

B. How a Digital Signature Works (Step-by-Step)

Step 1 — Sender generates a hash

The message is passed through a hash function → produces unique output.

Example:
Hash("Pay Ahmed $200") → 3F9A8B…

Step 2 — Sender encrypts the hash using private key

This encrypted hash = digital signature.

Step 3 — Sender sends:

• The message

• The signature

Step 4 — Receiver verifies

 • Receiver computes hash of received message

• Receiver decrypts signature using sender’s public key

• If both hashes match → message is authentic & unchanged

C. Real-Life Example

Example: Submitting an online scholarship application

If an applicant signs the PDF digitally:

• University can verify signature

• Can confirm document authenticity

• Knows the content wasn't modified

• Applicant cannot later deny sending it

D. Uses of Digital Signatures in the Real World

• Online banking transactions

• Income tax e-filing

• Software update verification

• SSL/TLS certificates

• E-contracts

• Blockchain transactions

Digital signatures are legally recognized in many countries.

Public-key cryptosystems support three broad categories of applications:

1. Encryption/decryption for confidentiality

2. Digital signatures for authentication and non-repudiation

3. Key exchange for secure key generation

Digital signatures are widely used to ensure that messages and documents are genuine
and unaltered. They rely on hashing and public-key cryptography and are essential for
secure communication, banking, software distribution, and e-commerce.
Q2. Explain Data Encryption Standard in detail.

DES is one of the earliest standardized block ciphers and is based on a 16-round Feistel
network.

1. Basic Characteristics

• Block size: 64 bits

• Key size: 56 bits (original 64 bits include 8 parity bits)

• Number of rounds: 16 rounds

• Structure: Feistel cipher

2. DES Encryption Steps

Step 1 – Initial Permutation (IP)

The 64-bit plaintext is permuted using a fixed table.

This does not add security but organizes bits for further processing.

Step 2 – Split into Two Halves

Left half (L0) = 32 bits

Right half (R0) = 32 bits

Step 3 – 16 Feistel Rounds

DES uses a Feistel function F applied 16 times with round keys.

Each round:
Ln = R(n-1)

Rn = L(n-1) ⊕ F(R(n-1), K(n))

So, the right side goes to left, and new right side is XOR of old left and F function.

Step 4 – Swap Halves After 16 Rounds

Swap L16 and R16.

Step 5 – Final Permutation (FP)

Inverse of initial permutation → produces ciphertext.

3. Key Generation in DES

DES generates 16 round keys, each 48 bits.

Steps:

1. Parity bit drop (64 → 56 bits)

2. Split into two 28-bit halves

3. Left shifts per round

4. Compression permutation (56 → 48 bits)

4. Weaknesses of DES

• 56-bit key is vulnerable to brute-force attacks

• Electronic Frontier Foundation cracked DES in <24 hours

• Not suitable for modern security

5. Real-life use & replacement

DES was widely used in ATMs, UNIX password hashing, and financial systems.
Now replaced by AES, 3DES, and stronger ciphers.

Q3. What parameters identify an SA, and what parameters characterize the nature of a
particular SA?

A Security Association (SA) is a simplex, one-directional relationship that defines how

IPsec will secure traffic.

1. Parameters that IDENTIFY an SA

These are used to uniquely locate a specific SA:

Identifying Parameter Meaning

SPI (Security Parameter Index) Unique 32-bit identifier of the SA

Destination IP Address Identify which host/gateway the SA belongs to

Security Protocol (AH or ESP) Determines the type of protection

These three parameters together form a SA triple:

{SPI, Destination IP, Protocol (AH/ESP)}

1. Security Parameters Index (SPI)

• A 32-bit number placed in AH/ESP header.

• The most important identifier.

 • Distinguishes multiple SAs between same pair of devices.

Example:
If two branch offices have multiple tunnels (HR-data, Finance-data), different SAs are
created with different SPIs.

2. Destination IP Address

• The IP address of the device that will receive and interpret the SA.

• Usually the tunnel endpoint (router, firewall, or host).

This helps identify which device owns the SA.

3. Security Protocol Identifier

• Specifies whether the SA is for:

o Authentication Header (AH) → value (51)

o Encapsulating Security Payload (ESP) → value (50)

This lets the IPsec engine know whether to use AH or ESP processing.

✔ These three parameters together uniquely identify an SA:

1. SPI

2. Destination IP address

3. Protocol (AH/ESP)

This triple is called the SA tuple.

2. Parameters that CHARACTERIZE the SA

These define what security services are applied:

Parameter Description

SPI (Security Parameter Index) A unique identifier used to distinguish between different SAs.

Encryption Algorithm Specifies which algorithm will be used to encrypt data (e.g., AES,
3DES).

Authentication Algorithm Specifies the algorithm used to verify data integrity (e.g., HMAC-
SHA256).
Encryption/Authentication Keys Secret keys are used for encryption and integrity protection.

SA Lifetime Time or data volume until an SA expires or must be re-negotiated.

Mode Specifies whether IPsec operates in Transport Mode or Tunnel Mode.

Sequence Number Counter used to prevent replay attacks.

Protocol Identifies the type of data carried inside the protected packet.

These parameters define the strength and behavior of IPsec protection.

Real-Life Example

Two offices (Delhi and Mumbai) have an IPsec VPN tunnel.

Identifying SA (Inbound SA at Mumbai):

• SPI = 0x23A94D11

• Destination IP = [Link] (Mumbai firewall)

• Protocol = ESP

SA Characteristics:

• Encryption: AES-256

• Authentication: HMAC-SHA-256

• Tunnel mode

• Key lifetime = 3600 sec

• Anti-replay window size = 64

• Sequence number = increments per packet

Final Summary (Exam-Ready)

An SA is uniquely identified by the tuple:

1. SPI

2. Destination IP address

3. Security protocol (AH or ESP)

An SA is characterized by parameters that describe how IPsec protects packets, including
encryption algorithm, authentication algorithm, key material, key lifetime, sequence
numbers, anti-replay window, and mode of operation (transport or tunnel).

Q4. How are hash functions generated? What are the characteristics of a secure hash
function?

1. How Hash Functions Are Generated

Hash functions convert input data of any size into a fixed-length value called a digest.

Hash algorithms typically use the following steps:

A. Preprocessing

• Pad the message

• Add message length

B. Divide into blocks

e.g., SHA-256 divides into 512-bit blocks.

C. Compression Function

Each block is processed through:

• XOR

• AND/OR

• Bit shifts

• Addition mod 2³²

• Substitution

This step mixes the bits thoroughly.

D. Final digest is produced

Example output sizes:

• MD5 → 128 bits

• SHA-1 → 160 bits

• SHA-256 → 256 bits

 2. Characteristics of a Secure Hash Function

A secure hash function must satisfy:

1. Pre-image resistance

Given a hash H, it should be infeasible to find any message M such that h(M) = H.

2. Second pre-image resistance

Given a message M1, it must be hard to find M2 such that:

h(M1) = h(M2)

3. Collision resistance

No two different messages should have the same hash.

4. Avalanche effect

A small change in input → large change in hash.

5. Deterministic

Same input → always same output.

6. Fast computation

Hash should be produced quickly.

These properties ensure the integrity and uniqueness of digital data.

Real-Life Examples of Hash Function Use

• Password storage in databases

• Blockchain (Bitcoin uses SHA-256)

• Digital signatures

• HMAC for integrity

• Certificate generation

• File integrity checking (MD5/SHA-256 checksums)

Final Summary (Exam-Ready)

Hash functions are generated using mathematical operations such as modular arithmetic,
bitwise functions, compression functions, and iterative rounds (like in SHA or MD5). They
convert messages of any length into fixed-size digests.

A secure hash function must satisfy properties such as preimage resistance, second
preimage resistance, collision resistance, avalanche effect, determinism, fixed output size,
and pseudorandomness. These properties make hash functions essential for digital
signatures, authentication, password protection, and blockchain.

Q5. What is the authentication header in Internet Protocol?

The Authentication Header (AH) is part of the IPsec protocol suite providing:

✔ Data origin authentication

✔ Data integrity
✔ Replay protection

1. Purpose of AH

AH ensures that:

• Data is not modified in transit

• The sender is authenticated

• Replay attacks are prevented

AH does not provide confidentiality (no encryption).

2. Position of AH in IP packet

AH is inserted between:

IP Header ← AH ← Payload

Thus the IP header (except mutable fields) is also authenticated.

3. AH Header Fields

Field Meaning

Next Header Identifies upper-layer protocol (TCP, UDP)

Payload Length Length of AH header

SPI Selects correct SA

 Sequence Number Prevents replay attacks

Authentication Data (ICV) Contains MAC value for integrity

4. AH Services

Integrity

Ensures that no alteration occurs.

Sender Authentication

Uses HMAC to prove authenticity.

Anti-Replay

Uses sequence numbers and sliding windows.

5. Limitations

• No confidentiality

• Cannot pass through NAT easily

• ESP is preferred in modern systems

Real-Life Example

A company has two branch offices connected over the Internet.

They set up IPsec VPN:

• AH ensures packets are authentic

• AH ensures no modification occurs

• AH blocks replay attacks

Even without encryption, AH protects sensitive configuration traffic (routing tables, logs).

Final Summary (Exam-Ready)

The Authentication Header is an IPsec protocol providing integrity, authentication, and

replay protection for IP packets by adding a cryptographic header to each packet. It uses
hashing and shared secret keys to detect modification and impersonation and can operate
in transport or tunnel mode.
SECTION B

Q6. Explain Secure Socket Layer. What is the difference between an SSL connection
and an SSL session?

1. INTRODUCTION TO SSL

Secure Socket Layer (SSL) is a security protocol developed to secure communication

between a client (like a browser) and a server (like a website) over the internet.

SSL provides:

✔ Confidentiality – data is encrypted

✔ Integrity – tampering is detected
✔ Authentication – verifies server identity
✔ Protection against eavesdropping

SSL is the reason why websites show https:// instead of [Link]

2. WHY SSL IS NEEDED? (VERY SIMPLE)

The internet is like a public road—anyone can “stand” and watch the data passing.
If you visit a banking site without SSL:

• Hackers can steal your password

• They can see your card details

• They can modify data

SSL creates a secure tunnel between your device and the website so no attacker can
understand or modify the communication.

3. HOW SSL WORKS (EASY STEP-BY-STEP)

STEP 1 — Client Hello

Client sends:

• Supported SSL versions

• Supported cipher suites

• Random number
STEP 2 — Server Hello

Server sends:

• Its SSL version

• Chosen cipher suite

• A digital certificate containing its public key

STEP 3 — Certificate Verification

The browser checks if the certificate is valid and trustworthy.

STEP 4 — Key Exchange

Client generates a pre-master secret and encrypts it using the server’s public key.

STEP 5 — Session Key Creation

Both sides calculate the same session key, which is symmetric (usually AES).

STEP 6 — Secure Communication Begins

All further data is encrypted using the session key.

 4. SSL ARCHITECTURE (TWO MAIN PARTS)

A. SSL Record Protocol

Provides:

• Fragmentation

• Compression

• MAC (Message Authentication Code)

• Encryption

• Transmission

This ensures the confidentiality and integrity of messages.

B. SSL Handshake Protocol

Handles:

• Authentication

• Key exchange

• Session negotiation

5. DIFFERENCE BETWEEN SSL CONNECTION AND SSL SESSION

SSL Connection SSL Session

Temporary, peer-to-peer Long-lived relationship between client & server.

communication channel.

Created for each request/response. Can be reused across multiple connections.

Uses session keys derived during Stores cryptographic parameters (session ID,
handshake. cipher suite).

Exists only while the data transfer is Exists even after connection closes (short time).
happening.

Example: loading one webpage. Example: browsing multiple pages on Amazon

without re-authentication.

Easy Explanation

• Session = long-term agreement

 • Connection = actual conversation using that agreement

6. REAL-LIFE EXAMPLE

When you log in to your bank account:

• SSL session is created once

• SSL connections are created for each page you open

• Session keys are reused to improve performance

SUMMARY

SSL secures client-server communication by encrypting data and authenticating the server.
An SSL session stores security parameters, while SSL connections use these parameters
for secure message exchange.

Q7. What is a dual signature, and what is its purpose?

1. INTRODUCTION

In electronic payments, two different parties need different information:

Merchant needs:

• Order Information (OI)

Bank needs:

• Payment Information (PI)

But neither party should see the other's information.

SET (Secure Electronic Transaction) uses dual signature to link OI and PI securely.

2. PURPOSE OF DUAL SIGNATURE

Dual Signature ensures:

✔ Customer privacy
✔ Merchant cannot see card details
✔ Bank cannot see what item was purchased
✔ Both OI and PI belong to the same order

It binds both halves of the transaction without revealing sensitive data unnecessarily.
 3. HOW DUAL SIGNATURE WORKS (STEP BY STEP)

Step 1: Compute hashes

Hash OI → OIMD
Hash PI → PIMD

These are fixed-length values summarizing the data.

Step 2: Link both hashes

Concatenate OIMD || PIMD

Step 3: Hash the combination

H(OIMD || PIMD)

Step 4: Sign using customer’s private key

Dual Signature = Encrypt( H(OIMD || PIMD), Customer Private Key )

4. Why this is secure

• Merchant gets: OI, dual signature, OIMD

• Bank gets: PI, dual signature, PIMD

• Both verify the signature independently

• Neither can access the other’s sensitive information

5. REAL-LIFE EXAMPLE

When buying a phone online:

• The merchant sees your chosen phone, address, etc.

• The bank sees card number, CVV, amount

• Dual signature ensures both match and are valid

SUMMARY

Dual signature binds OI and PI without exposing sensitive information and ensures integrity
and authentication in SET payments.
Q8. Why is web security important?

1. INTRODUCTION

Web security protects websites, servers, and users from online threats.
The web carries sensitive information such as:

• Passwords

• Banking transactions

• Personal data

• Business secrets

Without web security, data can be easily stolen or modified.

2. WHY WEB SECURITY IS IMPORTANT (DETAILED)

1. To protect user privacy

Hackers can intercept login credentials or personal data.

2. To ensure secure communication

Prevent eavesdropping on messages or financial transactions.

3. To maintain website integrity

Prevent tampering with website content.

4. To protect business reputation

A hacked website loses customer trust immediately.

5. To prevent unauthorized access

Attackers may hijack accounts, servers, or databases.

6. To stop phishing, malware, XSS, and SQL injection

Websites are common attack points for hackers.

3. Web Security Threat Examples

• Man-in-the-middle attack

• Session hijacking

• Drive-by downloads
 • Cookie theft

• Form tampering

4. Real-life examples

Banking:

Web security prevents attackers from reading your online banking password.

E-commerce:

SSL/TLS ensure your card information stays encrypted.

Social Media:

Security protects against account hacking and data leaks.

SUMMARY

Web security is essential for protecting user data, ensuring safe communication, defending
against cyber-attacks, and maintaining trust in online systems.

Q9. What is the role of viruses in security system?

1. INTRODUCTION

A virus is a malicious program that replicates by attaching itself to files or systems.

Viruses affect security by causing damage, stealing data, or disabling systems.

2. ROLE OF VIRUSES IN SECURITY SYSTEM

Viruses play several roles in shaping, motivating, and influencing information security
systems.

Below are the key roles, each explained deeply.

1. Viruses Drive the Development of Antivirus Technology

Without viruses, there would be no need for antivirus programs.

Because new viruses appear daily, antivirus systems must:

• Scan files for known signatures

• Perform heuristic analysis

• Monitor system behavior

• Detect abnormal activities

 • Quarantine suspicious files

• Use cloud-based scanning

• Update continuously

Viruses force security vendors to innovate.

2. Viruses Influence Security Policies and Standards

Organizations create strict policies because of viruses:

• Mandatory antivirus installations

• Email attachment restrictions

• Blocking of untrusted downloads

• Regular updates and patching

• Network access control

Security policies evolve due to rising virus threats.

3. Viruses Highlight the Need for Regular Updates

A virus exploits vulnerabilities in:

• Operating systems

• Browsers

• Applications

Examples include worms exploiting outdated systems.

Therefore, security systems must:

• Patch vulnerabilities quickly

• Use automatic update systems

• Maintain secure configurations

Viruses push the industry toward proactive patch management.

4. Viruses Encourage Use of Strong Authentication Systems

Some viruses:

• Steal passwords
 • Log keystrokes

• Hijack accounts

This motivates security systems to use:

• Two-factor authentication (2FA)

• Biometrics

• CAPTCHA

• Encrypted credentials

Thus, viruses lead to stronger authentication mechanisms.

5. Viruses Require Network-Level Protections

Because viruses spread over networks, security systems need:

• Firewalls

• Intrusion Detection Systems (IDS)

• Intrusion Prevention Systems (IPS)

• Network segmentation

• Traffic monitoring

Viruses force designers to protect the network layer, not just individual devices.

6. Viruses Drive the Need for Backup and Recovery Systems

Ransomware (a modern virus) encrypts user data.

This has led organizations to:

• Keep offline backups

• Maintain disaster recovery plans

• Use versioned backup solutions

Thus, viruses emphasize business continuity planning.

7. Viruses Help Security Researchers Improve Defenses

Security researchers study viruses to:

• Understand attack methods

 • Improve detection

• Design better algorithms

• Build sandboxing systems

• Strengthen overall architectures

Viruses serve as real-world test cases to strengthen systems.

8. Viruses Expose Weaknesses in Human Behavior

Many viruses spread due to careless actions:

• Clicking unknown links

• Opening suspicious attachments

• Using pirated software

• Ignoring warnings

Thus, security systems must include:

• User awareness training

• Behavior monitoring

• Email filtering

Viruses show that humans are often the weakest link.

9. Viruses Push Evolution Toward Zero-Trust Architecture

Since viruses can hide anywhere, modern systems adopt:

• Zero trust

• Least privilege access

• Continuous verification

Viruses have helped shift the industry away from “trust-based” models.

10. Viruses Lead to Development of Digital Immune Systems

Modern systems automatically:

• Detect new viruses

• Analyze them
 • Generate signatures

• Distribute updates

This “self-healing architecture” is inspired by biological immunity.

Final Summary (Exam-Ready)

Viruses play a major role in shaping security systems. They force the development of
antivirus software, influence security policies, motivate frequent updates, strengthen
authentication mechanisms, and promote advanced technologies like firewalls, IDS/IPS,
backups, and zero-trust models. By studying viruses, researchers develop better defenses,
making viruses an essential factor in the evolution of cybersecurity.

Q10. Write a note on Trusted systems and antivirus techniques.

1. TRUSTED SYSTEMS

A trusted system is designed to enforce security policies and ensure confidentiality,

integrity, and controlled access.

Features of trusted systems:

1. Access Control

o Ensures that only authorized users/processes can access files, applications,

or services.

o Example:
A student cannot access a university administrator's database

2. Reference Monitor Concept

o Controls all access.

o Must be tamper-proof, always invoked, and small enough to be verified.

3. Multilevel Security Models

o Example: Bell-LaPadula model (No read up, no write down).

o Used in military and government.

Why Trusted Systems Are Important

• Protect sensitive data

• Prevent insider misuse

 • Enforce policies

• Provide secure foundation for applications

• Reduce chances of system compromise

2. ANTIVIRUS TECHNIQUES

Antivirus systems detect, prevent, and remove malware.

1. Signature-based detection

• Each virus has a unique “fingerprint” called a signature.

• Antivirus scans files and matches signatures.

Pros: Very accurate

Cons: Cannot detect new/unknown viruses

2. Heuristic detection

• Detects viruses based on suspicious behavior or code patterns.

• Does not rely on signatures.

Example behaviors:

• Modifying system files

• Writing to boot sector

• Self-replication

Pros: Detects unknown viruses

Cons: May produce false positives

3. Behavioral monitoring

Monitors system actions in real time:

• Unexpected network access

• Mass file encryption (ransomware behavior)

• Rapid file modifications

If suspicious behavior occurs → antivirus stops it.

 4. Cloud-Based Detection

Modern antivirus uploads unknown samples to cloud servers:

• Servers analyze file

• Generate global threat intelligence

• Distribute updated signatures

Used by advanced vendors like Kaspersky, Bitdefender, etc.

5. Real-Time Protection

Antivirus continuously scans:

• Downloads

• Attachments

• Processes

• Memory

• Browser activity

This prevents infections before they execute.

SUMMARY

A trusted system is a computing environment designed with strong security controls such
as access control, auditing, security kernels, and policy enforcement to ensure reliability
and protection of sensitive data.
Antivirus techniques include signature-based detection, heuristic analysis, behavioral
monitoring, sandboxing, integrity checking, cloud-based scanning, and machine learning
methods. Together, these techniques help detect, prevent, and remove malware and
maintain system security.

SECTION C

a: Define categories of passive and active security attacks.

Passive attacks attempt to observe or monitor data without altering it. Examples include
eavesdropping on network communication or traffic analysis. Their goal is to gather
information silently, so they are hard to detect. Active attacks modify, disrupt, or inject
data into the system, such as DoS, spoofing, or message alteration. Passive attacks are
about listening; active attacks are about interfering.
b: What are the two basic functions used in encryption algorithms?

The two basic functions are substitution and permutation. Substitution replaces
elements of the plaintext with other values (e.g., shifting letters). Permutation rearranges
the bits or characters in the plaintext to hide patterns. These two operations combined
provide confusion and diffusion, making the encryption strong.

c: Briefly define the Caesar cipher.

The Caesar cipher is one of the simplest substitution ciphers, shifting each letter by a fixed
number of positions in the alphabet. For example, with a shift of 3: A→D, B→E, C→F. It is easy
to understand but also very easy to break. Still, it is important for understanding the basics
of cryptography.

d: Differentiate between steganography and cryptography.

Cryptography scrambles a message so that unauthorized users cannot understand it.

Steganography hides the existence of the message by embedding it inside images, audio,
or text. Cryptography protects the content; steganography protects the presence. They can
also be used together for increased security.

e: What is the difference between diffusion and confusion?

Diffusion spreads the influence of a single plaintext bit over many ciphertext bits, making
patterns disappear. Confusion makes the relationship between the key and ciphertext
complex, so attackers cannot guess keys easily. Diffusion hides plaintext structure;
confusion hides key structure. Both are necessary for strong ciphers like AES and DES.

f: Briefly describe SubBytes.

SubBytes is a transformation step in AES that applies a substitution box (S-box) to each
byte of the data block. It provides non-linearity and confusion, making the cipher resistant
to algebraic and differential attacks. Each byte is replaced with another value based on a
fixed lookup table. This step strengthens AES significantly.

g: What is a meet-in-the-middle attack?

A meet-in-the-middle attack is a cryptanalytic technique used against encryption schemes

with multiple keys, such as Double DES. Instead of trying all key combinations separately,
the attacker encrypts from one side and decrypts from the other side, “meeting in the
middle.” This reduces the effective security level drastically. It is a time-memory tradeoff
attack.
h: What is a one-way function?

A one-way function is easy to compute in one direction but extremely hard to reverse. For
example, given x, it's easy to compute f(x), but given f(x), it's nearly impossible to find x.
Hash functions use one-way functions to secure passwords and messages. One-way
functions form the basis of modern cryptography.

i: What is a message authentication code?

A Message Authentication Code (MAC) is a short piece of information used to verify

message integrity and authenticity. It is generated using a secret key + message and
ensures the message wasn’t changed. The receiver recomputes the MAC and compares it
to the received one. If they match, the message is trusted.

j: What are typical phases of operation of a virus or worm?

A virus or worm typically goes through four phases:

1. Dormant Phase – waits for a trigger.

2. Propagation Phase – spreads to other systems or files.

3. Trigger Phase – activates when conditions are met.

4. Execution Phase – performs malicious activity like deleting data or damaging

systems.
These phases help viruses survive and attack effectively.