Computer Security Assignment

By : Namusa hassan ugr/22318/13

1. Compare and Contrast Symmetric and Asymmetric Encryption Techniques

Symmetric Encryption

Definition: Uses the same secret key for both encryption and decryption.

Speed: Very fast and efficient, suitable for encrypting large amounts of data.

Examples: AES, DES, RC4.

Asymmetric Encryption

Definition: Uses a pair of keys – a public key (for encryption) and a private key
(for decryption).

Speed: Slower than symmetric encryption due to complex mathematics.

Examples: RSA, ECC (Elliptic Curve Cryptography).

Comparison Table
Feature Symmetric Encryption Asymmetric Encryption

Key Type Single shared key Public and private keys

Speed Fast Slower

Key Exchange Risky (must be secure) Secure (public key can be shared openly)

Use Case Encrypting data in bulk Secure key exchange, digital signatures

Example Protocols AES in VPNs, file storage RSA in SSL/TLS for key exchange

Advantages

Symmetric: High performance, simple to implement.

Asymmetric: Solves key distribution problem, enables secure authentication.

1
Disadvantages

Symmetric: Key must be shared securely beforehand; risk if intercepted.

Asymmetric: Computationally expensive, not ideal for large data encryption.

Combined Use in Modern Systems

Hybrid Encryption: Combines both methods.

Asymmetric encryption is used to exchange a symmetric key securely.

The symmetric key is then used for fast, secure communication.

Example: HTTPS (SSL/TLS)

Browser gets server’s public key (asymmetric).

Sends a randomly generated symmetric key encrypted with the public key.

The session then uses symmetric encryption for speed.

2. Structure and Working of the DES Algorithm

What is DES?

DES (Data Encryption Standard) is a symmetric key block cipher.

Developed in the 1970s by IBM and adopted by NIST.

Encrypts data in 64-bit blocks using a 56-bit key.

Structure of DES

1. Initial Permutation (IP)

Rearranges the 64-bit input block using a fixed permutation table.

2. 16 Rounds of Feistel Structure

Each round includes:

Splitting the data into two halves (Left and Right).

2
 The right half goes through:

Expansion (32 → 48 bits).

Key Mixing (XOR with 48-bit round key).

Substitution using 8 S-boxes (each compresses 6 bits to 4).

Permutation using a P-box.

Then the output is XORed with the left half and the halves are swapped.

3. Final Permutation (IP⁻¹)

Reverses the initial permutation to produce the final ciphertext.

Why is DES Insecure Today?

Short Key Length (56 bits):

Can be brute-forced easily with modern hardware.

In 1998, the EFF built a machine that cracked DES in less than a day.

Not Suitable for Modern Applications:

Processing power has increased dramatically.

Lacks resistance to more advanced attacks like differential and linear

cryptanalysis.

Improvements: Triple DES (3DES)

How it works:

Applies DES three times:

Ciphertext = E(K3, D(K2, E(K1, plaintext)))
(Encrypt with K1 → Decrypt with K2 → Encrypt with K3)

Key sizes: 112-bit or 168-bit.

Stronger than DES, but still slower and now considered deprecated.

3
Advanced Encryption Standard (AES)

Chosen to replace DES and 3DES.

Block size: 128 bits.

Key sizes: 128, 192, or 256 bits.

Uses Substitution-Permutation Network (not Feistel).

Much faster and more secure than DES/3DES.

Still widely used today in TLS, VPNs, file encryption, etc.

Summary Table
Feature DES 3DES AES

Key Size 56-bit 112/168-bit 128/192/256-bit

Block Size 64-bit 64-bit 128-bit

Speed Fast Slower Fast and efficient

Security Weak (brute-force) Stronger, but outdated Strong and modern

Status Obsolete Deprecated Current standard

3. Role of Key Size in Encryption Security

What is Key Size?

Key size (or key length) refers to the number of bits in a cryptographic key (e.g.,
128-bit, 2048-bit).

It determines the number of possible key combinations.

Impact on Brute-Force Attacks

Brute-force attack: Trying every possible key until the correct one is found.

4
 Larger key = exponentially more combinations = harder to crack.

Example:

A 56-bit DES key → 2⁵⁶ combinations (~72 quadrillion).

A 128-bit AES key → 2¹²⁸ combinations (virtually impossible to brute-force).

Trade-offs Between Security and Performance

Aspect Large Key Size Small Key Size

Security Stronger resistance to attacks Easier to break

Performance Slower encryption/decryption Faster operations

Storage/Transmission Larger overhead Smaller data sizes

In practice:

AES-128 is fast and secure for most purposes.

AES-256 is used when maximum security is needed (e.g., military, classified

data).

4. RSA Key Generation and Importance of Large Primes

RSA Key Generation Process

Select two large prime numbers, p and q.

Compute n = p × q; this n is part of the public key.

Compute Euler's totient, φ(n) = (p−1)(q−1).

Choose an integer e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1.

Compute the private key d such that d ≡ e⁻ ¹ mod φ(n) (modular inverse).

Public key = (e, n)

Private key = (d, n)

Why Use Large Primes?

5
 The security of RSA depends on the difficulty of factoring n.

If p and q are too small, n can be factored easily using modern algorithms and
computing power.

RSA keys today are typically 2048 or 3072 bits, meaning p and q are hundreds of
digits long.

Risks of Small or Poorly Selected Primes

Easier to Factor: Small primes reduce the complexity of factoring n.

Common Primes: Reusing or poorly choosing primes increases vulnerability

(e.g., shared factors in large datasets).

Predictable Keys: Poor randomness = predictable keys = easy attack.

Historical case: In 2012, researchers found shared factors in many public RSA keys due
to weak random number generation — making them crackable.

5. Avalanche Effect in Encryption Algorithms

What is the Avalanche Effect?

The avalanche effect means that a small change in the input (like flipping 1 bit)
should result in a significant and unpredictable change in the output
(ciphertext).

Ideally, changing 1 bit of the input should change about 50% of the output bits.

Purpose and Importance

Prevents attackers from detecting patterns or relationships between input and

output.

Even similar plaintexts produce completely different ciphertexts, improving

confusion and diffusion (core principles in cryptography).

Example in DES

If you encrypt the same message twice, but change one bit, the resulting
ciphertexts look completely different.

Why It’s Desirable

6
 Makes differential cryptanalysis (a technique to find key patterns by comparing
inputs/outputs) very difficult.

Ensures high unpredictability, even with minor changes in plaintext or key.

Helps in achieving strong security guarantees.

6. Passive vs Active Attacks in Computer Security

Passive Attacks

Definition: Eavesdropping or monitoring data without altering it.

Goal: Gain unauthorized access to information.

Example:

Packet sniffing: Monitoring network traffic to capture sensitive data like

passwords.

Traffic analysis: Observing communication patterns (e.g., who is talking

to whom and how often).

Impacts:

Compromises confidentiality.

Often difficult to detect since no data is modified.

Active Attacks

Definition: Involves modifying, disrupting, or injecting data into a system.

Goal: Alter data, cause disruption, or impersonate users.

Examples:

Man-in-the-Middle (MITM): Intercepts and modifies communication

between two parties.

Data modification: Tampering with files or database records.

Denial-of-Service (DoS): Floods a server to make it unavailable.

7
Impacts:

Breaches integrity, availability, and possibly confidentiality.

Usually detectable, but can cause severe damage.

Summary Table
Type of
Nature Examples Affected Security Principles
Attack

Packet sniffing,
Passive Eavesdropping Confidentiality
traffic analysis

Data MITM, DoS, data Integrity,Availability,

Active
manipulation tampering sometimes Confidentiality

7. Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks

What is a DoS Attack?

A Denial-of-Service (DoS) attack is a cyberattack where an attacker overwhelms

a server, network, or website with excessive requests or malicious data to make
it unavailable to legitimate users.

Example: Sending millions of requests to a website so it crashes and stops serving real
users.

What is a DDoS Attack?

Distributed Denial-of-Service (DDoS) is a more powerful form of DoS.

Uses multiple compromised systems (a botnet) to launch a coordinated attack

from many sources at once.

Example: Attackers control thousands of infected computers around the world to flood a
target server with requests.

8
Differences Between DoS and DDoS
Aspect DoS DDoS

Source Single machine Multiple machines (botnet)

Power Limited Very powerful and hard to stop

Detection Easier Harder (traffic comes from many IPs)

Mitigation Simple rate limiting may help Needs advanced strategies

Mitigation Mechanisms

Firewalls & Routers:

Block suspicious IPs or rate-limit traffic.

Intrusion Detection Systems (IDS):

Identify attack patterns early and raise alerts.

Traffic Filtering:

Use services like Cloudflare or AWS Shield to filter out attack traffic.

Load Balancing:

Distribute traffic across multiple servers to reduce load.

Rate Limiting & Throttling:

Limit the number of requests per IP address.

Blackholing or Sinkholing:

Redirect bad traffic to a non-existent server or analysis point.

8. Phishing and Human Vulnerabilities

What is Phishing?

A social engineering attack where attackers impersonate trusted entities to trick

users into revealing sensitive information, such as passwords, credit card
numbers, or login credentials.

9
Common Forms:

Fake emails from banks, employers, or tech support.

Links to counterfeit websites that look real.

Attachments containing malware.

How It Exploits Human Vulnerabilities

Trust: People believe the message comes from someone they know or trust.

Urgency: “Your account will be locked! Click now!”

Curiosity or fear: “You’ve received a large payment” or “Security alert!”

Multi-Layered Defense Strategy

Layer Description

Train employees to recognize phishing emails and avoid

User Education
clicking suspicious links.

Use advanced spam and phishing filters to block malicious

Email Filtering
messages.

Multi-Factor Adds a second layer of protection even if credentials are

Authentication (MFA) stolen.

Anti-Malware Tools Detect and block malicious attachments and links.

Security Awareness
Regular testing using simulated phishing emails.
Campaigns

DNS Filtering Prevent access to known phishing websites.

Incident Response Plan Procedures to follow when a phishing attack is detected.

9. Spoofing in Secure Communication

What is Spoofing?

Spoofing is an attack where a malicious actor impersonates a trusted source to deceive

systems or users. It involves forging the identity of something—like an IP address,
email, or website—to trick targets into trusting the fake source.

10
Types of Spoofing
Type Description

forged source IP address to disguise

Attacker sends packets with a
IP
their identity or bypass security filters. Often used in
Spoofing
DoS/DDoS attacks.

Email appears to come from a trusted sender.

Attacker sends an email that
Spoofing Used in phishing or scam emails.

DNS cache poisoning. Attacker redirects a user from

Also called
DNS
a legitimate website to a malicious site by corrupting DNS
Spoofing
records.

ARP associates their MAC address with the

In a local network, attacker
Spoofing IP address of another device to intercept or manipulate data.

Impact on Secure Communication

Loss of trust: Users may unknowingly interact with attackers.

Data theft: Login credentials, personal information, and financial data can be
stolen.

Session hijacking: Attackers can take over active sessions.

Malware installation: Victims may download malware from fake websites or

attachments.

11
Cryptographic Techniques to Detect and Prevent Spoofing
Technique How It Helps Prevent Spoofing

digitally signed to prove

Emails and messages can be
Digital Signatures authenticity and detect tampering (used in S/MIME, PGP
for email security).

trust framework using digital certificates

Provides a
Public Key
issued by Certificate Authorities (CAs). Used in HTTPS
Infrastructure (PKI)
(TLS/SSL) to verify website authenticity.

Secures communication channels and ensures the server is the

TLS/SSL Encryption
legitimate host. Prevents DNS spoofing or MITM attacks.

DNSSEC (DNS Security Adds digital signatures to DNS records to ensure data
Extensions) integrity and authenticity of DNS responses.

SPF, DKIM, and DMARC

Email authentication protocols:
(for Email)

SPF (Sender Policy Framework): Verifies the sender's IP.

DKIM (DomainKeys Identified Mail): Verifies that the email is not altered and
was sent by the domain.

DMARC: Enforces policies based on SPF/DKIM results and helps prevent

spoofed emails.
IPsec (Internet Protocol Security) Authenticates and encrypts IP packets,
protecting against IP spoofing and tampering in network traffic.

Question 10

Encryption of "DATA":

The given substitution cipher maps each letter to another in a sequential manner. The
mapping is as follows: A→Q, B→W, C→E, D→R, E→T, ..., Z→M.

To encrypt "DATA":

12
D→R

A→Q

T → G (since T is the 20th letter: A=1, B=2, ..., T=20. The mapping follows the sequence Q, W,
E, R, T, Y, U, I, O, P, A, S, D, F, G, H, J, K, L, Z, X, C, V, B, N, M. The 20th mapping is G.)

A→Q

Thus, the ciphertext is R Q G Q or RQGQ.

Decryption of RQGQ:

Reverse the mapping:

R→D

Q→A

G→T

Q→A

Thus, the decrypted plaintext is D A T A or DATA.

Question 11

Plaintext: 11010011

Key: 10101010

XOR encryption:

11010011 XOR 10101010 = 01111001 (first ciphertext)

Flipping one bit in the plaintext (e.g., change the 3rd bit from the left):

New plaintext: 11110011

XOR encryption:

11110011 XOR 10101010 = 01011001 (second ciphertext)

Comparison of the two ciphertexts:

First ciphertext: 01111001

Second ciphertext: 01011001

The two ciphertexts differ in the second bit from the left.

13
Demonstration of the avalanche effect:

Flipping a single bit in the plaintext resulted in a change in one bit of the ciphertext. While
this is a minimal change, XOR operations can propagate changes depending on the key. In
more complex ciphers (e.g., block ciphers), a single bit change in plaintext or key can
drastically alter the ciphertext, demonstrating the avalanche effect.

Question 12

Ciphertext letter positions (A=0, B=1, ..., Z=25).

Word: "SECURE"

Key: 5

Using a Caesar cipher with a shift of 5:

S (18) → 18 + 5 = 23 → X

E (4) → 4 + 5 = 9 → J

C (2) → 2 + 5 = 7 → H

U (20) → 20 + 5 = 25 → Z

R (17) → 17 + 5 = 22 → W

E (4) → 4 + 5 = 9 → J

Thus, the ciphertext is X J H Z W J or XJHZWJ.

14