CRYPTOGRAPHY 2022 ANSWER

1) Differentiate block cipher and stream cipher.

2) Differentiate substitution and transposition cipher.

3) What is prime and relative prime number in cryptography?

Prime Numbers

 Definition: A whole number greater than 1 with only two divisors: 1 and itself (e.g., 2, 3, 5, 7,
11).
  Cryptographic Role: Used to generate large numbers that are computationally hard to factor,
forming the foundation of public-key cryptography (like RSA) where multiplying two large
primes is easy, but finding the original primes from the product is extremely difficult.

Relatively Prime Numbers (Coprime)

 Definition: Two integers are relatively prime if their only common factor is 1 (e.g., 14 and 15
are coprime; 2 and 4 are not).

 Cryptographic Role: Essential for modular arithmetic, ensuring unique mappings and
operations in encryption/decryption. For instance, in RSA, a number 'e' (the public exponent)
must be relatively prime to

4) Differentiate MAC and Hash.

5) What do you mean by product cipher?

A product cipher is a strong encryption method that combines multiple simple ciphers (like
substitutions and transpositions) in layers (rounds) to create a highly secure code

How it works

 Composition: It takes two or more basic transformations (e.g., changing letters, rearranging
positions) and applies them one after another, often using different keys or settings in each
round.

 Rounds: The process repeats in multiple "rounds," with each round's output becoming the
next round's input, increasing complexity.

 Confusion (S-boxes): Substitutions (S-boxes) obscure the relationship between the key and
the ciphertext, so changing one key bit alters many ciphertext bits.

 Diffusion (P-boxes): Permutations (P-boxes) spread the influence of one plaintext bit across
many ciphertext bits, so changing one plaintext bit alters many ciphertext bits.

6) Describe birthday attack.

A birthday attack is a type of brute-force attack that exploits the mathematics behind the birthday
problem in probability theory to find collisions in hash functions. The goal is to find two different inputs
that produce the same hash value (a collision) faster than a simple brute-force approach. For an n-bit
hash function, a collision can be found in about .

 The Birthday Problem: In a room of just 23 people, there's a >50% chance two share a
birthday, even with 365 days.

 Cryptographic Application: An attacker applies this logic to hash functions (like MD5, SHA-
1). Instead of finding two people with the same specific birthday (e.g., Jan 1st), they find any
two people with any shared birthday (a collision).

7) What do you mean by Email security?

Email security refers to the practices, policies, and technical controls used to protect email
accounts, content, and communications from unauthorized access, loss, or compromise. It
safeguards against threats such as phishing attacks, malware, spam, and business email
compromise, often employing methods like encryption, spam filters, and multi-factor authentication.

8) What is Brute-Force attack? Explain with an example.

A brute-force attack is a trial-and-error method used by applications or automated scripts to guess
login credentials, encryption keys, or find a hidden webpage. The attacker systematically tries every
possible combination of characters, numbers, and symbols until they find the correct one.

 Example: An attacker tries to log into a user's email account. Instead of trying to guess the
password manually, they use an automated tool that might try a common password like
"password123", followed by other combinations like "123456", "qwerty", or words from a
dictionary combined with numbers, until the correct password is found and access is granted.

9) Distinguish between data-origin authentication and entity authentication. Explain with the
help of example.

Data-origin authentication, also known as message authentication, ensures that a given entity was
the original source of the received data and that the data has not been altered.

Entity authentication, also known as user authentication or peer entity authentication, provides
assurance that a given entity is involved and currently active in a communication session.
  Example: When a bank processes an online transaction:

o Entity authentication happens when you log in with your username and password (or
a fingerprint/face scan) to prove you are the account holder who is currently online and
making the request.

o Data-origin authentication occurs behind the scenes using algorithms like MACs or
digital signatures to verify that the transaction details (e.g., amount, recipient account
number) have not been changed in transit and truly originated from the bank's system
(and your session).

10) What is DDoS? Explain with the help of example.

A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of
a targeted website, server, or online service by overwhelming it with a flood of internet traffic from
multiple compromised computer systems (a botnet). This consumes the application's resources,
resulting in poor performance or complete downtime for legitimate users.

 Example: In 2016, a massive DDoS attack targeted Dyn, a major DNS provider. The attackers
used a vast network of compromised IoT devices (like security cameras and DVRs) to flood
Dyn's servers with traffic, which resulted in major websites and online services such as Netflix,
Amazon, and GitHub becoming inaccessible to users across large parts of the internet.

11) What services are provided by IPSec?

IPSec (Internet Protocol Security) is a suite of protocols that provides security services at the Internet
Protocol (IP) layer of network communication. It offers robust protection for data transmitted across
networks. The key services provided are:

 Confidentiality (Encryption): IPSec's Encapsulating Security Payload (ESP) protocol

encrypts the payload of IP packets (and potentially the entire packet in tunnel mode), ensuring
that data remains private and cannot be read by unauthorized parties if intercepted.

 Data Integrity: Both the Authentication Header (AH) and ESP protocols provide data integrity
by using hash functions to ensure that the data has not been altered or tampered with during
transmission.

 Authentication: IPSec verifies the identity of the communicating entities (hosts or networks),
guaranteeing that the data originates from a legitimate source and not an attacker.

 Access Control: By enforcing security policies that define which traffic is allowed to use
IPSec protection, it effectively provides a layer of access control.

 Replay Protection: Mechanisms are included to prevent an attacker from capturing encrypted
packets and re-transmitting them later to cause harm or gain unauthorized access.

 Key Management: IPSec includes the Internet Key Exchange (IKE) protocol, which securely
manages the generation, exchange, and negotiation of cryptographic keys required for the
other security services.

12) What is a firewall? Discuss its different types and possible configuration.

A firewall is a network security system that monitors and controls incoming and outgoing network
traffic based on predefined security rules. Its primary purpose is to establish a barrier between a
trusted internal network and untrusted external networks (like the internet), preventing unauthorized
access and threats.

Different Types of Firewalls

Firewalls have evolved through several generations and can be categorized by their mechanism and
location:

 Packet-Filtering Firewalls (Stateless): The first generation of firewalls. They operate at the
network layer (Layer 3 of the OSI model) and inspect individual data packets based on
information in the packet header, such as source/destination IP addresses and port numbers.
They are fast but lack context about the connection state.

 Stateful Inspection Firewalls: The second generation. These firewalls track the operating
state and context of active connections. They make decisions based on the flow of traffic, not
just individual packets, offering better security than simple packet filters but impacting network
performance slightly more.

 Proxy Firewalls (Application-Level Gateways): Operating at the application layer (Layer 7),
these firewalls act as intermediaries, terminating the client connection and establishing a new
connection to the destination server. This creates a highly secure barrier as the internal
network details are hidden, but they can introduce latency.

 Next-Generation Firewalls (NGFWs): Modern firewalls that combine traditional firewall

capabilities with advanced features like deep packet inspection (DPI), intrusion prevention
systems (IPS), and application-layer filtering. They provide comprehensive threat detection.

 Software Firewalls: Installed on individual computers or servers (host-based) to protect that

specific device. Examples include the built-in firewalls in Windows or macOS.

 Hardware Firewalls: Physical appliances placed at the network perimeter (e.g., between an
office network and the internet) to protect the entire private network.

Possible Configurations

Firewall configurations rely on a set of precise rules (often called Access Control Lists or ACLs) that
define the conditions under which traffic is permitted or blocked. Key configuration aspects include:

 Rule Prioritization: Rules are processed sequentially from top to bottom. Once a packet
matches a rule, the corresponding action (allow, deny, or reject) is taken immediately.

 Principle of Least Privilege: A fundamental security best practice is to configure firewalls

to deny all traffic by default and only explicitly allow necessary services or traffic.

 Network Segmentation: Firewalls can be used to divide a large network into smaller, isolated
segments (e.g., separating a guest Wi-Fi network from the sensitive internal corporate
network), applying different rules to each segment.

 NAT (Network Address Translation): Firewalls often use NAT to hide internal private IP
addresses behind a single public IP address, which helps conserve addresses and provides a
layer of defense by obscuring the internal network architecture.

 VPN Integration: Firewalls are crucial components for managing and securing Virtual Private
Networks (VPNs), handling the encryption and authentication of secure tunnels between
networks or remote users.
13) Define the RSA digital signature scheme and compare it to the RSA cryptosystem.

The RSA Digital Signature Scheme is a method used to provide message authenticity, integrity,
and non-repudiation. Unlike the standard RSA cryptosystem used for confidentiality (encryption),
where the sender uses the receiver's public key to encrypt a message, the signature scheme works
in reverse.

The process typically involves:

1. Hashing: The sender creates a hash (message digest) of the original message using a
cryptographic hash function.

2. Signing: The sender encrypts this hash value using their own private key. This encrypted
hash is the digital signature.

3. Verification: The receiver uses the sender's public key to decrypt the signature, revealing the
original hash value. The receiver also computes a hash of the received message themselves
and compares the two hashes.

Comparison with the RSA Cryptosystem:

Feature RSA Cryptosystem (Encryption) RSA Digital Signature Scheme

Authentication, Integrity, Non-repudiation

Confidentiality (ensuring only the recipient
Primary Goal (proving who sent it and that it wasn't
can read the message)
changed)

Keys Used
Recipient's public key to encrypt Sender's own private key to sign the hash
(Sender)

Keys Used
Recipient's private key to decrypt Sender's public key to verify the signature
(Receiver)

Uses public key for the encryption function

C=Me(modn)cap C equals cap M to the e-

th power space open paren mod n close
Operation Uses private key for the "signing" function
paren

𝐶=𝑀𝑒(mod𝑛