Cryptography & Software Vulnerabilities – Expanded

Breakdown
(Aligned with Learning Outcomes 2, 3, and 5)

Detailed Topics
1. Basic Cryptography
- Symmetric Encryption:
- Algorithms: AES, DES, 3DES.
- Use cases: Bulk data encryption (e.g., disk encryption).
- Key management challenges (e.g., secure key distribution).
- Asymmetric Encryption:
- Algorithms: RSA, ECC (Elliptic Curve Cryptography).
- Use cases: Secure key exchange (Diffie-Hellman), digital
signatures.
- Public Key Infrastructure (PKI): Certificates, Certificate
Authorities (CAs).
- Hashing:
- Functions: SHA-256, MD5 (and its vulnerabilities).
- Applications: Password storage, data integrity verification.
- Key Concepts:
- Digital signatures (non-repudiation).
- Hybrid systems (e.g., HTTPS: symmetric + asymmetric
encryption).
Cryptography is the science and practice of securing information
by transforming it into a format that is unintelligible to
unauthorized parties. It ensures confidentiality, integrity,
authentication, and non-repudiation of data through mathematical
algorithms and protocols. Below is a structured breakdown of its
core concepts, aligned with your cybersecurity course content:

1. Core Objectives of Cryptography

1. Confidentiality:
- Ensure only authorized parties can read the data (e.g.,
encrypted messages).
2. Integrity:
- Detect unauthorized alterations (e.g., using hashes like SHA-
256).
3. Authentication:
- Verify the identity of users/systems (e.g., digital certificates).
4. Non-repudiation:
- Prevent denial of actions (e.g., digital signatures).

2. Types of Cryptography
A. Symmetric Encryption
- Definition: Uses a single shared key for encryption and
decryption.
- Algorithms:
- AES (Advanced Encryption Standard): Used for disk/file
encryption (e.g., BitLocker).
- DES/3DES: Older standards, largely replaced by AES.
- Use Case: Securing bulk data (e.g., databases, files).
- Challenge: Secure key distribution (solved by asymmetric
encryption).

B. Asymmetric Encryption
- Definition: Uses public/private key pairs.
- Algorithms:
- RSA: For secure key exchange and digital signatures.
- ECC (Elliptic Curve Cryptography): Efficient for mobile/IoT
devices.
- Use Cases:
- Key Exchange: Diffie-Hellman for secure TLS handshakes.
- Digital Signatures: Signing software updates (non-repudiation).
- Framework: PKI (Public Key Infrastructure) manages certificates
and trust.

C. Hashing
- Definition: Converts data into a fixed-size string (hash) using one-
way functions.
- Algorithms:
- SHA-256: Secure for password storage and file integrity.
- MD5: Deprecated due to collision vulnerabilities.
- Applications:
- Password storage (salted hashes).
- Blockchain transactions (ensuring data integrity).

3. Key Cryptographic Concepts

- Public Key Infrastructure (PKI):
- Trust framework involving Certificate Authorities (CAs) (e.g.,
Let’s Encrypt).
- Issues digital certificates to validate public keys.
- Digital Signatures:
 - Combine hashing + asymmetric encryption to prove authenticity
(e.g., signing emails).
- Hybrid Systems:
- Use both symmetric and asymmetric encryption (e.g., HTTPS:
RSA negotiates a session key, AES encrypts data).

4. Real-World Applications
1. Secure Communication:
- HTTPS/SSL/TLS: Encrypts web traffic using hybrid
cryptography.
- VPNs: Protect data in transit (e.g., IPsec, OpenVPN).
2. Data Protection:
- Disk Encryption (e.g., BitLocker, LUKS).
- Password Managers: Store credentials as encrypted blobs.
3. Blockchain:
- Uses hashing (SHA-256) and digital signatures for transaction
security.

5. Cryptographic Challenges & Evolution

- Quantum Computing:
- Threatens RSA/ECC (Shor’s algorithm); post-quantum
cryptography (e.g., lattice-based) is being developed.
- Zero-Day Exploits:
- Weaknesses in cryptographic implementations (e.g., Heartbleed
in OpenSSL).
- Ethical Dilemmas:
- Balancing privacy (end-to-end encryption) vs. law enforcement
access (e.g., Apple vs. FBI).
6. Why It Matters in Cybersecurity
Cryptography is the backbone of modern cybersecurity strategies.
For example:
- GDPR Compliance: Encryption protects sensitive user data.
- Incident Response: Hashing verifies forensic data integrity.
- National Security: Secures critical infrastructure (e.g., power
grids).

Example Workflow (HTTPS)

1. Client Hello: Browser requests a secure connection.
2. Server Certificate: Website sends its public key (signed by a CA).
3. Key Exchange: Client generates a session key (AES) encrypted
with the server’s public key.
4. Encrypted Session: Symmetric encryption secures all data
transfers.

Tools You’ve Used

- OpenSSL: For encrypting files and generating certificates.
- Wireshark: Analyze TLS handshakes in network traffic.

Alignment with Your Course

This connects to your CYB 201 modules on:
- Week 4: Cryptography & software vulnerabilities.
- Week 6: Network security (TLS/HTTPS).
- Week 11: Ethics of encryption.
1. Symmetric Encryption
Remember
- Definitions:
- Symmetric Encryption: Uses a single shared key for
encryption/decryption.
- Algorithms: AES (Advanced Encryption Standard), DES (Data
Encryption Standard), 3DES (Triple DES).
- Use Cases: Disk encryption (e.g., BitLocker), secure messaging.

Activity: Flashcard drill to memorize algorithm names and key sizes

(e.g., AES-256).

Understand
- How It Works:
- Plaintext + Secret Key → Ciphertext (via encryption).
- Ciphertext + Secret Key → Plaintext (via decryption).
- Key Management Challenges: Secure key distribution (e.g.,
avoiding man-in-the-middle attacks).

Activity: Diagram the encryption/decryption process using AES.

Apply
- Hands-On Lab:
- Use OpenSSL to encrypt a file:
```bash
openssl enc -aes-256-cbc -in [Link] -out [Link] -k
secret
```
- Decrypt the file:
```bash
openssl enc -d -aes-256-cbc -in [Link] -out [Link] -
k secret
 ```

Assessment: Submit encrypted/decrypted files with a reflection on

key security.

Analyze
- Comparison:
- AES vs. DES: AES uses longer keys (128/256-bit vs. 56-bit),
making it more secure.
- 3DES: Applies DES three times but is slower and deprecated.

Case Study: Analyze why DES was replaced by AES (e.g., brute-
force vulnerability).

Evaluate
- Scenario:
- A hospital needs to encrypt patient records. Choose between
AES-256 and 3DES.
- Decision: AES-256 for its speed and modern security.

Debate: "Is symmetric encryption sufficient for IoT devices

with limited resources?"

2. Asymmetric Encryption
Remember
- Algorithms: RSA (Rivest-Shamir-Adleman), ECC (Elliptic Curve
Cryptography).
- PKI Components: Certificates, Certificate Authorities (CAs),
Public/Private Keys.

Activity: Match terms to definitions (e.g., CA → Issues digital

certificates).

Understand
- Key Exchange:
- Diffie-Hellman allows two parties to generate a shared secret
over an insecure channel.
- Digital Signatures: Provide non-repudiation (e.g., signing a PDF
with a private key).

Visual Aid: Animated video explaining Diffie-Hellman key exchange.

Apply
- Generate Key Pair:
```bash
openssl genpkey -algorithm RSA -out [Link]
openssl pkey -in [Link] -pubout -out [Link]
```
- Sign a File:
```bash
openssl dgst -sha256 -sign [Link] -out [Link]
[Link]
```

Lab Submission: Public/private key pair and signed document.

Analyze
- RSA vs. ECC:
- RSA: Relies on factoring large primes; slower with larger keys.
- ECC: Uses elliptic curves; smaller keys for equivalent security
(e.g., 256-bit ECC ≈ 3072-bit RSA).

Case Study: Why WhatsApp uses ECC for end-to-end encryption.

Evaluate
- Trust Models:
- Centralized (e.g., CAs) vs. Decentralized (e.g., blockchain-based
PKI).
- Prompt: "Is the CA system trustworthy given incidents like
Symantec’s certificate misuse?"

Group Discussion: Pros/cons of Let’s Encrypt’s free certificates.

Create
- Project:
- Design a decentralized PKI for a small business using
blockchain.
- Tools: Hyperledger Fabric framework.

Deliverable: Architecture diagram and 1-page rationale.

3. Hashing
Remember
- Hash Functions: SHA-256 (Secure Hash Algorithm), MD5
(deprecated).
- Applications: Password storage, file integrity checks.

Quiz: Identify which hash is insecure (MD5) and why.

Understand
- Purpose:
- Ensure data integrity (e.g., verifying downloaded files).
- Store passwords securely (e.g., salted hashes).

Demo: Show how changing one character alters the SHA-256 hash
of a document.

Apply
- Hash a File:
```bash
openssl dgst -sha256 [Link]
```
- Password Storage:
- Generate a salted hash using Python’s `hashlib`.

Code Example:
```python
import hashlib, os
salt = [Link](32)
password = "Cyb3rS3cur1ty".encode()
hashed = hashlib.pbkdf2_hmac('sha256', password, salt, 100000)
```

Analyze
- Collision Resistance:
- MD5 collisions can be generated in seconds (e.g., Flame
malware exploit).
- SHA-256 is currently collision-resistant.

Activity: Use online tools to create two different files with the same
MD5 hash.

Evaluate
- Scenario:
- A developer uses MD5 for password hashing. Assess the risk.
- Verdict: High risk; recommend bcrypt or Argon2.

Debate: "Should deprecated algorithms like MD5 still be taught?"

Create
- Design a System:
- Create a file integrity checker using SHA-256 hashes.
- Tools: Python script to monitor system files.

Deliverable: Script + report on detecting unauthorized changes.

4. Key Concepts
Remember
- Terms:
- Digital Signatures: Prove authenticity and non-repudiation.
- Hybrid Systems: Combine symmetric/asymmetric encryption
(e.g., HTTPS).

Flashcards: Define terms like “non-repudiation” and “TLS

handshake.”

Understand
- HTTPS Workflow:
1. Asymmetric encryption negotiates a symmetric session key.
2. Symmetric encryption secures data transfer.

Diagram: TLS handshake steps with client-server interaction.

Apply
- Set Up HTTPS:
- Use Let’s Encrypt to obtain a free SSL/TLS certificate for a
website.
- Tools: Certbot.

Lab: Configure HTTPS on an Apache server.

Analyze
- Performance Trade-offs:
- Symmetric encryption is faster but requires secure key
exchange.
 - Asymmetric encryption is slower but enables secure key
distribution.

Case Study: Compare Zoom’s end-to-end encryption (hybrid model)

vs. Signal’s.

Evaluate
- Ethical Dilemma:
- Should governments have backdoors to encryption for national
security?
- Arguments: Privacy vs. law enforcement needs.

Role-Play: Debate between privacy advocates and FBI

representatives.

Create
- Final Project:
- Design a secure chat app using hybrid encryption.
- Tools: Python (cryptography library), RSA for key exchange, AES
for messaging.

Deliverable: Working prototype + security architecture report.

Conclusion:
This structure ensures students progress from foundational
knowledge (Remember) to critical thinking and innovation (Create),
preparing them for real-world cybersecurity challenges. Activities
blend theory with hands-on practice, fostering deep engagement
and mastery.
Deep Dive: Cryptographic Algorithms
Cryptography relies on mathematical algorithms to secure data.
Below is a detailed breakdown of the key algorithms used in
symmetric encryption, asymmetric encryption, and hashing,
including their mechanisms, strengths, weaknesses, and
applications.

1. Symmetric Encryption Algorithms

Use a single shared key for encryption and decryption.

A. AES (Advanced Encryption Standard)

- Key Sizes: 128, 192, or 256 bits.
- Mechanism:
- Block Cipher: Processes data in 128-bit blocks.
- Rounds: 10 (128-bit key), 12 (192-bit), or 14 (256-bit).
- Steps:
1. SubBytes: Non-linear byte substitution using S-boxes.
2. ShiftRows: Shifts rows of the state array.
3. MixColumns: Mixes columns using matrix multiplication.
4. AddRoundKey: XORs the state with a round key.
- Security:
- Resists brute-force attacks (e.g., 2^256 possible keys for AES-
256).
- No practical cryptanalytic attacks exist.
- Use Cases:
- Disk encryption (BitLocker), TLS, VPNs.

B. DES (Data Encryption Standard)

- Key Size: 56 bits (obsolete).
- Mechanism:
- Block Cipher: 64-bit blocks.
 - Feistel Network: 16 rounds of substitution-permutation.
- Weaknesses:
- Vulnerable to brute force (broken in 1998 by EFF’s Deep Crack).
- Short key length (2^56 possible keys).
- Replacement: AES (since 2001).

C. 3DES (Triple DES)

- Key Size: 168 bits (three 56-bit keys).
- Mechanism: Applies DES three times: Encrypt → Decrypt →
Encrypt.
- Security:
- Safer than DES but slow.
- Retired by NIST in 2023 due to efficiency and modern threats.
- Legacy Use: Payment systems (EMV chips).

2. Asymmetric Encryption Algorithms

Use public/private key pairs for secure communication.

A. RSA (Rivest-Shamir-Adleman)
- Key Sizes: 2048–4096 bits (modern standards).
- Mechanism:
- Key Generation:
1. Choose large primes p and q.
2. Compute n = p × q and φ(n) = (p-1)(q-1).
3. Select e (public exponent) and d (private exponent) such that
e × d ≡ 1 mod φ(n).
- Encryption: c ≡ m^e mod n.
- Decryption: m ≡ c^d mod n.
- Security:
- Relies on the difficulty of factoring large primes.
- Vulnerable to Shor’s algorithm (quantum computing threat).
- Use Cases:
- SSL/TLS handshakes, digital signatures.

B. ECC (Elliptic Curve Cryptography)

- Key Sizes: 256 bits (equivalent to RSA 3072 bits).
- Mechanism:
- Elliptic Curve Equation: y² = x³ + ax + b.
- Key Exchange (ECDH):
- Alice and Bob agree on a curve and base point G.
- Alice computes A = aG, Bob computes B = bG.
- Shared secret: aB = bA = abG.
- Advantages:
- Smaller keys, faster computations (ideal for IoT/mobile).
- Use Cases:
- Bitcoin (secp256k1 curve), TLS 1.3.

C. Diffie-Hellman (DH)
- Purpose: Secure key exchange over public channels.
- Mechanism:
- Finite Field DH:
- Public parameters: Prime p and generator g.
- Alice sends g^a mod p, Bob sends g^b mod p.
- Shared secret: g^(ab) mod p.
- Elliptic Curve DH (ECDH): Uses ECC for better efficiency.
- Security:
- Relies on the discrete logarithm problem.
- Vulnerable to man-in-the-middle attacks without authentication.

3. Hashing Algorithms
Convert data into fixed-size hashes (one-way functions).
A. SHA-256 (Secure Hash Algorithm 256-bit)
- Output: 256-bit hash.
- Mechanism:
- Merkle-Damgård Construction: Processes input in 512-bit blocks.
- Steps:
1. Padding: Add bits to reach 512-bit multiple.
2. Compression: Applies 64 rounds of bitwise operations.
- Security:
- Collision-resistant (no two inputs produce the same hash).
- Used in Bitcoin mining and TLS certificates.

B. MD5 (Message Digest Algorithm 5)

- Output: 128-bit hash (deprecated).
- Weaknesses:
- Collision Attacks: Easily generate two inputs with the same hash
(e.g., Flame malware).
- Legacy Use: Non-security checks (file integrity without threats).

5. Trends & Future Directions

- Post-Quantum Cryptography:
- Lattice-Based: NIST’s CRYSTALS-Kyber (key exchange).
- Hash-Based: SPHINCS+ (digital signatures).
- Homomorphic Encryption: Compute on encrypted data (e.g.,
medical research).
- Zero-Knowledge Proofs: Prove knowledge without revealing data
(e.g., Zcash).
Key Takeaways
- Symmetric: Fast for bulk data (AES dominates).
- Asymmetric: Enables secure key exchange (RSA/ECC).
- Hashing: Ensures integrity (SHA-256 is gold standard).

This aligns with your CYB 201 coursework on encryption (Week 4),
network security (Week 6), and policy (Week 7). For hands-on
practice, revisit OpenSSL labs or explore Python’s `cryptography`
library! 🔐
2. Software Vulnerabilities
- OWASP Top 10 (2023):
- Injection attacks (SQLi, command injection).
- Broken Authentication, Sensitive Data Exposure.
- Cross-Site Scripting (XSS), Insecure Deserialization.
- Secure Coding Principles:
- Input validation, output encoding.
- Principle of least privilege, parameterized queries.
- Avoiding hardcoded secrets, dependency management.
- Root Causes of Vulnerabilities:
- Poor coding practices, lack of security testing.
- Legacy systems, third-party dependencies.

Activities – Expanded
Lab: Encrypt/Decrypt Files Using OpenSSL
Objective: Apply cryptographic concepts to secure data.
Steps:
1. Symmetric Encryption:
- Generate a key: `openssl rand -base64 32 > [Link]`
- Encrypt a file: `openssl enc -aes-256-cbc -salt -in [Link] -
out [Link] -pass file:[Link]`
- Decrypt: `openssl enc -d -aes-256-cbc -in [Link] -out
[Link] -pass file:[Link]`
2. Asymmetric Encryption:
- Generate a key pair: `openssl genpkey -algorithm RSA -out
[Link]`
- Extract public key: `openssl pkey -in [Link] -pubout -out
[Link]`
- Encrypt with public key: `openssl pkeyutl -encrypt -in
[Link] -pubin -inkey [Link] -out [Link]`
3. Hashing:
 - Generate a SHA-256 hash: `openssl dgst -sha256 [Link]`
- Compare hashes to verify integrity.

Discussion Questions:
- Why is symmetric encryption faster than asymmetric?
- What risks arise from improper key storage?

Case Study: Heartbleed Vulnerability & Patch Management

Objective: Analyze a real-world vulnerability and the lifecycle of its
mitigation.
Background:
- Heartbleed (CVE-2014-0160):
- A buffer over-read flaw in OpenSSL’s TLS heartbeat extension.
- Exploit: Attackers could extract up to 64KB of server memory
per request, exposing private keys, session cookies, etc.
- Impact: 17% of internet servers were vulnerable at the time.

Activity Flow:
1. Technical Analysis:
- Diagram how the Heartbeat Request/Response mechanism
works.
- Simulate a Heartbleed exploit using a vulnerable VM (e.g.,
Metasploit module).
2. Patch Management:
- Review the OpenSSL patch: [GitHub
commit]([Link]
- Discuss challenges in patching critical infrastructure (e.g.,
coordination across global systems).
3. Ethical Debates:
- Role-play: Students act as a company’s CISO, developer, and PR
team responding to Heartbleed.
- Should organizations disclose vulnerabilities immediately or
delay to develop patches?
Key Takeaways:
- Importance of open-source software maintenance.
- The role of timely updates and vulnerability disclosure policies.

Alignment with Learning Outcomes

1. Outcome 3: Students apply encryption techniques (OpenSSL lab)
and vulnerability mitigation (Heartbleed analysis).
2. Outcome 2: Heartbleed case study describes a common cyber-
attack and its solutions.
3. Outcome 5: Explores attacker methods (Heartbleed exploit) and
countermeasures (patching).

Additional Resources
- Tools:
- GnuPG (for PGP encryption), Burp Suite (for testing web
vulnerabilities).
- Readings:
- OWASP Secure Coding Practices Quick Reference Guide.
- [Cloudflare’s Heartbleed
Post-Mortem]([Link]
mortem/).

Assessment
- Quiz: Define AES vs. RSA, explain how hashing ensures integrity.
- Lab Report: Submit encrypted/decrypted files and a reflection on
key management risks.
- Case Study Analysis: Write a 500-word summary of Heartbleed’s
impact and mitigation steps.

Why This Works:

- Combines hands-on cryptography practice with real-world
vulnerability analysis.
- Bridges technical skills (OpenSSL) with strategic thinking (patch
management ethics).
- Prepares students to address both how to secure systems and why
certain vulnerabilities persist.