RADIUS performs three basic functions:
authentication, authorization, and accounting.
Authentication: RADIUS authenticates devices or
Primary users prior to allowing them to access a network.
Functions of Authorization: RADIUS authorizes devices or
users, allowing them to use specific services on
RADIUS the network.
Protocol
Accounting: RADIUS accounts for the number of
resources used—such as packets, bytes, and the
time expended—during the session.
TACACS+
TACACS+
Terminal Access Controller Access-Control
System Plus — a network security protocol
TACACS+ used for authentication, authorization, and
accounting (AAA) of users who access network
devices such as routers, switches, or firewalls.
TACACS+ helps ensure that only authorized users
TACACS+ can access and perform specific actions on
network equipment.
How It Works
A network device (like a router) sends user login
requests to a TACACS+ server.
TACACS+ The server checks credentials and permissions.
If approved, the server allows access and logs all
activities.
RADIUS VS
TACACS+
Kerberos
Kerberos
Kerberos
Kerberos
Kerberos
Kerberos
Kerberos
Kerberos
PGP
PGP
PGP
PGP (Pretty Good Privacy) is a data
PGP DETAILS encryption and digital signature protocol
used to secure emails, files, and communications.
It provides:
Confidentiality – only the intended person can
read the message.
Integrity – the message cannot be altered
PGP DETAILS without detection.
Authentication – verifies the sender's identity.
Non-repudiation – the sender cannot deny
sending the message.
PGP uses a combination of asymmetric
encryption and symmetric encryption:
1. Key Pair (Public & Private Keys)
PGP DETAILS You have:
Public Key → You share it with everyone.
Private Key → You keep it secret.
When person A wants to send person B an
encrypted message:
A writes the message.
PGP generates a random session key
Encryption (symmetric key) to encrypt the message.
Then PGP encrypts that session key using B’s
Process Public Key.
A sends the encrypted session key + encrypted
message to B.
When B receives the message:
B uses their Private Key to decrypt the session
Decryption key.
B uses the session key to decrypt the original
Process message.
PGP also signs messages to prove authenticity.
Sender creates a hash of the message (like a
fingerprint).
The sender encrypts the hash using their Private
PGP Digital Key.
Receiver decrypts the hash using the Sender’s
Signature Public Key.
If the hash matches, the message is authentic and
not modified.
S/MIME
S/MIME
S/MIME
S/MIME is built on Public Key Infrastructure
(PKI).
This means Digital Certificates and Certificate
Authorities (CAs) are used to verify identity.
Key Components:
How S/MIME Public Key → Shared publicly in the certificate.
Works Private Key → Stored securely on sender’s
device.
Certificate Authority (CA) → Trusted
organization that verifies and signs certificates.
When sending an encrypted email:
Sender gets the recipient’s public key (from the
certificate attached to their email).
S/MIME Sender uses the recipient’s public key to
Encryption encrypt the message.
Process Recipient uses their private key to decrypt the
email.
When signing an email:
Sender calculates a hash of the email content.
S/MIME Sender encrypts the hash with their Private
Key (signature).
Digital Receiver decrypts the hash using the
Signature Sender’s Public Key.
Process If the hash matches the message, the email is
verified.
S-HTTP is a protocol designed to provide secure
communication for individual HTTP
S-HTTP documents.
It was created as an early method to secure web
traffic before HTTPS became the global standard.
Purpose of S-HTTP
S-HTTP provides:
Confidentiality – encrypts the content being
transferred
Integrity – ensures data was not modified
S-HTTP Authentication – verifies the identity of the
sender/receiver
However, unlike HTTPS, S-HTTP only encrypts
the data being sent, not the entire
communication channel.
How S-HTTP Works
When a client requests a webpage:
The server sends its public key to the client.
The client uses the public key to encrypt the
message/content.
The server uses its private key to decrypt.
S-HTTP Optional: The client may also sign the data for
authentication.
Important Point:
Encryption in S-HTTP is per-message, not at the
session level.
S-HTTP
TLS is a cryptographic protocol used to secure
communication over networks, especially the
internet.
TLS TLS = Improved, secure replacement for SSL.
So when we say SSL/TLS, we really mean TLS
today.
The TLS handshake establishes secure session keys
before transferring data.
Simplified Steps:
Client Hello
The client says: “I want to communicate securely.”
TLS Sends supported encryption algorithms.
Handshake
Server Hello
Server selects encryption algorithm.
(Key Sends its Digital Certificate (contains the server's public
key).
Exchange Client verifies certificate using CA (Certificate Authority).
Key Exchange
Process) Client generates a shared secret and encrypts it with
server’s public key.
Both server and client derive the same session key.
Secure Communication Begins
All further messages are encrypted using the session
key (symmetric encryption).
Asymmetric (Public Key)
Used during handshake to exchange session key
TLS Uses RSA, ECDHE
Two Types of Symmetric Key
Cryptograph Used after handshake to encrypt data
y
AES, ChaCha20
TLS
SSL
SSL
SSL
End-to-End Security (E2E Security) refers to a
security model in which data is protected from
E2E
the moment it is created on the sender’s
device until it is received and decrypted on
Security the receiver’s device — with no intermediate
party (servers, networks, ISPs, cloud providers, or
attackers) able to read or modify it.
IPsec
An IP Network is a network of devices
(computers, phones, servers, routers, etc.) that
communicate with each other using IP
addresses.
IP (Internet Protocol) is the set of rules that
controls how data is sent, routed, and received
across networks like the internet.
IPsec