Pages
Showing posts with label Cryptography and System Security. Show all posts
Showing posts with label Cryptography and System Security. Show all posts

Confusion and Diffusion

 
    The terms confusion and diffusion were introduced by Claude Shannon to capture the two basic building blocks for any cryptographic system. Shannon's concern was to thwart cryptanalysis based on statistical analysis. Shannon suggests two methods for frustrating statistical cryptanalysis, diffusion, and confusion.
  1.  Diffusion
    2.     It means any of the characters in plaintext is changed then simultaneously several characters of the ciphertext should also be changed. Similarly, if the character of ciphertext is changed then simultaneously several characters of plaintext should be changed. It is a classical transposition cipher.
    An example of diffusion is to encrypt a message M = m1,m2,m3,... of characters with an average operation.
    y(n)=(∑i=1kmn+i)
    adding k successive letters to get ciphertext letters yn.
    "Diffusion" = Transposition or Permutation
    For eg, Hill cipher has the characteristic of diffusion.

  2. Confusion
    1. Confusion seeks to make the relationship between the statistics of the ciphertext and the value of the encryption key as complex as possible, again to thwart attempts to discover the key.
    2. Thus, even if the attacker can get some handle on the statistics of the ciphertext, the ways in which the key was used to produce that ciphertext is so complex as to make it difficult to deduce the key. This is achieved by use of a complex substitution algorithm. 
    3. For eg., suppose we have a Hill cipher with a matrix nxn and suppose we have a plaintext-ciphertext pair of length n2 with which we are able to solve for the encryption matrix. If we change one character of the ciphertext, one column of the matrix can change completely. Of course, it would be more desirable to have the entire key change. When a situation like that happened, the cryptanalyst would probably need to solve for the entire key simultaneously, rather than piece by piece.

Diffie-Hellman Key Exchange Algorithm

 

  • The Diffie-Hellman algorithm is widely known as key exchange algorithm or key agreement algorithm developed by Whitfield Diffie and Martin Hellman in 1976. Diffie-Hellman is used to generate same (symmetric) private cryptographic key at sender as well as a receiver and so that there is no need to transfer this key from sender to receiver.
  • Remember that Diffie-Hellman algorithm is used only for a key agreement, not for encryption or decryption of the message. If sender and receiver want to communicate with each other they first agree on the same key generated by a Diffie-Hellman algorithm, later on, they can use this key for encryption or decryption.
Steps for Diffie-Hellman Algorithm:
  1. If A wants to communicate with B, they first must agree on two large prime numbers p and q (q < p).
  2. A selects another secret large random integer number XA, and calculate YA such that 
    3. YA = qXAmod p
  3. A sends this YA to B.
  4. B independently selects another secret large random integer number XB, and calculate YB such that,
    5. YB = qXBmod p
  5. B sends this number YB to A.
  6. Now, A is calculating his secret key by using,
    7. AK = (YB)XAmod p
  7. Similarly, B calculates his secret key YK by using,
    8. BK = (YA)XBmod p
  8. If AK = BK, then A and B can agree for future communication called as key agreement algorithm.
Fig. Diffie-Hellman Key exchange algorithm

Define the goals of security and specify mechanisms to achieve each goal.

 
    Information security consists of methods used to protect data or information being transmitted for preserving the integrity, confidentiality, and availability of the information.

  1. Confidentiality
    2.     Confidentiality is the protection of transmitted data from passive attacks. The two important concepts are:
    1. Data Confidentiality: Assures that private or confidential information is not disclosed to the unauthorized user.
    2. Privacy: Assures that individual control information related to them.
  2. Integrity
    3.     Integrity assures that messages are received as sent with no duplication, insertion, modification, reordering or replays. The two important concepts are:
    1. Data Integrity: Assures information is changed only in an authorized manner.
    2. System integrity: Assures that the system performs intended function property and free from unauthorized manipulation.
  3. Availability
    4.     Assures that system works correctly and service is available to authorized users.
These three concepts are termed as CIA triad and embody fundamental security objectives for data and information services.

What are block ciphers? Explain with examples the ECB and CBC modes of block ciphers.

 
A block cipher encrypts a block of plaintext as a whole and produces a ciphertext block of equal length. A block cipher takes a fixed-length block of text of length b bits and a key as an input and produces a b-bit block of ciphertext. Typically, a block size of 64 or 128 bits is used. The five modes are meant to cover a wide variety of applications of encryption for which a block cipher could be used. They are as follows:
  1. Electronic Codebook (ECB)
  2. Cipher Block Chaining (CBC)
  3. Cipher Feedback (CFB)
  4. Output Feedback (OFB)
  5. Counter (CTR)
Fig. Block Cipher
1) Electronic Codebook (ECB)
    This is the simplest mode, in which plaintext is handled one block at a time and each block of plaintext is encrypted using the same key. The term codebook is used because, for a given key, there is a unique cipher text for every b-bit block of plaintext. Therefore, we can imagine a gigantic codebook in which there is an entry for every possible b-bit plaintext showing its corresponding ciphertext. For a message longer than b bits, the procedure is simply to break the message into b-bit blocks, padding the last block if require.
    Decryption is done one block at a time, always using the same key. In the figure shown below, the plaintext consists of a sequence of b-bit blocks (P1, P2, ..., Pn) the corresponding sequence of ciphertext blocks is C1, C2, ..., Cn.
ECB is define as,
Ci = E(K, Pi)    i = 1,..,N
Pi = D(K, Ci)    i = 1,..,N
Fig. Electronic Codebook (ECB)
The ECB method is ideal for a short amount of data such as an encryption key.  The most significant characteristic of ECB is that if the same b-bit block of plaintext appears more than once in the message, it always produces the same ciphertext.

2) Cipher Block Chaining Mode (CBC)
    Unlike ECB, CBC doesn't produce the same ciphertext of repeated plaintext. In this mode, the input to the encryption algorithm is XOR of the current plaintext and the preceding ciphertext block; the same key is used for each block. The input to the encryption function for each plaintext block bears no fixed relationship to the plaintext block. Therefore, repeating patterns of b bits are not exposed. As with the ECB mode, the CBC mode requires that the last block be padded to a full b bits if it is a partial block.
    For decryption, each cipher block is passed through the decryption algorithm. The result is XOR with the preceding ciphertext block to produce the plaintext block. To produce the the first block of ciphertext, an initialization vector (IV) is XOR with the first block of plaintext. On decryption the IV is XORed with the output of the decryption algorithm to recover the first block of plaintext. The IV is a data block that is of same size as that of cipher block.
CBC is define as,
C1 = E(K, [P1 ⊕ IV])
Ci = E(K, [Pi ⊕ Ci-1])    i = 2,..,N		 P1 = D(K, [C1 ⊕ IV])
Pi = D(K, Ci) ⊕ Ci-1    i = 2,..,N

Fig. Cipher Block Chaining (CBC)
The IV must be known to both the sender and receiver but be unpredictable by a third party. In particular, for any given plaintext it must not be possible to predict the IV that will be associated to the plaintext in advance of the generation of the IV. For maximum security, the IV should be protected against unauthorized changes this could be done by sending the IV using ECB encryption.
    Therefore, CBC can be used for encrypting messages of length greater than b bits and to achieve confidentiality the CBC mode can be used for authentication.

Types of Attacks Or Security Attacks

 


A useful means of classifying security attacks are classified into two types, passive attack and active attack. A passive attack attempts to learn or make use of information from the system but does not affect system resources, whereas active attack attempts to alter system resources or affect their operation.

Passive Attacks

    Passive attacks are in the nature of eavesdropping(spy) on, or monitoring of transmissions. The goal of the opponent is to obtain information that is being transmitted. Two types of passive attacks are the 'Release of Message Content' and 'Traffic Analysis'.
  1. Release of Message
              The 'release of message contents' is easily understood. A telephone conversation, an electronic mail message, and a transferred file may contain sensitive or confidential information. We would like to prevent an opponent from learning the contents of these transmissions.
   

      2. Traffic Analysis

             Here, suppose we had a way of making the contents of messages or other information traffic so that opponents, event if they captured the message, could not extract the information from the message. The common technique for masking contents is encryption. If we had encryption protection in place, an opponent could determine the location and identity of communicating hosts and could observe the frequency and length of messages being exchanged. This information might be useful in guessing the nature of the communication that was taking place.



Active Attacks

    Active attacks involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: Masquerade, Replay, Modification of Messages, and Denial of Service.
  1. Masquerade.
              A 'masquerade' takes place when one entity pretends to be a different entity. A masquerade attack usually includes one of the other forms of active attack. For example, authentication sequence has taken place, thus enabling few privilege to obtain extra privilege by pretending an entity that has those privileges.

       2. Replay.

              Replay involve the passive capture of a data unit and its subsequent retransmission to produce an authorized effect.


       3. Modification of messages.

              It simply means that some portion of a authorized message is altered, or that messages are delayed or reordered, to produce an unauthorized effect. For example, a ,message meaning "Allow Virat to read confidential file accounts" is changed to "Allow Dhoni to read confidential file accounts".


       4. Denial of Service.

              It prevents or inhibits the normal use or management of communication facilities. This attack may have a specific target; for example, an entity may suppress all messages directed to a particular destination. Another form of service denial is the disruption of an entire network, either by disabling the network or by overloading it with messages so as to degrade performance.



© Copyright 2015 TechBlogMU. Designed by Bloggertheme9 | Distributed By Gooyaabi Templates.Powered by Blogger.