::Life of Security::

Thursday, October 22, 2009

LEC 10:: Legal and Ethical Issues in Computer Security

Introduction
Legal and Ethical
Categories of law
Differences between legal and Ethic
Ethics concept in Information Security
Protecting programs and Data
Information and Law

Objectives of Understanding Legal Section
Therefore, there are three motivations for studying the legal section
to know what protection the law provides for computers and data;

to appreciate laws that protect the rights of others with respect to computers, programs, and data; and

to understand existing laws as a basis for recommending new laws to protect computers, data, and people.
::->There are three common used ways to provide protections by laws:
@Copyright
Copyright gives the author/programmer exclusive right to make copies of the expression and sell them to the public. That is, only the author can sell copies of the author’s book (except, of course, for booksellers or others working as the agents of the author).
Copyrights for Computer Works
The algorithm is the idea, and the statements of the programming language are the expression of the idea.

Therefore, protection is allowed for the program statements themselves, but not for the design: copying the code intact is prohibited, but reimplementing the algorithm is permitted.

Examples of Copyrights
A second problem with the copyright protection for computer works is the requirement that the work be published.

A program may be published by distributing copies of its object code, for example on a disk. However, if the source code is not distributed, it has not been published.

An alleged infringer cannot have violated a copyright on source code if the source code was never published.

A copyright controls the right to copy and distribute; it is not clear that allowing distributed access is a form of distribution in distributed system.

@Patent
Patents are unlike copyrights in that they protect inventions, not works of the mind.
The distinction between patents and copyrights is that patents were intended to apply to the results of science, technology, and engineering, whereas copyrights were meant to cover works in the arts, literature, and written scholarship.
The patents law excludes newly discovered laws of nature … [and] mental processes.
Computer Objects
The patent has not encouraged patents of computer software.
For a long time, computer programs were seen as the representation of an algorithm was a fact of nature, which is not subject to patent.
There was a case on a request to patent a process for converting decimal numbers into binary. The Supreme Court rejected the claim, saying it seemed to attempt to patent an abstract idea, in short, an algorithm. But the underlying algorithm is precisely what most software developers would like to protect.

@Trade Secret
A trade secret is information that gives one company a competitive edge over others. For example, the formula for a soft drink is a trade secret, as is a mailing list of customers, or information about a product due to be announced in a few months.

The distinguishing characteristic of a trade secret is that it must always be kept secret. The owner must take precautions to protect the secret, such as storing it in a safe, encrypting it in a computer file, or making employees sign a statement that they will not disclose the secret.
Trade secret protection applies very well to computer software.

The underlying algorithm of a computer program is novel, but its novelty depends on nobody else’s knowing it.

Trade secret protection allows distribution of the result of a secret (the executable program) while still keeping the program design hidden.
Trade secret protection does not cover copying a product (specifically a computer program), so that it cannot protect against a pirate who sells copies of someone else’s program without permission.

However, trade secret protection makes it illegal to steal a secret algorithm and use it in another product.

Why Computer Crime is Hard to Define?
Understanding
*Neither courts, lawyers, police agents, nor jurors necessarily understand computers.

Fingerprints
*Polices and courts for years depended on tangible evidence, such as fingerprints. But with many computer crimes there simply are no fingerprints, no physical clues.
Form of Assets
*We know what cash is, or diamonds, or even negotiable securities. But are 20 invisible magnetic spots really equivalent to a million dollars?

Juveniles
*Many computer crimes involve juveniles. Society understands immaturity and can treat even very serious crimes by juveniles as being done with less understanding than when the same crime is committed by an adult.

Type of Crimes Committed
Telecommunications Fraud
*It is defined as avoiding paying telephone charges by misrepresentation as a legitimate user.

Embezzlement
*It involves using the computer to steal or divert funds illegally.

Hacking
*It denotes a compulsive programmer or user who explores, tests, and pushes computers and communications system to their limits - often illegal activities.

Automatic Teller Machine Fraud
*It involves using an ATM machine for a fraudulent activity - faking deposits, erasing withdrawals, diverting funds from another person’s account through stolen PIN numbers.

Records Tampering
*It involves the alteration, loss, or destruction of computerised records.

Acts of Disgruntled Employees
*They often use a computer for revenge against their employer.

Child Pornography and Abuse
*They are illegal or inappropriate arts of a sexual nature committed with a minor or child, such as photographing or videotaping.

Drug Crimes
*Drug dealers use computers to communicate anonymously with each other and to keep records of drug deals.

Organised Crime
*For all kinds of crime, the computer system may be used as their tools.

Summary
Firstly, the legal mechanisms of copyright, patent, and trade secret were presented as means to protect the secrecy of computer hardware, software and data.

However, these mechanisms were designed before the invention of computer, so their applicability to computing needs is somewhat limited.

Meanwhile, program protection is especially desired, and software companies are pressing the courts to extend the interpretation of these means of protection to include computers.

Secondly, relationship between employers and employees, in the context of writers of software. Well-established laws and precedents control the acceptable access an employee has to software written for a company

Thirdly, some difficulties of in prosecuting computer crime. In general, the courts have not yet granted computers, software, and data appropriate status considering value of assets and seriousness of crime. The legal system is moving cautiously in its acceptance of computers.

What are Ethics?
Society relies on ethics or morals to prescribe generally accepted standards of proper behaviour.

An ethic is an objectively defined standard of right and wrong within a group of individuals.

These ethics may influence by religious believe. Therefore, through choices, each person defines a personal set of ethical practices.

A set of ethical principles is called and ethical system.

Differences of The Law and Ethics
Firstly, laws apply to every one, even you do not agree with the laws. However, you are forced to respect and obey the laws.

Secondly, there is a regular process through the courts for determining which law supersedes which if two laws conflict.

Thirdly, the laws and the courts identify certain actions as right and others as wrong. From a legal standpoint, anything that is not illegal is right.

Finally, laws can be enforced, and there are ways to rectify wrongs done by unlawful behaviour.

Contrast of Law Versus Ethics

LEC 9:: Intrusion Detection System

Intruders
Security Intrusion & Detection
Types of IDS
*HIDS
*NIDS
*DIDS
IDS Techniques
SNORT
Honeypots

An Intrusion detection system (IDS) is software and/or hardware designed to detect unwanted attempts at accessing, manipulating, and/or disabling computer systems, mainly through a network, such as the Internet. These attempts may take the form of attacks, as examples, by crackers, malware and/or disgruntled employees. An IDS cannot directly detect attacks within properly encrypted traffic.

An intrusion detection system is used to detect several types of malicious behaviors that can compromise the security and trust of a computer system. This includes network attacks against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, unauthorized logins and access to sensitive files, and malware (viruses, trojan horses, and worms).

An IDS can be composed of several components: Sensors which generate security events, a Console to monitor events and alerts and control the sensors, and a central Engine that records events logged by the sensors in a database and uses a system of rules to generate alerts from security events received. There are several ways to categorize an IDS depending on the type and location of the sensors and the methodology used by the engine to generate alerts. In many simple IDS implementations all three components are combined in a single device or appliance.

IDS Terminology
Alert/Alarm- A signal suggesting a system has been or is being attacked [1].

True attack stimulus- An event that triggers an IDS to produce an alarm and react as though a real attack were in progress [1].

False attack stimulus- The event signaling an IDS to produce an alarm when no attack has taken place [1].

False (False Positive)- An alert or alarm that is triggered when no actual attack has taken place [1].

*False negative- A failure of an IDS to detect an actual attack.

*Noise- Data or interference that can trigger a false positive .

*Site policy- Guidelines within an organization that control the rules and configurations of an IDS .

*Site policy awareness- The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity .

*Confidence value- A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack .

*Alarm filtering- The process of categorizing attack alerts produced from an IDS in
order to distinguish false positives from actual attacks.

Types of Intrusion-Detection systems
There are three main types of systems in which IDS can be used : network, applications and hosts.

In a network-based intrusion-detection system (NIDS), the sensors are located at choke points in network to be monitored, often in the demilitarized zone (DMZ) or at network borders. The sensor captures all network traffic and analyzes the content of individual packets for malicious traffic.

In systems, PIDS and APIDS are used to monitor the transport and protocols for illegal or inappropriate traffic or constructs of a language. For example forged SQL queries attempting to delete database records, virus in emails.

In a host-based system, the sensor usually consists of a software agent, which monitors all activity of the host on which it is installed. For example attempt to modify the master boot record, keylogger, file access.

Hybrids for the two later systems also exist.

Network intrusion detection system (NIDS)
It is an independent platform which identifies intrusions by examining network traffic and monitors multiple hosts. Network Intrusion Detection Systems gain access to network traffic by connecting to a hub, network switch configured for port mirroring, or network tap. An example of a NIDS is Snort.

Protocol-based intrusion detection system (PIDS)
It consists of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication protocol between a connected device (a user/PC or system) and the server. For a web server this would typically monitor the HTTPS protocol stream and understand the HTTP protocol relative to the web server/system it is trying to protect. Where HTTPS is in use then this system would need to reside in the "shim", or interface, between where HTTPS is un-encrypted and immediately prior to its entering the Web presentation layer.

Application protocol-based intrusion detection system (APIDS)
It consists of a system or agent that would typically sit within a group of servers, monitoring and analyzing the communication on application specific protocols. For example, in a web server with a database this would monitor the SQL protocol specific to the middleware/business logic as it transacts with the database.

Host-based intrusion detection system (HIDS)
It consists of an agent on a host which identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state. An example of a HIDS is OSSEC.

Hybrid intrusion detection system
It combines two or more approaches. Host agent data is combined with network information to form a comprehensive view of the network. An example of a Hybrid IDS is Prelude.

Intrusion detection systems can also be system-specific using custom tools and honeypots.

LEC 8:: FIREWALL

A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all (in and out) computer traffic between different security domains based upon a set of rules and other criteria.

Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

There are several types of firewall techniques:

1. Packet filter: Packet filtering inspects each packet passing through the network and accepts or rejects it based on user-defined rules. Although difficult to configure, it is fairly effective and mostly transparent to its users. In addition, it is susceptible to IP spoofing.
2. Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.
3. Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
4. Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Function
A firewall is a dedicated appliance, or software running on a computer, which inspects network traffic passing through it, and denies or permits passage based on a set of rules.

It is a software or hardware that is normally placed between a protected network and an unprotected network and acts like a gate to protect assets to ensure that nothing private goes out and nothing malicious comes in.

A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels. Typical examples are the Internet which is a zone with no trust and an internal network which is a zone of higher trust. A zone with an intermediate trust level, situated between the Internet and a trusted internal network, is often referred to as a "perimeter network" or Demilitarized zone (DMZ).

A firewall's function within a network is similar to physical firewalls with fire doors in building construction. In the former case, it is used to prevent network intrusion to the private network. In the latter case, it is intended to contain and delay structural fire from spreading to adjacent structures.

Without proper configuration, a firewall can often become worthless. Standard security practices dictate a "default-deny" firewall ruleset, in which the only network connections which are allowed are the ones that have been explicitly allowed. Unfortunately, such a configuration requires detailed understanding of the network applications and endpoints required for the organization's day-to-day operation. Many businesses lack such understanding, and therefore implement a "default-allow" ruleset, in which all traffic is allowed unless it has been specifically blocked. This configuration makes inadvertent network connections and system compromise much more likely.

First generation - packet filters

The first paper published on firewall technology was in 1988, when engineers from Digital Equipment Corporation (DEC) developed filter systems known as packet filter firewalls. This fairly basic system was the first generation of what would become a highly evolved and technical internet security feature. At AT&T Bell Labs, Bill Cheswick and Steve Bellovin were continuing their research in packet filtering and developed a working model for their own company based upon their original first generation architecture.

Packet filters act by inspecting the "packets" which represent the basic unit of data transfer between computers on the Internet. If a packet matches the packet filter's set of rules, the packet filter will drop (silently discard) the packet, or reject it (discard it, and send "error responses" to the source).

This type of packet filtering pays no attention to whether a packet is part of an existing stream of traffic (it stores no information on connection "state"). Instead, it filters each packet based only on information contained in the packet itself (most commonly using a combination of the packet's source and destination address, its protocol, and, for TCP and UDP traffic, the port number).

TCP and UDP protocols comprise most communication over the Internet, and because TCP and UDP traffic by convention uses well known ports for particular types of traffic, a "stateless" packet filter can distinguish between, and thus control, those types of traffic (such as web browsing, remote printing, email transmission, file transfer), unless the machines on each side of the packet filter are both using the same non-standard ports.

Second generation - Application layer

The key benefit of application layer filtering is that it can "understand" certain applications and protocols (such as File Transfer Protocol, DNS, or web browsing), and it can detect whether an unwanted protocol is being sneaked through on a non-standard port or whether a protocol is being abused in any harmful way.

Third generation - "stateful" filters

From 1989-1990 three colleagues from AT&T Bell Laboratories, Dave Presetto, Janardan Sharma, and Kshitij Nigam developed the third generation of firewalls, calling them circuit level firewalls.

Third generation firewalls in addition regard placement of each individual packet within the packet series. This technology is generally referred to as a stateful packet inspection as it maintains records of all connections passing through the firewall and is able to determine whether a packet is either the start of a new connection, a part of an existing connection, or is an invalid packet. Though there is still a set of static rules in such a firewall, the state of a connection can in itself be one of the criteria which trigger specific rules.

This type of firewall can help prevent attacks which exploit existing connections, or certain Denial-of-service attacks.

::TYPES::

There are several classifications of firewalls depending on where the communication is taking place, where the communication is intercepted and the state that is being traced.

Network layer and packet filters
Network layer firewalls, also called packet filters, operate at a relatively low level of the TCP/IP protocol stack, not allowing packets to pass through the firewall unless they match the established rule set. The firewall administrator may define the rules; or default rules may apply. The term "packet filter" originated in the context of BSD operating systems.

Network layer firewalls generally fall into two sub-categories, stateful and stateless. Stateful firewalls maintain context about active sessions, and use that "state information" to speed packet processing. Any existing network connection can be described by several properties, including source and destination IP address, UDP or TCP ports, and the current stage of the connection's lifetime (including session initiation, handshaking, data transfer, or completion connection). If a packet does not match an existing connection, it will be evaluated according to the ruleset for new connections. If a packet matches an existing connection based on comparison with the firewall's state table, it will be allowed to pass without further processing.

Stateless firewalls require less memory, and can be faster for simple filters that require less time to filter than to look up a session. They may also be necessary for filtering stateless network protocols that have no concept of a session. However, they cannot make more complex decisions based on what stage communications between hosts have reached.

Modern firewalls can filter traffic based on many packet attributes like source IP address, source port, destination IP address or port, destination service like WWW or FTP. They can filter based on protocols, TTL values, netblock of originator, of the source, and many other attributes.

Commonly used packet filters on various versions of Unix are ipf (various), ipfw (FreeBSD/Mac OS X), pf (OpenBSD, and all other BSDs), iptables/ipchains (Linux).

Application-layer
Application-layer firewalls work on the application level of the TCP/IP stack (i.e., all browser traffic, or all telnet or ftp traffic), and may intercept all packets traveling to or from an application. They block other packets (usually dropping them without acknowledgment to the sender). In principle, application firewalls can prevent all unwanted outside traffic from reaching protected machines.

On inspecting all packets for improper content, firewalls can restrict or prevent outright the spread of networked computer worms and trojans. The additional inspection criteria can add extra latency to the forwarding of packets to their destination.

Proxies
A proxy device (running either on dedicated hardware or as software on a general-purpose machine) may act as a firewall by responding to input packets (connection requests, for example) in the manner of an application, whilst blocking other packets.

Proxies make tampering with an internal system from the external network more difficult and misuse of one internal system would not necessarily cause a security breach exploitable from outside the firewall (as long as the application proxy remains intact and properly configured). Conversely, intruders may hijack a publicly-reachable system and use it as a proxy for their own purposes; the proxy then masquerades as that system to other internal machines. While use of internal address spaces enhances security, crackers may still employ methods such as IP spoofing to attempt to pass packets to a target network.

Network address translation

Firewalls often have network address translation (NAT) functionality, and the hosts protected behind a firewall commonly have addresses in the "private address range", as defined in RFC 1918. Firewalls often have such functionality to hide the true address of protected hosts. Originally, the NAT function was developed to address the limited number of IPv4 routable addresses that could be used or assigned to companies or individuals as well as reduce both the amount and therefore cost of obtaining enough public addresses for every computer in an organization. Hiding the addresses of protected devices has become an increasingly important defense against network reconnaissance.

LEC 7:: WIRELESS SECURITY

Wireless LANs
IEEE ratified 802.11 in 1997.
-Also known as Wi-Fi.
Wireless LAN at 1 Mbps & 2 Mbps.
WECA (Wireless Ethernet Compatibility Alliance) promoted Interoperability.
-Now Wi-Fi Alliance
802.11 focuses on Layer 1 & Layer 2 of OSI model.
-Physical layer
-Data link layer

A wireless local area network (WLAN) links two or more devices using some wireless distribution method (typically spread-spectrum or OFDM radio), and usually providing a connection through an access point to the wider internet. This gives users the mobility to move around within a local coverage area and still be connected to the network.

Wireless LANs have become popular in the home due to ease of installation, and the increasing popularity of laptop computers. Public businesses such as coffee shops and malls have begun to offer wireless access to their customers; sometimes for free.

Types of wireless lan

::Peer to peet::
An ad-hoc network is a network where stations communicate only peer to peer (P2P). There is no base and no one gives permission to talk. This is accomplished using the Independent Basic Service Set (IBSS).

A peer-to-peer (P2P) network allows wireless devices to directly communicate with each other. Wireless devices within range of each other can discover and communicate directly without involving central access points. This method is typically used by two computers so that they can connect to each other to form a network.

If a signal strength meter is used in this situation, it may not read the strength accurately and can be misleading, because it registers the strength of the strongest signal, which may be the closest computer.
IEEE 802.11 define the physical layer (PHY) and MAC (Media Access Control) layers based on CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance). The 802.11 specification includes provisions designed to minimize collisions, because two mobile units may both be in range of a common access point, but out of range of each other.

The 802.11 has two basic modes of operation: Ad hoc mode enables peer-to-peer transmission between mobile units. Infrastructure mode in which mobile units communicate through an access point that serves as a bridge to a wired network infrastructure is the more common wireless LAN application the one being covered. Since wireless communication uses a more open medium for communication in comparison to wired LANs, the 802.11 designers also included shared-key encryption mechanisms: Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA, WPA2), to secure wireless computer networks.

::Bridge::

A bridge can be used to connect networks, typically of different types. A wireless Ethernet bridge allows the connection of devices on a wired Ethernet network to a wireless network. The bridge acts as the connection point to the Wireless LAN.

::Wireless distribution system::

A Wireless Distribution System is a system that enables the wireless interconnection of access points in an IEEE 802.11 network. It allows a wireless network to be expanded using multiple access points without the need for a wired backbone to link them, as is traditionally required. The notable advantage of WDS over other solutions is that it preserves the MAC addresses of client packets across links between access points.

An access point can be either a main, relay or remote base station. A main base station is typically connected to the wired Ethernet. A relay base station relays data between remote base stations, wireless clients or other relay stations to either a main or another relay base station. A remote base station accepts connections from wireless clients and passes them to relay or main stations. Connections between "clients" are made using MAC addresses rather than by specifying IP assignments.

All base stations in a Wireless Distribution System must be configured to use the same radio channel, and share WEP keys or WPA keys if they are used. They can be configured to different service set identifiers. WDS also requires that every base station be configured to forward to others in the system.

WDS may also be referred to as repeater mode because it appears to bridge and accept wireless clients at the same time (unlike traditional bridging). It should be noted, however, that throughput in this method is halved for all clients connected wirelessly.

When it is difficult to connect all of the access points in a network by wires, it is also possible to put up access points as repeaters.

WPA and WEP

WPA and WEP are technologies that "encrypt" the traffic on your network. That is, they scramble it so that an attacker can't make any sense of it. To unscramble it at the other end, all systems using it must know a "key" or password.

Note that WPA is now in a second generation, referred to as WPA2. Unless otherwise specified, this document uses "WPA" to refer to both.

WPA and WEP provide both access control and privacy. Privacy comes from the encryption. Access control comes from the fact that someone must know the password to use your network.

For this reason, for small networks, using WPA is enough to meet the requirements of the Wireless policy. However you will still want to make sure that any services that use a password or other private information use SSL or some other type of end to end encryption.

WEP is significantly less secure than WPA, but can be used until your equipment can be upgraded to support WPA. While WEP is widely regarded as insecure, it is still a lot better than nothing.

WPA has two modes, personal and enterprise. For small installations you'll want to use personal mode. It just requires a password. Enterprise mode is for larger installations, that have a Radius server that will support WPA.

The primary problem with WPA in personal mode is that it has a single password, which you must tell to all users. That becomes impractical for larger installations.

WPA in enterprise mode requires each user to login with their own username and password. That simplifies management in large installations, because you don't have to distribute a common password to all your users. However it is a bit more complex to implement:

* Each user's system must have special software to let the user login to the network. This software is referred to as an "802.1x supplicant".
* The access point must support WPA enterprise mode. The access point is configured to talk to a RADIUS server, which is a central server that actually checks the password.
* You must have a RADIUS server that supports WPA enterprise mode. While the RADIUS server may have its own list of usernames and passwords, it would be more common for it to talk to an LDAP or Active Directory server, so that users login to the network with the same password that they use for other services.

For this reason, most large implementations at Rutgers do not use enterprise mode. Instead they use separate gateway boxes for access control, and depend upon end to end encryption for privacy. One can argue that this is not as secure as WPA enterprise mode, but it avoids the support implications of requiring users to login to the network with an 802.1x supplicant.
Choosing a good password

It is critical to use a good password. There are attacks against WPA that will break your security if your password uses words or any other well-known sequences. WPA allows passwords as long as 63 characters. We strongly recommend using a long random password, or at the very least a long phrase (at least 20 characters, but preferably longer). The phrase should not be taken from any web site or published work. Most software saves the password, so you only need to type it once on each system.

Even better than a long phrase is a truly random password. For example, consider using http://rulink.rutgers.edu/random.php3. This generates a random 32-character hex string. You can combine two of them (and leave off one character) to get a 63-character password.

LEC 6:: SECURITY APPLICATION

Security in Email
#SMIME

S/MIME (Secure / Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of e-mail encapsulated in MIME.
S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFCs. S/MIME was originally developed by RSA Data Security Inc. The original specification used the recently developed IETF MIME specification with the de facto industry standard PKCS #7 secure message format.

S/MIME provides the following cryptographic security services for electronic messaging applications: authentication, message integrity and non-repudiation of origin (using digital signatures) and privacy and data security (using encryption). S/MIME specifies the application/pkcs7-mime (smime-type "enveloped-data") type for data enveloping (encrypting): the whole (prepared) MIME entity to be enveloped is encrypted and packed into an object which subsequently is inserted into an application/pkcs7-mime MIME entity.

S/MIME functionality is built into the vast majority of modern e-mail software and interoperates between them.

#PGP

Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was originally created by Philip Zimmermann in 1991.

PGP and other similar products follow the OpenPGP standard (RFC 4880) for encrypting and decrypting data.
PGP encryption uses a serial combination of hashing, data compression, symmetric-key cryptography, and, finally, public-key cryptography; each step uses one of several supported algorithms. Each public key is bound to a user name and/or an e-mail address. The first version of this system was generally known as a web of trust to contrast with the X.509 system which uses a hierarchical approach based on certificate authority and which was added to PGP implementations later. Current versions of PGP encryption include both options through an automated key management server.
-Compatibility-

As PGP evolves, PGP systems that support newer features and algorithms are able to create encrypted messages that older PGP systems cannot decrypt, even with a valid private key. Thus, it is essential that partners in PGP communication understand each other's PGP capabilities or at least agree on PGP settings.

-Digital signatures-

PGP supports message authentication and integrity checking. The latter is used to detect whether a message has been altered since it was completed (the message integrity property), and the former to determine whether it was actually sent by the person/entity claimed to be the sender (a digital signature). In PGP, these are used by default in conjunction with encryption, but can be applied to plaintext as well. The sender uses PGP to create a digital signature for the message with either the RSA or DSA signature algorithms. To do so, PGP computes a hash (also called a message digest) from the plaintext, and then creates the digital signature from that hash using the sender's private keys.
Security in Web

#SSL
What is SSL?
SSL is the ubiquitous security protocol used in almost 100% of secure Internet transactions. Essentially,SSL transforms a typical reliable transport protocol (such as TCP) into a secure communications channel suitable for conducting sensitive transactions.i The SSL protocol defines the methods by which a secure communications channel can be established—it does not indicate which cryptographic algorithms need to be used. SSL supports many different algorithms, and serves as a framework whereby cryptography can be used in a convenient and distributed manner.

Any application that needs to transmit data over an unsecured network such
as the Internet or a company intranet is a potential candidate for SSL. SSL provides security, and moreimportantly, peace of mind. When using SSL, you can be fairly sure that your data are safe from eavesdroppers and tampering.
SSL is relatively new to the embedded world because it has been too complex for traditional embeddedsystems microprocessors to handle. However, starting with Rev. A of the Rabbit 3000 microprocessor, hardware assistance has been added to speed up some of the more complex SSL cryptography operations, making SSL a viable solution in a market where standard (usually complex) security protocols have not traditionally been supported. The applications for embedded applications are as numerous as those for the PC world.

#SSH
Secure Shell or SSH is a network protocol that allows data to be exchanged using a secure channel between two networked devices.[1] Used primarily on Linux and Unix based systems to access shell accounts, SSH was designed as a replacement for Telnet and other insecure remote shells, which send information, notably passwords, in plaintext, leaving them open for interception.[2] The encryption used by SSH provides confidentiality and integrity of data over an insecure network, such as the Internet.
SSH uses public-key cryptography to authenticate the remote computer and allow the remote computer to authenticate the user, if necessary.

SSH is typically used to log into a remote machine and execute commands, but it also supports tunneling, forwarding TCP ports and X11 connections; it can transfer files using the associated SFTP or SCP protocols.SSH uses the client-server model.

The standard TCP port 22 has been assigned for contacting SSH servers.

An SSH client program is typically used for establishing connections to an SSH daemon accepting remote connections. Both are commonly present on most modern operating systems, including Mac OS X, Linux, FreeBSD, Solaris and OpenVMS. Proprietary, freeware and open source versions of various levels of complexity and completeness exist.

#HTTPS
Hypertext Transfer Protocol Secure (HTTPS) is a combination of the Hypertext Transfer Protocol with the SSL/TLS protocol to provide encryption and secure identification of the server. HTTPS connections are often used for payment transactions on the World Wide Web and for sensitive transactions in corporate information systems. HTTPS should not be confused with Secure HTTP (S-HTTP) specified in RFC 2660
#SFTP
SFTP, or secure FTP, is a program that uses SSH to transfer files. Unlike standard FTP, it encrypts both commands and data, preventing passwords and sensitive information from being transmitted in the clear over the network. It is functionally similar to FTP, but because it uses a different protocol, you can't use a standard FTP client to talk to an SFTP server,can connect to an FTP server with a client that supports only SFTP.

LEC 5:: Security in network

Definition
+A computing network is a computing environment with more than one independent processors
+May be multiple users per system
+Distance between computing systems is not considered (a communications media problem)
+Size of computing systems is not relevant

What is a Network can Provide?

~ Logical interface function

~ Sending messages

~ Receiving messages

~ Executing program

~ Obtaining status information

~ Obtaining status information on other network users and their status

Type of Network

One way to categorize the different types of computer network designs is by their scope or scale. For historical reasons, the networking industry refers to nearly every type of design as some kind of area network. Common examples of area network types are:

* LAN - Local Area Network
* WLAN - Wireless Local Area Network
* WAN - Wide Area Network
* MAN - Metropolitan Area Network
* SAN - Storage Area Network, System Area Network, Server Area Network, or sometimes Small Area Network

Who Couse Security Problem

Ò
Ò~Hacker
Ò~Spy
Ò~Student
Ò~Businessman
Ò~Ex-employee
Ò~Stockbroker
Ò~Terrorist

Network Security Control

Ò~Encryption
Ò~Strong Authentication
Ò~IPSec,VPN,SSH
Ò~Kerberos
Ò~Firewall
Ò~Intrusion Detection System (IDS)
Ò~Intrusion Prevention System (IPS)
Ò~Honeypot

Encryption
Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people. Decryption is the process of converting encrypted data back into its original form, so it can be understood.

Encryption is the most effective way to achieve data security . To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Unencrypted data is called plain text; encrypt data is referred to as cipher text

Hacking And Preventation

Ò~motivated by thrill of access and status
É @hacking community a strong meritocracy
É @status is determined by level of competence
Ò~benign intruders might be tolerable
É @do consume resources and may slow performance
É @can’t know in advance whether benign or malign
Ò~IDS / IPS / VPNs can help counter
Ò~awareness led to establishment of CERTs
É @collect / disseminate vulnerability info / responses

Covering Track

Ò~Every activity is logged
~Syslog, accesslog, eventlog,

Intrusion Detection Systems
• classify intrusion detection systems (IDSs)
as:
• Host-based IDS: monitor single host activity
• Network-based IDS: monitor network traffic
• logical components:
• sensors - collect data
• analyzers - determine if intrusion has occurred
• user interface - manage / direct / view IDS

IDS Principles
• assume intruder behavior differs from
legitimate users
• expect overlap as shown
• observe deviations
from past history
• problems of:
• false positives
• false negatives
• must compromise

Honeyports

In computer terminology, a honeypot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated, (un)protected, and monitored, and which seems to contain information or a resource of value to attackers.
A honeypot is valuable as a surveillance and early-warning tool. While it is often a computer, a honeypot can take other forms, such as files or data records, or even unused IP address space. A honeypot that masquerades as an open proxy to monitor and record those using the system is a sugarcane. Honeypots should have no production value, and hence should not see any legitimate traffic or activity. Whatever they capture can then be surmised as malicious or unauthorized. One practical implication of this is honeypots that thwart spam by masquerading as the type of systems abused by spammers.
Honeypots can be classified based on their deployment and based on their level of involvement. Based on the deployment, honeypots may be classified as

1. Production Honeypots
2. Research Honeypots

Sunday, October 4, 2009

LEC 4:: AUTHENTICATION & ACCES CONTROL

Authentication
*Password
*Biometric
Access control
*Matrix
*List
*Unix access control

-Verification of identity of someone who generated some data
-Relates to identity verification
-classifications of identity verification:
+by something known e.g. password
+by something possessed e.g. smart card, passport
+by physical characteristics (biometrics) e.g. finger prints, palm prints, retina, voice
+by a result of involuntary action : signature

Password

Protection of passwords
Don’t keep your password to anybody
Don’t write or login your password at everywhere
Etc.
Choosing a good password
Criteria:
-Hard to guess and easy to remember
Characteristics of a good password
-Not shorter than six characters
-Not patterns from the keyboard
Etc.
Calculations on password
*Password population, N =rs
*Probability of guessing a password = 1/N
*Probability of success, P=nt/N

Techniques for guessing passwords
*Try default passwords.8
*Try all short words, 1 to 3 characters long.
*Try all the words in an electronic dictionary(60,000).
*Collect information about the user’s hobbies, family names, birthday, etc.
*Try user’s phone number, social security number, street address, etc.
*Try all license plate numbers
*Use a Trojan horse
*Tap the line between a remote user and the host system.

What is Biometric?
*The term is derived from the Greek words bio (= life) and metric (= to measure)
*Biometrics is the measurement and statistical analysis of biological data
*In IT, biometrics refers to technologies for measuring and analysing human body characteristics for authentication purposes
*Definition by Biometrics Consortium – automatically recognising a person using distinguishing traits

Verification vs Identification

*Verification (one-to-one comparison) –confirms a claimed identity
-Claim identity using name, user id, …
*Identification (one-to-many comparison) – establishes the identity of a subject from a set of enrolled persons
-Employee of a company?
-Member of a club?
-Criminal in forensics database?

Static vs. dynamic biometric methods

*Static (also called physiological) biometric methods – authentication based on a feature that is always present
*Dynamic (also called behavioural) biometric methods – authentication based on a certain behaviour pattern

Classification of biometric methods
Static
Fingerprint recognition
Retinal scan
Iris scan
Hand geometry
Dynamic
Signature recognition
Speaker recognition
Keystroke dynamics

Biometric system model

Subscribe to: Posts (Atom)

::Aku Milik TUHANKU..::

Apakah pendirian hidupmu?

Azamku tak mungkin kau jadikan kelabu Tepis-tepis kata yg sinis Yang panas ku jadikan membeku Bahagia aku kemudi selalu Biar ku menuju jalan tak berbiku Biarkan cemburu berkubur Asalkan tak cemari hidupku Biarkan ku senyum selalu Tandanya ku tiada seteru Jangan kau terpenjuru Jangan kau bercelaru Diriku bukan milikmu*

"Ya Allah... Tunjukkan kepada kami yang benar dan jadikan pilihan kami mengikuti yang benar itu. Dan juga tunjukkan kepada kami yang tidak benar dan permudahkan kami meninggalkannya."

:; Sepintas Bicara ::

Name :

Web URL :

Message :

by. oggix.com

more smileys

LAB 6::SECURITY IN NETWORK.

In the field of networking, the specialist area of network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorized access, and consistent and continuous monitoring and measurement of its effectiveness (or lack) combined together.

Network security starts from authenticating the user, commonly with a username and a password. Since this requires just one thing besides the user name, i.e. the password which is something you 'know', this is sometimes termed one factor authentication. With two factor authentication something you 'have' is also used (e.g. a security token or 'dongle', an ATM card, or your mobile phone), or with three factor authentication something you 'are' is also used (e.g. a fingerprint or retinal scan).

Once authenticated, a firewall enforces access policies such as what services are allowed to be accessed by the network users .Though effective to prevent unauthorized access, this component may fail to check potentially harmful content such as computer worms or Trojans being transmitted over the network. Anti-virus software or an intrusion prevention system (IPS)^[2] help detect and inhibit the action of such malware. An anomaly-based intrusion detection system may also monitor the network and traffic for unexpected (i.e. suspicious) content or behaviour and other anomalies to protect resources, e.g. from denial of service attacks or an employee accessing files at strange times. Individual events occurring on the network may be logged for audit purposes and for later high level analysis.

Communication between two hosts using the network could be encrypted to maintain privacy.

Honeypots, essentially decoy network-accessible resources, could be deployed in a network as surveillance and early-warning tools. Techniques used by the attackers that attempt to compromise these decoy resources are studied during and after an attack to keep an eye on new exploitation techniques. Such analysis could be used to further tighten security of the actual network being protected by the honeypot.

A useful summary of standard concepts and methods in network security is given by in the form of an extensible ontology of network security attacks.

IPSec Network Security

Description

IPSec is a framework of open standards developed by the Internet Engineering Task Force (IETF).

IPSec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPSec acts at the network layer, protecting and authenticating IP packets between participating IPSec devices ("peers"), such as Cisco routers.

IPSec provides the following network security services. These services are optional. In general, local security policy will dictate the use of one or more of these services:

•Data Confidentiality—The IPSec sender can encrypt packets before transmitting them across a network.

•Data Integrity—The IPSec receiver can authenticate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.

•Data Origin Authentication—The IPSec receiver can authenticate the source of the IPSec packets sent. This service is dependent upon the data integrity service.

•Anti-Replay—The IPSec receiver can detect and reject replayed packets.

With IPSec, data can be transmitted across a public network without fear of observation, modification, or spoofing. This enables applications such as virtual private networks (VPNs), including intranets, extranets, and remote user access.

::LAB 5: WEB APPLICATION SECURITY

Over 700 million people worldwide bank, shop, buy airline tickets, and perform research using the World Wide Web. With each transaction, private information, including names, addresses, phone numbers, credit card numbers, and passwords, are routinely transferred and stored in a variety of locations. Billions of dollars and millions of personal identities are at stake every day. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough to protect websites from hackers. Today, with prominent
Web attacks taking place seemingly every week, the industry knows better.

The best way to begin exploring web application security is by learning how the Web works. While most IT professionals are very comfortable with using a web browser to surf the Web, few of us look behind the application, at the client-server4 structure that powers the Web. This structure governs the way web browsers (Firefox5, Microsoft Internet Explorer) must communicate with web servers7 (Apache8, Microsoft IIS ) to retrieve web pages10. To peer deeper into the world of the Web we’ll begin by looking at the web browser location bar .
All major web browsers possess a location bar that displays the web address(URL) of the current web page. URL manipulation is one of the many ways to launch a web application attack. And yet, they (location bars) are required to enable customers, partners, and hackers to view your website. URL’s are used to uniquely identify the location of a web page or on-line resource. When traveling from one web page to the next, the displayed URL is updated. URLs, also referred to as links, are commonly embedded in web pages to click on to visit other pages. URLs also tell us a lot about a website. They tell us what type of communication they expect, what type of operating system they run, the type of web application code is being used, and more. We’ll be exploring the anatomy of URLs closely in the following section and we’ll look at how each section can be vulnerable to attack.

A critical point to note here: lack of firewall protection on the Web.When visiting any one of the millions of websites that exist today, it’s unlikely that you will encounter firewall protection. It’s notthat firewalls aren’t there or not useful, they are. In fact, most websites have firewalls protecting them from network-based attack (worms, viruses, hackers). But network-based attacks are fundamentally different from web-based attacks (XSS, SQL Injection), which are
immune to a firewall’s defenses.
A firewall’s job is to prevent unauthorized connections to protected network devices. For instance, you probably do not want intruders
connecting to internal databases, workstations, printers, and so forth. For a website to be accessible to the public, firewalls must allow traffic to the web server. If it did not, no one would be able to visit a website. This means if a website has a vulnerability, firewalls are powerless, since web traffic must be allowed in. Web application security sits above the network layer, in a world of its own.

Web Applications
http://example.com/path/to/application.cgi?param1=value1&param2=value2 Web application security owes its name to the next section of the URL. The portion of the URL after the final forward slash and before the question mark is the “web application14.” Web applications are software that enables a website to serve-up dynamic content. They can do just about anything and be programmed in just about any language. When they receive requests, these applications dynamically create web pages to return to the web browser. Web applications turn an ordinary web server into a Google (www.google.com), a Yahoo! (www.yahoo.com), an online auction, web bank, message board, blog, etc. Without web applications, the web would be filled with static content and none of the interactivity that drives innovation.

Three Places to Attack a Website
Statistically, over 90% of all websites have serious security issues, but the big question is “how are they attacked?” If we look at everything we’ve covered so far, basically there are only three places to attack a website: URL’s, cookies, and Post Data. We’ll explore each of these attack points by analyzing real-world exploits. Recall that there are twenty-four classes of attack, and each of these points is vulnerable to all of them.

URL

In July of 2005, the University of Southern California (USC) was informed of a SQL Injection vulnerability found within one of their websites. The website in question is used to accept applications from prospective students. According to sources, a lack of security checks on the login web-form text boxes allowed commands to be sent to the back-end database. These commands enabled public access to personal information including the names, birth dates, addresses, and social-security numbers of up to 280,000 users. While the specific technical details remain undisclosed, here is a likely scenario of what took place. When filling out the login web-form with a username (johndoe) and password (abc123), the web browser would generate a URL similar to following:
http://victim.com/login.asp?username=johndoe&password=abc123.

Cookie

Just before Valentine’s Day 2003, FTD.com (a large online florist) received word that hackers could illegally access customer information by simply changing a particular number within a cookie16. The number was a customer identifier that could be easily guessed and changed to access the sensitive information of other users. This class of attack is
generally referred to as Credential Session Prediction17. Security experts confirmed the problem existed and that customer billing records, names, addresses, and phone numbers were exposed.

Here is an example of what of likely took place:
When users login to FTD.com or add products to their shopping carts, they are given a cookie to track the current session. The cookie contains a unique customer identifier; in this case “CustomerID”, with
a value of “1001.”

Post Data
In October 2005, in an incident known as the Samy Worm, a hacker (Samy) used a common, Cross-Site Scripting (XSS) vulnerability to exploit the MySpace social networking website. Users’ web browsers were forced to send web requests that they did not expect to make. Approximately one million users unwittingly altered their profile web
page with malicious JavaScript code when they visited other infected profiles.
Samy altered his MySpace profile web page to include some crafty JavaScript exploit code. When another MySpace user visited Samy’s
profile, the JavaScript code would execute its payload in the user’s browser. At this point, Samy had complete control over the user’s browser. The payload forced the user to automatically befriend Samy, and also add him as a hero (“Samy is my hero” was appended to each profile page). To propagate site-wide, the exploit code would copy itself to the user’s profile and wait to exploit other unsuspecting users. To halt the infection, MySpace was forced to shutdown its website for twenty hours. While the incident was severe, the payload of the Samy worm was relatively benign. It would have been trivial for Samy to force everyone to delete their profile and blog data, resulting in a far more damaging situation for users and for MySpace.

::LAB 4: Modern Cryptography(extended version)

The word cryptography comes from the Greek words kryptos meaning hidden and graphein meaning writing. Cryptography is the study of hidden writing, or the science of encrypting and decrypting text and messages.
::RSA::
In cryptography, RSA (which stands for Rivest, Shamir and Adleman who first publicly described it; see below) is an algorithm for public-key cryptography. It is the first algorithm known to be suitable for signing as well as encryption, and one of the first great advances in public key cryptography. RSA is widely used in electronic commerce protocols, and is believed to be secure given sufficiently long keys and the use of up-to-date implementations.

Operation

The RSA algorithm involves three steps: key generation, encryption and decryption.

Key generation

RSA involves a public key and a private key. The public key can be known to everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted using the private key. The keys for the RSA algorithm are generated the following way:

Choose two distinct prime numbers p and q.
- For security purposes, the integers $p$ and $q$ should be chosen uniformly at random and should be of similar bit-length. Prime integers can be efficiently found using a Primality test.
Compute n = pq.
- $n$ is used as the modulus for both the public and private keys
Compute the totient: $\varphi(pq) = (p-1)(q-1)\,$ .
Choose an integer e such that e and share no divisors other than 1 (i.e. e and are coprime).
- $e$ is released as the public key exponent.
- Choosing e having a short addition chain results in more efficient encryption. Small public exponents (such as e=3) could potentially lead to greater security risks.^[2]
Determine d (using modular arithmetic) which satisfies the congruence relation .
- Stated differently, $e d - 1$ can be evenly divided by the totient $(p - 1)(q - 1)$ .
- This is often computed using the Extended Euclidean Algorithm.
- $d$ is kept as the private key exponent.

The public key consists of the modulus $n$ and the public (or encryption) exponent $e$ . The private key consists of the modulus $n$ and the private (or decryption) exponent $d$ which must be kept secret.

Notes on some variants:

PKCS#1 v2.0 and PKCS#1 v2.1 specifies using $\lambda(n) = {\rm lcm}(p-1, q-1) \,$ , where lcm is the least common multiple instead of $\varphi(pq) = (p-1)(q-1) \,$ .
For efficiency the following values may be precomputed and stored as part of the private key:
- $p$ and $q$ : the primes from the key generation,
- $d\mod (p - 1)$ and $d\mod(q - 1)$ ,
- $q^{-1} \mod(p)$ .

Encryption

Alice transmits her public key $(n, e)$ to Bob and keeps the private key secret. Bob then wishes to send message M to Alice.

He first turns M into an integer $0 < m < n$ by using an agreed-upon reversible protocol known as a padding scheme. He then computes the ciphertext $c$ corresponding to:

$c \equiv m^e \pmod{n}.$

This can be done quickly using the method of exponentiation by squaring. Bob then transmits $c$ to Alice.

Decryption

Alice can recover $m$ from $c$ by using her private key exponent $d$ by the following computation:

$m \equiv c^d \pmod{n}.$

Given $m$ , she can recover the original message M by reversing the padding scheme.

The above decryption procedure works because:

$c^d \equiv (m^e)^d \equiv m^{ed}\pmod{n}$ .

Now, since $ed = 1 + k\varphi(n)$ ,

$m^{ed} \equiv m^{1 + k\varphi(n)} \equiv m (m^{\varphi(n)})^{k} \equiv m \pmod{n}$ .

The last congruence directly follows from Euler's theorem when $m$ is relatively prime to $n$ . Using the Chinese remainder theorem, it can be shown that the equations holds for all $m$ .

This shows that we get the original message back:

$c^d \equiv m \pmod{n}.$

A working example

Here is an example of RSA encryption and decryption. The parameters used here are artificially small, but one can also use OpenSSL to generate and examine a real keypair.

Choose two prime numbers
$p = 61$ and $q = 53$
Compute $n = p q$
$n=61\cdot53=3233$
Compute the totient $\varphi(p,q) = (p-1)(q-1) \,$
$\varphi(p,q) = (61 - 1)(53 - 1) = 3120\,$
Choose $e > 1$ coprime to 3120
$e = 17$
Compute $d$ such that $d e \equiv 1\pmod{\varphi(p,q)}\,$ e.g., by computing the modular multiplicative inverse of $e$ modulo $\varphi(p,q)\,$ :
$d = 2753$
since 17 · 2753 = 46801 and mod (46801,3120) = 1 this is the correct answer.
(iterating finds (15 times 3120)+1 divided by 17 is 2753, an integer, whereas other values in place of 15 do not produce an integer)

The public key is ( $n = 3233$ , $e = 17$ ). For a padded message $m$ the encryption function is:

$c = m^e\mod {n} = m^{17} \mod {3233}.$

The private key is ( $n = 3233$ , $d = 2753$ ). The decryption function is:

$m = c^d\mod {n} = c^{2753} \mod {3233}.$

For example, to encrypt $m = 123$ , we calculate

$c = 123^{17}\mod {3233} = 855.$

To decrypt $c = 855$ , we calculate

$m = 855^{2753}\mod {3233} = 123$ .

Both of these calculations can be computed efficiently using the square-and-multiply algorithm for modular exponentiation. In real life situations the primes selected would be much larger, however in our example it would be relatively trivial to factor $n$ , 3233, obtained from the freely available public key back to the primes $p$ and $q$ . Given $e$ , also from the public key, we could then compute $d$ and so acquire the private key.

Padding schemes

When used in practice, RSA is generally combined with some padding scheme. The goal of the padding scheme is to prevent a number of attacks that potentially work against RSA without padding:

When encrypting with low encryption exponents (e.g., $e = 3$ ) and small values of the $m$ , (i.e. $m < n 1 / e$ ) the result of $m e$ is strictly less than the modulus $n$ . In this case, ciphertexts can be easily decrypted by taking the $e$ th root of the ciphertext over the integers.
If the same clear text message is sent to $e$ or more recipients in an encrypted way, and the receivers share the same exponent $e$ , but different $p$ , $q$ , and $n$ , then it is easy to decrypt the original clear text message via the Chinese remainder theorem. Johan Håstad noticed that this attack is possible even if the cleartexts are not equal, but the attacker knows a linear relation between them.^[3] This attack was later improved by Don Coppersmith.^[4]
Because RSA encryption is a deterministic encryption algorithm – i.e., has no random component – an attacker can successfully launch a chosen plaintext attack against the cryptosystem, by encrypting likely plaintexts under the public key and test if they are equal to the ciphertext. A cryptosystem is called semantically secure if an attacker cannot distinguish two encryptions from each other even if the attacker knows (or has chosen) the corresponding plaintexts. As described above, RSA without padding is not semantically secure.
RSA has the property that the product of two ciphertexts is equal to the encryption of the product of the respective plaintexts. That is $m_1^em_2^e\equiv (m_1m_2)^e\pmod{n}.$ Because of this multiplicative property a chosen-ciphertext attack is possible. E.g. an attacker, who wants to know the decryption of a ciphertext $c = m e mod n$ may ask the holder of the private key to decrypt an unsuspicious-looking ciphertext $c' = c r e mod n$ for some value $r$ chosen by the attacker. Because of the multiplicative property $c'$ is the encryption of $m r mod n$ . Hence, if the attacker is successful with the attack, he will learn $m r mod n$ from which he can derive the message m by multiplying $m r$ with the modular inverse of $r$ modulo $n$ .

To avoid these problems, practical RSA implementations typically embed some form of structured, randomized padding into the value $m$ before encrypting it. This padding ensures that $m$ does not fall into the range of insecure plaintexts, and that a given message, once padded, will encrypt to one of a large number of different possible ciphertexts.

Standards such as PKCS#1 have been carefully designed to securely pad messages prior to RSA encryption. Because these schemes pad the plaintext $m$ with some number of additional bits, the size of the un-padded message M must be somewhat smaller. RSA padding schemes must be carefully designed so as to prevent sophisticated attacks which may be facilitated by a predictable message structure. Early versions of the PKCS#1 standard (up to version 1.5) used a construction that turned RSA into a semantically secure encryption scheme. This version was later found vulnerable to a practical adaptive chosen ciphertext attack. Later versions of the standard include Optimal Asymmetric Encryption Padding (OAEP), which prevents these attacks. The PKCS#1 standard also incorporates processing schemes designed to provide additional security for RSA signatures, e.g, the Probabilistic Signature Scheme for RSA (RSA-PSS).

Signing messages

Suppose Alice uses Bob's public key to send him an encrypted message. In the message, she can claim to be Alice but Bob has no way of verifying that the message was actually from Alice since anyone can use Bob's public key to send him encrypted messages. So, in order to verify the origin of a message, RSA can also be used to sign a message.

Suppose Alice wishes to send a signed message to Bob. She can use her own private key to do so. She produces a hash value of the message, raises it to the power of $d mod n$ (as she does when decrypting a message), and attaches it as a "signature" to the message. When Bob receives the signed message, he uses the same hash algorithm in conjunction with Alice's public key. He raises the signature to the power of $e mod n$ (as he does when encrypting a message), and compares the resulting hash value with the message's actual hash value. If the two agree, he knows that the author of the message was in possession of Alice's private key, and that the message has not been tampered with since.

Note that secure padding schemes such as RSA-PSS are as essential for the security of message signing as they are for message encryption, and that the same key should never be used for both encryption and signing purposes.

Security and practical considerations

Integer factorization and RSA problem

The security of the RSA cryptosystem is based on two mathematical problems: the problem of factoring large numbers and the RSA problem. Full decryption of an RSA ciphertext is thought to be infeasible on the assumption that both of these problems are hard, i.e., no efficient algorithm exists for solving them. Providing security against partial decryption may require the addition of a secure padding scheme.^{[citation needed]}

The RSA problem is defined as the task of taking $e$ th roots modulo a composite $n$ : recovering a value $m$ such that $c = m e mod n$ , where $(n, e)$ is an RSA public key and $c$ is an RSA ciphertext. Currently the most promising approach to solving the RSA problem is to factor the modulus $n$ . With the ability to recover prime factors, an attacker can compute the secret exponent $d$ from a public key $(n, e)$ , then decrypt $c$ using the standard procedure. To accomplish this, an attacker factors $n$ into $p$ and $q$ , and computes $(p - 1)(q - 1)$ which allows the determination of $d$ from $e$ . No polynomial-time method for factoring large integers on a classical computer has yet been found, but it has not been proven that none exists. See integer factorization for a discussion of this problem.

As of 2008^[update], the largest (known) number factored by a general-purpose factoring algorithm was 663 bits long (see RSA-200), using a state-of-the-art distributed implementation. The next record is probably going to be a 768 bits modulus^[5]. RSA keys are typically 1024–2048 bits long. Some experts believe that 1024-bit keys may become breakable in the near term (though this is disputed); few see any way that 4096-bit keys could be broken in the foreseeable future. Therefore, it is generally presumed that RSA is secure if $n$ is sufficiently large. If $n$ is 300 bits or shorter, it can be factored in a few hours on a personal computer, using software already freely available. Keys of 512 bits have been shown to be practically breakable in 1999 when RSA-155 was factored by using several hundred computers and are now factored in a few weeks using common hardware.^[6] A theoretical hardware device named TWIRL and described by Shamir and Tromer in 2003 called into question the security of 1024 bit keys. It is currently recommended that $n$ be at least 2048 bits long.^[7]

In 1994, Peter Shor showed that a quantum computer could factor in polynomial time, breaking RSA. However, only small scale quantum computers have been realized.^{[citation needed]}

Key generation

Finding the large primes $p$ and $q$ is usually done by testing random numbers of the right size with probabilistic primality tests which quickly eliminate virtually all non-primes.

Numbers $p$ and $q$ should not be 'too close', lest the Fermat factorization for $n$ be successful, if $p - q$ , for instance is less than $2 n 1 / 4$ (which for even small 1024-bit values of $n$ is 3×10⁷⁷) solving for $p$ and $q$ is trivial. Furthermore, if either $p - 1$ or $q - 1$ has only small prime factors, $n$ can be factored quickly by Pollard's $p - 1$ algorithm, and these values of $p$ or $q$ should therefore be discarded as well.

It is important that the private key $d$ be large enough. Michael J. Wiener showed^[8] that if $p$ is between $q$ and $2 q$ (which is quite typical) and $d < n 1 / 4 / 3$ , then $d$ can be computed efficiently from $n$ and $e$ . There is no known attack against small public exponents such as $e = 3$ , provided that proper padding is used. However, when no padding is used or when the padding is improperly implemented then small public exponents have a greater risk of leading to an attack, such as for example the unpadded plaintext vulnerability listed above. 65537 is a commonly used value for $e$ . This value can be regarded as a compromise between avoiding potential small exponent attacks and still allowing efficient encryptions (or signature verification). The NIST Special Publication on Computer Security (SP 800-78 Rev 1 of August 2007) does not allow public exponents $e$ smaller than 65537, but does not state a reason for this restriction.

Speed

RSA is much slower than DES and other symmetric cryptosystems. In practice, Bob typically encrypts a secret message with a symmetric algorithm, encrypts the (comparatively short) symmetric key with RSA, and transmits both the RSA-encrypted symmetric key and the symmetrically-encrypted message to Alice.

This procedure raises additional security issues. For instance, it is of utmost importance to use a strong random number generator for the symmetric key, because otherwise Eve (an eavesdropper wanting to see what was sent) could bypass RSA by guessing the symmetric key.

Key distribution

As with all ciphers, how RSA public keys are distributed is important to security. Key distribution must be secured against a man-in-the-middle attack. Suppose Eve has some way to give Bob arbitrary keys and make him believe they belong to Alice. Suppose further that Eve can intercept transmissions between Alice and Bob. Eve sends Bob her own public key, which Bob believes to be Alice's. Eve can then intercept any ciphertext sent by Bob, decrypt it with her own private key, keep a copy of the message, encrypt the message with Alice's public key, and send the new ciphertext to Alice. In principle, neither Alice nor Bob would be able to detect Eve's presence. Defenses against such attacks are often based on digital certificates or other components of a public key infrastructure.

Timing attacks

Kocher described a new attack on RSA in 1995: if the attacker Eve knows Alice's hardware in sufficient detail and is able to measure the decryption times for several known ciphertexts, she can deduce the decryption key $d$ quickly. This attack can also be applied against the RSA signature scheme. In 2003, Boneh and Brumley demonstrated a more practical attack capable of recovering RSA factorizations over a network connection (e.g., from a Secure Socket Layer (SSL)-enabled webserver). This attack takes advantage of information leaked by the Chinese remainder theorem optimization used by many RSA implementations.

One way to thwart these attacks is to ensure that the decryption operation takes a constant amount of time for every ciphertext. However, this approach can significantly reduce performance. Instead, most RSA implementations use an alternate technique known as cryptographic blinding. RSA blinding makes use of the multiplicative property of RSA. Instead of computing $c d mod n$ , Alice first chooses a secret random value $r$ and computes $(r e c) d mod n$ . The result of this computation is $r m ~ \bmod ~n$ and so the effect of $r$ can be removed by multiplying by its inverse. A new value of $r$ is chosen for each ciphertext. With blinding applied, the decryption time is no longer correlated to the value of the input ciphertext and so the timing attack fails.

Adaptive chosen ciphertext attacks

In 1998, Daniel Bleichenbacher described the first practical adaptive chosen ciphertext attack, against RSA-encrypted messages using the PKCS #1 v1 padding scheme (a padding scheme randomizes and adds structure to an RSA-encrypted message, so it is possible to determine whether a decrypted message is valid.) Due to flaws with the PKCS #1 scheme, Bleichenbacher was able to mount a practical attack against RSA implementations of the Secure Socket Layer protocol, and to recover session keys. As a result of this work, cryptographers now recommend the use of provably secure padding schemes such as Optimal Asymmetric Encryption Padding, and RSA Laboratories has released new versions of PKCS #1 that are not vulnerable to these attacks.

Branch prediction analysis attacks

Branch prediction analysis is also called BPA. Many processors use a branch predictor to determine whether a conditional branch in the instruction flow of a program is likely to be taken or not. Usually these processors also implement simultaneous multithreading (SMT). Branch prediction analysis attacks use a spy process to discover (statistically) the private key when processed with these processors.

Simple Branch Prediction Analysis (SBPA) claims to improve BPA in a non-statistical way. In their paper, "On the Power of Simple Branch Prediction Analysis", the authors of SBPA (Onur Aciicmez and Cetin Kaya Koc) claim to have discovered 508 out of 512 bits of an RSA key in 10 iterations.

::DES::
Data Encryption Standard (DES) is a widely-used method of data encryption using a private (secret) key that was judged so difficult to break by the U.S. government that it was restricted for exportation to other countries. There are 72,000,000,000,000,000 (72 quadrillion) or more possible encryption keys that can be used. For each given message, the key is chosen at random from among this enormous number of keys. Like other private key cryptographic methods, both the sender and the receiver must know and use the same private key.

DES applies a 56-bit key to each 64-bit block of data. The process can run in several modes and involves 16 rounds or operations. Although this is considered "strong" encryption, many companies use "triple DES", which applies three keys in succession. This is not to say that a DES-encrypted message cannot be "broken." Early in 1997, Rivest-Shamir-Adleman, owners of another encryption approach, offered a $10,000 reward for breaking a DES message. A cooperative effort on the Internet of over 14,000 computer users trying out various keys finally deciphered the message, discovering the key after running through only 18 quadrillion of the 72 quadrillion possible keys! Few messages sent today with DES encryption are likely to be subject to this kind of code-breaking effort.

DES originated at IBM in 1977 and was adopted by the U.S. Department of Defense. It is specified in the ANSI X3.92 and X3.106 standards and in the Federal FIPS 46 and 81 standards. Concerned that the encryption algorithm could be used by unfriendly governments, the U.S. government has prevented export of the encryption software. However, free versions of the software are widely available on bulletin board services and Web sites. Since there is some concern that the encryption algorithm will remain relatively unbreakable, NIST has indicated DES will not be recertified as a standard and submissions for its replacement are being accepted. The next standard will be known as the Advanced Encryption Standard (AES).

::LAB 3: CLASSIC CRYPTOGRAPHY

cryptography is the study of

secret (crypto-) writing (-graphy)

concerned with developing algorithms which may be used to:
- conceal the context of some message from all except the sender and recipient (privacy or secrecy), and/or
- verify the correctness of a message to the recipient (authentication)

form the basis of many technological solutions to computer and communications security problems

Basic Concepts

cryptography: the art or science encompassing the principles and methods of transforming an intelligible message into one that is unintelligible, and then retransforming that message back to its original form
plaintext: the original intelligible message
ciphertext: the transformed message
cipher: an algorithm for transforming an intelligible message into one that is unintelligible by transposition and/or substitution methods
key: some critical information used by the cipher, known only to the sender & receiver
encipher (encode): the process of converting plaintext to ciphertext using a cipher and a key
decipher (decode): the process of converting ciphertext back into plaintext using a cipher and a key
cryptanalysis: the study of principles and methods of transforming an unintelligible message back into an intelligible message without knowledge of the key. Also called codebreaking
cryptology: both cryptography and cryptanalysis
code: an algorithm for transforming an intelligible message into an unintelligible one using a code-book

Concepts

Encryption C = E_(K)(P)

Decryption P = E_(K)^(-1)(C)

E_(K) is chosen from a family of transformations known as a cryptographic system.

The parameter that selects the individual transformation is called the key K, selected from a keyspace K

More formally a cryptographic system is a single parameter family of invertible transformations

E_(K) ; K in K : P -> C

with the inverse algorithm E_(K)^(-1) ; K in K : C -> P

such that the inverse is unique

Usually assume the cryptographic system is public, and only the key is secret information

Private-Key Encryption Algorithms

a private-key (or secret-key, or single-key) encryption algorithm is one where the sender and the recipient share a common, or closely related, key

all traditional encryption algorithms are private-key

overview of a private-key encryption system and attacker

Cryptanalytic Attacks

have several different types of attacks

ciphertext only

only have access to some enciphered messages
use statistical attacks only

known plaintext

know (or strongly suspect) some plaintext-ciphertext pairs
use this knowledge in attacking cipher

chosen plaintext

can select plaintext and obtain corresponding ciphertext
use knowledge of algorithm structure in attack

chosen plaintext-ciphertext

can select plaintext and obtain corresponding ciphertext, or select ciphertext and obtain plaintext
allows further knowledge of algorithm structure to be used

Unconditional and Computational Security

two fundamentally different ways ciphers may be secure
unconditional security
- no matter how much computer power is available, the cipher cannot be broken
computational security
- given limited computing resources (eg time needed for calculations is greater than age of universe), the cipher cannot be broken

A Brief History of Cryptography

Ancient Ciphers

have a history of at least 4000 years
ancient Egyptians enciphered some of their hieroglyphic writing on monuments

ancient Hebrews enciphered certain words in the scriptures
2000 years ago Julius Ceasar used a simple substitution cipher, now known as the Caesar cipher
Roger Bacon described several methods in 1200s
Geoffrey Chaucer included several ciphers in his works
Leon Alberti devised a cipher wheel, and described the principles of frequency analysis in the 1460s
Blaise de Vigenère published a book on cryptology in 1585, & described the polyalphabetic substitution cipher
increasing use, esp in diplomacy & war over centuries

Machine Ciphers

Jefferson cylinder, developed in 1790s, comprised 36 disks, each with a random alphabet, order of disks was key, message was set, then another row became cipher

Wheatstone disc, originally invented by Wadsworth in 1817, but developed by Wheatstone in 1860's, comprised two concentric wheels used to generate a polyalphabetic cipher

Enigma Rotor machine, one of a very important class of cipher machines, heavily used during 2nd world war, comprised a series of rotor wheels with internal cross-connections, providing a substitution using a continuosly changing alphabet

Classical Cryptographic Techniques

have two basic components of classical ciphers: substitution and transposition
in substitution ciphers letters are replaced by other letters
in transposition ciphers the letters are arranged in a different order
these ciphers may be:
monoalphabetic - only one substitution/ transposition is used, or
polyalphabetic - where several substitutions/ transpositions are used
several such ciphers may be concatentated together to form a product cipher

Caesar Cipher - a monoalphabetic cipher

replace each letter of message by a letter a fixed distance away eg use the 3rd letter on
reputedly used by Julius Caesar

eg.

	L FDPH L VDZ L FRQTXHUHG
	I CAME I SAW I CONQUERED

ie mapping is

	ABCDEFGHIJKLMNOPQRSTUVWXYZ
	DEFGHIJKLMNOPQRSTUVWXYZABC

can describe this cipher as:

Encryption E_(k) : i -> i + k mod 26

Decryption D_(k) : i -> i - k mod 26

Cryptanalysis of the Caesar Cipher

only have 26 possible ciphers
could simply try each in turn - exhaustive key search

				GDUCUGQFRMPCNJYACJCRRCPQ
				HEVDVHRGSNQDOKZBDKDSSDQR
	Plain	-	IFWEWISHTOREPLACELETTERS
				JGXFXJTIUPSFQMBDFMFUUFST
				KHYGYKUJVQTGRNCEGNGVVGTU
	Cipher -	LIZHZLVKWRUHSODFHOHWWHUV
				MJAIAMWLXSVITPEGIPIXXIVW

also can use letter frequency analysis

Single Letter              Double Letter             Triple Letter             
E                          TH                        THE                       
T                          HE                        AND                       
R                          IN                        TIO                       
N                          ER                        ATI                       
I                          RE                        FOR                       
O                          ON                        THA                       
A                          AN                        TER                       
S                          EN                        RES

Character Frequencies

in most languages letters are not equally common
in English e is by far the most common letter
have tables of single double & triple letter frequencies
these are different for different languages (see Appendix A in Seberry & Pieprzyk)

use these tables to compare with letter frequencies in ciphertext, since a monoalphabetic substitution does not change relative letter frequencies

[1] do need a moderate amount of ciphertext (100+ letters)

Modular Arithmetic monoalphabetic cipher

more generally could use a more complex equation to calculate the ciphertext letter for each plaintext letter

E_(a b) : i ->a.i + b mod 26

nb a must not divide 26 (ie gcd(a,26) = 1)

otherwise cipher is not reversible eg a=2

and a=0, b=1, c=2 ... , y=24, z=25

eg E_(5 7) : i ->5.i + 7 mod 26

Cryptanalysis:

use letter frequency counts to guess a couple of possible letter mappings
- nb frequency pattern not produced just by a shift
use these mappings to solve 2 simultaneous equations to derive above parameters

Example - Sinkov pp 34-35

Mixed Alphabets

most generally we could use an arbitrary mixed (jumbled) alphabet
each plaintext letter is given a different random ciphertext letter, hence key is 26 letters long

Plain:   ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher:  DKVQFIBJWPESCXHTMYAUOLRGZN
Plaintext:  IFWEWISHTOREPLACELETTERS
Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA

now have a total of 26! ^(~) 4 ^(x) 10^(26) keys
with so many keys, might think this is secure

!!!WRONG!!!

problem is not the number of keys, rather:

1) there is lots of statistical information in message

2) can solve the problem piece by piece

(ie can get key nearly right, and nearly get message)

(near enough MUST NOT be good enough!)

Cryptanalysis

use frequency counts to guess letter by letter
also have frequencies for digraphs & trigraphs

General Monoalphabetic

special form of mixed alphabet
use key as follows:
- write key (with repeated letters deleted)
- then write all remaining letters in columns underneath
- then read off by columns to get ciphertext equivalents

Example Seberry p66

	STARW
	BCDEF
	GHIJK
	LMNOP
	QUVXY
	Z

Plain:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher: SBGLQZTCHMUADINVREJOXWFKPY

Plaintext:  I KNOW ONLY THAT I KNOW NOTHING
Ciphertext: H UINF NIAP OCSO H UINF INOCHIT

Polyalphabetic Substitution

in general use more than one substitution alphabet
makes cryptanalysis harder since have more alphabets to guess
and because flattens frequency distribution
(since same plaintext letter gets replaced by several ciphertext letter, depending on which alphabet is used)

Vigenère Cipher

basically multiple caesar ciphers
key is multiple letters long K = k_(1) k_(2) ... k_(d)
ith letter specifies ith alphabet to use
use each alphabet in turn, repeating from start after d letters in message

Plaintext	THISPROCESSCANALSOBEEXPRESSED
Keyword		CIPHERCIPHERCIPHERCIPHERCIPHE
Plaintext	VPXZTIQKTZWTCVPSWFDMTETIGAHLH

can use a Saint-Cyr Slide for easier encryption

based on a Vigenère Tableau

   ABCDEFGHIJKLMNOPQRSTUVWXYZ

A  ABCDEFGHIJKLMNOPQRSTUVWXYZ
B  BCDEFGHIJKLMNOPQRSTUVWXYZA
C  CDEFGHIJKLMNOPQRSTUVWXYZAB
D  DEFGHIJKLMNOPQRSTUVWXYZABC
E  EFGHIJKLMNOPQRSTUVWXYZABCD
F  FGHIJKLMNOPQRSTUVWXYZABCDE
G  GHIJKLMNOPQRSTUVWXYZABCDEF
H  HIJKLMNOPQRSTUVWXYZABCDEFG
I  IJKLMNOPQRSTUVWXYZABCDEFGH
J  JKLMNOPQRSTUVWXYZABCDEFGHI
K  KLMNOPQRSTUVWXYZABCDEFGHIJ
L  LMNOPQRSTUVWXYZABCDEFGHIJK
M  MNOPQRSTUVWXYZABCDEFGHIJKL
N  NOPQRSTUVWXYZABCDEFGHIJKLM
O  OPQRSTUVWXYZABCDEFGHIJKLMN
P  PQRSTUVWXYZABCDEFGHIJKLMNO
Q  QRSTUVWXYZABCDEFGHIJKLMNOP
R  RSTUVWXYZABCDEFGHIJKLMNOPQ
S  STUVWXYZABCDEFGHIJKLMNOPQR
T  TUVWXYZABCDEFGHIJKLMNOPQRS
U  UVWXYZABCDEFGHIJKLMNOPQRST
V  VWXYZABCDEFGHIJKLMNOPQRSTU
W  WXYZABCDEFGHIJKLMNOPQRSTUV
X  XYZABCDEFGHIJKLMNOPQRSTUVW
Y  YZABCDEFGHIJKLMNOPQRSTUVWX
Z  ZABCDEFGHIJKLMNOPQRSTUVWXY

can describe this cipher as:

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = a + k_(i) (mod n)

Beauford Cipher

similar to Vigenère but with alphabet written backwards
can be descibed by

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = (k_(i) - a) (mod n)

and its inverse is

f_(i) ^(-1)(a) = (k_(i) - c) (mod n)

Example - Seberry p71

Key = d
Plain:   ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher:  DCBAZYXWVUTSRQPONMLKJIHGFE

Variant-Beauford Cipher

just the inverse of the Vigenère (decrypts it)

given K = k_(1) k_(2) ... k_(d)

then f_(i) (a) = a - k_(i) (mod n)

Language Redundancy & Unicity Distance

human languages are highly redundant
- eg th lrd s m shphrd shll nt wnt
Claude Shannon derived several important results about the information content of languages in 1949
entropy of a message H(X) is related to the number of bits of information needed to encode a message X [2]
- cannot exceed log_(2)n bits for n possible messages
the rate of langauge for messages of length k denotes the average number of bits in each character

D = F(H(M),k)

rate of English is about 3.2 bits/letter
distinguish information context and redundancy
Shannon defined the unicity distance of a cipher to give a quantatative measure of:
- the security of a cipher (must not be too small)
- the amount of ciphertext N needed to break it

N = F(H(K),D)

where H(K) is entropy (amount of info) of the key,

and is D the rate of the language used (eg 3.2)

for polynomial based monoalphabetic substitution ciphers have:

N = F(H(K),D) = F(log_(2)26,3.2) = 1.5

hence only need 2 letters to break

for general monoalphabetic substitution ciphers have

N = F(H(K),D) = F(log_(2)n!,D) = F(log_(2)26!,3.2) = F(26 log_(2)F(26,e),3.2) = 27.6

hence only need 27 or 28 letters to break

for polyalphabetic substitution ciphers, if have s possible keys for each simple subs, and d keys used, then

N = F(H(K),D) = F(log_(2)s^(d),D) = F(d log_(2)26,3.2) = 1.5d

hence need 1.5 times the number of separate substitutions used letters to break the cipher

but first need to determine just how many alphabets were used
- Kasiski method
- index of coincidence

Kasiski Method

use repetitions in ciphertext to give clues as to period, looking for same plaintext an exact period apart, leading to same ciphertext

Example - Seberry p71

Plaintext:   TOBEORNOTTOBE
Key:         NOWNOWNOWNOWN
Ciphertext:  GCXRCNACPGCXR

Since repeats are 9 chars apart, guess period is 3 or 9.

Index of Coincidence

Index of Coincidence (IC) was introduced in 1920s by William Friedman
measures variation of frequencies of letters in ciphertext
- period = 1 => simple subs => variation is high, IC high
- period > 1 => poly subs => variation is reduced, IC low

see Seberry Table 3.2 p72 and Table 3.3 p74

d           IC             
1           0.0660         
2           0.0520         
3           0.0473         
4           0.0450         
5           0.0436         
6           0.0427         
7           0.0420         
8           0.0415         
9           0.0411         
10          0.0408         
11          0.0405         
12          0.0403         
13          0.0402         
14          0.0400         
15          0.0399         
...         ...            
Inf         0.0380

	Table 3.3 - Period and IC for English

first define a measure of roughness (MR) giving variation of frequencies of individual characters relative to a uniform distribution

		MR = Isu(i=o,n-1,(p_(i) - F(1,n))^(2))

where p_(i) is probability an arbitrary character in ciphertext is the ith character a_(i) in the alphabet

			 Isu(i=o,n-1,p_(i)) = 1

for English letters can derive

		MR = Isu(i=o,n-1,p_(i)^(2)) - 0.038

		MR + 0.038 = Isu(i=o,n-1,p_(i)^(2))

is prob two arbitrary letters in ciphertext are the same

can compute MR for plaintext using characteristic letter frequencies

eg MR for English is 0.028 (0.066 - 0.038)

can also compute MR for a flat distribution as 0
since probabilities and period are unknown, cannot compute MR, however can estimate from ciphertext
now the number of pairs of letters that can be chosen from ciphertext of length N is

		Bbc[(S(N,2)) = F(1,2) N (N-1)

if F_(i) is the freq of the ith letter of English in the ciphertext, then the number of pairs containing just the ith letter is

		F(F_(i)(F_(i)-1),2)		and	Isu(i=o,n-1,F_(i)) = 1

now define the Index of Coincidence (IC) as the prob that two letters at random from the ciphertext are indeed the same

	IC = 	Isu(i=o,n-1,F(F_(i)(F_(i)-1),N(N-1)))

and use the IC estimate in

		MR + 0.038 = IC

since usually use IC in crypto work, expect that

		0.038 < IC < 0.066

for a cipher of period d the expected value of the IC is

		Exp(IC) = F(1,d) F(N-d,N-1)(0.066) + Bbc[(S(d-1,d))F(N,N-1)(0.038)

and we can use these values to estimate d from the ciphertext

Example program to compute IC - Seberry Fig3.4 p74

Solving Polyalphabetic Ciphers

use Kasiski method & IC to estimate period d
then separate ciphertext into d sections, and solve each as a monoalphabetic cipher

Example - Seberry pp73-77

Krypto program

this is a program to help solve simple substitution and transposition ciphers
invoke using

krypto [file]

has the following commands available

       Command                                    Meaning                           
?                       this message.                                               
!                       execute a shell command.                                    
f [ [n]]        print [the n most] frequent strings of length seqlen.       
g [ ]             print the frequency distribution graph of letters.          
i [
]                 calculate the index of coincidence of the text.             
l [ ]             list only the modified string.  [b=blklength, B=blks/line]  
p                       print current code.                                         
q                       exit.                                                       
s             substitute ch2 for ch1.                                     
S [-] -[gvbB] {keys}    Perform the substitution specified by the key.              
T [-] |key        Transpose text by perm or keyword. e.g. T 4,5,2,3,1         
t  [/regexp]         look for transpositions of period n;  [print only /regexp]. 
B [-] |key        apply the specifed rectangular encryption to the text.      
b  [/regexp]         look for block decryptions of size n;  [print only          
                       /regexp].                                                   
u                       undo previous modification.                                 
z                       reset the code to its initial state.                        
r                 enter code from file.                                       
w                 write code to file.                                         
e                       edit code.

see man entry for more details

Transposition Ciphers

transposition or permutation ciphers hide the message contents by rearranging the order of the letters

Scytale cipher

an early Greek transposition cipher
a strip of paper was wound round a staff
message written along staff in rows, then paper removed
leaving a strip of seemingly random letters

not very secure as key was width of paper & staff

For information on lots of simple substitution and permutation ciphers see:

A. Sinkov "Elementary Cryptanalysis", New Mathematical Library, Random House, 1968* other simple transposition ciphers include:

Reverse cipher

write the message backwards

Plain:	I CAME I SAW I CONQUERED
Cipher:	DEREU QNOCI WASIE MACI

Rail Fence cipher

write message with letters on alternate rows
read off cipher row by row

Plain:	I A E S W C N U R D
        C M I A I O Q E E
Cipher:	IAESW CNURD CMIAI OQEE

Geometric Figure

write message following one pattern and read out with another

Row Transposition ciphers

in general write message in a number of columns and then use some rule to read off from these columns
key could be a series of number being the order to: read off the cipher; or write in the plaintext

Plain:	THESIMPLESTPOSSIBLETRANSPOSITIONSXX
Key (R):      2 5 4 1 3	
Key (W):                           4 1 5 3 2 	

             T H E S I		S T I E H 	
             M P L E S		E M S L P 	
             T P O S S		S T S O P 	
             I B L E T		E I T L B 	
             R A N S P		S R P N A 	
             O S I T I		T O I I S 	
             O N S X X		X O X S N
Cipher:	STIEH EMSLP STSOP EITLB SRPNA TOIIS XOXSN

Example - Davies p26 Fig 2.14

or can use a word, with letter order giving sequence: to write in the plaintext; or read off the cipher

Plain:	ACONVENIENTWAYTOEXPRESSTHEPERMUTATION
Key (W):      C O M P U T E R
Key (W):      1 4 3 5 8 7 2 6
	
             A N O V I N C E
             E W T A O T N Y
             H E P R T U E M
             A O I N Z Z T Z

Cipher:       ANOVI NCEEW TAOTN YHEPR TUEMA OINZZ TZ

Example - Davies p26 Fig 2.15

key idea for row transposition ciphers is that message is in groups that have the letters reordered in each
Exercise using key sorcery (to read out) encipher:

Key(R):	sorcery => 6 3 4 1 2 5 7
laser beams can be modulated to carry more intelligence than radio waves

gives

erasb lecam snabd umole atoed ctamo ryrre elntl iicee ntgha dnria oesav w

decryption consists of:
- writing the message out in columns
- reading off the message by reordering columns
- (use T command in krypto, uses read out keys)
hint - its not a good idea to leave message in groups matching the size of your key!!!

Cryptanalysis of Row Transposition ciphers

a frequency count will show a normal language profile
hence know have letters rearranged
basic idea is to guess period, then look at all possible permutations in period, and search for common patterns (eg t command in krypto)
use lists of common pairs & triples & other features

Example - Seberry p67-8 [3]

to determine the complexity of this cipher, we can calculate its unicity distance
- given blocks of period d, there are d! keys, hence

N = F(H(K),D) = F(log_(2)d!,D) = F(d log_(2)(d/e),3.2)

Seberry Table 3.1 p69

Block (Columnar) Transposition ciphers

another group of ciphers are block (columnar) transposition ciphers where the message is written in rows, but read off by columns in order given by key (use B command in krypto)
for ease of recovery may insist matrix is filled

Key(R):       s o r c e r y        s o r c e r y
Key(R):       6 3 4 1 2 5 7        6 3 4 1 2 5 7

             l a s e r b e        l a s e r b e
             a m s c a n b        a m s c a n b
             e m o d u l a        e m o d u l a
             t e d t o c a        t e d t o c a
             r r y m o r e        r r y m o r e
             i n t e l l i        i n t e l l i
             g e n c e t h        g e n c e t h
             a n r a d i o        a n r a d i o
             w a v e s            w a v e s q r

giving ciphertext (by reading off cols 4, 5, 2, 3, 6, 1, 7)

ecdtm ecaer auool edsam merne nasso dytnr vbnlc rltiq laetr igawe baaei hor

decryption consists of:
- calculating how many rows there are (by dividing message length by key length)
- then write out message down columns in order given by key

Example - Sinkov p148

exercise - Sinkov p148 #74

Sinkov p148

Cryptanalysis of Block Transposition ciphers

again know must be a transposition, and guess is perhaps a block transposition
guess size of matrix by looking at factors of message length, and write out by columns
then look for ways of reordering pairs of columns to give common pairs or triples (very much trial & error)
(nb use b command in krypto to try possibilities)

Example - Sinkov p 149-151

Nihilist ciphers

a more complex transposition cipher using both row and column transpositions is the nihilist cipher
write message in rows in order controlled by the key (as for a row cipher)
then read off by rows, but in order controlled by the key, this time written down the side
uses a period of size the square of the key length

Plaintext:    NOWISTHETIMEFORALLGOODMEN

Key (W):             L E M O N
                    2 1 3 5 4
             L 2    O N W S I
             E 1    H T E I T
             M 3    E M F R O
             0 5    L A L O G
             N 4    D O M N E

Nihilist Cipher:     HTEIT ONWSI EMFRO DOMNE LALOG

Diagonal Cipher:     ONHET WSEML DAFII TRLOM OOGNE

Example - Davis Fig2.16 p27

attacking this cipher depends on column and row rearrangement, with much trial and error
for more complexity can vary readout algorithm
- diagonal cipher reads out on fwd diag (/) in alternate directions (up diag, down diag etc), ie a zig-zag read out

Product ciphers

can see that in general ciphers based on just substitutions or just transpositions are not secure
what about using several ciphers in order
- two substitutions are really only one more complex substitution
- two transpositions are really only one more complex transposition
- but a substitution followed by a transposition makes a new much harder cipher
product ciphers consist substitution-transposition combinations chained together
in general are far too hard to do by hand, however one famous product cipher, the 'ADFGVX' cipher was used in WW1 (see Kahn pp339-350)
instead there use had to wait for the invention of the cipher machine, particularly the rotor machines (eg Enigma, Hagalin) mentioned briefly earlier

ADFGVX Product Cipher

named since only letters ADFGVX are used
chosen since have very distinct morse codes
uses a fixed substitution table to map each plaintext letter to a letter pair (row-col index)
then uses a keyed block transposition

	
Substitution Table

\\    A     D     F     G     V     X    
A     K     Z     W     R     1     F    
D     9     B     6     C     L     5    
F     Q     7     J     P     G     X    
G     E     V     Y     3     A     N    
V     8     O     D     H     0     2    
X     U     4     I     S     T     M

	Plaintext:	PRODUCTCIPHERS
	
	Intermediate Text:
				FG AG VD VF XA DG XV
				DG XF FG VG GA AG XG

Keyed Block Columnlar Transposition Matrix

D     E     U     T     S     C     H        Key                    
2     3     7     6     5     1     4        Sorted Order           
F     G     A     G     V     D     V                               
F     X     A     D     G     X     V                               
D     G     X     F     F     G     V                               
G     G     A     A     G     X     G

	Ciphertext:	DXGX FFDG GXGG VVVG VGFG CDFA AAXA

Lab 1-introduction to vmware

This lab we learn about vmware . What is vmware?? Virtual machine software from VMware, that allows multiple copies of the same operating system or several different operating systems to run in the same x86-based machine. For years, VMware has been the leader in virtualization software.

VMware Workstation installation

This is simple step by step on how to install VMware Workstation:

1.Download VMware Workstation from http://www.vmware.com/download/ws/. Then, double click the VMware launcher to start the installation wizards.

2. Click NEXT and choose Typical setup type

3. Choose the location for VMware Workstation installation. Then, click NEXT

4. Configure the shortcuts for the VMware Workstation and click NEXT

5. Click INSTALL. This will take several minutes to finish

6. Enter the serial number for the VMware Workstation.

7. Click FINISH and restart the computer.

::Life of Security::

Thursday, October 22, 2009

LEC 10:: Legal and Ethical Issues in Computer Security

LEC 9:: Intrusion Detection System

LEC 8:: FIREWALL

LEC 7:: WIRELESS SECURITY

LEC 6:: SECURITY APPLICATION

LEC 5:: Security in network

Sunday, October 4, 2009

LEC 4:: AUTHENTICATION & ACCES CONTROL

::HalWa qALbU::

::Aku Milik TUHANKU..::

::SaHaBaT::

::Sepintas Lalu::

:; Sepintas Bicara ::

<< ASMA ALLAH >>

- DeMi MaSa-

-Menghitung Hari-

Blog Archive

Teman Sebicara

::LINK ::

LAB 6::SECURITY IN NETWORK.

IPSec Network Security

Description

::LAB 5: WEB APPLICATION SECURITY

::LAB 4: Modern Cryptography(extended version)

Operation

Key generation

Encryption

Decryption

A working example

Padding schemes

Signing messages

Security and practical considerations

Integer factorization and RSA problem

Key generation

Speed

Key distribution

Timing attacks

Adaptive chosen ciphertext attacks

Branch prediction analysis attacks

::LAB 3: CLASSIC CRYPTOGRAPHY

Basic Concepts

Concepts

Private-Key Encryption Algorithms

Cryptanalytic Attacks

ciphertext only

known plaintext

chosen plaintext

chosen plaintext-ciphertext

Unconditional and Computational Security

A Brief History of Cryptography

Ancient Ciphers

Machine Ciphers

Classical Cryptographic Techniques

Caesar Cipher - a monoalphabetic cipher

Cryptanalysis of the Caesar Cipher

Character Frequencies

Modular Arithmetic monoalphabetic cipher

Mixed Alphabets

General Monoalphabetic

Polyalphabetic Substitution

Vigenère Cipher

Beauford Cipher

Variant-Beauford Cipher

Language Redundancy & Unicity Distance

Kasiski Method

Index of Coincidence

Solving Polyalphabetic Ciphers

Krypto program

Transposition Ciphers

Scytale cipher

Reverse cipher

Rail Fence cipher

Geometric Figure

Row Transposition ciphers

Cryptanalysis of Row Transposition ciphers

Block (Columnar) Transposition ciphers

Cryptanalysis of Block Transposition ciphers

Nihilist ciphers