Cs2610

Information security protects information against unauthorized access or disclosure. It also prevents unauthorized modification and disruption or destruction.

Digital files and databases • email and network communications • printed documents and records • personal and organizational information.

It protects sensitive personal information and business assets. It keeps operations running and supports government and national security. Large breaches such as Equifax can expose identity and financial data at scale.

Confidentiality: only authorized access. Integrity: correct and complete information without unauthorized changes. Availability: authorized users can access information when needed.

Hardware and software controls must work with policies and procedures and people. A technical tool alone cannot cover every security weakness.

Confidentiality limits information access to authorized parties. Stolen passwords or intercepted traffic or sending records to the wrong person can expose confidential information.

Encryption protects readable content. Authentication verifies identities. Access controls restrict permitted access. Data classification determines how sensitive information must be handled.

Integrity preserves data correctness and completeness and prevents unauthorized modification. Confidentiality controls who can read data. A medical record can remain secret yet lose integrity if its treatment information is changed.

At rest: stored on a device or medium. In transit: moving between systems. In use: actively processed or accessed. Integrity protection is needed in all three states.

Unauthorized changes • accidental edits • malware corruption • data loss caused by system malfunction.

Access controls limit who can modify data. Hashes and signatures detect changes when verified through a trusted reference. Version control preserves change history. Audit logs help identify what changed and who acted.

Availability means authorized users can obtain needed information and services. Power failures and denial-of-service attacks and ransomware can prevent access.

Redundancy supplies backup components or resources. Failover moves service to a working alternative. Firewalls can filter unwanted traffic that could disrupt service.

A vulnerability is a weakness in a system. A threat is a potentially harmful event or actor that could exploit that weakness. An unpatched service is a vulnerability. An attacker exploiting it is a threat.

Natural: fire or earthquake. Accidental: human mistakes or software errors. Malicious: intentional attacks such as phishing or malware or distributed denial of service.

Security competes with cost and time and available resources and usability. Systems retain weaknesses. The goal is to reduce and manage risk through appropriate protections.

A breach exposes data to an unauthorized party. Data loss makes data unavailable. Exfiltration transfers data without authorization. One incident may cause all three.

Identity theft • financial loss • reputation damage • loss of access to systems or information.

An unprotected router let an attacker reach servers holding customer data and offer stolen information for sale. One exposed entry point can cause lasting exposure and major costs: the slides cite a \$350 million settlement and \$150 million in security improvements.

A threat actor is a person or group that exploits vulnerabilities. Motives include fun and profit and disruption and blackmail or revenge and political goals.

An insider already has an organizational relationship or access that can be abused. An external actor attacks from outside that trusted relationship.

White-hat hackers test with authorization. Gray-hat hackers find vulnerabilities without permission and may report them. Black-hat hackers maliciously exploit systems without permission.

An attacker with limited technical skill who relies on tools or scripts written by others.

It is highly skilled and well funded and maintains long-term access to valuable targets. Persistence and sustained targeting distinguish it from a brief opportunistic attack.

State actors work for government interests. Hacktivists pursue social or political causes. Criminal syndicates organize attacks for profit. Competitors seek advantage by harming rival organizations.

An attack vector is a path used to exploit a weakness. Examples include direct access and wireless links and vulnerable or unsupported software and messaging and supply chains and social media and removable media and cloud services.

The attack surface is the collection of exposed entry or interaction points. A vector is a specific method used through one of those points. Reducing exposed services and weaknesses shrinks the surface.

Patch systems • remove unused services and open ports • replace default passwords • protect wireless connections • restrict access • train users. Each action removes or strengthens a potential entry point.

It manipulates people into compromising security: revealing secrets or clicking malicious links or sending money or downloading malicious software.

Social-based attacks exploit human emotions or trust. Physical-based attacks use proximity. Technical-based attacks use technology such as deceptive websites or DNS manipulation.

Authority invokes a superior's power. Familiarity makes the request seem known. Intimidation creates fear. Trust makes the victim accept the claimed relationship or identity without adequate verification.

Consensus says others already comply. Scarcity suggests a limited opportunity. Urgency demands immediate action. Each pressures the victim to act before checking the request.

Dumpster diving searches discarded material for information. Shoulder surfing observes sensitive input or screens. Tailgating follows an authorized person into a restricted area.

The attacker compromises a website frequently visited by the intended victims. Visiting that familiar site can expose them to malicious content or software.

Typosquatting uses a deceptive domain resembling a commonly mistyped legitimate name. Pharming redirects users to a fraudulent destination by manipulating name resolution such as DNS.

Phishing uses fraudulent messages to steal information or induce harmful actions. Vishing uses phone calls. Smishing uses SMS or text messages.

General phishing targets many unrelated recipients. Spear phishing targets a specific person or group. Whaling is targeted phishing against high-value people such as executives.

An attacker impersonates a trusted person or organization through email to deceive employees. Common goals include fraudulent payments or disclosure of sensitive information.

Malware is software designed to compromise confidentiality or integrity or availability. It may spread itself or block access or spy or mislead users or hide malicious activity. Phishing is a common delivery method.

A virus attaches to a host file or program and spreads when that host executes. A worm self-replicates across networks without requiring a user to run an infected host program.

Malicious code that operates primarily in memory or abuses existing system tools instead of relying on a conventional malicious file. It can be harder to find with file-focused detection.

They can steal or modify or destroy data. Worms may exploit network vulnerabilities to install other malware and backdoors on additional devices.

A bot is a compromised device under remote control. A command-and-control server sends instructions and receives results. A botnet is a group of bots coordinated for large-scale attacks.

It uses the victim's computing resources to mine cryptocurrency for the attacker. This consumes processing power and electricity without authorization.

Malware that denies access to files or systems and demands payment to restore access. It directly threatens availability and may also be associated with stolen-data extortion.

Spyware secretly collects information such as browsing activity or financial details or webcam output. A keylogger specifically records keyboard input and may capture passwords or payment information.

Unwanted preinstalled software consumes resources and can introduce vulnerabilities. Some bloatware may also collect data or include spyware.

A Trojan disguises harmful functions as legitimate software. A remote access Trojan specifically gives an attacker remote control to steal data or change settings or install more malware.

Software users may not knowingly want that is often bundled with another program. It may install adware or cause unwanted behavior even when it is not designed to cause direct damage.

A backdoor bypasses normal authentication. A logic bomb activates when a condition is met. A rootkit hides malicious activity while enabling privileged access.

A kernel rootkit targets the operating system kernel. An application rootkit modifies application files. Either can hide malware or backdoors and interfere with removal.

A mechanism that protects the confidentiality or integrity or availability of systems and data.

Technical controls use technology such as firewall rules. Managerial controls establish governance and policies. Operational controls are performed by people such as training. Physical controls protect facilities and equipment such as cameras or locks.

Preventive controls block incidents such as door locks. Deterrent controls discourage violations such as warning signs. Directive controls prescribe expected behavior such as an acceptable use policy.

Detective controls identify incidents such as alarms or motion detectors. Corrective controls restore normal operation such as recovering files from backups after ransomware.

Passive controls reduce or discourage incidents through preventive or deterrent or directive measures. Active controls detect incidents and respond through detective or corrective measures.

Identification claims an identity. Authentication verifies the claim. Authorization determines which resources and actions that identity may access. IAM manages these functions and the identities behind them.

A human or application or process or device. Identifiers may include usernames and certificates and tokens and SSH keys and smart cards.

Identity proofing verifies who a person is during enrollment such as checking identification when opening a bank account. Authentication later verifies that a login attempt belongs to the enrolled identity.

Characteristics associated with an identity such as name or email address or location or credentials. Access policies can use these attributes when making decisions.

Knowledge: something you know. Possession: something you have. Inherence: something you are. Location: where you are. Behavior: how you act.

Location may be checked through GPS coordinates or an IP address. Behavior may involve a drawn pattern or hand gesture or typing pattern. These supply context or evidence beyond knowledge and possession.

Password: knowledge. Security token: possession. Fingerprint: inherence. A physical biometric is something you are.

The messages and rules used to verify an identity. Examples include PAP and CHAP and Kerberos and EAP and IEEE 802.1X and RADIUS and TACACS+.

The subject requests access such as a user or process. The object is the resource being accessed such as a file or database. Authorization policy determines the subject's permitted actions on the object.

Discretionary access control • mandatory access control • role-based access control • attribute-based access control • rule-based access control.

Single-factor uses one factor category. Two-factor uses two different categories. MFA uses two or more different categories. Password plus phone approval and smart card plus PIN are examples of 2FA.

Both are knowledge factors. MFA requires evidence from different categories such as knowledge plus possession or inherence.

Static KBA uses previously selected questions and answers such as birthplace. Dynamic KBA generates questions from records such as previous addresses. Both depend on personal information that an attacker may discover.

An authentication code intended for one use. It is commonly a 6–10 digit code generated by software or hardware or delivered by SMS or email or phone call. It often supplies an additional authentication factor.

TOTP combines a shared secret with time and commonly changes every 30 seconds. HOTP combines a shared secret with an event-advanced counter and is not inherently time-expiring. The server tracks accepted counters to prevent reuse.

During setup the app and server share a secret key. Both use that secret with the same time or counter input to independently calculate matching OTPs.

The authentication server sends a login approval request to a registered device. The user approves or denies it. Control of that device acts as a possession factor.

A hardware token generates codes locally from a secret shared with the server. It does not depend on delivery through a phone or email channel. RSA SecurID is the lecture example.

Pre-generated one-time codes stored securely for future use. They provide backup access when the normal authenticator or network is unavailable. Each code should be consumed once.

A protected cryptographic processor typically on a motherboard. It stores keys and supports device authentication and measured or trusted boot. It helps detect unauthorized firmware or software changes.

It can protect the keys used to unlock an encrypted drive and condition release on the device's trusted state. Full-disk encryption covers operating system and user files. BitLocker with a TPM is the lecture example.

A dedicated appliance or expansion card that protects cryptographic keys and performs operations such as key generation and encryption. It is commonly used in enterprise servers and payment systems.

TPMs and HSMs provide hardware-protected cryptographic functions. A TPM typically serves one device while an HSM often serves enterprise workloads. FIPS 140 specifies security requirements for cryptographic modules.

Physical biometrics include fingerprints and facial features and iris or retina patterns and palm or vein patterns. Behavioral biometrics include voice and gait and signatures and typing patterns.

Users can authenticate with a physical or behavioral characteristic instead of memorizing or carrying another credential. Such traits can be harder to copy than a password but systems can still falsely accept or reject people. Biometrics are not infallible.

FAR measures impostor attempts incorrectly accepted: false accepts ÷ impostor attempts. FRR measures genuine attempts incorrectly rejected: false rejects ÷ genuine attempts. FAR is Type II and FRR is Type I in the slide convention.

A stricter acceptance threshold generally lowers false accepts but increases false rejects. A looser threshold generally lowers false rejects but increases false accepts.

CER or EER is the error rate where FAR equals FRR. A lower CER indicates better matching accuracy under that evaluation. The slides cite example target thresholds of FRR 3% and FAR 0.01%.

1. The client sends credentials. 2. The server returns ACK or NAK. PAP normally authenticates at session establishment and does not itself encrypt credentials. An unprotected channel exposes the password.

1. Server sends a random challenge. 2. Client returns a hash-based response using the challenge and shared secret. 3. Server computes its expected response and accepts or rejects. The shared secret is not transmitted.

CHAP proves knowledge of a shared secret through challenge-response instead of sending it directly. A fresh challenge limits simple response replay. CHAP can repeat authentication during a session.

Kerberos is ticket-based network authentication. A user authenticates and then presents tickets to obtain services without repeatedly submitting a password. It commonly appears in Windows domains and uses port 88.

A realm is an administrative domain using Kerberos. Its Key Distribution Center is a trusted service containing the Authentication Server and Ticket-Granting Server.

The AS authenticates the client and issues a ticket-granting ticket. The TGS accepts that TGT to issue a ticket for a requested service.

1. Client authenticates to AS. 2. AS returns a TGT. 3. Client presents TGT and service request to TGS. 4. TGS issues a service ticket. 5. Client presents it to the service. 6. Service validates it and grants access.

A TGT lets the client request tickets from the TGS. A service ticket is intended for a particular service and has a limited validity period. Neither should be treated as a reusable plaintext password.

Extensible Authentication Protocol is a framework for carrying different authentication methods. Request asks for information. Response supplies it. Success and Failure report the authentication result.

Both a server certificate and a client certificate. This supports certificate-based mutual authentication.

Both establish a TLS tunnel using a server certificate. The client authenticates inside the tunnel without requiring a client certificate. EAP-TTLS can carry methods such as PAP. PEAP tunnels EAP messages.

EAP-FAST can establish a protected tunnel using a server-issued Protected Access Credential or PAC. It can support certificates but does not always require them.

EAP-TLS: client and server certificates. EAP-TTLS and PEAP: server certificate with tunneled client authentication. EAP-FAST: PAC-based tunnel establishment can avoid certificate requirements.

EAP-TLS and EAP-TTLS and EAP-FAST and PEAP all support it when configured correctly. The server is authenticated through the chosen method and the client proves its identity using a certificate or protected inner credentials.

Port-based network access. It carries authentication exchanges so a wired or wireless device gains network access only after successful authentication.

Supplicant: endpoint requesting access. Authenticator: switch or access point controlling the port and relaying messages. Authentication server: verifies credentials and decides whether to allow access.

The supplicant requests access and supplies identity. The authenticator relays it to the authentication server. Server challenges and client responses pass through the authenticator. The server returns accept or reject and the authenticator enforces the result.

Authentication verifies identity. Authorization determines permitted access. Accounting records activity and resource use.

In Remote Authentication Dial-In User Service the client is a network access server such as an AP or switch. It relays user authentication requests. The central RADIUS server authenticates and authorizes access.

UDP 1812 for authentication and authorization. UDP 1813 for accounting.

Accept permits access. Reject denies it. Challenge requests additional authentication information before a final decision. Challenge-response can support additional factors.

The user connects to the NAS. The NAS sends an access request to the RADIUS server. The server may challenge for more information. A final accept starts the session or a reject denies it. Accounting can record session activity.

Terminal Access Controller Access-Control System Plus provides centralized AAA for administrative access to devices such as routers and switches. It separates authentication and authorization and accounting and uses TCP port 49.

Accept for valid authentication. Reject for failed authentication. Error for an authentication-system or communication failure.

TACACS+ protects the packet body while its header remains visible. Traditional RADIUS protects the password field rather than the entire packet body. Neither comparison means all transport metadata is hidden.

RADIUS commonly authenticates users joining a network. TACACS+ commonly controls administrator access to network equipment and can authorize individual administrative actions. RADIUS uses UDP while TACACS+ uses TCP.

Security Assertion Markup Language is an XML-based standard for exchanging authentication and authorization information. It commonly supports enterprise web single sign-on between an identity provider and service providers.

Principal: the user. Identity provider or IdP: authenticates the user and manages identity information. Service provider or SP: provides the application the user wants to access.

An assertion is an XML statement from the IdP about a user. Its digital signature lets the SP verify the trusted issuer and detect modification before relying on the information.

1. User requests the SP. 2. SP directs authentication to IdP. 3. IdP requests and verifies credentials. 4. IdP returns a signed assertion. 5. SP verifies it and grants or denies access.

Authentication: when and how the user authenticated. Attribute: identity information as name–value pairs. Authorization decision: permitted resources or actions. The SP uses the assertion to make its access decision.

Web sign-in using one identity provider across multiple relying parties. The IdP authenticates the user and the relying party accepts its identity confirmation to support single sign-on.

The user registers with an IdP and requests login at a relying party. The user authenticates to the IdP. The IdP confirms the identity to the relying party which then grants access.

It lets a user delegate limited resource access to an application without giving that application the user's password. OAuth is an authorization framework using access tokens for HTTP-based services.

1. User approves the client application's request. 2. Authorization server issues an access token. 3. Client presents the token to the resource server. 4. Resource server validates it and permits the authorized access.

SAML commonly supplies enterprise SSO assertions. OpenID supplies web identity authentication. OAuth delegates permission to access resources. Permission to read data is different from proof of who logged in.

How accounts are created and used and maintained and disabled and removed throughout their lifecycle.

User: ordinary individual access. Privileged: elevated system control. Shared: multiple users share credentials. Guest: temporary access. Service: used by an application or server rather than normal interactive login.

Multiple people use the same credentials. An activity log naming that account may not establish which person performed the action.

Complexity sets length and character requirements. History limits reuse of prior passwords. Age sets how long a password may be used before a required change.

Software that securely stores and manages passwords. It helps users keep distinct credentials without memorizing every password.

Geolocation estimates a device's position using sources such as GPS or IP. Geotagging associates geographic data with an item or device. Geofencing permits or restricts access according to a defined geographic boundary.

It compares successive login locations and times. If the implied trip could not plausibly occur in that interval the account may be compromised and the new login can be blocked or challenged.

IP or MAC-based network location identifies the connection point. Time-of-day rules specify allowed login periods. Policies can require both an approved network and an approved time.

Auditing reviews accounts and permissions. Disabling preserves an account but prevents access. Lockout temporarily blocks access after repeated failed logins and may require administrator action or a timeout to unlock.

It limits repeated failed attempts against an account. The lockout duration determines when automatic retry becomes possible. An administrator may instead need to unlock the account manually.

The object's owner grants or removes permissions. An access control list records which subjects may perform which actions. DAC is common in operating-system file permissions.

A central authority assigns subject clearances and object classification labels. Mandatory policy compares those labels to decide access. Individual owners cannot freely override the policy.

A collection of subjects and objects governed by a common security policy.

Top Secret > Secret > Confidential > Restricted > Unclassified. A subject's clearance and an object's classification are compared under the governing policy.

No read up prevents a lower-cleared subject from reading higher-classified data. No write down prevents higher-classified information from being written to a lower level. These rules protect confidentiality.

Access must also satisfy the system's discretionary permissions such as its ACL. Satisfying the mandatory label rules alone does not automatically grant access.

Administrators assign permissions to job roles and users to roles. Users inherit the permissions of their assigned roles. This is centrally controlled rather than left to each object owner.

A central authority or administrator controls access policy. Individual resource owners do not freely choose the governing permissions.

Subject attributes such as role or clearance. Object attributes such as sensitivity or owner. Environmental attributes such as time or location or threat level. A policy evaluates these together to allow or deny access.

It applies administrator-defined conditions such as source IP or time or device type or protocol or port. A firewall that allows HTTPS on TCP 443 and denies SSH on TCP 22 is an example.

Owner chooses: DAC. Labels and clearances: MAC. Job role: RBAC. Combined subject and object and environment attributes: ABAC. Explicit administrator conditions such as IP or port: rule-based control.

r permits reading. w permits writing or modification. x permits execution of a regular file. A dash means that permission is absent in that position.

r-x allows reading and executing. rw- allows reading and writing. rwx allows all three. Evaluate each position separately rather than treating the three characters as one permission.

The first character identifies file type. The next three permissions apply to the owner. The next three apply to the group. The final three apply to everyone else.

Owner: read and write and execute. Group: execute only. Other users: read and execute. The initial dash marks a regular file.

File Properties → Security. Full Control includes reading and writing and modifying and deleting plus changing permissions.

Modify permits reading and writing and deleting. Read & Execute permits viewing and running. Read permits viewing. Write permits creating or changing content. Full Control additionally includes changing permissions.

PAM or PIM secures and monitors elevated accounts such as Administrator or root. Least privilege gives each user only the permissions needed for their job and limits unnecessary privileged access.

They can configure systems and networks and manage accounts and override security controls and shut systems down. Compromise therefore gives an attacker broad power.

Access decisions based on current conditions such as user location or IP or device type or patch status or account risk. A policy may require 2FA before allowing a sensitive application.

Cryptography designs ways to protect information. Cryptanalysis studies how to break cryptographic protection. Cryptology includes both. The historical roots of cryptography mean secret writing.

Confidentiality • integrity • data-origin authentication • non-repudiation. Different primitives provide different goals. Encryption alone does not automatically provide all four.

Message authentication checks the claimed origin of a message. Non-repudiation provides evidence against a sender later denying it. A shared-key MAC does not distinguish which key holder created a tag. Digital signatures can support that distinction.

A lock hides message content and represents encryption. A seal reveals unauthorized changes and represents an authentication tag or signature. A readable message can be authenticated without being encrypted.

Substitution replaces plaintext elements with different elements. Transposition rearranges their positions without adding or removing elements. Neither historical technique alone provides modern cryptographic security.

A monoalphabetic substitution always maps a particular plaintext letter to the same ciphertext letter. A polyalphabetic substitution can map it differently depending on position or the selected alphabet.

Represent A–Z as 0–25. Encrypt with C=(P+k) mod 26. Decrypt with P=(C−k) mod 26. Wrap around the alphabet at either end.

The Caesar cipher shifts each letter three positions forward. Using that rule converts cryptography to fubswrjudskb. Decryption shifts each letter three positions backward.

Its shift is 13 in a 26-letter alphabet. Applying it twice shifts by 26 and restores the original. For example cryptography becomes pelcgbtencul.

Choose the rail count as the key. Write letters in a repeating diagonal down-and-up zigzag. Read each rail from top to bottom to form the ciphertext.

The rails read ROR • ASMAE • NW. Concatenating them gives RORASMAENW. The procedure preserves the original letters but changes their positions.

Write plaintext in rows whose width equals the keyword length. Rank keyword letters alphabetically. Read the columns from top to bottom in that ranked order. The keyword determines the permutation.

Write rows SPYW and ARE. The keyword ranks are K=3 • I=2 • T=4 • E=1. Read E then I then K then T: W + PR + SA + YE = WPRSAYE.

Symmetric confidentiality uses shared-key encryption such as AES with a secure mode. Asymmetric confidentiality uses public-key encryption such as RSA encryption or ElGamal.

Symmetric integrity and authentication use message authentication codes such as CBC-MAC. Asymmetric integrity and authentication use digital signatures such as RSA signatures. Hash functions and random generators support these constructions.

Cryptographic hashes • pseudorandom generators • key exchange • key management • password management. Strong encryption still depends on correct use of these supporting mechanisms.

Alice and Bob are intended communicating parties. Eve passively eavesdrops. Mallory actively observes and tampers. The goals are to hide content from Eve and detect Mallory's unauthorized changes.

Plaintext is the original message. Ciphertext is its encrypted form. A cipher is the algorithm. Encryption maps plaintext to ciphertext. Decryption reverses that transformation using the required key. Messages are represented as bits.

A key selects the cipher's transformation. The key space is the set of possible keys. Key length is the number of key bits. An unrestricted k-bit key space contains 2^k possible keys.

A key derivation procedure adds computational work to processing a password or weak secret. This makes repeated guesses more expensive. It does not create new unpredictability merely by producing a longer output.

Symmetric systems use a shared secret key for encryption and decryption. Asymmetric systems use a public key and a corresponding private key. Symmetric encryption is generally faster but requires secure shared-key distribution.

A cryptosystem should remain secure even when its algorithms and design are public. Security should depend on the secret key. A suspected leaked key should be replaceable without redesigning the system.

Confusion obscures the relationship between the key and ciphertext. Diffusion spreads plaintext structure across ciphertext bits. Changing one key or input bit should influence many output bits.

A small input change such as one plaintext or key bit causes many output bits to change. It helps resist analysis but does not alone prove the whole encryption scheme secure.

Seeing ciphertext should not reveal useful new information about the plaintext beyond permitted leakage such as length. An attacker should not reliably distinguish encryptions of two allowed candidate messages.

A ciphertext-only attacker has encrypted messages alone. A known-plaintext attacker also knows some corresponding plaintext–ciphertext pairs.

A CPA attacker obtains encryptions of selected messages. A CCA attacker obtains decryptions of selected ciphertexts subject to the model's restrictions. A combined chosen-plaintext/ciphertext attack model or CPCA allows both kinds of access.

The attacker resends an intercepted valid message or ciphertext. Replaying does not require learning the plaintext or changing the message. Freshness checks such as nonces or counters are needed to reject duplicates.

Indistinguishability under chosen-plaintext attack. The attacker selects equal-length M0 and M1. A challenger randomly chooses b and returns an encryption of Mb. The attacker may obtain chosen-message encryptions and tries to guess b better than random chance.

An efficient attacker achieves a non-negligible advantage over the 1/2 success probability of guessing. Security requires every allowed efficient attacker to have at most negligible advantage. One successful attack strategy establishes insecurity.

Ordinary encryption can reveal plaintext length. Different-length candidates could be distinguished from ciphertext length alone. Equal lengths isolate information leakage beyond that expected limitation.

The definition focuses on feasible attacks. An astronomically slow strategy or an advantage such as 2^−128 does not constitute a practical break merely because it is theoretically nonzero.

The attacker requests an encryption of M0 and compares it with the challenge. A match identifies M0 and a mismatch identifies M1. Secure repeated-message encryption needs suitable fresh randomness or unique state.

No. A deterministic cipher may have excellent confusion and diffusion yet expose repeated messages. The complete encryption construction and its use of randomness or state must satisfy the security definition.

It efficiently protects large amounts of data and is used within protocols such as HTTPS and IPsec. Both parties first need a secure way to obtain the same secret key.

KeyGen produces K. Enc_K(M) produces C. Dec_K(C) recovers M. Correctness requires Dec_K(Enc_K(M))=M for every valid message and generated key. The algorithms must also be efficient and secure.

A stream cipher combines plaintext with a generated keystream a bit or byte at a time. A block cipher transforms fixed-size blocks. Stream-like XOR encryption can handle continuous data efficiently.

Generate a keystream Z from secret key material. Encrypt with C=M⊕Z. Decrypt with M=C⊕Z using the same keystream. A ciphertext bit flip changes only the corresponding plaintext bit in this basic construction.

It expands secret key material into the bit stream used for stream encryption. A5/1 in legacy GSM is the lecture example. The keystream must not repeat where it protects different plaintexts.

0⊕0=0 • 0⊕1=1 • 1⊕0=1 • 1⊕1=0. XOR returns 1 exactly when its two input bits differ.

x⊕0=x and x⊕x=0. XOR is commutative and associative. Therefore x⊕y⊕x=y. To solve y⊕1=0 XOR both sides with 1 to obtain y=1.

It must be uniformly random and independent of the plaintext. It must be at least as long as the protected message and remain secret. Each key segment must be used only once.

Encryption: C=M⊕K. Decryption: M=C⊕K. Apply XOR at each matching bit position. The plaintext and ciphertext and used key segment have the same bit length.

XOR each corresponding bit. 01000001 ⊕ 11101100 = 10101101. That result is the ciphertext C.

C⊕K=(M⊕K)⊕K=M because K⊕K=0. For example 10101101 ⊕ 11101100 = 01000001.

For any plaintext M and ciphertext C there is exactly one compatible key K=M⊕C. All keys are equally likely. Observing C therefore does not favor one possible plaintext over another of the same length.

C0⊕C1=(M0⊕K)⊕(M1⊕K)=M0⊕M1. The key cancels. Knowing one plaintext then reveals the other by XORing with this result.

Communicating parties must securely distribute and store fresh random key material as long as all protected data. Reusing old material destroys its security. The slides cite reused Soviet wartime pads as a real example.

A one-time pad consumes fresh random secret bits as long as the message. A block-cipher scheme reuses a fixed-size secret key with a suitable mode and fresh IVs or unique nonces for different encryptions.

A byte is 8 bits. A hexadecimal digit is 4 bits so two hex digits make one byte. A machine word is architecture-dependent such as 32 or 64 bits.

Group bits into sets of four from the right and convert each group. Hex digits 0–9 represent values 0–9 and A–F represent 10–15. Example: 1100 0110 1000 0000 becomes 0xC680 or two bytes.

A permutation of all n-bit blocks. Every plaintext block maps to exactly one ciphertext block and the inverse decryption maps it back. A k-bit key selects among 2^k possible key settings.

Block size determines how many bits one primitive operation transforms. Key size determines the size of the key space. AES has 128-bit blocks even when its key has 192 or 256 bits. IDEA uses 64-bit blocks.

Divide the message into blocks and use a mode of operation. Some modes require padding for an incomplete final block. Stream-like modes can use only the needed portion of their last keystream block.

Its keyed permutation may look random to an efficient attacker yet remain deterministic. Repeated plaintext blocks produce repeated ciphertext blocks. A complete confidentiality scheme needs a secure mode and correct randomness or state.

Its 56-bit key is vulnerable to brute force and its 64-bit block is small. The slides cite the EFF's 1998 key search taking 56 hours. Strong confusion and diffusion do not compensate for inadequate sizes.

DES uses a 64-bit block and 56 effective key bits. It applies initial permutation and 16 Feistel rounds followed by final permutation. The block splits into two 32-bit halves.

Set the new left half to the old right half. Set the new right half to old left XOR f(old right and round key). The round function expands bits and applies key XOR and S-box substitutions and permutation.

S-box substitutions create confusion. Permutations and repeated Feistel rounds spread input influence to create diffusion and an avalanche effect. DES remains deterministic when used as a bare block cipher.

It uses encrypt–decrypt–encrypt: C=E_K3(D_K2(E_K1(M))). Its block size remains 64 bits. Repeated DES operations do not enlarge the block.

Three independent DES keys use 168 key bits. Two independent keys use 112. One repeated key uses 56 and collapses to ordinary DES under the EDE construction. These are key-material sizes rather than equal claims of attack strength.

It is slow and retains a 64-bit block size. Block collisions enable attacks such as Sweet32 at high data volumes. Longer key material does not solve the short-block problem.

128-bit key: 10 rounds. 192-bit key: 12 rounds. 256-bit key: 14 rounds. All three use 128-bit blocks. Round keys are derived from the original cipher key.

After an initial AddRoundKey the rounds apply SubBytes → ShiftRows → MixColumns → AddRoundKey. The final round omits MixColumns. Decryption applies corresponding inverse operations.

Substitution and shifting and mixing produce confusion and diffusion. Adequate key and block sizes resist generic attacks. AES is a security assumption rather than a mathematical proof of unbreakability. Bare AES remains deterministic and needs a secure mode.

They build encryption for arbitrary-length messages from a fixed-block primitive. Appropriate modes add randomness or unique state to avoid deterministic message leakage. The slides cover ECB and CBC and CFB and OFB and CTR.

Split into full blocks. Encrypt independently with C_i=E_K(M_i). Decrypt with M_i=D_K(C_i). Concatenate the results. ECB has no IV and no chaining between blocks.

It needs complete blocks so ordinary variable-length use requires padding. Both encryption and decryption can run in parallel because each block is independent.

The corresponding recovered plaintext block is scrambled through the cipher's avalanche effect. Other blocks are unaffected. There is no cross-block error propagation.

Equal plaintext blocks under one key produce equal ciphertext blocks. Repeated image regions or message structures remain visible as repeated encrypted blocks. AES-ECB is therefore not IND-CPA secure.

Actual message data may end with the same bits. The receiver cannot determine where data ends and padding begins without an additional length convention.

Append one 1 bit followed by enough 0 bits to reach a block boundary. Always add padding. An already aligned message receives an entire new padding block so unpadding can locate the final 1 marker.

For block size B bytes and message length L bytes compute p=B−(L mod B). Append p bytes each with value p. If L is already aligned then p=B and a full padding block is added.

HELLO occupies five bytes and AES blocks contain 16 bytes. Therefore p=16−5=11. Append eleven bytes of value 0x0B. Verify all padding bytes before removing them.

Pad into full blocks and choose a fresh unpredictable IV. Set C_0=IV. For each i compute C_i=E_K(M_i⊕C_(i−1)). Send IV followed by all ciphertext blocks.

Parse IV and ciphertext blocks. Set C_0=IV. Recover M_i=D_K(C_i)⊕C_(i−1). Concatenate the plaintext blocks and validate and remove padding.

XOR each plaintext block with the IV or previous ciphertext and then apply E. The successive XOR inputs are 10/10/01/01. The resulting ciphertext blocks are 11/11/10/10.

Decrypt each block then XOR with the IV or previous ciphertext: 10⊕10=00 • 10⊕11=01 • 01⊕11=10 • 01⊕10=11. The plaintext blocks are 00/01/10/11.

Encryption needs the previous ciphertext before computing the next block. Decryption uses ciphertext blocks that have already arrived so each D_K(C_i) and XOR can be computed independently. CBC requires padding.

It scrambles plaintext block M_i and flips the same bit in M_(i+1). Later blocks are unaffected. If only the IV is altered the corresponding bits of the first plaintext block flip.

Under the same key identical starting plaintext blocks produce identical starting ciphertext blocks up to the first difference. Fresh unpredictable IVs prevent this common-prefix leakage. CBC still needs separate integrity protection.

Set C_0=IV. Encrypt with C_i=E_K(C_(i−1))⊕M_i. Decrypt with M_i=E_K(C_(i−1))⊕C_i. Both directions use the block cipher's encryption operation.

No padding is needed when only the required final keystream portion is used. Encryption is sequential because each next step needs the previous ciphertext. Decryption can be parallelized once ciphertext blocks are available.

It flips the same bit in the corresponding plaintext block and scrambles the next plaintext block. Error propagation then stops. This differs from CBC which scrambles the current block and flips one bit in the next.

Use a fresh unpredictable IV of the block size under the key. Reusing the IV repeats the first keystream block and leaks relationships between starting plaintexts. Proper CFB supplies confidentiality but no authentication tag.

Set Z_0=IV and repeatedly compute Z_i=E_K(Z_(i−1)). Encrypt with C_i=M_i⊕Z_i. Decrypt with M_i=C_i⊕Z_i. The feedback uses cipher output rather than ciphertext or plaintext.

No padding is needed. Keystream generation is sequential because each Z_i depends on Z_(i−1). It can be precomputed before the message arrives. Once available the independent XOR operations can run in parallel.

A changed ciphertext bit changes only the matching plaintext bit. A changed IV alters the generated keystream and corrupts the recovered message throughout.

Repeating the IV repeats the entire keystream. XORing the two ciphertexts then reveals the XOR of their plaintexts just as in one-time-pad key reuse.

For each block form a unique nonce–counter input and compute Z_i=E_K(N∥i). Encrypt C_i=M_i⊕Z_i. Decrypt M_i=C_i⊕Z_i. Transmit the nonce so the receiver can regenerate the keystream.

Each nonce–counter block can be encrypted independently. Encryption and decryption can both run in parallel. Any block can be recovered without processing prior blocks. A partial final block uses only the needed keystream bytes and requires no padding.

A changed ciphertext bit flips only its matching plaintext bit. A changed nonce changes all counter inputs and therefore corrupts the keystream and recovered message throughout.

The full nonce–counter input to the block cipher. Use a unique nonce per message and prevent counter wrap or overlapping ranges. Repetition reuses the keystream and exposes C⊕C′=M⊕M′.

An IV initializes a mode and its requirements depend on that mode. A nonce is a number used once and need not be random. CBC needs unpredictability while CTR principally needs unique nonce–counter inputs under the key.

Usually no. They can be transmitted with ciphertext so the receiver can reproduce the computation. Their mode-specific freshness or unpredictability requirements still matter and unauthorized changes must be detected when integrity is needed.

They make accidental repeats unlikely when generated correctly and used within appropriate volume limits. A 128-bit random value gives a large space. Randomness does not excuse deliberate reuse or failure to track counter exhaustion.

Properly constructed CBC and CTR can both provide strong confidentiality. Their misuse differs: CBC IV reuse leaks common prefixes while CTR nonce reuse repeats the keystream and can reveal whole message relationships. Neither alone authenticates data.

An attacker may change ciphertext and cause changed plaintext without being detected. Confidentiality does not prove who created the message or that it was unaltered. Use a MAC or an authenticated encryption construction.

Use C′=C⊕M⊕M_target at the targeted positions. On decryption the original M cancels and M_target appears. The attacker needs the relevant plaintext and ciphertext but does not need the secret encryption key.

The change mask is 0x31⊕0x39=0x08. XOR the original ciphertext byte with it: 0x57⊕0x08=0x5F. The corresponding plaintext digit changes from 1 to 9 without knowing the secret key.

The receiver cannot conclude from gibberish alone that the sender did not send it. Some modifications are also predictable. A cryptographic verification tag is needed to reliably reject unauthorized changes.

It maps an arbitrary-length message M to a fixed-length digest H(M). The digest acts as a compact fingerprint. Different input lengths still produce the same output length for a selected hash algorithm.

Different hashes prove the files differ. Matching hashes are strong evidence of equality when a secure hash is used but not mathematical proof because collisions exist. Compare against a trusted reference digest.

It is deterministic and efficient. It should resist preimage and second-preimage and collision attacks. A small input change should produce a substantially different digest through the avalanche effect.

Preimage: given a digest find any message hashing to it. Second preimage: given one message find a different message with its digest. Collision: find any two different messages with the same digest.

MD5 produces 128 bits and SHA-1 produces 160 bits. Practical collision attacks broke their collision-resistance goals. The slides associate MD5 with 2004 attacks and SHA-1 with the 2017 demonstrated collision.

SHA-256 and SHA-384 and SHA-512 produce 256 and 384 and 512 bits. SHA3-256 and SHA3-384 and SHA3-512 produce the corresponding lengths using the different Keccak design. SHA-3 does not imply SHA-2 must be abandoned.

Length extension can let an attacker extend a known hash to cover added data without knowing the original secret. Proper HMAC avoids this construction's weakness. The warning does not apply identically to every SHA-2 variant.

A collision search that exploits the large number of pairs among sampled messages. Generic collision work is about 2^(n/2) while generic preimage work is about 2^n. Collision resistance therefore requires more output bits than equivalent preimage resistance.

If the genuine program is fixed first it is a second-preimage problem. Finding any two programs with matching hashes is a collision problem. The two attack goals have different difficulty.

The attacker can replace the message and recompute the hash. The receiver sees a consistent pair. Integrity requires protecting the reference hash or using a secret-key MAC or digital signature.

When the expected digest is obtained through a trusted channel the attacker cannot change. Compute the downloaded file's hash and compare it with that reference. A mismatch detects a changed or corrupted download.

Spoofing creates a message pretending to come from another sender. Tampering changes a legitimate message. A MAC helps detect both when the attacker does not possess the shared secret key.

A keyed tag supplies integrity and data-origin authentication among parties sharing the key. It does not encrypt the message and does not provide non-repudiation because either key holder could generate the tag.

Generate a shared key K. Sender computes T=MAC_K(M) and sends M with T. Receiver recomputes the tag over the received message and compares. Accept only if verification succeeds.

Even after obtaining tags on chosen messages an efficient attacker should have only negligible probability of producing a valid tag for a new message that was not queried. This is existential unforgeability under chosen-message access.

No. An attacker can resend a previously valid message and tag. Include and verify freshness information such as a sequence number or nonce to distinguish a new message from a replay.

NMAC_(K1，K2)(M)=H(K1∥H(K2∥M)). The course uses two independent secret keys each the length of the hash output. Its two-key setup motivates HMAC's single-key construction.

Use the hash's input block size B. If K exceeds B bytes first hash it. Then zero-pad the resulting key or any shorter key to B bytes to obtain K′. Do not confuse block size with digest size.

HMAC_K(M)=H((K′⊕opad)∥H((K′⊕ipad)∥M)). ipad repeats byte 0x36 and opad repeats byte 0x5C across the hash input block. The nested passes use different derived key masks.

SHA-256 processes 64-byte input blocks and produces a 32-byte digest. HMAC-SHA256 therefore normalizes its key to 64 bytes and produces a full 256-bit tag. These are two different sizes.

It is named for its hash such as HMAC-SHA256 or HMAC-MD5. A verifier needs the shared secret key to recompute the tag. HMAC is deterministic and efficient but does not hide the message.

It provides confidentiality together with integrity and authenticity. It combines protection against reading messages with reliable rejection of unauthorized modifications.

1. Encrypt M using K_enc to obtain C. 2. Compute T=MAC_K_mac(C). 3. Send C and T. Authenticate all encryption inputs that need integrity such as the IV or nonce along with the ciphertext.

1. Verify the tag on the received ciphertext and associated authenticated inputs. 2. Reject on failure. 3. Decrypt only after successful verification. This detects tampering before processing plaintext.

An attacker cannot create a new accepted ciphertext without authorization. Encrypt-then-MAC can provide it by authenticating ciphertext before decryption with an independent secure MAC key.

1. Compute T=MAC_K_mac(M). 2. Encrypt M∥T using K_enc. 3. Send the resulting ciphertext. The tag itself is hidden inside the encrypted content.

Decrypt the ciphertext and parse the recovered message and tag. Then verify the MAC on the plaintext. Tampering is detected only after decryption so the decryption path can become an attack surface.

It can reject altered ciphertext before decryption. MAC-then-encrypt may leak information through padding errors or response timing. Arbitrary secure encryption and MAC components do not automatically make every MAC-then-encrypt combination secure.

A system whose observable behavior reveals whether decrypted padding was valid. Differences in errors or timing can let an attacker learn plaintext through repeated modified ciphertexts. Authentication before decryption helps prevent this exposure.

Reusing one key across functions can cause unexpected interactions. Derive independent keys for encryption and for each communication direction's MAC as required by the protocol.

Public-key encryption supplies asymmetric confidentiality. Digital signatures supply asymmetric integrity and origin authentication. Their symmetric counterparts are shared-key encryption and MACs.

The sender encrypts with Bob's public key. Bob decrypts with his private key. Bob's private key must remain secret while the sender must obtain an authentic copy of his public key.

It avoids requiring a pre-shared secret for encryption but uses more expensive operations. A public key may be distributed openly while the matching private key remains with its owner.

KeyGen creates matching PK and SK. Enc_PK(M) creates C. Dec_SK(C) recovers M. Correctness requires Dec_SK(Enc_PK(M))=M. Secure encryption must also prevent efficient message recovery and support the intended indistinguishability goal.

A function that is easy to compute but hard to reverse without special secret information. The secret trapdoor makes reversal efficient for the intended private-key holder.

RSA is associated with integer factorization. Diffie–Hellman and ElGamal use discrete-logarithm-related problems. Elliptic-curve cryptography uses problems such as the elliptic-curve discrete logarithm problem.

1. Choose distinct large primes p and q. 2. Compute n=pq and φ(n)=(p−1)(q−1). 3. Choose e with gcd(e，φ(n))=1. 4. Compute d=e^−1 mod φ(n). Publish (e，n) and keep d and the factors secret.

ed≡1 mod φ(n). Such an inverse exists when gcd(e，φ(n))=1. Use the extended Euclidean algorithm to find d. For example 3×27=81≡1 mod 40.

For a message representative 0≤M<n compute C=M^e mod n. Recover M=C^d mod n. These raw formulas illustrate the mathematics and require secure encoding for real encryption.

n=5×11=55. φ(n)=4×10=40. gcd(3，40)=1. Since 3×27=81≡1 mod 40 choose d=27. The public key is (3，55) and the private exponent is 27.

Encrypt: C=6^3 mod 55=216 mod 55=51. Decrypt: M=51^27 mod 55=6. Use modular exponentiation instead of constructing the entire huge power.

ed=1+k(p−1)(q−1). Fermat's little theorem gives M^(ed)≡M mod p and mod q. The Chinese remainder theorem combines these congruences to give M^(ed)≡M mod n.

For prime p and a not divisible by p Fermat gives a^(p−1)≡1 mod p. CRT says matching residues modulo distinct primes p and q determine the same residue modulo pq. Zero residues are handled directly.

Primality tests find suitable random primes. Extended Euclid computes the inverse d. Repeated squaring performs fast modular exponentiation. The slides list e=3 and e=65537 as exponent examples. Small classroom primes are only demonstrations.

Raw RSA is deterministic so a public-key holder can encrypt guessed messages and compare them. RSA-OAEP adds randomized encoding to provide a secure public-key encryption construction under its assumptions.

From p and q an attacker computes φ(n) and then d=e^−1 mod φ(n). Keeping the factors secret is therefore essential. The course's RSA security assumption concerns the difficulty of this problem with properly chosen large parameters.

ElGamal uses fresh randomness and discrete-logarithm-related assumptions. The same plaintext can produce different ciphertexts. Its two-component ciphertext has roughly twice the message-representation size in the simplified comparison.

Appropriate elliptic-curve schemes can provide comparable security with smaller keys than RSA. Their hardness assumption involves elliptic-curve problems rather than integer factorization. Smaller keys can help constrained devices.

1. Generate a fresh symmetric key K. 2. Encrypt the message with a suitable symmetric scheme using K. 3. Protect K with the recipient's public-key scheme. 4. Send both protected key material and encrypted message.