Cryptography
Course Introduction
Ashutosh Bhatia
BITS Pilani
ashutosh.bhatia@pilani.bits-pilani.ac.in
Overview
Cyber Security Facts
Grading Policy
Security Concepts
Goals
Attacks
Services
Mechanisms
Cyber Security Facts
A new Zero-Day vulnerability is discovered every week.
Advanced attack groups continue to profit from
previously undiscovered flaws in browsers and
website plugins.
Exploit the vulnerabilities until they are publicly
exposed, then toss them aside for newly
discovered vulnerabilities.
Ref: 2016 Internet Security Threat Report
Cyber Security Facts
Over Half a Billion Personal Records Were Stolen or Lost in 2015
Ref: 2016 Internet Security Threat Report
Cyber Security Facts
Phishing Campaigns Targeting Employees Increased 55 Percent in 2015
Ref: 2016 Internet Security Threat Report
Cyber Security Facts
Ransomware Increased 35 Percent in 2015
Ref: 2016 Internet Security Threat Report
Cyber Security Facts
There were more than three times as many Android apps classified as containing
malware in 2015 than in 2014, an increase of 230 percent.
Ref: 2016 Internet Security Threat Report
Cyber Security Facts: Coin Mining Attack
The rise in cryptocurrency values inspired many cyber criminals to
shift to coin mining as an alternative revenue source.
As compared to the previous year (2016), the number of coinminers
present over the internet have increased by 8,500 percent.
600 percent increase in overall IoT attacks in 2017, which means that
cyber criminals could exploit the connected nature of these devices
for mining purpose.
Ref: 2018 Internet Security Threat Report
Cyber Security Facts: Attacks on Software Supply Chain
Finding vulnerabilities in the software are becoming increasingly difficult for attackers to identify
and exploit.
An alternative approach taken by attackers is to inject malware implants into the supply chain to
infiltrate unsuspecting organizations.
There is a a 200 percent increase in such attack with one every month of 2017 as compared to
four attacks annually in years prior.
Hijacking software updates provides attackers with an entry point for compromising well-
protected targets
The Petya (Ransom.Petya) outbreak was the most notable example: after using Ukrainian
accounting software as the point of entry, Petya/NotPetya used a variety of methods to spread
across corporate networks to deploy the attackers’ malicious payload.
Ref: 2018 Internet Security Threat Report
Cyber Security Facts
Federal government has suffered 680% increase in cyber security breaches in the
past six years
Governments, not hackers, are most likely to launch cyber attacks
More than 600,000 accounts are compromised every day on Facebook alone
National Nuclear Security Administration records 10 million attempted hacks a day
US Navy receives 110,000 attacks per hour
Every second 18 adults suffer cybercrime (1.5 million/day)
Global spam rate in 2013 is 68%. Of these 61% are adult/dating messages, 28% are
pharmaceutical.
Grading
• Mid-Term 30%
• Final Exam (Open Book) 40%
• Assignments (2) 15%
• Project 15%
Why Security
Protecting good from bad
Definitions
• Computer Security - generic name for the collection of tools
designed to protect data and to thwart hackers
• Network Security - measures to protect data during their
transmission
• Internet Security - measures to protect data during their
transmission over a collection of interconnected networks
• Mobile Security, Web Security, Software Security, OS security
…..
Three Attributes of Information
Authorized Users
Content (Data)
Time
Information Security Goals
• Confidentiality of the Content: Assures that private
or confidential information is not made available or
disclosed to unauthorized individuals
Confidentiality • Confidentiality of Authorized Users (Privacy):
Assures that individuals control or influence what
information related to them may be collected and stored
and by whom and to whom that information may be
disclosed
Information Security Goals
• Content: Assures that information content is
changed only in a specified and authorized
manner.
Integrity • Authorized Users: Assures the no adversary is
able to claim as the authorized users of the
information
• Time: Assures that any modification related to
the timing of the information gets detected
Information Security Goals
• Assures that systems work promptly and service
Availability
is not denied to authorized users
Information Security Goals
• Confidentiality of the Content: Assures that private or confidential
information is not made available or disclosed to unauthorized individuals
Confidentiality • Confidentiality of Authorized Users (Privacy): Assures that individuals
control or influence what information related to them may be collected
and stored and by whom and to whom that information may be disclosed
• Content: Assures that information content is changed only in a specified
and authorized manner.
• Authorized Users: Assures the no adversary is able to claim as the
Integrity authorized users of the information
• Time: Assures that any modification related to the timing of the
information gets detected
• Assures that systems work promptly and service is not denied to
Availability authorized users
Attacks
The three goals of security (confidentiality, integrity, and availability)
can be threatened by security attacks.
• Threatening Confidentiality
Attacks • Threatening Integrity
• Threatening Availability
Classification: Active and Passive
Attacks on Confidentiality
Attacks on the confidentiality of the content or the authorized user
• Snooping : An unauthorized access to or interception of data
• Traffic Analysis: Obtaining the information about the data by
monitoring on line traffic
Attacks on Integrity
Modification: Unauthorized changes in the content of the information
Masquerading: Attacker impersonating as one of the authorized entity
Repudiation: An authorized entity trying to disown itself from the
information
Replaying: An unauthorized attempt to resend the same data sometime
later
Attack on Availability
Denial of Service: Either slow down or totally
disrupt the service of a system
Security Attacks
Security
Attacks
Threat to Threat to Threat to
Confidentiality integrity Availability
Traffic Denial of
Snooping Modification Masquerading Replaying Repudiation
Analysis Service
Classifying Attacks
• A means of classifying security
attacks, used both in X.800 and
RFC 4949, is in terms of passive
attacks and active attacks
•A passive attack attempts to
learn or make use of information
from the system but does not
affect system resources
•An active attack attempts to
alter system resources or affect
their operation
Passive Attacks
•Are in the nature of
eavesdropping on, or
monitoring of, transmissions
• Goal of the opponent is to
obtain information that is
being transmitted • Two types of passive attacks are:
• The release of message contents
• Traffic analysis
Active Attacks
• Involve some modification of the • Takes place when one entity pretends
to be a different entity
Masquerade
data stream or the creation of a • Usually includes one of the other
forms of active attack
false stream
• Involves the passive capture of a data
unit and its subsequent
Replay
• Difficult to prevent because of the retransmission to produce an
unauthorized effect
wide variety of potential physical,
software, and network • Some portion of a legitimate message
vulnerabilities Modification is altered, or messages are delayed or
reordered to produce an
of messages unauthorized effect
• Goal is to detect attacks and to
recover from any disruption or Denial of • Prevents or inhibits the normal use or
management of communications
delays caused by them service facilities
Standards
National Institute of Standards and Technology
• NIST is a U.S. federal agency that deals with measurement science, standards, and technology related to U.S. government use
and to the promotion of U.S. private-sector innovation
• Despite its national scope, NIST Federal Information Processing Standards (FIPS) and Special Publications (SP) have a
worldwide impact
Internet Society
• ISOC is a professional membership society with world-wide organizational and individual membership
• Provides leadership in addressing issues that confront the future of the Internet and is the organization home for the groups
responsible for Internet infrastructure standards
ITU-T
• The International Telecommunication Union (ITU) is an international organization within the United Nations System in which
governments and the private sector coordinate global telecom networks and services
• The ITU Telecommunication Standardization Sector (ITU-T) is one of the three sectors of the ITU and whose mission is the
development of technical standards covering all fields of telecommunications
ISO
• The International Organization for Standardization is a world-wide federation of national standards bodies from more than
140 countries
• ISO is a nongovernmental organization that promotes the development of standardization and related activities with a view to
facilitating the international exchange of goods and services and to developing cooperation in the spheres of intellectual,
scientific, technological, and economic activity
Services and Mechanisms
• ITU-T provides some security services and some mechanisms to implement
those services.
• A processing or communication service Intended to counter security
attacks, and they make use of one or more security mechanisms to provide
the service.
• A process (or a device incorporating such a process) that is designed to
detect, prevent, or recover from a security attack
• Security services and mechanisms are closely related because a mechanism
or combination of mechanisms are used to provide a service.
Security Services
Security Attacks
Threat to
Threat to integrity Threat to Availability
Confidentiality
Traffic Denial of
Snooping Modification Replaying Masquerading Repudiation
Analysis Service
Security Services
Data Data Non- Access
Authentication
Confidentiality Integrity Repudiation Control
Proof of Proof of
Anti Change Anti Replay Peer Entity Data Origin
Origin Delivery
Security Mechanisms
Encipherment Hiding or covering data
Data integrity Adding a Check Value
Digital Signature To digitally sign and verify a data
Authentication
Challenge/Response Mechanism
Exchange
Security Mechanisms
Traffic Padding To avoid traffic analysis
Routing Control Selection of secure routes
Involving a trusted third party in the
Notarization
communication
Access Control To prove that user has access right
Relationship between services and mechanism
Security Services Security Mechanisms
Data Confidentiality Encipherment, and Routing control
Data Integrity Encipherment, Digital Signature, Data Integrity
Authentication Encipherment, Digital Signature, Authentication Exchange
Non Repudiation Digital Signature, Data Integrity, notarization
Access Control Access Control Mechanisms
Encipherment Techniques
Cryptography: A word with Greek origin means “secret
writing”. Science and art of transferring message (i.e.
encipherment) to make them immune to attacks.
Steganography: A word with Greek origin means
“Covered Writing”. Science and art of transferring
message to make them immune to attacks. Concealing
the message itself by covering it with something else
Computer Security Challenges
• Security is not simple
• Potential attacks on the security need to be considered
• Procedures used to provide particular services are often counter intuitive
• It is necessary to decide where to use security mechanism
• It is too often an after thought
• Typically involve more than a particular algorithm or protocol
• Never ending process
• No visible benefit
• Strong security is often seen as an impediment to efficient and user
friendly operation
Threats and Attacks (RFC 4949)
• A potential for violation • An intelligent and
of security, which exist deliberate attempt
when there is a to invade security
circumstance, services and violate
capability, action, or security policy of a
event that could breach system
the security and cause
harm.
Threat Attack
Quiz-1
Which security services and mechanisms are involved in each of the
following cases?
a) BITS demand your user name and password to use the internet.
b) You automatically get disconnected if you are logged in for more than two hours
c) A professor provides your grades to you through mail only on receiving a mail from
your side containing a value that was preassigned by him to you.
d) BITS does not allow you to reach a certain types of sites
e) To withdraw from the Cryptography course your professor required signed withdrawal
form from you.
f) Night canteen requires your ID to give you food
g) Requesting AUGUSD division to repeat cryptography course by producing an
application duly signed by the course in-charge
h) Professor coming up a mechanism so that the students cannot add/delete the
contents in the answer sheets during marks distribution
Thank You
