MCA – 45

Security in Computing

Prof. Jayesh N. Modi.

Department of Computer Science,
HNGU, Patan.
Topics To be Discussed
What is security?
What is Computer Security?
What does Secure means?
What is intruder?
What is cryptography?
Cryptography
Strongest tool for providing Security
Terminology
Sender S
Recipient R
Channel T
Outsider O
Four types of Attacks
 Block – preventing to reach to destination
 Intercept – reading or listening to the message
 Modify – changing in some way
 Fabricate – authentic looking message delivered as
original sender
Terminology
Encryption(encode, Enciphering)
Decryption(Decoding, deciphering)
Cryptosystem
Plaintext
Cipher text
C=E(P)
P=D(C)
Encryption Algorithm
Encryption Key
Keyless Cipher
 Encryption Process

Plain Text CipherTe Plain Text

Encryption xt Decryption
 Two Types of Encryption Process
Key

Plain Text CipherTe

Encryption xt Decryption

(A) Symmetric Cryptography

Encryption Key KE Decryption Key KD

Plain Text CipherTe

Encryption xt Decryption

(A) Asymmetric Cryptography

 Cryptography means hidden writing and it refers to
the practice of using conventional text.
 Cryptanalyst studies encryption and encrypted
message, hopping to find the hidden message.
 An encryption algorithm is called breakable when,
given enough time and data, an analyst can
determine the algorithm.
The cryptanalysis' can perform
break a single message.
Recognize pattern n encrypted message
Deduce the key
Find weakness in general encryption algorithm
 Representing Character
Modulo 26-letter
Letter A B C D E F G H I J K L M N O P Q R S
T U V W X Y Z
Code 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
19 20 21 22 23 24 25

A+3=D K – 1 = J Y + 3 =B
Types of encryption
Substitution
Caesar cipher
One- time pad substitution
Vernam cipher
Book cipher
Vigenere cipher
Transposition (Permutation)
Columnar cipher
Cross cipher
Advantage s and disadvantage of cipher.
How to crack it.
Vigenere tableau
Shannon’s Characteristics of “Good”
Cipher
Secrecy needed amount of labor
Set of keys and algorithm should be free
from complexity
The implementation of the process should
be as simple as possible
Errors in ciphering should not propagate
and cause corruption of further information
in the message.
The size of the enciphered text should be
no longer than the text of the original
message.
Properties of trustworthy Encryption
System
It is based on sound Mathematics
It has been analyzed by competent experts
and found to be sound
It has stood the test of time.
Stream vs. Block Ciphers
 Comparison
Stream Encryption Block Encryption
Algorithm Algorithm
Advantages Speed of Transfer Faster High Diffusion
Low Error Propagation Immunity to insert of
symbol
Disadvantag Low Diffusion Slowness of Encryption
es Susceptibility to Malicious Error Propagation
Substitution

Compare Between Confusion and Diffusion

The Data Encryption Standard
Developed for us government in the early
1970.
Product Cipher
M

Original Message

E1(M)

After Applying Cipher E1

E2(E1(M)

After applying Product of Cipher E1. E2

AES (Advanced Encryption
Standard)
Symmetric algorithm
Designed by rijndael in 1997-1999.
Problem with DES
Unclassified
Publicly disclosed
Available for royalty free
Not usable with different keys
Contd…
128 bits block cipher
Key size 128,192,256 round required
10,12,14
Represented in blocks of 4 X 4 matrics
Operations on AES
Byte Substitution
Shift row
Mix columns
Add round key
Public Key Encryption
 Motivation

 Characteristics
P=D(KPRIV, E(KPUB,P)) P=D(KPUB, E(KPRIV,P))
RSA( Rivest
-Shamir-Adelman) Algorithm
Why Security is needed?
Increasing threat of effect
Availability of number of tools and
resources on the internet
Fast growing of computer network
Product launched in the market
Lack of specialized resources that may be
allotted for securing system
Security Architecture
Attack : an action that compromise the
security
Mechanism : process design to detect,
prevent or recover from security attack:
Services : process that enhances the
security of the data proessing
Two Types of Attack
Active
Masquerade
Replay
Modification
Denial of services
Passive
The release of message contents
Traffic analysis
Attacks
Vulnerabilities is a weakness in the security
system.
Threat to a computing system is a set of
circumstances that has a potential to cause
loss or harm.
Attacks : a human who exploits a
vulnerabilities an attack on the system.
Control it’s a protective measure, that is
control is an action, devices, procedure or
techniques that reduce the vulnerabilities.
The Threats are
Interception

Interruption

Modification

Fabrications.
MOM
Methods : skill , knowledge, tools and other
things which to be able to pull of the attack
Opportunity : the time and access to
accomplish the task
Motive : a reason to want to perform this
task
The following figures are included (source:
Datapro Research) as example, to give an
idea what is going on in the real world.
Common Causes of damage : Human Error
52%, Dishonest people 10%, Technical
Sabotage 10%, Fire 15%, Water 10% and
Terrorism 3%.
Who causes damage? Current employees
81%, Outsiders 13%, Former employees
6%.
Types of computer crime: Money theft 44%,
Damage of software 16%, Theft of
information 16%, Alteration of data 12%,
What is Security?
Security is the protection of information,
systems and services against disasters,
mistakes and manipulation so that the
likelihood and impact of security
incidents is minimized. It consist of
Confidentiality
Integrity:
Availability:
Legal Compliance:.
A threat is a danger which could affect
the security (confidentiality, integrity,
Authentication assurance that the
communicating entity is one that to be
Confidentiality ensures that computer
related assets are accessed only by the
authorised parties.
Integrity means that assets can be
modified only by authorized parties.
Availabilities means that assets are
accessible to authorized parties at
appropriate times.
Non repudiation provides protection against
denial of attacks.
Integrity means
Precise
Accurate
Unmodified
Modified only in acceptable ways
Modified only by authorized ways
Consistent
Meaningful and usable
Availability means
It is present in usable form
Making clear process, not in waiting mode
Services is completed in acceptable period of
time.
necessary?
Customer information or accounting
information could be disclosed, affecting
credibility.
This information could be used by (new)
competitors to launch more effective
marketing campaigns.
Virus development has continued at an
alarming rate in the last few years, leaving
few, if any companies untouched.
System interconnection increases security
risks significantly:
Computer Criminals
Computer crime is any crime involving a
computer or aided by the use of one.
Amateurs : normal People
Crackers of malicious hacker: often high
school or university student
Career criminals : computer Professionals
who admits the computer crime
Terrorists : the link between computer and
terrorists is quite evident
Target of attacks
Propagation vehicles
Methods of attack
Methods of Defenses
The possibilities for harm to occur is called
risk.
Prevent it. By clocking
Deter it by making harder
Deflect it by making another target easier
Detect it either as it happens
Recover from its effect.
Hacking as defense
Mechanism
Hacking means to gain unauthorized
access to data or information.
A cracker is a hacker who uses the
knowledge of hacking for malicious
practice. Two types of cracker
Inside cracker
Outside cracker
Ethical hacking is tools or solution to
system hacking.
Esthetical hacking use the same
methodology as cracker to detect
vulnerabilities, the objectives are different.
The methodology of Hacking
Foot printing : social engineering and
dumpster driving
Scanning : pre-attack , use of different tools
and techniques
Gaining access : denial of services to stop
work, spoofing, packet flooding
Maintaining access : trojans horse, rootkit
Covering tracks: try to keep hidden,
undetected
Classification of Hackers
Black Hats : Crackers
White Hats : for defenses
Grey Hats : may be black or white Hat
Blue Hats : works with Computer system
Consulting firms to bug test a system prior
to launch.
Control
Traditional fortress
A strong gate or door
Heavy walls
Arrow slits
A drawbridge to limit access to authorized
people
Gate keeper to verify that only authorized
people ad goods could enter
Today
Strong locks on the door
Burgur alarm
Reinforces window
Multiple Controls
Available controls
 Encryption
 Software controls
 Internal Program Controls
 OS and Network system Control
 Independent Control Programs
 Development Controls
 Hardware controls
 Hardware or smart card implantation of encryption
 Locks of cables limiting access or determining theft
 Device to verify user’s identities
 Firewall
 Intrusion detection system
 Circuit boards that control to storage media
Effectiveness of Controls
Awareness of problem
Likelihood of use
Overlapping of controls
Periodic review
Policies and procedures
Frequently changes of password

Physical controls
Locks on the doors
Guards at entry points
Backup copies of hardware and software data
Physical site planning that reduces the risk of
natural disaster

Very easy , most effective and least costly

Intruders - Key Points
Unauthorized intrusion into a computer
system or network is one of the most
serious threats to computer security.
Intrusion detection systems have been
developed to provide early warning of an
intrusion so that defensive action can be
taken to prevent or minimize damage.
Intrusion detection involves detecting
unusual patterns of activity or patterns of
activity that are known to correlate with
intrusions.
One important element of intrusion
prevention is password management, with
Types of Intruders
Masquerader: An individual who is not
authorized to use the computer and who
penetrates a system's access controls to
exploit a legitimate user's account
Misfeasor: A legitimate user who accesses
data, programs, or resources for which such
access is not authorized, or who is
authorized for such access but misuses his
or her privileges
Clandestine user: An individual who have
supervisory control of the system and uses
this control to do auditing and access
controls or to suppress audit collection
Few examples of Intruders
activity
Reported by Bell Labs
Attempts to copy the password file at a rate
exceeding once per every other day
Suspicious remote procedure call request at
a rate exceeding once per week
Attempts to connect to nonexistent “bait”
machines at least every two weeks.
One of the result of the growing awareness of
the intruder problem has been the
establishment of a number of computer
emergency response team(CERT).
Intrusion Techniques
The objective of the intruder is to gain
access to a system or to increase the range
of privileges accessible on a system.
This requires the intruder to acquire
information that should have been
protected.

Two way password files can be protected:

One way function
Access control:
Common techniques
 Try default passwords used with standard accounts that
are shipped with the system. Many administrators do not
bother to change these defaults.
 Exhaustively try all short passwords (those of one
to three characters).
 Try words in the system's online dictionary or a list of
likely passwords. Examples of the latter are readily
available on hacker bulletin boards.
 Collect information about users, such as their full names,
the names of their spouse and children, pictures in their
office, and books in their office that are related to
hobbies.
 Try users' phone numbers, Social Security
numbers, and room numbers.
 Try all legitimate license plate numbers for this
state.
Motivation for IDS
If an intrusion is detected quickly enough,
the intruder can be identified and ejected
from the system before any damage is
done or any data are compromised. Even if
the detection is not sufficiently timely to
preempt the intruder, the sooner that the
intrusion is detected, the less the amount
of damage and the more quickly that
recovery can be achieved.
An effective intrusion detection system can
serve as a deterrent, so acting to prevent
intrusions.
Intrusion detection enables the collection of
IDS Techniques
 Statistical anomaly detection: Involves the collection
of data relating to the behavior of legitimate users over
a period of time. Then statistical tests are applied to
observed behavior to determine with a high level of
confidence whether that behavior is not legitimate user
behavior.
 Threshold detection: This approach involves
defining thresholds, independent of user, for the
frequency of occurrence of various events. Threshold
detection involves counting the number of
occurrences of a specific event type over an interval of
time. If the count surpasses what is considered a
reasonable number that one might expect to occur,
then intrusion is assumed.
 Profile based: A profile of the activity of each user is
developed and used to detect changes in the behavior
of individual accounts. Detection focuses on
Statistical anomaly Detection
 Rule-based detection: Involves an attempt
to define a set of rules that can be used to
decide that a given behavior is that of an
intruder. Rules may represent past behavior
patterns of users, programs, privileges, time
slots, terminals, and so on. Current behavior is
then observed, and each transaction is
matched against the set of rules to determine
if it conforms to any historically observed
pattern of behavior.
 Anomaly detection: Rules are developed to detect
deviation from previous usage patterns.
 Penetration identification: An expert system
approach that searches for suspicious behavior. it
takes a very different approach to intrusion
Rule Based Penetration
identification
Users should not read files in other users'
personal directories.
Users must not write other users' files.
Users who log in after hours often access
the same files they used earlier.
Users do not generally open disk devices
directly but rely on higher-level operating
system utilities.
Users should not be logged in more than
once to the same system.
Users do not make copies of system
programs.
Example
Subject
Action
Object
Exception-Condition
Resource-Usage
Time-Stamp
COPY GAME.EXE TO <Library>GAME.EXE
Smith execute <Library>COPY.EXE 0 CPU = 00002
11058721678
Smith read <Smith>GAME.EXE 0 RECORDS = 0
11058721679
Smith execute <Library>COPY.EXE write-viol RECORDS = 0
11058721680
Password Management
The ID determines whether the user is
authorized to gain access to a system. In
some systems, only those who already
have an ID filed on the system are allowed
to gain access.
The ID determines the privileges accorded
to the user. A few users may have
supervisory or "superuser" status that
enables them to read files and perform
functions that are especially protected by
the operating system. Some systems have
guest or anonymous accounts, and users of
these accounts have more limited
Key Points
 Malicious software is a software that is
intentionally included or inserted in a system
for a harmful purpose.
 A virus is a piece of software that can infect
other programs by modifying them: the
modification includes a copy of the virus
program which can then go on to infect the
other programs.
 A worm is a program that replicate itself and
send copies from computer to computer across
network connections. Upon arrival, the worm
may be activated to replicate and propagates
again. In addition to propagations, the worm
usually performs some unwanted function.
Name Description
Virus Attaches itself to a program and propagates copies of
itself to other program
Worm Program that propagates copies of itself to other
computer
Logic bomb Triggers action when condition occurs
Trojan horse Program that contains unexpected additional
functionality
Backdoor(Trapd Program modification that allows unauthorized access
oor) to functionality
Exploits Code specific to a single vulnerabilities or set of
vulnerabilities
Downloader Program that install other items on a machine that is
under attack. Usually, a downloader is sent in an e-mail.
Auto-rooter Malicious hacker tools used to break into new machine
remotly
Kit(Virus Set of tools generating new virus automatically
Generator)
Spammer Used to send large volumes of unwanted e-mail
programs
Flooders Used to attack networked computer system with a large
volume of traffic to carry out a denial of service attack
During its life time virus goes through the
following four phases:
Dormant phase : Ideal
Propagation phase : Each infected program
has identical copy
Triggering phase : it can cause variety of
action invent
Execution phase : the function is performed.
A Simple Virus
Program V:=

[goto main;
1234567;

subroutine infect-executable
:=
{loop
file :=get-random-
executable-file;
if(first-line-of-
file=1234567)
then goto
loop
else prepend
V to file; }
subroutine do-damage :=
{ whatever damage is
to be done }
subroutine trigger-pulled : =
{ return true if some
condition holds }
Cntd..
When this program is invoked, control
passes to its virus, which perform the
following steps;
For each uninfected file P2 that is found, the
virus first compresses that file to produce P2
which is shorter than the original program by
the size of the virus.
A copy of the virus is prep-ended to the
compressed program.
The compressed version of the original
infected program p1 is uncompressed.
The uncompressed original program is
executed.
Types of Viruses
Parasitic virus : most common form of virus.
Attaches to file and replicates itself.
Memory-resident virus : lodges in memory
Boot sector virus : infects a master boot
record
Stealth virus : a virus explicitly designed to
hide itself from detection by antivirus
software.
Polymorphic virus : a virus that mutates
with every infection, making detection by
the signature of the virus impossible.
Metamorphic virus : this virus exactly same
as polymorphic virus only difference is it
Macro viruses
It is really treating for following reason:
A micro virus is platform independent. Macro
virus infect Microsoft word and and infect all
the hardware and operating system.
Macro virus infect document not exe file.
Macro virus easily spread. A common way by
electronic mail.
E-mail viruses
If the recipient opens the email attachment
, the word macro is activated and then
The e-mail virus sends itself to every one on
the mailing list in the user’s e-mail package.
The virus does local damage.
worms
A worms has same four phase as viruses ,
only the difference is in propagation phase
as below:
Search for other systems to infect by
examining host tables or similar repositories
of remote system addresses.
Establish a connection with a remote system.
Copy itself to the remote system and cause
the copy to be run.
Generation of Antivirus
First generation
Second generation
Third generation
Fourth generation
First generation
 The first generation of antivirus software emerged in the late 1980s
and early 1990s. During this time, computer viruses were relatively
new, and antivirus solutions were basic in terms of functionality and
detection capabilities. Most first-generation antivirus programs relied
on signature-based detection, where they matched patterns of known
viruses against files on a computer. However, this approach had its
limitations, as it required regular updates to stay up-to-date with new
threats and could not detect unknown viruses.
 Additionally, first-generation antivirus software was primarily designed
for individual users and lacked the ability to detect and prevent
network-based attacks. These early solutions typically focused on
scanning files and emails to identify and remove viruses. As viruses
became more sophisticated, with polymorphic and stealth capabilities,
first-generation antivirus software struggled to keep up.
 Limitations of First Generation Antivirus Software
 Limited detection capabilities due to reliance on signature-based
detection
 Inability to detect unknown or new viruses
 Lack of network-based threat detection and prevention
 Complex command-line interfaces
 Difficulty in keeping up with polymorphic and stealth viruses

 Second generation
 The second generation of antivirus software emerged in the mid-1990s, addressing
some of the shortcomings of the first generation. These solutions introduced
heuristic scanning, which aimed to detect viruses based on their behavior and
characteristics rather than relying solely on signatures. Heuristic scanning allowed
antivirus programs to detect and block unknown viruses by identifying suspicious
actions or code patterns.
 Second-generation antivirus software also enhanced their network-based threat
detection capabilities, providing protection against malware distributed through the
internet, email attachments, and other communication channels. These solutions
often included firewalls and intrusion detection systems to strengthen overall
security.
 The user interfaces of second-generation antivirus software became more user-
friendly, featuring graphical interfaces that made it easier for users to navigate and
understand the status of their antivirus protection. The inclusion of real-time
scanning and automatic updates further improved the detection and remediation of
viruses.
 Advancements in Second Generation Antivirus Software
 Heuristic scanning for detecting unknown viruses
 Enhanced network-based threat detection and prevention
 Improved user interfaces with graphical representations
 Real-time scanning and automatic updates

 Third generation
 The third generation of antivirus software emerged in the early 2000s,
introducing proactive and behavior-based detection mechanisms. Traditional
signature-based detection alone was no longer sufficient to combat the rapidly
evolving landscape of malware. Third-generation antivirus solutions adopted
sandboxing, virtualization, and machine learning techniques to identify and block
malicious code and activities.
 Sandboxing allowed suspicious files or processes to run in isolated environments
where their behavior could be analyzed. Virtualization technologies helped create
secure containers where potentially harmful code could be executed and
monitored, without posing a risk to the underlying system. Machine learning
algorithms played a crucial role in analyzing large volumes of data and
identifying patterns and anomalies associated with malware.
 Third-generation antivirus software also incorporated cloud-based threat
intelligence, enabling real-time information sharing and faster detection of new
threats. This collaborative approach helped antivirus programs stay up-to-date
with the latest malware strains and provided stronger defense mechanisms
against zero-day attacks.
 Key Features of Third Generation Antivirus Software
 Proactive and behavior-based detection mechanisms
 Implementation of sandboxing and virtualization technologies
 Incorporation of machine learning algorithms
 Cloud-based threat intelligence for real-time information sharing

 Fourth generation
 The fourth and current generation of antivirus software focuses on proactive
and predictive approaches to threat detection and prevention. This
generation leverages artificial intelligence (AI), deep learning, and advanced
analytics to analyze vast amounts of data and identify previously unknown
threats.
 Fourth-generation antivirus solutions utilize AI and machine learning
algorithms to learn from previous cyber attacks and model patterns of
malicious behavior. They use this knowledge to detect and stop threats
before they can cause harm. These solutions can identify zero-day attacks,
polymorphic malware, and other advanced threats that may bypass
traditional signature-based detection methods.
 The inclusion of big data analytics enables the analysis of vast quantities of
structured and unstructured data to uncover hidden threats and identify
complex attack vectors. These solutions also embrace automation, allowing
security teams to streamline their operations and respond to threats more
efficiently.
 Key Features of Fourth Generation Antivirus Software
 Utilization of artificial intelligence and machine learning algorithms
 Advanced analytics and big data for threat analysis
 Predictive modeling and proactive threat prevention
 Automation to streamline security operations
 Advanced Antivirus
Techniques
 Generic Decryption(GD) : Generic decryption (GD)
technology enables the antivirus program to easily detect
even the most complex polymorphic
viruses while maintaining fast scanning speeds. Recall
that when a file containing a polymorphic virus is
executed, the virus must decrypt itself to activate. In
order to detect such a structure, executable files are
run through a
GD scanner, which contains the following elements:
 CPU emulator: A software-based virtual computer.
 Instructions in an exe-cutable file are interpreted by the emulator
rather than
executed on the underlying processor. The emulator includes soft
ware versions of all register and other processor hardware, so that
the underlying processor is unaffected
by programs interpreted on the emulator.

Digital Immune system
 Digital Immune system
1. A monitoring program on each PC uses a variety of heuristics b
ased on system behavior, suspicious changes to programs, or
family signature to infer that a
virus may be present. The monitoring program forwards a cop
y of any program
thought to be infected to an administrative machine within the
organization.
2. The administrative machine encrypts the sample and sends it
to a central virus analysis machine.
3. This machine creates an environment in which the infected
program can
be safely run for analysis. Techniques used for this purpose inc
lude emulation, or the creation of a protected environment wit
hin which the suspect program can be executed and monitore
d. The virus analysis machine then
produces a prescription for identifying and removing the virus.
4. The resulting prescription is sent back to the administrative m
Behavior-Blocking
Software
 Unlike heuristics or fingerprint-based scanners, behavior
blocking software integrates with the operating system o
f a host computer and monitors program
behavior in real-time for malicious actions.
The behavior blocking software then blocks potentially m
alicious actions
before they have a chance to affect the system. Monitor
ed behaviors can include
 Attempts to open, view, delete, and/or modify files;
 Attempts to format disk drives and other unrecoverable
disk operations;
 Modifications to the logic of executable files or macros;
 Modification of critical system settings, such as start-
up settings;
 Scripting of e-
mail and instant messaging clients to send executable c
Behavior-Blocking
Software
Key Points - Firewall
 A firewall forms a barrier through which the
traffic going in each direction must pass. A
firewall security policy dictates which traffic is
authorized to pass in each direction.
 A firewall may be designed to operate as a
filter at the level of IP packets, or may operate
at a higher protocol layer.
Firewall Characteristics
 All traffic from inside to outside, and vice
versa, must pass through the firewall.
 Only authorized traffic, as defined by the local
security policy, will be allowed to pass.
 The firewall itself is immune to penetration.
This implies that use of a trusted system with a
secure operating system.
 A firewall defines a single choke point.
 A firewall provides a location for monitoring
security-related events.
 A firewall is a convenient platform for several
Internet functions that are not security related.
 A firewall can serve as the platform for IPSec.
four general techniques that firewalls use
to control access and enforce the site's
security policy.
Service control:
Direction control
User control:
Behavior control:
Limitation of firewall
The firewall cannot protect against attacks
that bypass the firewall.
The firewall does not protect against
internal threats
The firewall cannot protect against the
transfer of virus-infected programs or files.
Types of Firewall
Packet-Filtering Router
It is a technique used to control network
access by monitoring outgoing and
incoming packets and allowing them to
pass or halt based on the source and
destination Internet Protocol (IP) addresses,
protocols, and ports. This firewall is also
known as a static firewall.
disadvantage:
Because packet filter firewalls do not
examine upper-layer data.
Because of the limited information
available to the firewall, the logging
functionality present in packet filter
firewalls is limited.
Most packet filter firewalls do not support
advanced user authentication schemes.
Finally, due to the small number of
variables used in access control decisions.

Advantage : fast and easy implimentation

Application-Level
Gateway
 Known as Proxy Server – act as a relay of application
level traffic.
 It is more secure than packet filters.
 Disadvantage : additional Processing overhead on each
connection.
 These firewalls can examine application layer (of OSI
model) information like an HTTP request. If finds some
suspicious application that can be responsible for
harming our network or that is not safe for our network
then it gets blocked right away.
 Next-generation Firewalls
 These firewalls are called intelligent firewalls. These
firewalls can perform all the tasks that are performed by
the other types of firewalls that we learned previously
but on top of that, it includes additional features like
application awareness and control, integrated intrusion
Circuit Level Gateway
A circuit-level gateway is a firewall that
provides User Datagram Protocol (UDP)
and Transmission Control Protocol (TCP)
connection security and works between an
Open Systems Interconnection (OSI)
network model’s transport and application
layers such as the session layer.
Stateful Inspection
Firewalls
 It is also a type of packet filtering that is used
to control how data packets move through a
firewall. It is also called dynamic packet
filtering. These firewalls can inspect that if the
packet belongs to a particular session or not. It
only permits communication if and only if, the
session is perfectly established between two
endpoints else it will block the communication.
Key Points -
DigitalSignatureSignature
A digital signature is an authentication
mechanism that enables the creator of a
message to attach a code that acts as a
signature.
 The signature is formed by taking the hash of
the message and encrypting the message with
the creator's private key. The signature
guarantees the source and integrity of the
message.
 The digital signature standard (DSS) is an NIST
standard that uses the secure hash algorithm
(SHA).
Digital signature
Requirements
Message authentication protects two parties
who exchange messages from any third
party. However, it does not protect the two
parties against each other. Several forms of
dispute between the two are possible.
The digital signature is analogous to the
handwritten signature
It must verify the author and the date and
time of the signature.
It must to authenticate the contents at the
time of the signature.
It must be verifiable by third parties, to
The following requirements for a digital
signature:
The signature must be a bit pattern that
depends on the message being signed.
The signature must use some information
unique to the sender, to prevent both forgery
and denial.
It must be relatively easy to produce the
digital signature.
It must be relatively easy to recognize and
verify the digital signature.
It must be computationally infeasible to forge
a digital signature, either by constructing a
new message for an existing digital signature
or by constructing a fraudulent digital
signature for a given message.
Types of Digital Signature
Direct Digital Signature

Arbitrated Digital Signature

Digital Signature
Standard
The National Institute of Standards and
Technology (NIST) has published Federal
Information Processing Standard FIPS 186,
known as the Digital Signature Standard
(DSS).
The DSS makes use of the Secure Hash
Algorithm (SHA) and presents a new digital
signature technique, the Digital Signature
Algorithm (DSA).
The DSS was originally proposed in 1991
and revised in 1993 in response to public
feedback concerning the security of the
scheme.
There was a further minor revision in 1996.
Key Points – Electronic Mail
Security
PGP is an open-source freely available
software package for e-mail security. It
provides authentication through the use of
digital signature; confidentiality through
the use of symmetric block encryption;
compression using the ZIP algorithm; e-
mail compatibility using the radix-64
encoding scheme; and segmentation and
reassembly to accommodate long e-mails.
PGP incorporates tools for developing a
public-key trust model and public-key
certificate management.
S/MIME is an Internet standard approach to
Pretty Good Privacy
PGP is a remarkable phenomenon, the
effort of a single person, Phil Zimmermann.
PGP provides a confidentiality and
authentication service that can be used for
electronic mail and file storage
applications.
Selected the best available cryptographic
algorithms as building blocks.
Integrated these algorithms into a general-
purpose application that is independent of
operating system and processor and that is based
on a small set of easy-to-use commands.
Made the package and its documentation,
including the source code, freely available via the
Reason for growth of PGP
It is available free worldwide in versions
that run on a variety of platforms
It is based on algorithms that have survived
extensive public review and are considered
extremely secure.
It has a wide range of applicability.
It was not developed by, nor is it controlled
by, any governmental or standards
organization.
 PGP is now on an Internet standards
track (RFC 3156).
Notation
Ks =session key used in symmetric
encryption scheme
PRa =private key of user A, used in public-
key encryption scheme
PUa =public key of user A, used in public-
key encryption scheme
EP = public-key encryption
DP = public-key decryption
EC = symmetric encryption
DC = symmetric decryption
H = hash function
|| = concatenation
Operation
Authentication
Confidentiality
(Confidentiality and authentication)
Compression
E-mail Compatibility
Segmentation and Reassembly
Authentication & Confidentiality
Compression
PGP compresses the message after
applying the signature but before
encryption, having advantage as follows:
It is preferable to sign an uncompressed
message so that one can store only the
uncompressed message together with the
signature for future verification.
Even if one were willing to generate
dynamically a recompressed message for
verification, PGP's compression algorithm
presents a difficulty.
E-Mail Compatibility
The scheme used for this purpose is radix-
64 conversion.
Each group of three octets of binary data is
mapped into four ASCII characters.
This format also appends a CRC to detect
transmission errors
Segmentation and
Reassembly
 E-mail facilities often are restricted to a
maximum message length. For example, many
of the facilities accessible through the Internet
impose a maximum length of 50,000 octets.
Any message longer than that must be broken
up into smaller segments, each of which is
mailed separately.
 To accommodate this restriction, PGP
automatically subdivides a message that is too
large into segments that are small enough to
send via e-mail. The segmentation is done
after all of the other processing, including the
radix-64 conversion. Thus, the session key
component and signature component appear
S/MIME
S/MIME (Secure/ Multipurpose Internet Mail
Extension) is a security enhancement to
the MIME Internet e-mail format standard,
based on technology from RSA Data
Security.
Both are on IETF track, but S/MIME will
emerge as the industry standard for
commercial and organizational use, while
PGP will remain the choice for personal e-
mail security
Format of E-mail (RFC822)
Date: Tue, 16 Jan 1998 10:37:17 (EST)
From: "William Stallings" <ws@shore.net>
Subject: The Syntax in RFC 822
To: Smith@Other-host.com
Cc: Jones@Yet-Another-Host.com

Hello. This section begins the actual

message body, which is delimited from the
message heading by a blank line.
 Email is probably the most used mode of communication today not
only for casual chat purposes but for the transmission of very
sensitive information. It could be business plans, personal
information, or other important documents, all of which you would
want to be sure are safe in your email.
 S/MIME can do both symmetric encryption and digital signatures,
which are two very important functions for securing emails in the
best possible way. Symmetric encryption guarantees that only the
addressee will be able to read your email, and digital signatures
identify who it came from and show that it wasn’t changed on its
way to your inbox. With S/MIME, you will be able to protect your
communication against unwanted readers and establish trust with
those receiving your emails.
 S/MIME stands for Secure/Multipurpose Internet Mail Extensions.
Through encryption, S/MIME offers protection for business emails.
S/MIME comes under the concept of Cryptography. S/MIME is a
protocol used for encrypting or decrypting digitally signed E-mails.
This means that users can digitally sign their emails as the
owner(sender) of the e-mail.
 Emails could only be sent in NVT 7-bit format in the past, due to
which images, videos, or audio were not a part of e-mail
attachments. Bell Communications launched the MIME standard
Advantages of S/MIME
It offers verification.
It offers integrity to the message.
By the use of digital signatures, it facilitates
non-repudiation of origin.
It offers seclusion.
Data security is ensured by the utilization
of encryption.
Transfer of data files like images, audio,
videos, documents, etc. in a secure
manner.
 Functions
 Authentication − It refers to the verification of a
computer user's or a website's identity.
 Message consistency − This is a guarantee that
the message's contents and data have not been
tampered with. The message's secrecy is crucial. The
decryption procedure entails checking the message's
original contents and guaranteeing that they have
not been altered.
 Use of digital signatures that invoke non-
repudiation − This is a circumstance in which the
original sender's identity and digital signatures are
validated so that there is no doubt about it.
 Protection of personal information − A data
breach cannot be caused by an unintentional third
party.
Key Points – IP Security
IP security (IPSec) is a capability that can
be added to either current version of the
Internet Protocol (IPv4 or IPv6), by means
of additional headers.
IPSec encompasses three functional areas:
authentication, confidentiality, and key
management.
Authentication makes use of the HMAC
message authentication code.
Authentication can be applied to the entire
original IP packet ( tunnel mode) or to all of
the packet except for the IP header
(transport mode).
 Applications of IPSec
 IP Sec (Internet Protocol Security) is an Internet Engineering
Task Force (IETF) standard suite of protocols between two
communication points across the IP network that provide data
authentication, integrity, and confidentiality. It also defines the
encrypted, decrypted, and authenticated packets. The
protocols needed for secure key exchange and key
management are defined in it.
 IPSec refers to a collection of communication rules or protocols
used to establish secure network connections.
Internet Protocol (IP) is the common standard that controls
how data is transmitted across the internet. IPSec enhances
the protocol’s security by introducing encryption and
authentication. For example, it encrypts data at the source and
then decrypts it at the destination. It also verifies the source of
the data.
 IPSec provides the capability to secure communications across
a LAN, across private and public WANs, and across the
Benefits of IPSec
When IPSec is implemented in a firewall or
router, it provides strong security that can
be applied to all traffic crossing the
perimeter.
IPSec in a firewall is resistant to bypass if
all traffic from the outside must use IP.
IPSec is below the transport layer (TCP,
UDP) and so is transparent to applications.
IPSec can be transparent to end users.
There is no need to train users on security
mechanisms.
IPSec can provide security for individual
IP Security Architecture
Its too complex.
IPSec Documents
RFC 2401: An overview of a security
architecture
RFC 2402: Description of a packet
authentication extension to IPv4 and IPv6
RFC 2406: Description of a packet encryption
extension to IPv4 and IPv6
RFC 2408: Specification of key management
capabilities
IP Security Architecture
 IPSec encryption is a software function that encrypts
data to protect it from unauthorized access. An
encryption key encrypts data, which must be decrypted.
IPSec supports a variety of encryption algorithms,
including AES, Blowfish, Triple DES, ChaCha, and DES-
CBC. IPSec combines asymmetric and
symmetric encryption to provide both speed and
security during data transmission. In
asymmetric encryption, the encryption key is made
public, while the decryption key remains private.
Symmetric encryption employs the same public key to
encrypt and decrypts data. IPSec builds a secure
connection using asymmetric encryption and then
switches to symmetric encryption to speed up data
transmission.
 Components of IP Security
 Encapsulating Security Payload (ESP)
 Encapsulating Security Payload (ESP): It provides data integrity,
encryption, authentication, and anti-replay. It also provides
authentication for payload.
Authentication Header (AH): It also provides data integrity,
authentication, and anti-replay and it does not provide encryption.
The anti-replay protection protects against the unauthorized
transmission of packets. It does not protect data confidentiality.
Internet Key Exchange (IKE): It is a network security protocol
designed to dynamically exchange encryption keys and find a way
over Security Association (SA) between 2 devices. The Security
Association (SA) establishes shared security attributes between 2
network entities to support secure communication. The Key
Management Protocol (ISAKMP) and Internet Security Association
provides a framework for authentication and key exchange. ISAKMP
tells how the setup of the Security Associations (SAs) and how
direct connections between two hosts are using IPSec.
Internet Key Exchange (IKE) provides message content protection
and also an open frame for implementing standard algorithms such
as SHA and MD5. The algorithm’s IP sec users produce a unique
identifier for each packet. This identifier then allows a device to
Working on IP Security
 The host checks if the packet should be transmitted using IPsec
or not. This packet traffic triggers the security policy for itself.
This is done when the system sending the packet applies
appropriate encryption. The incoming packets are also checked
by the host that they are encrypted properly or not.
 Then IKE Phase 1 starts in which the 2 hosts( using IPsec )
authenticate themselves to each other to start a secure
channel. It has 2 modes. The Main mode provides greater
security and the Aggressive mode which enables the host to
establish an IPsec circuit more quickly.
 The channel created in the last step is then used to securely
negotiate the way the IP circuit will encrypt data across the IP
circuit.
 Now, the IKE Phase 2 is conducted over the secure channel in
which the two hosts negotiate the type of cryptographic
algorithms to use on the session and agree on secret keying
material to be used with those algorithms.
 Then the data is exchanged across the newly created IPsec
What are IPSec modes?

Tunnel: The IPSec tunnel mode is

appropriate for sending data over public
networks because it improves data security
against unauthorised parties. The computer
encrypts all data, including the payload and
header, and adds a new header to it.
Transport: IPSec transport mode encrypts
only the data packet’s payload while
leaving the IP header unchanged. The
unencrypted packet header enables
routers to determine the destination
address of each data packet. As a result,
IPSec transport is utilized in a closed and
 Features of IPSec
 Authentication: IPSec provides authentication of IP packets
using digital signatures or shared secrets. This helps ensure
that the packets are not tampered with or forged.
 Confidentiality: IPSec provides confidentiality by encrypting
IP packets, preventing eavesdropping on the network traffic.
 Integrity: IPSec provides integrity by ensuring that IP
packets have not been modified or corrupted during
transmission.
 Key management: IPSec provides key management
services, including key exchange and key revocation, to
ensure that cryptographic keys are securely managed.
 Tunneling: IPSec supports tunneling, allowing IP packets to
be encapsulated within another protocol, such as GRE
(Generic Routing Encapsulation) or
L2TP (Layer 2 Tunneling Protocol).
 Flexibility: IPSec can be configured to provide security for a
wide range of network topologies, including point-to-point,
site-to-site, and remote access connections.
Advantages of IPSec
 Strong security: IPSec provides strong
cryptographic security services that help
protect sensitive data and ensure network
privacy and integrity.
 Wide compatibility: IPSec is an open
standard protocol that is widely supported by
vendors and can be used in heterogeneous
environments.
 Flexibility: IPSec can be configured to provide
security for a wide range of network topologies,
including point-to-point, site-to-site, and
remote access connections.
 Scalability: IPSec can be used to secure large-
scale networks and can be scaled up or down
Disadvantages of IPSec
 Configuration complexity: IPSec can be
complex to configure and requires specialized
knowledge and skills.
 Compatibility issues: IPSec can have
compatibility issues with some network devices
and applications, which can lead to
interoperability problems.
 Performance impact: IPSec can impact
network performance due to the overhead of
encryption and decryption of IP packets.
 Key management: IPSec requires effective
key management to ensure the security of the
cryptographic keys used for encryption and
authentication.
Secure socket layer (SSL) provides security
services between TCP and applications that
use TCP. The Internet standard version is
called transport layer service (TLS).
SSL/TLS provides confidentiality using
symmetric encryption and message
integrity using a message authentication
code.
SSL/TLS includes protocol mechanisms to
enable two TCP users to determine the
security mechanisms and services they will
use.
Secure electronic transaction (SET) is an
Secure Socket Layer
Netscape originated SSL. Version 3 of the
protocol was designed with public review
and input from industry and was published
as an Internet draft document.
SSL Architecture
SSL Record Protocol
Confidentiality: The Handshake
Protocol defines a shared secret key
that is used for conventional
encryption of SSL payloads.
Message Integrity: The Handshake
Protocol also defines a shared secret
key that is used to form a message
authentication code (MAC).
SSL Record Header format
Content Type (8 bits)
Major Version (8 bits):the value is 3.
Minor Version (8 bits): the value is 0.
Compressed Length (16 bits):
Change Cipher Spec
Protocol
The Change Cipher Spec Protocol is one of
the three SSL-specific protocols that use
the SSL Record Protocol, and it is the
simplest.
This protocol consists of a single message,
which consists of a single byte with the
value 1.
The sole purpose of this message is to
cause the pending state to be copied into
the current state, which updates the cipher
suite to be used on this connection.
Alert Protocol
The Alert Protocol is used to convey SSL-
related alerts to the peer entity.
alert messages are compressed and
encrypted.
 unexpected_message:
 bad_record_mac:
 decompression_failure:
 handshake_failure:
 illegal_parameter:
 close_notify:
 no_certificate:
 bad_certificate:
 unsupported_certificate:
 certificate_revoked:
 certificate_expired:
Handshake Protocol
The most complex part of SSL is the
Handshake Protocol.
This protocol allows the server and client to
authenticate each other and to negotiate
an encryption and MAC algorithm and
cryptographic keys to be used to protect
data sent in an SSL record.
The Handshake Protocol is used before any
application data is transmitted.
Transport Layer Security
TLS is an IETF standardization initiative
whose goal is to produce an Internet
standard version of SSL.
TLS is defined as a Proposed Internet
Standard in RFC 2246. RFC 2246 is very
similar to SSLv3.
Differences
Version Number
 For the current version of TLS, the Major Version is 3
and the Minor Version is 1.
Message Authentication Code
decryption_failed
Pseudorandom Function record_overflow:
unknown_ca:
Alert Codes access_denied:
Secure Electronic transaction
(SET)
SET is an open encryption and security
specification designed to protect credit card
transactions on the Internet.
The current version, SETv1, emerged from
a call for security standards by MasterCard
and Visa in February 1996.
 A wide range of companies were involved
in developing the initial specification,
including IBM, Microsoft, Netscape, RSA,
Terisa, and Verisign.
 Beginning in 1996, there have been
numerous tests of the concept, and by
1998 the first wave of SET-compliant
SET Services
Provides a secure communications channel
among all parties involved in a transaction
Provides trust by the use of X.509v3 digital
certificates
Ensures privacy because the information is
only available to parties in a transaction
when and where necessary
SET Overview
A good way to begin our discussion of SET
is to look at the business requirements for
SET, its key features, and the participants
in SET transactions.
Requirements
 Provide confidentiality of payment and ordering
information:
 Ensure the integrity of all transmitted data:
 Provide authentication that a cardholder is a
legitimate user of a credit card account:
 Provide authentication that a merchant can
accept credit card transactions through its
relationship with a financial institution:
 Ensure the use of the best security practices and
system design techniques to protect all legitimate
parties in an electronic commerce transaction:
 Create a protocol that neither depends on
transport security mechanisms nor prevents their
use:
 Facilitate and encourage interoperability among
software and network providers:
Key Features of SET
Confidentiality of information:
Integrity of data:
Cardholder account authentication:
Merchant authentication:
SET Participants
Cardholder:
Merchant:
Issuer:
Acquirer:
Payment gateway:
Certification authority (CA):
Acquire Payment
Gateway
Steps :
The customer opens an account.
The customer receives a certificate.
Merchants have their own certificates.
The customer places an order.
The merchant is verified.
The order and payment are sent.
The merchant requests payment
authorization.
The merchant confirms the order.
The merchant provides the goods or
service.
The merchant requests payment.
Dual Signature
Payment Processing
Purchase request
Payment authorization
Payment capture