Multiple Choice Questions on CNS & IS (Part 1)

 MCQs on CNS & IS

1.  Which of the following term indicates that the data is not modified by unauthorised users? 

• Confidentiality
• Integrity
• Availability
• Flexibility

2.  Authentication is used for which of the following? 

• Provide access rights
• Verify identify of the user
• Monitor systems connected to a network
• Encrypt data at rest

3.  Which device connects multiple networks? 

• Hub
• Router
• Switch
• Repeater

4.  Information Security is for protecting which of the following? 

• Hardware
• Software
• Data
• Data Center

5.  Reconnaissance means ________________. 

• Gaining access
• Collecting information
• Exploiting system
• Clearing logs

6.  Which security service ensures that data is protected from unauthorised disclosure. 

• Confidentiality
• Authenticity
• Availability
• Integrity

7. Which of the following encryption algorithms is based on the Fiestal structure?

• RSA public key cryptographic algorithm
• Advanced Encryption Standard (AES)
• Data Encryption Standard (DES)
• None of the above

Explanation:

• Feistel Cipher is not a specific scheme of block cipher, it is a design model from which many different block ciphers are derived. 
• DES is just one example of a Feistel Cipher. 
• A cryptographic system based on Feistel cipher structure uses the same algorithm for both encryption and decryption.

8.  Which one of the following algorithm is not used in asymmetric key cryptography?

• RSA Algorithm
• Diffie-Hellman Algorithm
• Electronic Code Book Algorithm
• None of the above

Explanation:  

• RSA algorithm and Diffie-Hellman algorithm are popular asymmetric key cryptographic algorithms.  
• RSA is used for encryption and decryption, while Diffie-Hellman is used for key exchange.  
• Electronic Code Book (ECB) algorithm is a symmetric key cryptographic algorithm in which the same key is used for both encryption and decryption.

9.  Which one of the following is true for asymmetric-key cryptography?

• Private key is kept by the receiver and the public key is announced to the public.
• Public key is kept by the receiver and the private key is announced to the public.
• Both private key and the public key are kept by the receiver.
• Both private key and the public key are announced to the public.

10.  A sender is employing public key cryptography to send a secret message to a receiver. Which one of the following statements is TRUE?

• Sender encrypts using Receiver's public key
• Sender encrypts using his own public key
• Receiver decrypts using Sender's public key
• Receiver decrypts using his own public key

11.  Hashed message is signed by a sender using his ___________________.

• his public key
• his private key
• receiver's public key
• receiver's private key

Explanation:  

• After the generation of hash value (also called message digest) that needs to be transmitted over a network, it is signed (encrypted) using the private key of the sender which is known as digital signature.  
• The message is transmitted along with the digital signature which ensures authentication and non-repudiation.

12.  Anarkali digitally signs a message and sends it to Salim. Verification of the signature by Salim requires ____________________.

• Anarkali's public key
• Salim's public key
• Anarkali's private key
• Salim's private key

13.  Which of the following are used to generate a message digest by the network security protocols?

• RSA
• SHA-1
• DES
• MD5

Explanation:  SHA 1 and MD5 are used to generate a message digest by the network security protocols.

• RSA – It is an algorithm used to encrypt and decrypt messages.
• SHA 1 – Secure Hash Algorithm 1, or SHA 1 is a cryptographic hash function. It produces a 160 bit (20 byte) hash value (message digest).
• DES – Data Encryption Standard, or DES is a symmetric key algorithm for encryption of electronic data.
• MD5 – Message Digest 5, or MD5 is a widely used cryptographic hash function that produces a 128 bit hash value (message digest).

14.  MD5 is a widely used hash function for producing hash value of ____________.

• 64 bits
• 128 bits
• 512 bits
• 1024 bits

15. Pretty Good Privacy (PGP) is used in ______________.

• Browser security
• FTP Security
• E-mail security
• None of the above

Explanation:

• PGP is a an encryption phenomena that provide cryptographic privacy and authentication for data communication over e-mails. 
• It generates a public key to encrypt a message at sender's end and private key to decrypt a message at receiver's end allowing us to send files and messages securely over internet. 
• OpenPGP is an email encryption standard. 
• It uses Digital Signatures to provide authentication and integrity checking basically to check if the message is actually sent by the person or entity claimed to be the sender. 

Continue reading →

Firewalls and Intrusion Detection

Introduction to Firewalls

• A firewall is a computer or group of computers that stand between  trusted networks (such as LAN) and untrusted networks (such as the Internet), inspecting all traffic passing between them.
• A firewall can be a router, a personal computer, or a collection of hosts, that is set up specifically to shield a private network from security attacks that comes from an external entity.
• The basic function of a firewall is to screen network traffic for the purpose of preventing unauthorised access between computer networks.

• To be effective in their operation, firewalls must have the following attributes:
• All communications must pass through the firewall
• The firewall permits only traffic that is authorized
• The firewalls can withstand attacks upon itself

 

Continue reading →

Transport Layer Security for Web Applications

Web Security

• Virtually all businesses including government agencies as well as individuals have web sites now-a-days.  
• The number of users of web sites and web applications increase rapidly day by day.  
• Web browsers are easy to use, web servers are relatively easy to configure and manage, and web content is increasingly easy to develop.
• But, Internet and World Wide Web (WWW) are vulnerable to compromises of various security threats that may challenge the web traffic security of an organisation or an individual.

• The World Wide Web (WWW) provides the platform for client/server applications to run over the Internet and TCP/IP intranets.
• Casual and untrained (in security matters) users are common clients for web based services.  Such users are not necessarily aware of the security risks that exist and do not have the tools or knowledge to take effective countermeasures

Web Security Threats:

• One way of classifying attacks on Web can be in terms of their impact on the web: passive attack and active attack
• Passive attacks include eavesdropping on network traffic between browser and server and gaining access to information on a Web site that is supposed to be restricted
• Active attacks include impersonating another user, altering message in transit between client and server, and altering information on a web site.

Table: A Comparison of Threats on the Web

• Another way of classifying the attack on the Web can be done in terms of the location of its occurrence on the web: web server, web browser, and network traffic between browser and the server.

Web Traffic Security Approaches:

• One way of providing web security is to use IP Security (IPSec) protocol as shown in Figure (a).  IPSec is a general-purpose solution for providing security on the internet, which is transparent to end users and applications.

• Another way of implementing web security is to implement security just above TCP (Figure b).  In this approach, the protocols such as Secure Socket Layer (SSL) and Transport Layer Security (TLS) could be used on top of the Transport Layer.
• The third approach is providing security at the application layer.  In this approach, the application-specific security service such as Kerberos is embedded within the particular application for securing its data transmission on the web.

Transport Layer Security (TLS)

• One of the most widely used security services for web security is Transport Layer Security (TCL) 
• TCL is an Internet standard that evolved from a commercial protocol known as Secure Socket Layer (SSL)
• TLS is a general-purpose service implemented as a set of protocols that rely on TCP
• TLS can be used for web security in two ways:
• TLS could be provided as part of the underlying protocol suit and therefore transparent to applications running above it
• TLS can be embedded in specific application packages, such as web browsers on which web clients are running
• TLS is designed to make use of TCP to provide a reliable end-to-end secure service for the applications running on the application layer

Fig. TLS Protocol Stack

Continue reading →

Question Bank on Information Security

Frequently Asked Questions (FAQ)

Unit-1 Questions

Topics Covered: 

• Security Attacks (Interruption, Interception, Modification and Fabrication)
• Security Services (Confidentiality, Integrity, Authentication, Non-repudiation, Access Contol)
• Security Mecahanisms
• A model for inter-network security
• Classical Encryption Techniques
• DES, Strength of DES
• Differential and Linear Cryptanalysis
• Design principles and Modes of Operation of Block ciphers
• Blowfish
• Placement of Encryption Function
• Traffic Confidentiality
• Key Distribution
• Random Number Generation

Descriptive Questions (2 Marks):

1. What does the CIA Triad stand for?
2. What do you mean by Security Service?
3. Define data confidentiality.
4. What is Cryptanalysis?
5. What are the ingredients of Symmetric Cipher model?
6. List the security services available for securing a system from various attacks.
7. Define stream ciphers.
8. Differentiate Symmetric and Asymmetric cryptography.
9. How many modes of operations are there for implementing a Block Cipher?  What are they?
10. Give example for mono alphabetic and poly alphabetic ciphers.
11. What is known as security attack?
12. Brief the strengths of triple DES.

Descriptive Questions (5 Marks):

1. With the help of a neat diagram, explain the model for network security.
2. Differentiate active and passive security attack.
3. Write short notes on Data Confidentiality.
4. Explain symmetric cipher model with diagram.
5. Compare and Contrast between Symmetric and Asymmetric key cryptography.
6. Write about any two classical cryptosystems with suitable examples.
7. Explain the Ceaser cipher and mono alphabetic cipher.
8. Explain about Hill Cipher. Consider the plaintext "paymoremoney" and use the encryption key:
   
       Find the cipher text?
9. For each of the following assets, assign a low, moderate or high impact level for the loss of confidentiality, availability and integrity respectively.  Justify your answer:
• Financial organisation managing routine administrative information
• Organisation managing public information on its web server
• Law enforcement organisation managing extremely sensitive information.
10. Draw a matrix that shows the relationship between security mechanisms and attacks.
11. State the difference between block cipher and stream cipher.
12. Discuss in details about cipher block modes of operation.
13. Explain about security attacks
14. Compare and contrast linear and differential cryptanalysis.
15. Describe DES algorithm with neat diagram and explain the steps.
16. List and explain the strength of DES.
17. Explain in detail about Blowfish Algorithm.

Unit-2 Questions

Topics Covered: 

• Principles of Public Key Cryptography
• RSA Algorithm
• Key Management
• Diffie-Hellman Key Exchange
• Elliptic Curve Cryptography
• Message Authentication and Hash Functions
• Authentication Requirements
• Message authentication
• Hash Functions and MACs
• Hash and MAC Algorithms
• SHA-512
• HMAC

Descriptive Questions (2 Marks):

1. Describe the use of Public Key cryptography.
2. List the 6 ingredients of public key encryption.
3. What are the advantages of key distribution in cryptography?
4. Draw the diagram for Public-Key distribution scenario.
5. What are the principles of Public-Key cryptosystems?
6. What are the different approaches to Public-Key management?
7. What is one-way authentication.
8. What are the requirements for (message) authentication?
9. Draw the general structure of Secure Hash Code.
10. What are the requirements of MAC function?

Descriptive Questions (5 Marks):

1. Briefly explain the working principle of Public Key Cryptography.
2. In RSA, Given n=12091 and e=13, encrypt the message "THIS IS TOUGH" using the 00 to 26 encoding scheme.  Also decrypt the ciphertext to find the original message.
3. Explain RSA algorithm, and perform encryption and decryption using RSA with p=7, q=11, e=17,  and M=8.
4. Explain simple secret key distribution with diagram.
5. Explain Diffie-Hellman key exchange algorithm in detail.
6. Discuss about authentication requirement.
7. Discuss about message authentication and Hash functions.
8. Explain the SHA-512 algorithm.  Illustrate with an example.
9. Explain message digest generation using SHA-512 algorithm.  
10. What is the order of finding two messages having the same message digest using SHA-512?
11. Define HMAC.  Write short notes on Security of HMAC.

Unit-3 Questions

Topics Covered: 

• Digital Signatures
• Authentication Protocols
• Digital Signature Standard (DSS)
• Authentication Applications
• Kerberos
• X.509 Directory Authentication Service (DAS)
• E-Mail Security
• Pretty Good Privacy (PGP)
• S/MIME

Descriptive Questions (2 Marks):

1. What is Digital Signature?
2. Differentiate RSA and DES approach for digital signature.
3. Why Kerberos is needed?
4. List any two applications of X.509 certificates.

Descriptive Questions (5 Marks):

1. State the properties and requirements of digital signatures.
2. Mention three variations of digital signatures and state the purpose of each.
3. Explain Digital Signature Standard (DSS) with necessary diagrams in detail.
4. Explain in detail about Kerberos.
5. What do you mean by the Kerberos Realm? Explain the working of Kerberos.
6. Assume client C wants to communicate with a server S using Kerberos protocol.  How can it be achieved?
7. Explain the X.509 certificate formats.
8. Explain the X.509v3 certificate format.
9. What do you mean by PGP?  Explain the working principle of PGP.
10. How are the messages generated and transmitted in pretty good privacy (PGP) protocol? Explain with clear diagrams.
11. Why does PGP compress the message?  What are the reasons for compressing the signature before encryption.
12. List and explain the services provided by PGP and show how message generation is done using PGP with a neat diagram.
13. In PGP, what is the probability that a user with N Public Keys will have at least one, duplicate key ID?
14. Explain the significance of email security protocols like PGP and S/MIME in protecting email communication.

Unit-4 Questions

Topics Covered: 

• IP Security
• Overview
• IP Security Architecture
• Authentication Header (AH)
• Encapsulating Security Payload (ESP) 
• Combining Security Associations (SAs)
• Key Management
• Web Security
• Web Security Requirements
• Secure Socket Layer (SSL)
• Transport Layer Security (TLS)
• Secure Electronic Transaction (SET)

Descriptive Questions (2 Marks):

1. Define Virtual Private Network (VPN).
2. Define the term IP Security (IPSec).
3. Write about Security Association (SA).
4. What is Secure Socket Layer (SSL)?
5. What is TLS?
6. What are the different alert codes of TLS Protocol?

Descriptive Questions (5 Marks):

1. What is IP Security?  Discuss in detail about IPSec Architecture.
2. Explain in detail IP security architecture.
3. What are the differences between transport mode and tunnel mode in IPsec?
4. Explain the need for combining Security Associations (SAs) for network security.
5. What are different services provided by the SSL Record Protocol?
6. Describe in detail the working of SSL/TLS, including the handshake process and encryption techniques.
7. List and briefly define the parameters that define an SSL session state.
8. Explain in detail Secure Electronic Transaction (SET).
9. Discuss the steps involved in Secure Electronic Transaction (SET).
10. List out the participants of SET system, and explain in detail?

Unit-5 Questions

Topics Covered: 

• Intruders
• Viruses and Worms
• Viruses and related threats
• Firewall
• Firewall Design Principles
• Trusted Systems
• Intrusion Detection System (IDS)

Descriptive Questions (2 Marks):

1. What do you mean by Worms?
2. Differentiate between worms and viruses.
3. Write any two design goals of firewall.
4. Define Firewall.
5. List the three types of firewall.
6. What is the role of firewall in Information Security (IS)?
7. What is an intrusion detection system, and how does it work?

Descriptive Questions (5 Marks):

1. Select any antivirus of your choice and explain it in detail.
2. Write and explain the four phases that a typical virus goes through.
3. Discuss about:
• Intruders
• Trusted System
4. What is Intrusion? Explain in detail Intrusion Detection System (IDS) with diagram.
5. Generalise the role of Intrusion Detection System? Point out the three benefits that can be provided by an intrusion detection system?
6. Illustrate the working of an Intrusion Detection System with a real-world example.
7. Justify the role of firewalls in protecting enterprise networks from cyber threats.
8. Where would you place a web server in an organisation assuming that you can use a network firewall and why?
9. Illustrate the three common types of firewalls with diagrams?
10. Define firewall.  Explain its characteristics, types, services and limitations.

Continue reading →

Tutorial on Information Security

Tutorials on Information Security (IV CSE)

Tutorial-I (04-08-2026):

1. Explain the Play Fair cipher algorithm? Encrypt the message ‘MY BALLOON’ using the key ‘MONARCHY.
2. Encrypt the message “this is an exercise” using Caesar Cipher with key = 20.  Ignore the space between words. 
3. Encrypt the message “the house is being sold tonight” using Vigenere cipher with key = “dollars”.  Ignore the space between words.
4. Use PlayFair cipher with keyword = “Health” to encipher the message “Life is Full of Surprises”
5. Use Hill Cipher to encipher the message “WE LIVE ON EARTH” using the key = “DCFH”

Tutorial-II (12-08-2026):

1. Explain HMAC.
2. Discuss about authentication requirements.
3. Discuss about message authentication and hash functions.
4. Explain the Diffie-Hellman key exchange algorithm.
5. Explain the SHA-512 algorithm. Illustrate with an example.

Tutorial-III (05-09-2026):

1. Assume client C wants to communicate with a server S. How can it be achieved using Kerberos protocol?
2. What is one-way authentication? Also explain the X.509 certificate formats.
3. Mention three variations of digital signatures and briefly state the purpose of each.
4. What do you mean by PGP? Explain the working principle of PGP.
5. In PGP, what is the probability that a user with N public keys will have at least one, duplicate key ID?

Tutorial-IV (19-09-2026):

1. Discuss the need for IPSec and also explain the role of Security Asociations (SA) in managing IP security.
2. What is IP Security? Discuss in detail IPSec Architecture with supporting diagram.
3. What is TLS? Explain in detail Secure Electronic Transaction (SET).
4. Define VPN. Also explain in detail about the two ways in which IPSec authentication service can be used for providing information security.
5. Identify the challenges involved in implementing Web Security.

Tutorial-V (30-09-2026):

1. What do you mean by Worms?  Write notes on Intruders and Trusted Systems.
2. What is the function of a firewall?  Explain its characteristics, types, services and limitations.
3. Explain in detail about Intrusion Detection System (IDS).
4. Select any antivirus of your choice and explain it in detail.
5. Where would you place a web server in an organisation assuming that you can use a network firewall.  Justify.

Continue reading →

Assignment on Information Security (IS)

Assignment-1 Questions

SET-1:

1. Differentiate active and passive security attack.
2. Write short notes on Data confidentiality.
3. Explain symmetric cipher model with diagram.
4. Compare and contrast linear cryptanalysis and differential cryptanalysis.
5. Write RSA algorithm and explain with one example
6. Explain simple secret key distribution with diagram.

SET-2:

1. What is known as security attack?  Also define the term IP security.
2. Draw and explain the general Structure of Secure Hash Code.
3. Draw the diagram and explain Public-Key Distribution Scenario.
4. How DES Signing and Verifying is done? Explain.
5. State the properties and requirements of digital signature.
6. Differentiate RSA and DES approach for digital signature.

SET-3:

1. Compare and Contrast between Symmetric and Asymmetric key cryptography.
2. Discuss in detail about AES algorithm.
3. Discuss in details about cipher block modes of operation.
4. What do you mean by the Kerberos Realm? Explain the working of Kerberos.
5. What are the advantages of Key Distribution?  What are different approaches to Public-key Management?
6. 
   
   

SET-4:

1. What the principles of public key cryptosystems?  List the 6 ingredients of public key encryption.
2. Name the security services available for Information Security.  What are the requirements for (message) authentication?
3. Describe DES algorithm with neat diagram and explain the steps.
4. Explain in detail about various security attacks.
5. Explain the ceaser cipher.  And brief the strengths of triple DES.
6. Explain RSA algorithm, perform encryption and decryption to the system with p=7, q=11, e=17, M=8

SET-5:

1. Explain Diffie-Hellman key exchange algorithm in detail
2. Explain digital signature standard with necessary diagrams in detail.
3. Differentiate between interruption and interception attacks.
4. Outline the concepts of authentication and access control.
5. Outline the concept of traffic confidentiality and its significance in network security.
6. Define Blowfish cipher and highlight its major advantages.

SET-6:

1. Compare RSA with Elliptic Curve Cryptography (ECC) in terms of key size, security, performance and application.
2. Illustrate SHA-512 algorithm with suitable example.
3. Explain HMAC algorithm in detail.
4. Outline the major applications of digital signatute.
5. Classify the authentication protocols and list out their features.
6. List the advantages and limitations of Kerberos.

Assignment-2 Questions

SET-1:

1. Explain in detail IPSec protocol.
2. Explain the role of Encapsulation Security Payload in securing data transmission over IP.
3. Define TLS.  How does HTTP differ from HTTPS?  What makes HTTPS secure for communication between web client and web server?
4. What is Secure Socket Layer?  How does the client/server communication happen securely on the internet using SSL Record protocol? 
5. What is the need for a firewall.  Discuss the various types of firewalls available for network security.

SET-2:

1. What do you mean by the Kerberos Realm? Explain the working of Kerberos.
2. How the messages are generated and transmitted in pretty good privacy (PGP) protocol Explain with clear diagrams.
3. What are different alert codes of TLS protocol?  What are different services provided by the SSL Record Protocol?
4. How does the client/server communication happen securely on the internet using SSL Record protocol? 
5. Generalize the role of intrusion detection system? Point out the three benefits that can be provided by the intrusion detection system?

SET-3:

1. With diagram explain X.509 Formats.
2. Define the term IP security.  Explain IP security architecture with a supporting diagram.
3. List out all the new challenges of Web security.
4. A Write and explain the four phases that a typical virus goes through.
5. What is Intrusion? Discuss Intrusion detection system with neat Diagram.

SET-4:

1. Explain how Transmission and Reception of PGP Messages occurs.
2. Define virtual private network.  Write in detail about the two ways in which the IPSec authentication service can be used.
3. Describe in detail the working of SSL/TLS, including the handshake process and encryption techniques.
4. Differentiate worms and viruses.  Illustrate the working of an Intrusion Detection System with a real-world example.
5. Define Firewall. Justify the role of firewalls in protecting enterprise networks from cyber threats.

SET-5:

1. Justify the statement-“Message encryption by itself can provide a measure of authentication”
2. List any two applications of X.509 certificates.  Also discuss the purpose of X.509 certificate standard.
3. State the number of security keys used in Kerberos.  Explain Kerberos version 4 in brief.
4. Write about PGP cryptographic functions for authentication only, confidentiality only and both confidentiality and authentication.
5. Discuss the benefits of IP security.  What are the differences between transport mode and tunnel mode in IPsec?

SET-6:

1. Examine how asymmetric encryption resolves the key distribution problem of symmetric ciphers.
2. Explain X.590 directory authentication service.
3. Explain how security can be provided to E-mails.
4. Explain the steps involved in SSL Record Protocol transmission.
5. What are the applications of IPSec?  Explain the ESP Protocol with a neat diagram.

Continue reading →

Problems to solve on Cryptography

List of Experiments on Cryptography

1(a) Implementation of Encryption and Decryption of Vigenère Cipher as follows:

• Cipher keyword is: deceptive 
• Key: deceptivedeceptivedeceptive 
• Plaintext: we are discovered save yourself

(OR)

1(b) Raju sends an encrypted message (cipher text) “PHHW PH DIWHU WKH WRJD SDUWB” to Rani. Can you build decryption process and find out what is the message (plain text) send to Rani? Hint: try all keys.

2(a)  Kohli have plain text “wewishtoreplaceplayer”. Can you build encryption process and find out what is the cipher text he needs send to BCCI using Playfair Cipher. Help him to build a key matrix using the key “mrecwautonomous”

(OR)

2(b)  By using key “CBDE” Raju would like send message (plain text)“HELLO WORLD” to Rani.  Can you build encryption process and find out what is the encrypted message (cipher text) to Raju by using Hill Cipher.

Continue reading →

Presentations and Video Lectures on CNS & IS

Useful Resources for Learning IS & CNS

​

Presentations for Teaching/Learning:

1. Introduction to Information Security.
2. Model for Security & Symmetric Encryption
3. History and Overview of Cryptography
4. Introduction to Transposition & Block Ciphers
5. Data Encryption Standard & Algorithm
6. Public-Key Cryptography
7. SSL/TLS Ptotocols

Video Tutorials from Neso Academy:

1. Feistel Cipher Structure
2. Advanced Encryption Standard (AES)

Other Video Tutorials:

     1. Two Types of Encryption

     2. Hybrid Encryption and it's use

     3. SSL & TLS

     4. Use of Cryptography in SSL/TLS 

Learning Material from Pathshala:

     1.  IP Security

     2.  Web Security using SSL and TLS

Continue reading →

Course Detail of the Subject - Information Security

INFORMATION SECURITY (2205PC13) 

Credits: 3

Prerequisites: Computer Networks, Mathematics 

Course Outcome:

Upon successful completion of this course, students will be able to:

1. Classify security attacks, services, and mechanisms, and apply classical & block ciphers (DES, Blowfish) with appropriate modes.
2. Implement public key algorithms (RSA, Diffie-Hellman, ECC) and use hash functions & MACs (SHA-512, HMAC) for authentication.
3. Apply digital signatures, Kerberos, X.509, and configure email security (PGP, S/MIME).
4. Analyze IPSec (AH, ESP, key management) and evaluate web security protocols (SSL/TLS, SET).
5. Identify malware and intruders, and design firewall rules & IDS for network defense.

UNIT I – Security Attacks, Services & Classical Encryption

• Attacks
• Interruption
• Interception
• Modification
• Fabrication
• Services
• Confidentiality
• Authentication
• Integrity
• Non-repudiation
• Access Control
• Availability
• Classical encryption
• Data Encryption Standard
• Strength of DES
• Differential & linear cryptanalysis
• Block cipher principles
• Modes of operation
• Blowfish
• Traffic confidentiality
• Key distribution
• Random number generation

UNIT II – Public Key Crypto & Message Authentication

• Public key principles
• RSA
• Key management
• Diffie-Hellman
• Elliptic Curve Cryptography
• Message authentication
• Hash functions
• MACs
• SHA-512
• HMAC

UNIT III – Digital Signatures & Email Security

• Digital signatures
• Authentication protocols
• Digital Signature Standard
• Kerberos
• X.509
• Email security: PGP, S/MIME

UNIT IV – IP & Web Security

• IP Security (IPSec)
• Architecture
• AH
• ESP
• Security Associations
• Key Management
• Web Security
• SSL/TLS
• SET (Secure Electronic Transaction)

UNIT V – Intruders, Malware & Firewalls

• Intruders
• Viruses
• Worms
• Firewall design principles
• Trusted systems
• Intrusion detection systems (IDS)

Text Book:

• Cryptography and Network Security – William Stallings, Pearson, 4th Ed.

Reference Books: 

1. Network Security Essentials – Stallings (Reference)
2. Principles of Information Security – Whitman, Thomson (Reference)

Link for Joining the Classroom for learning this subject

Continue reading →

IPSec Architecture

Components of IPSec Architecture

IPSec architecture defines the concepts and mechanisms required for securing the data transmission at the IP (Internet Protocol) layer, which include the following:

1. Security Association
   
2. Security Protocols - AH and ESP
   
3. Key Management Protocol - IKE
4. Databases - SPD and SAD

Figure: IPSec Architecture

Here is a video introducing IPSec Protocol

Security Associations

• An association is a one-way logical connection between a sender and a receiver that affords security services to the traffic carried on it.
• If a peer communication is needed, for two-way secure exchange, then two security associations are required
• A security Association is uniquely identified by three parameters:
• Security Parameter Index (SPI)
• IP Destination Address
• Security Protocol Identifier
• SA parameters are defined as follows:
  
• SPI is a bit string assigned to SA which will be carried in AH or ESP headers to enable the receiving system to identify the corresponding SA that will process the packet further
• IP Destination Address identifies the destination endpoint of the SA, which may be an end user system or a network system such as a firewall or router
• Security Protocol Identifier indicates the protocol used for securing the data transmission in SA
  

Authentication Header (AH)

• AH is a security protocol used within the IPSec suite
• It confirms that the data originates from the expected source
• Its primary function is to ensure that the data remains unmodified during the transmission from the source to the destination (maintains data integrity)
• AH achieves authentication by adding a header to IP packets, containing a checksum and a digital signature

Figure: Format of the AH Header

Encapsulating Security Payload (ESP)

• ESP consists of an encapsulating header and trailer used to provide encryption or combined encryption/authentication

Security Association Database (SAD)

SAD defines each SA with the following set of parameters:

• Sequence Number Counter:  A 32-bit value used to generate the Sequence Number field in AH or ESP headers
• Sequence Counter Overflow:  A flag indicating whether overflow of the Sequence Number Counter should generate an auditable event and prevent further transmission of packets on this SA
• Anti-Replay Windows:  Used to determine whether an inbound AH or ESP packet is a replay or not
• AH Information:  Consists of details about authentication algorithm, keys, key lifetimes, and related parameters being used with AH 
• ESP Information:  Consists of details about encryption and authentication algorithm, keys, initialization values, key lifetimes, and related parameters
• Lifetime of This Security Association:  A time interval or byte count after which an SA must be replaced with a new SA or terminated
• IPSec Protocol Mode:  Indicates the mode of operation used - Tunnel, Transport or Wildcard
• Path MTU:  Any observed path maximum transmission unit (maximum size of a packet that can be transmitted without fragmentation) and aging variables

Security Policy Database (SPD)

• SPD contains entries, each of which defines a subset of IP traffic and points to an SA for that traffic
• Each SPD entry is defined by a set of IP and upper-layer protocol field values, called selectors (SA Selectors) 
• These selectors are used to filter outgoing traffic in order to map it into a particular SA
• Selectors that determine an SPD entry are as follows:
• Destination IP Address:  This may be a single IP address, an enumerated list or range of addresses
• Source IP Address:  This may be a single IP address, an enumerated list or range of addresses
• UserID:  A user identifier from the operating system.  This is an ID available in the operating system if IPSec is running on the same OS as the user
  
• Data Sensitivity Level:  Used for systems providing information flow security
• Transport Layer Protocol:  Obtained from the IPv4 protocol or IPv6 Next Header field.
• Source and Destination Ports:  These may be individual TCP or UPD port values, an enumerated list of ports, or a wildcard port

Two Modes of Operation in IPSec

• Both AH and ESP support two modes of operation: transport and tunnel mode.  
• Transport mode provide protection primarily for upper layer protocols by protecting the payload of an IP packet.  Whereas, tunnel mode provides protection for the entire IP packet. 
  

Transport Mode:

• Transport mode is used for end-to-end communication between two hosts (e.g., a client and a server, or two workstations)
• Transport mode encrypts only the data packet's payload and leaves the IP header in its original form. 
• The unencrypted packet header allows routers to identify the destination address of each data packet. Therefore, IPSec transport mode is used in a close and trusted network, such as securing a direct connection between two computers.
• ESP in the transport mode encrypts and optionally authenticates the IP payload but not the IP header
• AH in transport mode authenticates the IP payload and selected portions of the IP header
  

Tunnel Mode:

• The IPSec tunnel mode is suitable for transferring data on public networks as it enhances data protection from unauthorized parties. 
• The computer encrypts all data, including the payload and header, and appends a new header to it.

Video Presentations on IPSec:

 

Video on IPSec Protcols - AH and ESP

Continue reading →

IP Security (IPSec) Protocol

IP Security (IPSec)

• One of the key areas identified by Internet Architecture Board (IAB) in securing Internet communication is securing the network infrastructure from unauthorized users.
• Securing the network infrastructure can be done by implementing the following:
1. Monitoring and controlling the network traffic
2. Securing end-user-to-end-user traffic using authentication and encryption techniques

• An enterprise can run a secure, private IP network by doing the following:
• Disallowing links to untrusted  sites
• Encrypting packets that leave the premises and
• Authenticating packets that enter the premises

 

 

• IPSec provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet
• Implementing security at the IP level can help an organization secure networking through which applications can communicate with the external world
• IPv6 is the next-generation IP that fully implements IPSec by including the security features such as authentication and encryption.

IP Vs IPSec

• Internet Protocol (IP) is the common standard that determines how data travels over the internet. Whereas, IPSec refers to security mechanism impelemtned at the IP layer to ensure integrity, authentication and confidentiality of data during transmission in the open Internet environment.
• IPsec (IP Security) is a suite of security protocols added as an extension to the IP layer by performing the following:
  
• IPSec adds encryption and authentication to make IP more secure. For example, it scrambles the data at its source and unscrambles it at its destination. It also authenticates the source of the data. 
• IPsec ensures a secure connection between two computing devices over unprotected IP networks, such as the Internet.
• IPsec is a capability built over IP (IPv4 and IPv6) by means of additional headers.   It consists of three distinct functions – authentication, confidentiality and key management

Here is a link to have an Animated Video on IPSec

Key Functions of IPSec

IP-level security encompasses three functional areas namely:

1. Authentication
2. Confidentiality
3. Key Management

Authentication:

• The authentication mechanism assures that a received packet was, in fact, transmitted by the party identified as the source in the packet header (ensure authenticity)
• It also assures that the packet has not been altered in transit (ensure integrity of packets during transmission)

Confidentiality:

• The confidentiality facility enables communicating nodes to encrypt messages to prevent eavesdropping by third parties.

Key Management:

• The key management facility is concerned with the secure exchange of keys among two communicating parties

 

 

Figure: An IP Security Scenario

 

• When IPSec is implemented in a firewall or router, it provides strong security that can be applied to all traffic crossing the perimeter. 
• Some of the applications of IPSec are as follows:
• Secure branch office connectivity over the Internet
• Secure remote access over the Internet
• Establish extranet and intranet connectivity with partners
• Enhance electronic commerce security

How does IPSec work?

Computers exchange data with the IPSec protocol through the following steps. 

1. The sender computer determines if the data transmission requires IPSec protection by verifying against its security policy. If it does, the computer initiates secure IPSec transmission with the recipient computer.
2. Both computers negotiate the requirements to establish a secure connection. This includes mutually agreeing on the encryption, authentication, and other security association (SA) parameters. 
3. The computer sends and receives encrypted data, validating that it came from trusted sources. It also performs checks to ensure that the underlying content is reliable. 
4. Once the transmission is complete or the session has timed out, the computer ends the IPSec connection.
   

 

 

 

Figure: IPSec Architecture

• IPSec protocols send data packets securely.  A data packet is a specific structure that formats and prepares information for network transmission. 
• A data packet in IPSec consists of a header, payload, and trailer:
• A header is a preceding section that contains instructional information for routing the data packet to the correct destination. 
• Payload is a term that describes the actual information contained within a data packet.
• The trailer is additional data appended to the tail of the payload to indicate the end of the data packet. 

The three protocols defined in IPSec

IPsec is a suite of three transport-level protocols used for authenticating the origin and content of IP packets and optionally for data payload encryption.

Authentication header (AH):

• The authentication header (AH) protocol adds a header that contains sender authentication data and protects the packet contents from modification by unauthorised user.  
• It alerts the recipient of possible manipulations of the original data packet. 
• When receiving the data packet, the computer compares the cryptographic hash calculation from the payload with the header to ensure both values match.  
• A cryptographic hash is a mathematical function that summarises data into a unique value. 

Encapsulating security payload (ESP):

• The encapsulating security payload (ESP) protocol performs encryption on the entire IP packet or only the payload. 
• ESP adds a header and trailer to the data packet upon encryption. 

Internet key exchange (IKE):

• Internet key exchange (IKE) is a protocol that establishes a secure connection between two devices on the internet. 
• Both devices set up security association (SA), which involves negotiating encryption keys and algorithms to transmit and receive subsequent data packets. 

Continue reading →