Computer Security: CIA Triad and Ransomware

• Guangsheng (Saber) Yu can be contacted at [email protected] for queries

Computer Security Objectives

• CIA stands for Confidentiality, Integrity, and Availability.

Confidentiality

• Ensures private information isn't accessible to unauthorized individuals.
• Assures control over how personal data is collected, stored, and disclosed.

Integrity

• Guarantees data and programs undergo modifications in a specified, authorized manner only.
• Confirms a system's operations align with the intended function, preventing unauthorized interference.

Availability

• Ensures systems operate promptly without denial of service to authorized users.

Ransomware Scenario

• A user unknowingly downloads ransomware disguised as a legitimate software update.
• Upon execution, the ransomware encrypts files, like documents and photos.
• Encryption is robust, making decryption without a key nearly impossible.
• Attackers demand cryptocurrency for the decryption key.
• Such an attack is a breach of confidentiality, integrity, and availability.

Security Attacks Classification

• Security attacks are classified as either passive or active, as defined in X.800 and RFC 4949.

Passive Attack

• Aims to learn or use system information without altering resources, like sniffing wireless signals.

Active Attack

• Attempts to alter system resources or affect their operations, which includes man-in-the-middle attacks.

Nature of Passive Attacks

• Eavesdropping on or monitoring transmissions.
• The goal of a passive attach is obtaining transmitted information.
• Prevention is key since detection is difficult.
• Passive attacks include the release of message contents and traffic analysis.

Active Attacks Overview

• Involve modifying data streams or creating false ones.
• Difficult to prevent due to diverse vulnerabilities in software, hardware and networks.
• The goal of active attacks is detecting and recovering disruptions or delays.
• Detection is favored over prevention.

Masquerade

• When an entity pretends to be a different entity.
• Usually includes another form of active attach.

Replay

• Involves capturing data, then retransmitting it to cause an unauthorized effect.

Modification of Messages

• Involves altering or reordering messages to produce unauthorized effects.

Denial of Service

• Prevents or inhibits the normal use of communication facilities.

Cryptographic Algorithm Groupings

• Symmetric encryption provides data confidentiality using a single key.
• Asymmetric encryption conceals small data blocks, like encryption keys.
• Data integrity algorithms protect data blocks from alteration.
• Authentication protocols verify the identity of entities using cryptographic algorithms.

Basic Terminology

• Plaintext is the original message.
• Ciphertext is the coded message.
• Enciphering/encryption is the process of converting plaintext to ciphertext.
• Deciphering/decryption is restoring ciphertext to plaintext.
• Cryptography studies encryption.
• Cryptographic systems/ciphers are encryption schemes.
• Cryptanalysis involves deciphering messages without key knowledge.
• Cryptology encompasses cryptography and cryptanalysis.

Encryption Scheme Security

• Unconditionally Secure: Ciphertext cannot be decrypted, regardless of available time.
• Computationally Secure: The cost/time to break the cipher exceeds the encrypted information's value/lifetime.

Types of attacks on encrypted messages

• Ciphertext Only: Only the encryption algorithm and ciphertext are known.
• Known Plaintext: The encryption algorithm, ciphertext, and plaintext-ciphertext pairs are known.
• Chosen Plaintext: The encryption algorithm, ciphertext, and chosen plaintext with corresponding ciphertext are known.
• Chosen Ciphertext: Algorithm, ciphertext, and chosen ciphertext with corresponding decrypted plaintext are known.

Cryptanalysis

• Attacks rely on the algorithm's nature and plaintext characteristics.
• Successfully exploits the algorithm to deduce plaintext or the key being used.

Brute-Force Attack

• The attacker tries every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
• On average, half of all possible keys must be tried to achieve success.

Cryptographic System Dimensions

• Type of Operations: Substitution or transposition.
• Number of Keys: Symmetric(single key) or asymmetric(two keys).
• Plaintext Processing: Block or stream cipher.

Symmetric Encryption

• It is referred to as conventional or single-key encryption.
• It was the only encryption type before public-key encryption in the 1970s.
• Remains the most used encryption type.
• Examples: DES (Data Encryption Standard), AES (Advanced Encryption Standard).

Substitution Technique

• Plaintext letters are replaced by other letters, numbers, or symbols.
• Plaintext bit patterns replaced with ciphertext bit patterns.

Caesar Cipher

• It is one of the simplest/earlist substitution cipher, used by Julius Caesar.
• Every letter is replaced by the letter three places down the alphabet.
• The alphabet wraps around in the Caesar Cipher, so the letter after is A.

Caesar Cipher Algorithm Details

• Each letter is given a number based on its location in the alphabet.
• C = E(k, p) = (p + k) mod 26 where 'C' is the cipher, 'E' is encryption, 'k' is the key. 'p' is the plaintext.
• p = D(k, C) = (C - k) mod 26 where 'D' is decryption.

Brute-Force Cryptanalysis of Ceasar Cipher

• Encryption and decryption algorithms are known.
• There is only 25 keys to try.
• The plaintext is known or easily recognizable.

Monoalphabetic Cipher Definition

• A permutation of a finite set of elements S is an ordered sequence of all the elements of S, with each element appearing exactly once.
• If "cipher" can be any permutation, 26 alphabetic characters yield 26! (over 4 x 10^26) keys.
• Has 10 more orders of magnitude than DES regarding keyspace.
• Employs a single cipher alphabet per message.

Monoalphabetic Cipher Vulnerabilities

• Easy to break because they reflect frequency data of the original alphabet.
• Digram: Most common two-letter combo is "th."
• Trigram: Most common three-letter combo is "the."
• Countermeasures: Using multiple substitutes (homophones) for a single letter.

Playfair Cipher

• It is a multiple-letter encryption cipher.
• Digrams are treated in plaintext as single units translated into ciphertext digrams.
• Based on a 5x5 letter matrix with a keyword.
• The British and US Armies used it in World War 1 and 2.

Playfair Key Matrix Construction

• Fill with keyword letters (no duplicates), left to right, top to bottom.
• Then fill the rest of the matrix with remaining alphabet letters.
• Rules for encryption
• Repeating letters in a pair are separated by "x."
• If 2 letters are in the same row: replace each with the letter to its right (wrap to start if needed).
• If 2 letters are in the same column: replace each with the letter below it (wrap to top if needed).
• Otherwise replace a letter with the one in its own row, but in the column of the other letter.

Rail Fence Cipher

• Simplest transposition cipher.
• The algorithm writes plaintext as diagonals, then reads them off as a sequence of rows.

Row Transposition Cipher

• More complex transposition.
• Writes the message in a rectangle, row by row.
• Then reads the message off by column but permutes column order.
• The column order is the key to the transposition.

Rotor Machines

• Enigma was used in WWII.
• Offers multiple stages of encryption.
• Each cylinder has 26 input/output pins linked internally.
• Results in 262626 = 17,576 different substitution alphabets.
• Points the way to modern ciphers like Data Encryption Standard (DES).