Computer Security: CIA Triad

Computer Security Objectives - CIA

• Confidentiality ensures private information isn't disclosed to unauthorized individuals.
• It gives individuals control over what information is collected, stored, and by whom.
• Integrity ensures information and programs are changed only in an authorized manner.
• The system performs its intended function, free from deliberate or inadvertent unauthorized manipulation.
• Availability ensures systems work promptly and that authorized users are not denied service.

CIA Scenario

• A user downloads ransomware disguised as a software update unknowingly.
• The ransomware encrypts all files, including documents and photos.
• Encryption is robust, making it difficult to decrypt files without the key.
• After encryption, a message demands cryptocurrency in exchange for the decryption key.
• This scenario breaches Confidentiality, Integrity, and Availability.

Security Attacks

• Security attacks classification used is based on X.800 and RFC 4949.
• Passive attacks aim to learn or use system information without affecting resources.
• Active attacks attempt to alter system resources or affect their operation.

Passive Attacks

• Involve eavesdropping on or monitoring transmissions.
• The goal is to obtain transmitted information.
• Prevention is preferred over detection, as detection is difficult.
• Two types of passive attacks are: the release of message contents and traffic analysis.

Active Attacks

• Active attacks involve modifying data or creating false data streams.
• They're hard to prevent due to potential vulnerabilities in hardware and software.
• The goal is to detect attacks and recover from any disruption or delays.
• Detection is more likely than prevention.
• Masquerade takes place when one entity pretends to be a different entity.
• Replay involves capturing and retransmitting data to cause an unauthorized effect.
• Modification of messages alters or reorders a legitimate message, leading to unauthorized outcomes.
• Denial of service prevents normal use or management of communications facilities.

Security Mechanisms (X.800)

• Specific security mechanisms can be added to protocol layers to provide OSI security services.
• Trusted functionality is perceived as correct based on specific criteria, like a security policy.
• A security label marks a resource with its security attributes.
• Event detection identifies security-relevant events.
• A security audit trail is data used for an independent review of system records.
• Security recovery manages mechanisms, handling events and recovery actions.
• Encipherment transforms data using algorithms to make it unintelligible, relying on keys.
• Digital signatures prove the source and integrity of data, protecting against forgery.
• Access control enforces resource access rights.
• Data integrity ensures the integrity of data units or streams.
• Authentication exchange verifies an entity's identity through information exchange.
• Traffic padding inserts bits into data streams to thwart traffic analysis.
• Routing control selects secure routes and enables routing changes if security is breached.
• Notarization uses a trusted third party to ensure properties of a data exchange.

Model for Network Security

• Model Includes a sender, receiver, and trusted third party.
• Security-related transformation helps to make it a secure, encrypted message.
• Secret information is used.
• Information channel acts as medium for encrypted text passed from sender to receiver.
• Opponent tries to listen in.

Cryptographic Algorithms and Protocols

• Major areas include symmetric encryption, asymmetric encryption, data integrity algorithms, and authentication protocols.
• Symmetric encryption conceals data blocks or streams, with symmetric keys.
• Asymmetric encryption conceals small data blocks, like encryption keys, using asymmetric keys.
• Data integrity algorithms protect data blocks from alteration.
• Authentication protocols use cryptographic algorithms to verify entities' identities.

Basic Terminology

• Plaintext is the original message, while ciphertext is the coded message.
• Enciphering (encryption) converts plaintext to ciphertext.
• Deciphering (decryption) restores plaintext from ciphertext.
• Cryptography is the study of encryption.
• A cryptographic system or cipher is a scheme used for encryption.
• Cryptanalysis involves deciphering messages without knowing the encryption details.
• Cryptology encompasses both cryptography and cryptanalysis.

Encryption Scheme Security

• An unconditionally secure scheme cannot be decrypted by an opponent, regardless of time because needed info is missing.
• A Computationally secure scheme breaking costs is higher than the encrypted information value or time needed exceeds the useful information lifetime.

Types of Attacks on Encrypted Messages

• "Ciphertext Only" attacks rely only on knowledge of the encryption algorithm and ciphertext.
• "Known Plaintext" attacks knows the encryption algorithm, ciphertext, and how it corresponds to plaintext.
• "Chosen Plaintext" attacks rely on the encryption algorithm, obtained ciphertext, and plaintext.
• "Chosen Ciphertext" attacks rely on the algorithm, and related ciphertext with corresponding decrypted plaintext generated with the secret key.

Cryptanalysis and Brute-Force Attack

• Cryptanalysis relies on algorithm knowledge and plaintext characteristics to deduce plaintext or the key.
• Brute-force attack tests every possible key until intelligible translation is achieved.

Cryptographic Systems

• Systems categorized by operation type, number of keys, and how plaintext is processed.
• Operation type includes substitution and transposition.
• Number of keys includes single-key (symmetric) and two-key (asymmetric) systems.
• Plaintext processing methods are block cipher and stream cipher.

Symmetric Encryption

• Also called conventional or single-key encryption.
• It was the only form before public-key encryption developed in the 1970s.
• It is the most widely used encryption.
• Examples: Data Encryption Standard (DES) and Advanced Encryption Standard (AES).

Simplified Model of Symmetric Encryption

• Sender and receiver both know the secret key.
• Plaintext input is encrypted using the secret key and an algorithm to produce ciphertext.
• The receiver decrypts the ciphertext using the same key and a reverse algorithm to recover the plaintext.

Substitution Technique

• Letters in plaintext are replaced by other letters, numbers, or symbols.
• If plaintext is bits, substitution replaces plaintext bit patterns ciphertext bit patterns.

Caesar Cipher

• The Caesar cipher is the earliest known substitution cipher.
• Used by Julius Caesar.
• It involves replacing each letter with the letter three positions down the alphabet.
• The alphabet is circular, so the letter after "Z" is "A".

Caesar Cipher Algorithm

• Can define transformation: each letter replaced three positions down.
• Mathematically gives letter a number.
• Expressed as: c = E(3, p) = (p + 3) mod (26).
• Caesar algorithm is C = E(k, p) = (p + k ) mod 26.
• 'k' is value 1 to 25.
• Decryption algorithm is: p = D(k, C) = (C - k) mod 26.

Brute-Force Analysis

• Encryption and decryption algorithms are known.
• There are 25 keys to try.
• Ciphertext is easily recognizable.

Monoalphabetic Cipher

• Defined as a permutation: a finite ordered sequence with elements appearing once.
• If the "cipher" line can be any permutation of the 26 alphabetic characters, then there exceeding 4 x 1026 possible keys
• The key space for DES is 10 orders of magnitude less than the quantity of permutations.
• One cipher alphabet is used per message in single cipher alphabet.
• More easily broken as it reflects frequency data.
• Digram is a two-letter combination (most common: th).
• Trigram is a single three-letter combination (most common: the).
• Possible countermeasure against these attacks: multiple substitutes (homophones)

Playfair Cipher

• An encryption cipher known as a multiple-letter encryption substitution.
• Treats digrams in the plaintext as single units, and translates these units into cipher text digrams.
• A 5x5 matrix of letters is built as security based on use of keyword.
• The British Army used the standard system, and the U.S. Army and allied forces adopted it during World War II.
• Repeating plaintext letters that are in the same pair are separated with a filler letter, so that balloon would be treated as ba lx lo on.
• Two plaintext letters that fall in the same row of the matrix are each replaced by the letter to the right, with the first element of the row circularly following the last.
• Two plaintext letters that fall in the same column are each replaced by the letter beneath, with the top element of the column circularly following the last.
• Plaintext letter in a pair is replaced by the letter that lies in its own row and the column occupied by the other plaintext letter.

Rail Fence Cipher

• This Cipher is one of the Simplest transposition.
• Plaintext is written down diagonals and read off rows.

Row Transposition Cipher

• A complex transposition.
• Write the message in a rectangle row by row; read the message column by column.
• Permute the order of the columns for the key.

Rotor Machines

• Rotor machines such as Enigma used in World War II were key to encryption.
• It allowed multiple stages of encryption.
• Key factor: the different substitution alphabets are 26* 26 * 26 = 17,576
• These machines pave the way for Data Encryption Standard (DES).