CSSY2201 Introduction to Cryptography PDF

{ CSSY2201 } CSSY2201: Introduction to Cryptography  📖 Chapters Chapter 1: Introduction To Cryptology Chapter 2: Classical Cryptography Chapter 3: Modern Block Cipher and DES Chapter 4: Advanced Encryption Standard (AES) and Modes of Operation...

{ CSSY2201 } CSSY2201: Introduction to Cryptography  📖 Chapters Chapter 1: Introduction To Cryptology Chapter 2: Classical Cryptography Chapter 3: Modern Block Cipher and DES Chapter 4: Advanced Encryption Standard (AES) and Modes of Operation Chapter 5: Asymmetric Cryptography & RSA Chapter 6: Data Integrity and Mutual Trust  📝 Marking Scheme Practical Assessments (3 Assessments – 8 Marks, Take Best 2) Quiz (10 Marks) Midterm (20 Marks) Project (14 Marks) Final (40 Marks) Labs Are Based on Python Use Jupyter Notebook to write the code  🔔 Reminders Attendance (V.3) First Warning Letter >= 10% Second Warning Letter >= 20% Debar Letter >= 30% ( >20% for Version 5 Students) 2 Times Late == Absence Prepare Before Class Random Students Will Be Asked at the Beginning  Advices 1 Think Like a Hacker Question Everything Understand the WHY of any Concept Consider Extreme Examples Ask ‘What Happens If... ?’  Advices 2 Understand, Don’t Memorise Engage in the Class Take Notes 20 Mins Study Round Create Your Own Examples  { CSSY2201 } Chapter 1 Introduction to Cryptology  Introduction To Cryptology 1. Overview of Secret Communications Using Cryptography 2. Principles of Cryptography 3. Dimensions of Cryptography 4. Cryptanalysis Basic 5. Steganography Overview (Demo)  Cryptology Branch of Applied Mathematics Encompassing Both Cryptography and Cryptanalysis.  Cryptography The Art and Science of Keeping Messages Secure. Practiced by Cryptographers  Cryptanalysis The Art and Science of Recovering the Plaintext From Encrypted Message Practiced by Cryptanalysts  Computer Security Computer Security: The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and con dentiality of information system resources (includes hardware, software, rmware, information/data, and telecommunications). fi fi  Computer Security CIA triad Con dentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. A loss of con dentiality is the unauthorized disclosure of information. Integ rity: Guarding against improper information modi cation or destruction, including ensuring information nonrepudiation and authenticity. A loss of integrity is the unauthorized modi cation or destruction of information. Availability: Ensuring timely and reliable access to and use of information. A loss of availability is the disruption of access to or use of information or an information system. fi fi fi fi  Computer Security CIA triad Con dentiality:This term covers two related concepts: Data con dentiality: Assures that private or con dential information is not made available or disclosed to unauthorized individuals. Privacy: Assures that individuals control or in uence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. fi fi fl fi  Computer Security CIA triad Integrity: This term covers two related concepts: Data integrity: Assures that information and programs are changed only in a speci ed and authorized manner. System integrity: Assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system. Availability: Assures that systems work promptly and service is not denied to authorized users. fi  Computer Security More Concepts Authenticity:The property of being genuine and being able to be veri ed and trusted; con dence in the validity of a transmission, a message, or message originator.This means verifying that users are who they say they are and that each input arriving at the system came from a trusted source. Accountability:The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity.This supports nonrepudiation, deterrence, fault isolation, intrusion detection and prevention, and after- action recovery and legal action. Because truly secure systems are not yet an achievable goal, we must be able to trace a security breach to a responsible party. Systems must keep records of their activities to permit later forensic analysis to trace security breaches or to aid in transaction disputes. fi fi  Aspects of Security based on ITU-T X.800 1. Security Attacks 2. Security Mechanism 3. Security Service  (1) Security Attacks Any Action That Compromises the Security of Information Owned by an Organization Threat : Possible Danger That Might Exploit Attack : Assault on System Security.  Passive Attacks Attempts To Learn or Make Use of Information From the System but Does Not Affect System Resources 1. Eavesdropping/Snif ng/Snooping 2. Traf c Analysis: Intercepting and Examining Messages in Order To Deduce Information From Patterns fi fi  Passive Attacks Eavesdropping/Sniffing/Snooping Passive Attacks Traffic Analysis Active Attacks  Security Mechanism X.800 Process That Is Designed To Detect, Prevent and Recover From Security Attacks  Security Service X.800 Process That Enhances the Security of Data Processing System (RFC 4949) a Process or Communication Service That Is Provided by a System To Give a Speci c Kind of Protection to System Resources. Use One or More of Security Mechanisms To Provide the Service fi  Security Service X.800 1. Authentication - Assurance That the Communicating Entity Is the One Claimed 2. Access Control - Prevention of the Unauthorized Use of a Resource 3. Data Con dentiality -Protection of Data From Unauthorized Disclosure 4. Data Integrity - Assurance That Data Received Is as Sent by an Authorized Entity 5. Non-Repudiation - Protection Against Denial by One of the Parties in a Communication fi  Cryptosystem A Combination of an Algorithm, Plus all Possible Plaintexts, Ciphertexts, and Keys  Basic Terminologies Plaintext: any Simple Message Is Called Plaintext. (Text, Sound, Video, Image, Etc). Encryption: the Process of Disguising a Message in Such a Way as To Hide its Contents. E(M) = C Ciphertext: an Encrypted Message. Decryption:the Process of Turning Ciphertext Back Into Plaintext. D(C) = M  Basic Terminologies Cryptographic Algorithm: Is the Mathematical Function Used for Encryption and Decryption. It Is Also Called a Cipher Key:This Is Denoted by K.This Key Might Be any One of a Large Number of Values. Keyspace: Range of Possible Values of the Key. Encode: To Convert a Message Into a Representation in a Standard Alphabet. Decode = To Convert the Encoded Message Back to its Original Alphabet and Original Form Note: the Goal of Encoding/Decoding Is To Represent the Data in a Certain Format, but the Goal of Encryption/Decryption Is To Provide Data Con dentiality. fi  Players Alice: Sender of an Encrypted Message Bob: Intended Receiver of Encrypted Message. Eve: Passive Attacker Mallory: Active Attacker Simpli ed Model of Symmetric Encryption fi  General Approaches to Cryptanalysis 1. Cryptanalytic Attack :This Type of Attack Exploits the Characteristics of the Algorithm To Attempt To Deduce a Speci c Plaintext or To Deduce the Key Being Used. 2. Brute-Force Attack :the Attacker Tries Every Possible Key on a Piece of Cipher Text Until an Intelligible Translation Into Plain Text Is Obtained. fi  Cryptanalysis The Science of Recovering the Plaintext of a Message Without Access to the Key. The. Goal Is To Recover Plaintext or the Key. Different Methods: Statistical Attack : Estimate the Occurrence Frequency of Letters in a Text Algebraic Attack : Try To Find Equivalent Representation of the Encryption Algorithm To Simplify It. Linear Cryptanalysis : Linear Approximation of the Encryption Algorithm (Which Is a Non-Linear System) Differential Cryptanalysis : Study How the Plaintexts Difference Propagate and Affect the Ciphertext Difference To Find Unbalanced Output. Types of Cryptanalysis  Levels of Cipher Security Unconditionally Secure: no Matter How Much Time or Ciphertext Is Available, the Cipher Can Not Be Broken Because It Does Not Contain Enough Information To Determine Uniquely the Corresponding Plaintext. Theoretically: One-Time Pad (OTP) (Next Chapter) Computationally Secure: Since We Can Not Achieve the Above Scheme, the Secure Cipher Should Ful ll the Following Two Criteria: The Cost of Breaking the Cipher Exceeds the Value of the Encrypted Information. The Time Required To Break the Cipher Exceeds the Useful Lifetime of the Information. fi  Levels of Cipher Security Average Time Required for Exhaustive Key Search Dimensions of Cryptography  Dimensions of Cryptography 1. Number of Keys: Keyless, One-Key (Symmetric), and Two-Keys (Asymmetric) 2. Operation Types: Substitution, Transposition, and Product. 3. Plaintext Process Methods: Block, Stream 4. Historical Perspective: Classical, Modern, Quantum  Dimensions of Cryptography 1-Number of Keys Keyless: the Algorithm Can Work Without a Key. Hash Function, Reverse Cipher (Lab1), Pseudorandom Number Generator Symmetric or One-Key Cipher: Both Sender and Receiver Use the Same Key. Symmetric Encryption, Message Authentication Code (MAC) Asymmetric, Public-Key, or Two-Keys Cipher: Sender and Receiver Use Different Key. Asymmetric Encryption, Digital Signature, Key Exchange Dimensions of Cryptography 1-Number of Keys  Dimensions of Cryptography 2-Operation Types 1. Substitution: Each Element in Plaintext Is Mapped Into Another Element. 2. Transposition: Elements in the Plaintext Are Rearranged. 3. Product: Multiple Stages of Substitution and Transposition.  Dimensions of Cryptography 3-Plaintext Process Methods 1. Block Cipher: Processes the Input One Block of Elements at a Time, Producing an Output Block for Each Input Block. 2. Stream Cipher: Processes the Input Elements Continuously, Producing Output One Element at a Time, as It Goes Along.  Dimensions of Cryptography 4-Historical Perspective 1. Classical: Those Were Invented Pre-Computer Up Until Around the 1950’s. Schemes Were Designed in an Ad-Hoc Manner and Then Evaluated Based on Their Perceived Complexity/Cleverness True ‘Strength’ of These Schemes Was in ‘Secrecy’ of Their Respective Protocols/Methods.  Dimensions of Cryptography 4-Historical Perspective 2. Modern: Based on Scienti c Foundations. The Strength Is NOT in Secrecy of Protocols but in Sound Mathematical and Computational Principles. Used for More Than Just Data Con dentiality, Can Protect Data Integrity, Enable User Authentication, Etc. fi fi  Dimensions of Cryptography 4-Historical Perspective 3. Quantum: Field of Study That Utilizes the Principles of Quantum Mechanics To Develop Cryptographic Schemes That Are Theoretically Impossible To Break Using Classical Computing Methods. It Includes Techniques Such as Quantum Key Distribution and Quantum Secure Direct Communication. Its Strength Lies in the Laws of Physics That Govern the Behavior of Quantum Systems, Rather Than in Mathematical Complexity or Secrecy. Steganography  Steganography De nition: Hiding Information Within Another Medium So its Existence Is Concealed. Difference From Cryptography: Cryptography Obscures Content, While Steganography Hides the Very Existence of the Message. fi  Steganography Common Mediums: Images: Altering Pixel Colors Subtly. Audio: Slight Changes in Sound Waves. Video: Modifying Frames Without Noticeable Change. Text: Using Whitespace or Word Arrangement. Network: Manipulating Packet Headers or Data Timing. Purpose: Secure Private Communication or Intellectual Property. Can Also Be Used Maliciously. Steganalysis: Detecting and Decoding Hidden Content.  Steganography Demo https://stylesuxx.github.io/steganography/