Free Essay

Cryptography Outline

In: Computers and Technology

Submitted By cdoyle
Words 3749
Pages 15
Course Title: Cryptography
Section 1-1 Topic: Introduction To Cryptography

Confidentiality, Integrity, Availability and Authentication
How companies use cryptography
How penetration testers can also use cryptography
Tools, Techniques and Attacks
Academics discusses history of encryption.
Academics simply encrypt or hash, why aren't people using hashing more?
Professional is just, encrypt or not, hash or just verify Section 1-2 Topic: Key Concepts of Cryptography: PKIS & Encryption
Learning Objectives: Cryptography is one of the most underrated courses of study in the industry. Of those who do study it, issues with comprehension tend to hinder individual mastery. By taking this course, learners will finally be able to grasp all the critical concepts, theories and practices associated with Cryptography.
This Cryptography presentation discusses and demonstrates the key concepts of Cryptography from attacks, PKIs and Encryption in detail.
You’ll learn about the difference between public and private keys and about the similarities and differences between symmetry & asymmetry. We’ll also discuss the concept of integrity and confidentiality and their relationships to/with protocols.
This Cryptography course will help you master the basics of Cryptography as you begin to develop the discipline needed to become an accomplished pen tester. Keys and Principles
1. Keys
1a. Symmetric - also referred to as same keys, private key, symmetric key - same (confidentially)
Different Version/Ways/Procedures to get PlainText to CipherText Symmetric Cipher Examples:
AES, DES, 3DES, IDEA, CAST, twofish, Blowfish, RC2, Serpent, Rijndael - (there are others, chart at end of section)
PGP, OTP (One Time password) Mnemonic device to remember some Symmetric Ciphers (how it reads, sounds and then corresponds, in English):
Hey! These 3 guys, had an idea to cast their rod to fish for blowfish, but instead received, serpents in the rain.
A! Dees 3 guys, had an IDEA to CAST their rod TWOFISH for BLOWFISH, but instead Received, Serpents in the Rain.
AES DES 3DES IDEA CAST TWOFISH BLOWFISH RC2 Serpent Rijndael 1b. Asymmetric - public/private key pair - what one key does, the other key undoes
(confidentially, authentication, nonrepudiation) Asymmetric Cipher Examples:
DH (key exchange), El Gamal (open source), RSA (internet), Elliptical Curve (for limited processor machines),
Knapsack, DSA (popular as a US standard) Mnemonic device to remember some Asymmetric Ciphers (how it reads and then corresponds, in English):
D-E-R-E-K-S
Diffie Hellman, El Gamal, RSA, Elliptical Curve, Knapsack, DSA 2. Principles (C, I, A)
Principles of CIA (confidentiality, integrity and authentication) along with PAIN will be discussed in detail later, focus on concepts and definitions.
Substitution/Transposition - PlainText to CipherText, and CipherText to PlainText
Disk Encryption (further detail later) Integrity
Detect unauthorized change via output of Message Digest, also known as, a hash.
MD5 (128bit), SHA (160 bit, also variable), Hashing Calculator PKI
A public key infrastructure (PKI) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.
CA, RA, X.509
IKE (internet Key exchange), ISAKMP, CRL (certification revocation list), OCSP (dynamic, checks x.509 cerrtification) Attacks
Known Plaintext
Known CipherText
Chosen CipherText (needs physical access to machine)
Chosen Plaintext (choose what gets decrypted, needs physical access to) Protocols
SSH (replaced Telnet)
HTTPS (SSL/TLS with security protocol, wraps all upper layer application in cryptographic wrapper)
IPSec (Network Layer, analogy truck: authentication header/integrity check, payload: integrity check and confidentiality check)
SSL/TLS (protocols)
Symmetric Ciphers Key Length
Blowfish 1-448 bits
DES 56 bits
IDEA 128 bits
RC4 1-2048 buts
RC5 128-256 bits
Rijndael 128-256 bits
Serpent 128-256 bits
Triple (3) DES 168 bits
Twofish 128-256 bits
Section 1-3 Topic: Introduction to Cryptographic Tools
Section 1-4 Topic: Services & Threats of Cryptography
Section 2-1 Topic: Integrity Checking: Modifications
Learning Objectives: These videos, while separate, build on each other and are all linked.
Explain how cryptography is used to protect CIA. ‘CIA’ can also be a ‘PAIN’ – all defined… 1. Confidentiality (C of CIA) (also Privacy, P of PAIN) - prevent unauthorized disclosure of data
Threats
a. Social Engineering: Opening Unsigned Emails (Spear Phishing, Whaling Attack)
Defense Controls: Physical, Technical, Mail Filter, Administrative Training
Ideas: Separation of Duties, Need to Know
b. Media Reuse: USB Thumb Drive reuse is common.
Sanitizing can also be referred to as Zero'ing
Destroying a hard drive, completely, requires incineration.
Degaussing method only works for Magnetic Media.
Deleting only removes pointer to file and Formatting can be recovered.
c. Eavesdropping: protocol (packet) analyzer/ sniffer. Wireshark is popular.
Replay Attack: Capturing a packet that contains a password and reusing;
This allows access to ‘use’ a password without never knowing the actual password
Zero Knowledge Proof: Kerberos allows end user to prove the password, without sending password across network
Hack Attack Discussion: Directory Services: Query DNS, reply to send Credential to Server 1 2. Integrity (I of CIA, I of PAIN)
Accidental Modifications are checked by message digests, or hashes.
(digital representation of file - checks if identical)
Intentional (Malicious) Modification can be checked by using:
Message Authentication Code (MAC) or
Digital Signatures (both provide an extra step of authentication) 3. Authenticity (A of CIA, A of PAIN)
How to prove is truly came from the sender, is it valid? 4. Non repudiation (N of PAIN)
Combination of Integrity and Authenticity – must have both!
Sender can't dispute sending the message or contents - we use digital signatures for this
(further detailed explanations will follow on how) Mnemonic Device, some remember it as CIA, or PAIN - P(rivacy) A(uthentication) I(ntegrity) N(on Repudiation) Section 2-2 Topic: CipherText
Learning Objectives: Learn how to properly create CipherText and the processes behind it in this lecture series on Cryptography.
Privacy/Confidentiality
Plaintext + Initialization Vector + Algorithm + Key = CipherText
Plaintext is just plain, non-encrypted text or data.
Initialization Vector (IV) adds randomness and complexity. Randomized Starting Point
~Computer cannot generate a random number, so we have a pseudo random number.
~We could take any number of variable pieces of data to generate a pseudo random number such as:
A Date: 12/12/1999 would be 34.
Algorithm (aka Cipher, is a collection of math functions) ~Symmetric Cryptography can also be referred to as: Private Key Secret Key Session Key Shared Key (i.e. shared between two parties) ~Any Symmetric Algorithm, to be discussed later, will be either: Block Stream ~Asymmetric Discrete logarithms Factorization
Key (Crypto Variable) is the instruction on how to use the algorithm (how to use the math) Section 2-3 Topic: Master Pattern Analysis with CrypTool
Learning Objectives: Learn how to perform pattern analysis with CryptTool to identify trends during the encryption process. CrypTool Lab
CrypTool is a non-academic analysis tool that offers a fundamental understanding of encryption algorithms.
Can be found at: http://www.cryptool.org Section 2-4 Topic: Symmetric Encryption
Learning Objectives: The Symmetric Encryption discussion opens by reviewing the usage of random numbers, explaining what Replay Attack is, the importance of unique information on data packets and in sequencing and defining key terms including Nonce and Key Generation.
Then, you’re introduced to Symmetric Encryption with a basic summary of how it works, what ciphers are, the different types of Symmetric Ciphers, what happens with block ciphers, and what the difference means to encryption and decryption as a process.
As a penetration tester, you must know the difference between confusion and diffusion. You’ll observe how that correlates to how algorithms work and the importance of strong math in configuring algorithms. And you’ll learn what happens as algorithms are used and what you need to look for in your testing results.
Cryptographic Uses of Random Numbers ~There is very little true randomness (or entropy) so instead we use pseudo random. Nonces - process of stamping uniqueness on packet without being sequential. Note: Adds uniqueness and helps to stop replay attacks Key Generation - keys must be unique, (pseudo) random and of a suitable length Note: All things being equal, longer will offer more protection. Symmetric Encryption (same key on both ends - real world example: a house key) Ciphers Confusion - Confusion relates to complex math and substitution Diffusion - Diffusion relates to permutations or rounds (DES went through 16 rounds, 3DES goes through 48 times/rounds/permutations) Bit length is not necessarily the final determination of the strength of a key. Open - Kerckhoffs Principles, algorithm should be open Key Generation – (definition above) Example Algorithm:
[R1]+2, [R2]-2, [R3]*2, [R4]/2, ... [R6]^2 - each [R] would be considered an SBox (or substitution box) Block Ciphers (slower, but more secure) ECB CBC DES 3DES (secure, very process intensive, but AES would be preferred) AES (Advanced Encryption Standard) Section 2-5 Topic: Stream Ciphers, XOR and RC4
Learning Objectives: As a continuation of learning about Symmetric Encryption, this lesson explores the other type of cipher: Stream Ciphers.
We’ll go much deeper into what happens during XOR (which stands for exclusive Or), what transposition and substitution is, and whether or not multiple transposition and substitution is preferred. You’ll also observe a rich demonstration of how XOR provides encryption, learn what RC4 is and what takes place at the encryption and decryption level.
As a Penetration Tester, you must understand the key functions of each of these events, what their impact is on each other and how to determine when to use one over another in Symmetric Encryption. StreamCiphers One bit at a time Transposition (THE becomes HET; moving over 1 character) Substitution (A for T, B for H, C for E, assigning different characters, etc.), XOR (Exclusive Or) How XOR works, since it is a stream, it goes bit by bit XOR Example
Plain 1 1 1 1 0 1 1 0 The plaintext
Key 0 1 0 0 1 1 0 0 compared to the key
CIPHER 1 0 1 1 1 0 1 0 If alike, becomes 0. If different becomes 1 A real world example could be WEP/WPA which uses RC4 (fast encryption and decryption, trades security for speed) WPA2 uses AES which is more secure. Section 2-6 Topic: Pros and Cons of Symmetric Cryptography
Learning Objectives: As we wrap up our lesson on Symmetric Cryptography, we must address the pros and cons of this encryption method.
You’ll discuss its greatest pro—speed. But as we know, sometimes being too fast occurs at a cost. Those costs will be discussed when we cover the cons of Symmetric Cryptography, such as Out of Band Key Distribution, lack of authenticity, issues with integrity, and non-repudiation.
Knowing what the boundaries are with your encryption resources will enable you to make accurate decisions and advise decision-makers with specific points of fact. Con: Out of band key distribution (no straight forward means of key exchange) Not Scalable (every unique conversation requires a key) No 'A'uthenticity (no court room authenticity, both parties share the key) No 'I'ntegrity (corruption happens, it cannot detect corruption or packet drops) No 'N'on Repudiation (requires both Authenticity and Integrity)
Pro:
Does provide 'P'(rivacy/Confidentiality) of 'PAIN' FAST, FAST, FAST! (It can be noticably real world faster)
Section 2-7 Topic: Public Key Cryptography
Learning Objectives: This final lesson in Section 2 of the Cryptography module focuses on public key cryptography.
Every user on the network is given a public and private key for encryption. This lesson discusses how the public and private key exchange happens, how Asymmetric Cryptography works, what has to happen so that public and private key exchanges can authenticate, and what the advantage/disadvantages are to employing Asymmetric Cryptography.
And finally, there is a contrast discussion on Symmetric vs. Asymmetric Cryptography discussion introducing how penetration testers can get the best out of both worlds. Public Key Cryptography Two keys issued to each user (simplified example) ~1 public key and 1 private key (a key pair) Done automatically at the application layer with Outlook, Browser, etc. Anything encrypted with one key (public) can only be decrypted with the other (private) and vice versa Provides key exchange, scalability and non-repediation SLOW Section 3-1 Topic: Asymmetric Cryptography Functions
Learning Objectives: As we wrap up our lesson on Cryptography, we spend our last section exploring Asymmetric Cryptography in detail with several labs to supplement the lecture knowledge.
A penetration tester must be able to understand what happens at each stage of encryption/decryption phase and how those transactions affect or trigger the outcomes of other events.
In this session, we learn how Asymmetric Cryptography delivers all four encryption services: privacy, authenticity, integrity, non-repudiation (PAIN). We’ll then we find out what happens at each state of asymmetric cryptography.
At the conclusion of this lesson, you’ll know what info is exchanged between public and private key, how packet verification occurs, how a hash is created and how hashing algorithms are used. Asymetric Cryptography P.A.I.N. Privacy Sender always encrypt with the receiver's PUBLIC key. Receiver decrypts with receiver's PRIVATE key which only that receiver has. Authenticity Sender will encrypt "something" with the sender's PRIVATE key. When the receiver is able to successfully decrypt that 'something' with that sender's PUBLIC key, that proves it was encrypted with the sender's PRIVATE key, which only the sender has. Example: I am sending message; my content is encrypted with receiver’s public key. The time stamp is encrypted with senders (my) private key - this can prove that *I* sent it. Integrity Create a message digest (hash) with a hashing algorithm (MD5:128 bit; used less, SHA-1:160 bit; used less, SHA 256:256 bit) Asymmetric and Symmetric both use keys Hashes do not use keys, they only use math functions Example: Very rudimentary, but concept is important - hashes are one way functions H E L L O (every characters numeric value, or the message, then added together) 8 5 12 12 15 = 52 (this value is the message digest/hash) If you ONLY know the 52 (hash), trying to figure out the corresponding additive values would be arduous. Coupled with higher bit level encryption, the effort could take longer than we have time in the universe. However, if they both match, the message has not been modified. Very easy one way math. Non-Repudiation Sender encrypts hash with the sender’s private key. Receiver decrypts hash with sender’s public key. Receiver hashes document - if hashes match, receiver gets a guaranteed message has not been modified. This is called a digital signature. Example:

Hello Confidentiality (encrypt content with receivers public key)
0LL34
52
(hash value after encryption with senders private key) 3ncryp7ed
*It is generally accepted that you cannot reverse a hash* SSL - secure sockets layer – Asymmetrical (for all above), Symmetrical for data exchange (speed) Section 3-2 Topic: Public Key Exchange
Learning Objectives: we continue our focus on Asymmetric Cryptography with a detailed diagram and discussion on secure public key exchange and how it works. You’ll learn the entire process from start to finish and why it’s a faster, more reliable encryption process.
You’ll also learn about Certificates of Authority (CA), what comprises the certificate revocation list (CRL), what a online certification status protocol (OCSP) is, and why they are each essential to the encryption process. We’ll discuss the entire PKI (public key infrastructure) and what role each of its components has.
And finally, we’ll observe then explore what CA hashing looks like during encryption and decryption at the browser level, and learn why thorough PKI knowledge and training in Symmetric & Asymmetric Encryption for netadmins and cyber security professionals is essential. SSL/TLS
Example:
[Desktop clients] -> uses https:// to reach -> [BofA servers] 1. Client requests via https to server 2. BofA sends public key* to client key 3. Client generates a symmetric session key (i.e. 8439...) how does it get this session key to server?* 4. Client encrypts the session key with servers public key (since server will be able to decode with private key) Result: Enables Asymmetric Key Exchange/Symmetric Data Exchange - Secure Channel Setup *This model still allows Man In The Middle (MITM) attacks, we must go further for assurance and authenticity. To cure this, we must have the following public key being verified by a CA via public key infrastructure BofA server proves to Verisign CA (certificate of authority) that they are truly BofA (other CA’s would be Thawte, Baltimore, Entrust, etc.) The CA then gives a certificate back to bind public/private key to server
*How do we know it came from Verisign, a trusted authority? Verisign sends certificate with private key (can be decrypted with Verisigns public key).
*Your web browser may be pre-loaded with CA's - trust gained by having CA's public key. Could set up our own CA, where we 'vouch' for ourselves. While that may not work for web based transactions, but for internal network transactions, it may be an acceptable trade-off. CRL (pronounced krill) - Certificate Revocation List
OCSP - Online Certificate Status Protocol
Section 3-3 Topic: Advanced Encryption Package
Learning Objectives: The Advanced Encryption Package lab demonstrates use of an advanced encryption analysis components and how to use them to dig deeper in your file, password and data analysis.
You’ll observe creation of a password protected text file, see how the Advanced Encryption Package tool rates the strength of assigned password, and uses powerful algorithms to generate secure encryption for network files and directories.
In the Advanced Encryption Package lab, you’ll learn the advantages and disadvantages in the integrity principle vs. confidentiality principle and how those differences impact Symmetric vs. Asymmetric encryption. You’ll also see how to perform secure deletions, and learn how to use this tool as a key generator and PKI manager. Advanced Encryption Package Lab
Can be found (Free Trial) at: http://www.aeppro.com/ Section 3-4 Topic: Hashing and Hash Collisions
Learning Objectives: This session of our Cryptography module introduces an extensive overview on Hashing. It begins with mapping out exactly what a Hash does and where it falls short and why it’s a disadvantage being one-directional.
You’ll also explore Hash collisions—what they are, how they happen, what it takes to recreate them, what happens when there is no integrity and how that is determined by the penetration tester. Hashing Hash functions Scenario 1: A MITM could just intercept and change the hash! Without authenticity, hash is only useful for detecting accidental changes/corruption. Scenario 2: Digital Signature adds authentication to the integrity, we get true non repudiation: protects against accidental or intentional changes...this all requires a PKI ($ overhead) Scenario 3: Introduce a solution; use a M(essage)A(uthentication)C(ode) = Message + Symmetric Key + Hashing Algorithm (this would be a step below having/paying for the PKI overhead) Passwords, credit cards, PII Digital Forensics Hash the drive before doing forensic analysis (write protect the drive). Even opening a file could change the hash. Malware analysis and virus detection Hash Collisions Two different pieces of text product the same hash. Collision resistant hashes are the goal. If a collision is achieved, you now can produce the hash even though it was not the original. MAC HMAC Section 3-5 Topic: Hash Calc
Learning Objectives: The Hash Calc lab teaches you what information is gained from using Hash Calculators to analyze files within a directory, or specifically targeted files. For example, the output of the Hash Calc tool includes the message digest about the target as well as all its relevant integrity algorithms.
The lab also discloses several integrity algorithms not output from the Hash Calc tool that provide a wider range of output datasets. Used in conjunction with the Hash My Files, and Advanced Encryption Package tool Hash Calc can be a very revealing “go-to” suite of resources for cryptographic analysis. HashCalc is a fast and easy-to-use calculator that allows to compute message digests, checksums and HMACs for files, as well as for text and hex strings. It offers a choice of 13 of the most popular hash and checksum algorithms for calculations.
Can be found at: http://www.slavasoft.com/hashcalc/
Section 3-6 Topic: Digital Signature, SHA2(256) and RSA
Learning Objectives: In this sub-part of our previous Hash lesson, we take a closer, more intimate look at digital signatures, SHA2(256). We’ll look at Asymmetric Algorithm, RSA, what is met by satisfying the digital signature standard, and what the entire packet transfer looks like when hashing takes place.
We will also introduce concepts behind protecting data at rest.
Several key definitions are discussed included full disk encryption, file encryption, code signing with a discussion on how they differ, what occurs in each of those data transactions, and why that sequence of events is important for Penetration Testers to know as part of the Asymmetric encryption process. Digital Signatures Hash (remember, hashes are just one way math) MD4, SHA-1, SHA-2 Asymmetric Algorithm RSA - satisfied the Digital Signature Standard Protecting Data At Rest File Encryption - some files or properties may be readable if hard drive is moved to another computer OS (i.e. Windows Hard Drive using Encrypting File System is physically moved to a Linux Box) Full Disk Encryption - modern motherboard have TPM (trusted platform module) BitLocker, PGP, etc. achieve this. Code Signing - distributed code accessed on Internet (Java, Javascript, ActiveX) should be digitally signed. Section 3-7 Topic: Hash My Files
Learning Objectives: This lab demonstrates the Hash My Files tool which analyzes files by specific file or by directory and validates their integrity. The Hash My Files process report is basic and the output can be exported to a series of different formats including HTML.
You’ll also observe a demonstration of how the Hash My Files tool works and what you can learn from the information it provides.
Because of their strong algorithms, security professionals rely heavily on hashing as a reliable Cryptographic analysis tool for integrity validation. Hash My Files tool analyzes files by specific file or by directory and validates their integrity.
HashMyFiles is small utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in your system. You can easily copy the MD5/SHA1 hashes list into the clipboard, or save them into text/html/xml file.
HashMyFiles can also be launched from the context menu of Windows Explorer, and display the MD5/SHA1 hashes of the selected file or folder.
Can be found at: http://www.nirsoft.net/ Tools Used
CrypTool - http://www.cryptool.org
Advanced Encryption Package - http://www.aeppro.com
HashCalc - http://www.slavasoft.com/hashcalc/
HashMyFiles - http://www.nirsoft.net/
(links cannot be guaranteed, as they are maintained independently) END OF OUTLINE

Similar Documents

Free Essay

Cryptography

...Prologue: Cryptography is an excellent art/science of protecting data from unwanted intruders by transforming the data to an unreadable format which can be brought back to the original form only by those who are authenticated to do so. This system depends vastly on a principle of key usage and is the basic underlying principle of network security. A detailed technical discussion of cryptography ,particularly from a network’s stand point provides a compelling and an up to date examination of the political and the social issues that are now inextricably intertwined with cryptography. A complete discussion of cryptography itself requires a complete book and so we touch on only the essential aspects of cryptography. It is now high time to introduce Alice and Bob who are essentially the widely accepted persons for a discussion on networks as communicators. Also ,the third party Trudy ,the intruder also has a wide role to play in hacking the discussion of the two. So the whole thread would hang about these three and the ways there adhere to secure and hack the data that is transmitted. A First look on Terminologies Now its high time to know the basic terminologies of Cryptography. Firstly the text that we type in the human understandable format is called as the Plain Text. The plain text is then converted to a generally incomprehensive form called as the Cipher text using a technique called Encryption which usually does this, and the cipher is transmitted.......

Words: 1831 - Pages: 8

Free Essay

Unit 8 Lab

...encrypts the IP packets and ensures their integrity. 4. Create Enrollment Object, Set Enrollment Parameters, Create Request, Submit Request, Process request, Get Certificate, Accept Certificate 5. Advantages: Straight-forward Concept, Chain-length limit, Less time to obtain a usable certificate within the CA Disadvantages: Scalability, Single point of trust, Still need an impeccable CA 6. Outline the business scenario, Define the application certificate requirements, Create certificate policies and practices statements, Design the certification authority (CA) infrastructure, Create a certificate renewal strategy, Develop a CA management plan 7. System overview, hardware, applications 8. Display information about the digital certificates that are installed on a DirectAccess client, DirectAccess server, or intranet resource. 9. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. 10. It is so that a user can use one username and password for multiple applications. It can help security because it is only one username and password that a user will have to know. It can increase security risk by......

Words: 293 - Pages: 2

Free Essay

Ceh Course

...EC-Council CEH v7 Course Outline Course Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems. The lab intensive environment gives each student in-depth knowledge and practical experience with the current essential security systems. Students will begin by understanding how perimeter defenses work and then be lead into scanning and attacking their own networks, no real network is harmed. Students then learn how intruders escalate privileges and what steps can be taken to secure a system. Students will also learn about Intrusion Detection, Policy Creation, Social Engineering, DDoS Attacks, Buffer Overflows and Virus Creation. When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking. This course prepares you for EC-Council Certified Ethical Hacker exam 312-50 Who Should Attend This course will significantly benefit security officers, auditors, security professionals, site administrators, and anyone who is concerned about the integrity of the network infrastructure. Duration 5 days (9:00 – 5:00) Certification The Certified Ethical Hacker exam 312-50 may be taken on the last day of the training (optional). Students need to pass the online Prometric exam to receive CEH certification. Page 2 EC-Council Legal Agreement Ethical Hacking and Countermeasures course mission is to......

Words: 458 - Pages: 2

Premium Essay

Some Problems in Symmetric and

...Some Problems in Symmetric and Asymmetric Cryptography A thesis submitted for the partial fulfillment of the degree of Doctor of Philosophy in Mathematics By SANTOSH KUMAR YADAV Under the supervision of Prof. Sunder Lal and Prof. S. C. Arora DEPARTMENT OF MATHEMATICS DR. B. R. AMBEDKAR UNIVERSITY, AGRA (FORMERLY AGRA UNIVERSITY) 2010 *Sanskrit verse dating back to the pre-Christian era Dedicated to my Teachers, Friends, Students and Family Members DECLARATION I do hereby declare that the present research work has been carried out by me under the supervision of Prof. Sunder Lal and Prof. S. C. Arora. This work has not been submitted elsewhere for any other degree, diploma, fellowship or any other similar title. Santosh Kumar Yadav Research Scholar CERTIFICATE This is to certify that the thesis entitled “Some Problems in Symmetric and Asymmetric Cryptography” submitted to Dr. B.R.Ambedkar University, Agra for the degree of Doctor of Philosophy by Mr. Santosh Kumar Yadav, is a bonafide record of research work done by him under our supervision. To the best of our knowledge, this thesis has not previously formed the basis for the award to any candidate of any degree, diploma, fellowship or any other similar title and the work has not been submitted to any university or institution, for the award of any other degree. S. C. ARORA SUNDER LAL (Co-supervisor) (Supervisor) Professor Professor of Mathematics, and Department of Mathematics Pro-Vice......

Words: 37424 - Pages: 150

Free Essay

382 Algorithms

...CSC 382, Analysis of Algorithms Group Project For this project you need to make groups of 3-6 people and choose one of the following topics. Most of these topics require you to write a short paper and present it in class (20 points). For those you have the option to just submit a paper and not present for only 10 points. A list of topics: 1. Linear Programming 2. Approximation Algorithms 3. Max-Flow Min-Cut 4. Cryptography: Asymmetric Encryption 5. Complexity Theory 6. Programming Project: Implementing Algorithms, Comparing Running times (10 points, no presentation) For some topics you can find information in the course textbooks (and other textbooks). For the rest, you must research on your own - but I am willing to give suggestions if I have any. You may suggest another topic as well, but I need to approve it. Requirements Each paper is expected to be 3-5 pages long (single-spaced and at 11pt) and it should include references to your sources (which should be more than just Wikipedia). As long as the paper is complete and well-written, the length requirements should not be too important. However, more than 5 pages would be an overkill and less than 3 might not let you give the necessary information and explanations. As for the actual contents of the paper, you should address your classmates, who will receive a copy of the paper in class and before your presentation. You should explain the topic you have selected and give an appropriate 1 2 example. The specifics may differ...

Words: 796 - Pages: 4

Free Essay

Different Types of Encryption

...applications of encryption are very important. First of all we have data protection. Here we are referring to files and email encryption. The data is protected in the hard disk in case a hacker gets into the system. However, if the person who has the key of the encryption to decode the message shares it, then the encryption will not be effective. On the other hand, Encryption is also used for authentication which means proof of identification. For example, if the user wants to log into a system using his or her username and password, all the details will be sent over the network already encrypted. This is the reason why an additional ‘s’ will appear next to http. With this in mind, it is essential to mention that since the 1970, Modern Cryptography has been creating methods and techniques to avoid activities such as hacking, sniffing, etc. Here my personal experience serves as an illustration. I remember going to Dunken Donuts to have a coffee and “play” with my Kindle Fire HD. I went to Facebook and then I decided to get to bankofamerica.com to check my debit balance. I have always heard about the possibility of having my bank account hacked, but I never really thought it could ever happen to me, which is not very wise. So I stopped going in public places to check my bank account until I found out that my bank has actually an encrypted web site, and therefore it is very safe. Here is the reason why I found very interesting to find out what encryption is and how it actually......

Words: 1201 - Pages: 5

Premium Essay

Bitcoin

...which are subsequent to the nature of an economic cycle. Some inflation is a by-product of the regulation, de-regulation and/or government monetary policy. What if there was a new currency that was not associated with a nation, government or bank? What if there was unified currency that allowed the wealth of one person to directly compare or exchange with to the wealth of another regardless of geographic location? This “new” currency has recently been developed and it is called the Bitcoin. The Bitcoin and its concept is extremely progressive and is not considered a savior currency that will solve any monetary problems; however, this paper will outline the Bitcoin and explain the potential impact it will have on the future of currency. The Bitcoin is considered a Cryptocurrency which is essentially a digital currency that uses cryptography for security, thus making it extremely difficult to counterfeit. Cryptocurrencies are considered fiat currency, which means it only gains its value from supply and demand, assuming people agree to use it as a medium of exchange. The Bitcoin is not linked to any country or government and its value cannot be affected by any bank. Many people from all over the world use the Bitcoin and are currently circulating approximately 11.275million Bitcoins at an approximate rate of two thousand transactions per hour according to bitcoincharts.com. (Bitcoin Charts / Bitcoin Network ) New Bitcoins are constantly entering the market; however, they are......

Words: 1765 - Pages: 8

Free Essay

Client and Server Security

...Table of Contents Project Outline 3 Security Requirements 4 Perimeter Security 5 Client and Server Security 10 Database Security 10 Server Security 12 Wireless and Remote Access Security 15 Security Configuration Management 19 References 23   Project Outline Tiger Tees is a medium sized business with 4 locations across the eastern United States. This company produces and sells t-shirts for school systems, both locally and across the country via the internet. The organization’s headquarters is located in Beckley, West Virginia, and employs 25 people. The departments include the warehouse, human resources, accounting, sales, and administration. The second location of Tiger Tees is located in Columbus, Georgia, and employs 10 people full time, and 4 persons part time. The third location is located in Washington, DC, and employs 15 people. The fourth location located in Richmond, Virginia is the smallest of all the locations employing 5 persons full time. Tiger Tees is a fast growing company in dire need of a secure network that will ensure that the confidentiality, integrity, and availability of client information remain confidential. All transactions completed are sent to the organizational headquarters in Beckley, WV and processed there. In the past these orders and transactions have been completed by telephone and e-mail. A secure wide area network would streamline this process making the transactions more secure, and providing faster service to the......

Words: 5336 - Pages: 22

Premium Essay

Pert

... | |3.1.6 Concurrent, parallel and distributed systems | |3.1.7 Databases and information retrieval | |3.2 Applied computer science | |3.2.1 Artificial intelligence | |3.2.2 Computer architecture and engineering | |3.2.3 Computer graphics and visualization | |3.2.4 Computer security and cryptography | |3.2.5 Computational science | |3.2.6 Information science | |3.2.7 Software engineering | |4 Academia | |4.1 Conferences | |4.2 Journals | |5 Education ...

Words: 5655 - Pages: 23

Premium Essay

Secuity Final

...called ____ cryptography. | Selected Answer: | c. private key | | | The simplest type of stream cipher is a ____ cipher. | | Selected Answer: | a. substitution | | | ____ is designed to replace DES. | | Selected Answer: | b. 3DES | | | The____  is a symmetric cipher that was approved by the NIST in late 2000 as a replacement for DES. | | Selected Answer: | a. AES | | | The algorithm ____ is a block cipher that operates on 64-bit blocks and can have a key length from 32 to 448 bits. | | Selected Answer: | b. Blowfish | | | ____ encryption uses two keys instead of only one and these keys are mathematically related. | | Selected Answer: | b. Asymmetric | | | The basis for a digital signature rests on the ability of ____ keys to work in both directions. | | Selected Answer: | c. asymmetric | | | The ____ algorithm is the most common asymmetric cryptography algorithm and is the basis for several products. | | Selected Answer: | a. RSA | | A ____ is a number divisible only by itself and 1. | Selected Answer: | a. prime number | | ____ was first proposed in the mid-1980s  and it uses sloping curves. | Selected Answer: | b. ECC | | ____ attempts to use the unusual and unique behavior of microscopic objects to enable users to securely develop and share keys as well as to detect eavesdropping. | Selected Answer: | a. Quantum cryptography | | | NTRUEncrypt uses ____ cryptography that......

Words: 6826 - Pages: 28

Premium Essay

Management

...Communication Channel Security Today, the Internet remains largely unchanged from its original, insecure state. Message packets on the Internet travel an unplanned path from a source node to a destination node. A packet passes through a number of intermediate computers on the network before reaching its final destination. The path can vary each time a packet is sent between the same source and destination points. Because users cannot control the path and do not know where their packets have been, it is possible that an intermediary can read the packets, alter them, or even delete them. That is, any message traveling on the Internet is subject to secrecy, integrity, and necessity threats. This section describes these problems in more detail and outlines several solutions for those problems. Secrecy Threats Secrecy is the security threat that is most frequently mentioned in articles and the popular media. Closely linked to secrecy is privacy, which also receives a great deal of attention. Secrecy and privacy, though similar, are different issues. Secrecy is the prevention of unauthorized information disclosure. Privacy is the protection of individual rights to nondisclosure. The Privacy Council, which helps businesses implement smart privacy and data practices, created an extensive Web site surrounding privacy - covering both business and legal issues. Secrecy is a technical issue requiring sophisticated physical and logical mechanisms, whereas privacy protection is a legal......

Words: 5468 - Pages: 22

Free Essay

Ecash

...Journal of Electronic Commerce Research, VOL. 5, NO.4, 2004 USING E-CASH IN THE NEW ECONOMY: AN ECONOMIC ANALYSIS OF MICROPAYMENT SYSTEMS Michelle Baddeley Gonville & Caius College and Faculty of Economics and Politics, Cambridge, UK mb150@cam.ac.uk ABSTRACT The growth of electronic commerce is dependent upon the emergence of effective electronic payment systems. Whilst payments for large purchases can be made relatively easily using credit/debit cards, small-scale electronic commerce is constrained by the limited nature of existing e-cash (or ‘micropayments’) systems. This paper outlines the evolution of electronic payment systems, leading to an analysis of the essential characteristics of e-cash, and microeconomic / macroeconomic implications of the development of e-cash. Finally, the key characteristics of successful electronic payment innovations are analysed using binary dependent variable estimation techniques on data derived from the Electronic Payments Systems Observatory (ePSO) database. Keywords: e-cash, micro-payment systems, e-commerce 1. Introduction Electronic commerce is growing at an increasing pace and financial instruments are adapting to the increased volume of spending taking place over the Internet (Economides, 2001). Until now, most buyers have used credit arrangements or checking accounts as the principle means of paying for Internet purchases. There is however, a 'price umbrella' underneath credit-card transactions that makes......

Words: 11078 - Pages: 45

Premium Essay

Security

...Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Chapter 18 AUDIT TRAILS 18.1 18.2 18.3 18.4 18.5 Benefits and Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Audit Trails and Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 Implementation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Interdependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Cost Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 ix Chapter 19 CRYPTOGRAPHY 19.1 19.2 19.3 19.4 19.5 Basic Cryptographic Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Uses of Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Implementation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Interdependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Cost Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 V. EXAMPLE Chapter 20 ASSESSING AND MITIGATING THE RISKS TO A HYPOTHETICAL COMPUTER SYSTEM 20.1 20.2 20.3 20.4 20.5 20.6 20.7 Initiating the Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 HGA's Computer System . . . . . . . . . . . . . . . . . . . . .......

Words: 93588 - Pages: 375

Premium Essay

The Handbook

... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Chapter 18 AUDIT TRAILS 18.1 18.2 18.3 18.4 18.5 Benefits and Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Audit Trails and Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 Implementation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Interdependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Cost Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 ix Chapter 19 CRYPTOGRAPHY 19.1 19.2 19.3 19.4 19.5 Basic Cryptographic Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Uses of Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Implementation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Interdependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Cost Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 V. EXAMPLE Chapter 20 ASSESSING AND MITIGATING THE RISKS TO A HYPOTHETICAL COMPUTER SYSTEM 20.1 20.2 20.3 20.4 20.5 20.6 20.7 Initiating the Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 HGA's Computer System . . . . . . . . . . ...

Words: 93564 - Pages: 375

Premium Essay

Ethical Hacking

...of these are being offered in the public sector within community colleges and universities. It is interesting to note that while many schools offer such education and training, a number of professionals express concern about teaching hacking techniques. This apprehension stems from a fear that students may use the information unethically. Educational institutions counteract this assumption by offering concepts within an ethical framework (Sanders, 2003). Community Colleges and Universities Some of the more prominent programs at community colleges and universities vary in intensity and course content. Syracuse University offers a Cyber Security Boot Camp to prepare future technology security professionals. Topics include cybersecurity, cryptography, steganography, digital forensics, network security, and wireless security. There are stringent rules for entry into the program, and the Boot Camp ends with "Hackfest" which is a hands-on event putting into practice the theoretical concepts covered within the course (Carnevale, 2005). In Paris, Zi Hackademy, offers hacking courses to a wide variety of students. The school's philosophy is "only if you become a hacker can you understand how hackers think and operate" (van der Laan, 2001). The University of Glamorgan and a leading information security firm 7Safe offer certifications in penetration testing and information security with additional topics Ethical Hacking 6 addressing wireless security and computer forensics (New......

Words: 6103 - Pages: 25