Introduction

➢ The word cryptography comes from two Greek words meaning "secret
writing" and is the art and science of concealing meaning.
➢ Cryptanalysis is the breaking of codes.
➢ The basic component of cryptography is a cryptosystem.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Introduction
➢ A cryptosystem is a 5-tuple (E, D, M, K, C), where
❖M is the set of plaintexts,
❖ K the set of keys,

❖ C is the set of ciphertexts,

❖ E: M x K ->C is the set of enciphering functions,

❖ D: C x K ->M is the set of deciphering functions.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Caesar cipher

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Introduction
➢ The goal of cryptography is to keep enciphered information secret.
➢ Assume that an adversary wishes to break a ciphertext.
➢ Standard cryptographic practice is to assume that she knows the algorithm
used to encipher the plaintext, but not the specific cryptographic key (in
other words, she knows D and E).
➢ Three types of attacks:
1. In a ciphertext only attack, the adversary has only the ciphertext. Her
goal is to find the corresponding plaintext. If possible, she may try to find
the key, too.
2. In a known plaintext attack, the adversary has the ciphertext and the
plaintext that was enciphered. Goal is to find the key that was used.
3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Introduction
3. In a chosen plaintext attack, the adversary may ask that specific
plaintexts be enciphered. She is given the corresponding ciphertexts. Her
goal is to find the key that was used.
➢ A good cryptosystem protects against all three types of attacks.
➢ Cryptoanalysis uses mathematics and statistics.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Classical Cryptosystems
➢ Classical cryptosystems (also called single-key or symmetric
cryptosystems) are cryptosystems that use the same key for encipherment
and decipherment.
➢ In these systems, for all Ek ∈ C and k ∈ K, there is a Dk ∈ D such that Dk
= Ek –1

➢ Transposition cipher: A transposition cipher rearranges the characters in

the plaintext to form the ciphertext. The letters are not changed.
➢ Substitution cipher : A substitution cipher changes characters in the
plaintext to produce the ciphertext. [Caesar cipher]
3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Rail-fence cipher
➢ In the rail fence cipher, the plaintext is written downwards and diagonally on
successive "rails" of an imaginary fence, then moving up when we reach the
bottom rail. [Transposition cipher]
➢ When we reach the top rail, the message is written downwards again until the
whole plaintext is written out.
➢ It when read horizontally gives the cipher-text.
Plain Text: 'WE ARE DISCOVERED FLEE AT ONCE’

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Vigenère Cipher
➢ The Vigenère cipher chooses a sequence of keys, represented by a string.
➢ The key letters are applied to successive plaintext characters, and when the end
of the key is reached, the key starts over.
➢ The length of the key is called the period of the cipher.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
One-time pad
➢ The one-time pad is a variant of the Vigenère cipher.
➢ The technique is the same. The key string is chosen at random, and is at least as
long as the message, so it does not repeat.
➢ The key is as long as the message
➢ Perfect secrecy

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Public Key Cryptography
➢ In 1976, Diffie and Hellman proposed a new type of cryptography that
distinguished between encipherment and decipherment keys.
➢ One of the keys would be publicly known; the other would be kept private by
its owner.
➢ Classical cryptography requires the sender and recipient to share a common
key.
➢ Public key cryptography does not. If the encipherment key is public, to send a
secret message simply encipher the message with the recipient's public key.
Then send it.
➢ The recipient can decipher it using his private key.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Public Key Cryptography
Because one key is public, and its complementary key must remain secret, a
public key cryptosystem must meet the following three conditions.
1. It must be computationally easy to encipher or decipher a message given the
appropriate key.
2. It must be computationally infeasible to derive the private key from the
public key.
3. It must be computationally infeasible to determine the private key from a
chosen plaintext attack.

The first cipher to meet these requirements generates a shared session key. The
second one provides both secrecy and authentication.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Diffie-Hellman
➢ First public key cryptosystem proposed,
➢ A pair of users use this algorithm to generate a common key.
➢ It is based on the discrete logarithm problem.
➢ This problem is to find a value of k such that n = g k mod p for a given n, g, and
prime p.
➢ In this cryptosystem, all users share a common modulus p and a g other than
0, 1, or p – 1.
➢ Each user chooses a private key k and computes a public key K.
➢ When two users want to communicate, each enciphers the other's public key
using their own private key, and uses the result as the shared secret key S.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Diffie-Hellman

In Book
3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
RSA
➢ RSA is an exponentiation cipher.
➢ Choose two large prime numbers p and q, and let n = pq.
➢ The totient f(n) of n is the number of numbers less than n with no factors in
common with n.
➢ Choose an integer e < n that is relatively prime to f(n).
➢ Find a second integer d such that ed mod f(n) = 1.
➢ The public key is (e, n), and the private key is d.
Let m be a message. Then:
c = me mod n and m = cd mod n

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
RSA

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Cryptographic Checksums
➢ A cryptographic checksum function (also called a strong hash function or a
strong one-way function) h: A B is a function that has the following properties.
1. For any x E A, h(x) is easy to compute.
2. For any y E B, it is computationally infeasible to find x A such that h(x) n = y.
3. It is computationally infeasible to find x, x' E A, such that x != x' and h(x) = h(x’).
(Such a pair is called a collision.)
➢ The third requirement is often stated as:
4. Given any x ∈ A, it is computationally infeasible to find another x’ E A such that
x !=x’ and h(x') = h(x).

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Key Management
➢ Key management refers to the distribution of cryptographic keys; the
mechanisms used to bind an identity to a key; and the generation, maintenance,
and revoking of such keys.
➢ Representation
X —>Y:{Z}k
X sends Y a message Z, enciphered with key k
➢ An interchange key is a cryptographic key associated with a principal to a
communication.
➢ A session key is a cryptographic key associated with the communication itself.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
Key Exchange
➢ The goal of key exchange is to enable Alice to communicate secretly to Bob, andn
vice versa, using a shared cryptographic key. Solutions to this problem must
meet the following criteria.
➢ The key that Alice and Bob are to share cannot be transmitted in the clear. Either
it must be enciphered when sent, or Alice and Bob must derive it without an
exchange of data from which the key can be derived. (Alice and Bob can exchange
➢ data, but a third party cannot derive the key from the data exchanged.)
➢ Alice and Bob may decide to trust a third party (called "Cathy" here).
➢ The cryptosystems and protocols are publicly known. The only secret data is to
be the cryptographic keys involved.
➢ Classical cryptosystems and public key cryptosystems use different protocols.

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus
 ➢ Certificate
A certificate is a token that binds an identity to a cryptographic key.
➢ Certification authority
A certification authority (CA) is an entity that issues certificates.
➢ Key storage
➢ Key revocation

3/1/2020 Information Security and Audit Ch-3 Sunil Dahal IOE, Pashchimanchal Campus