Chapter two: Cryptography

Ambo University
Department of Computer Science

Chapter 2: Cryptography (AmboU

CS Dept) 1
 History of Cryptography
 Hieroglyph – The Oldest Cryptographic
Technique
Some 4000 years ago, the Egyptians used to communicate
by messages written in hieroglyph.
This code was the secret known only to the scribes who
used to transmit messages on behalf of the kings.

The scholars moved on to using simple mono-alphabetic

substitution ciphers during 500 to 600 BC
Chapter 2: Cryptography (AmboU CS Dept) 2
 History….
 Caesar Shift Cipher
 Relies on shifting the letters of a message by an agreed
number (three was a common choice).
The recipient of this message would then shift the letters
back by the same number and obtain the original message.

Chapter 2: Cryptography (AmboU CS Dept) 3

 History….
 Steganography
People not only want to protect the secrecy of an
information by concealing it, but they also want to make
sure any unauthorized person gets no evidence that the
information even exists.
An unintended recipient or an intruder is unaware of the
fact that observed data contains hidden information.
In cryptography, an intruder is normally aware that data
is being communicated, because they can see the
coded/scrambled message.

Chapter 2: Cryptography (AmboU CS Dept) 4

 History…

Chapter 2: Cryptography (AmboU CS Dept) 5

 Modern Cryptography
 Modern cryptography is the cornerstone of
computer and communications security.
 Its foundation is based on various concepts of
mathematics such as
Number theory
Computational-complexity theory, and
Probability theory.
 There are three major characteristics that
separate modern cryptography from the
classical approach
Chapter 2: Cryptography (AmboU CS Dept) 6
 Classical vs Modern
Cryptography
Classical Cryptography
 It manipulates traditional
characters, i.e., letters and
digits directly
 The techniques employed for
coding were kept secret and
only the parties involved in
communication knew about
them.
 It requires the entire
cryptosystem for
communicating
Chapterconfidentially.
2: Cryptography (AmboU CS Dept)
Modern Cryptography
 It operates on binary bit
sequences.
 It relies on publicly known
mathematical algorithms for
coding the information.
– computational difficulty of
algorithms,
– absence of secret key
 Requires parties interested
in secure communication to
possess the secret key only.
7
 Context of Cryptography
 Cryptology, the study of cryptosystems, can be
subdivided into two branches:
Cryptography
Cryptanalysis
 Cryptography is the art and science of making a
cryptosystem that is capable of providing
information security.
 Cryptography deals with
The actual securing of digital data.
The design of mechanisms based on mathematical
algorithms that provide fundamental information security
Chapter 2: Cryptography (AmboU CS Dept) 8
 Cryptanalysis
 Cryptanalysis: the art and science of breaking
the cipher text.
Cipher text: an encrypted text
 Cryptanalysis is the sister branch of
cryptography and they both co-exist.
 The cryptographic process results in the cipher
text for transmission or storage.
 Cryptanalysis is also used during the design of
the new cryptographic techniques to test their
security strengths.
Note: Cryptography concerns with the design of
Chapter 2: Cryptography (AmboU CS Dept) 9
 Security services of
Cryptography
 Confidentiality
It is a security service that keeps the information from an
unauthorized person.
It is sometimes referred to as privacy or secrecy.
 Data Integrity
It is security service that deals with identifying any
alteration to the data.
Data integrity cannot prevent the alteration of data, but
provides a means for detecting whether data has been
manipulated in an unauthorized manner.
 Authentication
Provides the identification of the originator.
Chapter 2: Cryptography (AmboU CS Dept) 10
 Security services…
 Authentication service has two variants:
Message authentication: identifies the originator of the
message without any regard router or system that has sent
the message.
Entity authentication: is assurance that data has been
received from a specific entity, say a particular website.
 Non-repudiation
It is a security service that ensures that an entity cannot
refuse the ownership of a previous commitment or an
action.
Non-repudiation is a property that is most desirable in
Chapter 2:situations whereCSthere
Cryptography (AmboU Dept) are chances of a dispute over the 11
 Cryptosystems
 A cryptosystem is an
implementation of
cryptographic
techniques and their
accompanying
infrastructure to
provide information
security services.
 A cryptosystem is also
referred to as a cipher  Example of
system. Cryptosystem model
Chapter 2: Cryptography (AmboU CS Dept) 12
 Components of a
Cryptosystem
 The various components of a basic cryptosystem
are as follows:
Plaintext: It is the data to be protected during
transmission.
Encryption Algorithm: It is a mathematical process that
produces a ciphertext for any given plaintext and
encryption key.
Ciphertext: It is the scrambled version of the plaintext
produced by the encryption algorithm using a specific the
encryption key.
Decryption Algorithm: It is a mathematical process, that
produces a unique plaintext for any given ciphertext and
decryption
Chapter 2: Cryptography key.CS Dept)
(AmboU 13
 Components…
Decryption Key: The decryption key is related to the
encryption key, but is not always identical to it.
• The receiver inputs the decryption key into the
decryption algorithm along with the ciphertext in
order to compute the plaintext.

 For a given cryptosystem, a collection of all

possible decryption keys is called a key space.
 An interceptor (an attacker) is an unauthorized
entity who attempts to determine the plaintext.

Chapter 2: Cryptography (AmboU CS Dept) 14

 Types of cryptosystems
 Fundamentally, there are two types of
cryptosystems based on the manner in which
encryption-decryption is carried out in the
system:
Symmetric Key Encryption
Asymmetric Key Encryption
 The main difference between these
cryptosystems is
The relationship between the encryption and the
decryption key.
Logically, in any cryptosystem, both the keys are closely
associated.
Chapter 2: Cryptography (AmboU CS Dept) 15
 Symmetric Key Encryption
 The encryption process where same keys are
used for encrypting and decrypting the
information.
 The study of symmetric cryptosystems is
referred to as symmetric cryptography.
 Symmetric cryptosystems are also sometimes
referred to as secret key cryptosystems.
 A few well-known examples of symmetric key
encryption methods are:
Digital/Data Encryption Standard (DES)
Chapter 2: Cryptography (AmboU CS Dept) 16
Triple-DES (3DES
 Symmetric Cryptography
 Salient features  Length of Key (number of bits)
in this encryption is smaller
 Persons using symmetric key and hence, process of
encryption must share a encryption-decryption is faster
common key prior to exchange than asymmetric key
of information. encryption.
 Keys are recommended to be  Processing power of computer
changed regularly to prevent system required to run
any attack on the system. symmetric algorithm is less.
 A robust mechanism needs to
exist to exchange the key
between the communicating
parties.
 In a group of n people, to
enable two-party
communication between any
Chapter 2: Cryptography (AmboU CS Dept) 17
two persons, the number of
 Symmetric…
 Challenges of Symmetric Cryptography:
Key establishment – Before any communication, both the
sender and the receiver need to agree on a secret symmetric
key. It requires a secure key establishment mechanism in
place.
Trust Issue – Since the sender and the receiver use the
same symmetric key, there is an implicit requirement that
the sender and the receiver ‘trust’ each other. For example,
it may happen that the receiver has lost the key to an
attacker and the sender is not informed
 These limitations of symmetric key encryption
gave rise to asymmetric key encryption schemes
Chapter 2: Cryptography (AmboU CS Dept) 18
 Asymmetric Key Cryptography
 The encryption process where different keys are
used for encrypting and decrypting the
information.
 Though the keys are different, they are
mathematically related and hence, retrieving the
plaintext by decrypting ciphertext is feasible.
 Asymmetric Key Encryption was invented in the
20th century to come over the necessity of pre-
shared secret key between communicating
persons.
 It 2:isCryptography
Chapter also known as public key cryptosystem
(AmboU CS Dept) 19
 Asymmetric…
 Salient features  Length of Keys (number of bits) in
this encryption is large and hence,
 Every user in this system needs the process of encryption-
to have a pair of dissimilar keys, decryption is slower than
private key and public key. symmetric key encryption.
 It requires to put the public key  Processing power of computer
in public repository and the system required to run
private key as a well-guarded asymmetric algorithm is higher.
secret.
 Though public and private keys
of the user are related, it is
computationally not feasible to
find one from another.
 When Host1 needs to send data
to Host2, he obtains the public
key of Host2 from repository,
Chapter 2: Cryptography (AmboU CS Dept) 20
encrypts the data, and
 Asymmetric…
 Challenges of asymmetric cryptosystem
The user needs to trust that the public key that he is using
in communications with a person really is the public key of
that person and has not been spoofed by a malicious third
party.
This is usually accomplished through a Public Key
Infrastructure (PKI) consisting a trusted third party.

Chapter 2: Cryptography (AmboU CS Dept) 21

Chapter 3: User Authentication

Ambo University
Department of Computer Science

Chapter three: User

Authentication 22
 Introduction
 User authentication is the fundamental and the
primary line of defense.
 The process of verifying an identity claimed by
or for a system entity.
 An authentication process consists of two steps:
Identification step: Presenting an identifier to the
security system.
Verification step: generating authentication information
that corroborates the binding between the entity and the
identifier.

Chapter three: User Authentication 23

 Intro…
 Note:
User authentication is the means of establishing the
validity of the claim.
Message authentication allows that communicating
parties to verify that the contents of a received message
have not been altered and that the source is authentic.

Chapter three: User Authentication 24

 Means of Authentication
 There are four means of authenticating a user’s
identity, which can be used alone or in
combination:
Something the individual knows: a password, PIN, or
answers to a prearranged set of questions.
Something the individual possesses: electronic
keycards, smart cards, and physical keys. This type of
authenticator is referred to as a token.
Something the individual is (static biometrics):
recognition by fingerprint, retina, and face.

Chapter three: User Authentication 25

 Means…
Something the individual does (dynamic biometrics):
Examples include recognition by voice pattern,
handwriting characteristics, and typing rhythm.
 Each method has problems:
Passwords can be guessed, be stolen or can be forgotten
Tokens can be stolen
Overhead for managing passwords and tokens

Chapter three: User Authentication 26

 Password-Based Auth
 A widely used line of defense against intruders
is the password system.
 Many services require that a user provide not
only a name or identifier (ID) but also a
password.
 The password serves to authenticate the ID of
the individual logging on to the system.

Chapter three: User Authentication 27

 Password-based…
 The ID provides security in the following ways:
The ID determines whether the user is authorized to gain
access to a system.
The ID determines the privileges accorded to the user.
The ID is used in what is referred to as discretionary
access control.
• For example, by listing the IDs of the other users,
a user may grant permission to them to read files
owned by that user.

Chapter three: User Authentication 28

 Vulnerability of Passwords
 We can identify the following attack strategies
and countermeasures:
Offline dictionary attack: strong access controls are
used to protect the system’s password file.
• Experience shows that determined hackers can
frequently bypass such controls and gain access to
the file.
• The attacker obtains the system password file and
compares the password hashes against hashes of
commonly used passwords. If a match is found, the
attacker can gain access by that ID/password
combination.

Chapter three: User Authentication 29

 Vulnerability of password…
• Countermeasures include controls to prevent
unauthorized access to the password file, intrusion
detection measures to identify a compromise.
Specific account attack: The attacker targets a specific
account and submits password guesses until the correct
password is discovered.
• The standard countermeasure is an account lockout
mechanism, which locks out access to the account
after a number of failed login attempts.

Chapter three: User Authentication 30

 Vulnerability of Passwords…
Popular password attack: A variation of the preceding
attack is to use a popular password and try it against a
wide range of user IDs.
• A user’s tendency is to choose a password that is
easily remembered; this unfortunately makes the
password easy to guess. Countermeasures include
policies to inhibit the selection by users of common
passwords and scanning the IP addresses of
authentication requests.
Password guessing against single user: The attacker
attempts to gain knowledge about the account holder and
system password policies and uses that knowledge to guess
the password.
Chapter three: User Authentication 31
 Vulnerability of Passwords…
• Countermeasures include training in and enforcement
of password policies that make passwords difficult to
guess.
Workstation hijacking: The attacker waits until a
logged-in workstation is unattended.
• The standard countermeasure is automatically logging
the workstation out after a period of inactivity.
• Intrusion detection schemes can be used to detect
changes in user behavior.
Exploiting user mistakes: If the system assigns a
password, then the user is more likely to write it down
because it is difficult to remember.

Chapter three: User Authentication 32

 Vulnerability of Passwords…
• This situation creates the potential for an adversary
to read the written password.
• Countermeasures include user training, intrusion
detection, and simpler passwords combined with
another authentication mechanism.
Exploiting multiple password use: Attacks can also
become much more effective or damaging if different
network devices share the same or a similar password for a
given user.
• Countermeasures include a policy that forbids the
same or similar password on particular network
devices.

Chapter three: User Authentication 33

 Vulnerability of Passwords…
Electronic monitoring: If a password is communicated
across a network to log on to a remote system, it is
vulnerable to eavesdropping.
• Simple encryption will not fix this problem, because
the encrypted password is, in effect, the password
and can be observed and reused by an adversary.

Chapter three: User Authentication 34

 Token Based Authentication
 Objects that a user possesses for the purpose of
Horachu

user authentication are called tokens.

 Two types of tokens are widely used: Memory
cards & Smart cards.
 Memory Cards
Memory cards can store but not process data. The most
common such card is the bank card with a magnetic stripe
on the back.

Chapter three: User Authentication 35

 Token Based…
A magnetic stripe can store only a simple security
code, which can be read (and unfortunately
reprogrammed) by an inexpensive card reader.
There are also memory cards that include an internal
electronic memory.
Memory cards can be used alone for physical access,
such as a hotel room.
For authentication, a user provides both the memory
card and some form of password or personal
identification number (PIN).
• A typical application is an automatic teller
machine (ATM).
Chapter three: User Authentication 36
 Token Based…
The memory card, when combined with a PIN or
password, provides significantly greater security than a
password alone.
An adversary must gain physical possession of the card (or
be able to duplicate it) plus must gain knowledge of the
PIN.
 Among the potential drawbacks are the
following
Requires special reader: This increases the cost of using
the token and creates the requirement to maintain the
security of the reader’s hardware and software.
Chapter three: User Authentication 37
 Token Based Drawbacks…
Token loss: A lost token temporarily prevents its owner
from gaining system access. Thus there is an
administrative cost in replacing the lost token.
User dissatisfaction: Although users may have no
difficulty in accepting the use of a memory card for ATM
access, its use for computer access may be deemed
inconvenient.

Chapter three: User Authentication 38

 Token Based…
 Smart Cards: These can be categorized along
four dimensions.
Physical characteristics: Smart tokens include an
embedded microprocessor.
User interface: Manual interfaces include a keypad and
display for human/ token interaction.
Electronic interface: A smart card or other token
requires an electronic interface to communicate with a
compatible reader/writer.
• Contact: card must be inserted to the reader.
• Contactless: uses radio frequency
Chapter three: User Authentication 39
 Token Based…
Authentication protocol: The purpose of a smart token
is to provide a means for user authentication. Can be
classified into three categories:
• Static: With a static protocol, the user
authenticates himself or herself to the token and
then the token authenticates the user to the
computer.
• Dynamic password generator: In this case, the token
generates a unique password periodically.
• Challenge-response: In this case, the computer system
generates a challenge, such as a random string of
numbers. The smart token generates a response based
on the challenge.

Chapter three: User Authentication 40

 Biometric Authentication
 A biometric authentication system attempts to
authenticate an individual based on his or her
unique physical characteristics.
fingerprints, hand geometry, facial characteristics, and
retinal and iris patterns; and dynamic characteristics,
such as voiceprint and signature.
 In essence, biometrics is based on pattern
recognition.
Compared to passwords and tokens, biometric
authentication is both technically more complex and
expensive.
Chapter three: User Authentication 41
 Biometric…
 The most common physical characteristics used
in biometric authentication are:
Facial characteristics: Facial characteristics are the most
common means of human-to-human identification; thus it
is natural to consider them for identification by computer.
Fingerprints: Fingerprints have been used as a means of
identification for centuries, and the process has been
systematized and automated particularly for law
enforcement purposes.
Hand geometry: Hand geometry systems identify
features of the hand, including shape, and lengths and
widths of fingers.
Chapter three: User Authentication 42
 Biometric…
Retinal pattern: The pattern formed by veins beneath the
retinal surface is unique and therefore suitable for
identification.
Iris: Another unique physical characteristic is the detailed
structure of the iris.
Signature: Each individual has a unique style of
handwriting and this is reflected especially in the
signature, which is typically a frequently written
sequence.
Voice: voice patterns are more closely tied to the physical
and anatomical characteristics of the speaker.

Chapter three: User Authentication 43

 Biometric…

Fig: Cost versus Accuracy of Various Biometric Characteristics in User

Authentication Schemes
Chapter three: User Authentication 44
 Biometric…

Chapter three: User Authentication 45

 Biometric…

Chapter three: User Authentication 46

 Remote User Authentication
 The simplest form of user authentication is local
authentication.
A user attempts to access a system that is locally present,
such as a stand-alone office PC or an ATM machine.
 Remote authentication takes place over the
Internet, a network, or a communications link.
Remote user authentication raises additional security
threats, such as an eavesdropper being able to capture a
password, or an adversary replaying an authentication
sequence that has been observed.

Chapter three: User Authentication 47

 Remote User Auth…
 To counter threats to remote user authentication,
systems generally rely on some form of
challenge-response protocol.
Password Protocol
Token Protocol
Static Biometric Protocol
Dynamic Biometric Protocol

Chapter three: User Authentication 48

 Summary

Chapter three: User Authentication 49

 Summary…

Chapter three: User Authentication 50

Chapter4: Access Control

Ambo University
Department of Computer Science

Chapter 4: Access Control 51

 Access Control
 Access Control can be defined as
The process of granting or denying specific requests to:
• (1) obtain and use information and related
information processing services; and
• (2) enter specific physical facilities.
A process by which use of system resources is regulated
according to a security policy and is permitted only by
authorized entities (users, programs, processes, or other
systems) according to that policy.
 The principal objectives of computer security are
To prevent unauthorized users from gaining access to
resources
Chapter 4: Access Control 52
 Access Control…
To prevent legitimate users from accessing resources in an
unauthorized manner, and
To enable legitimate users to access resources in an
authorized manner.
 Access Control can be viewed as the central
element of computer security.
 Access Control can also be defined as Measures
that implement and assure security services in a
computer system, particularly those that assure
access control service.

Chapter 4: Access Control 53

 Access Control Context
 The context of Access control involves the
following entities and functions:
Authentication: Verification that the credentials of a user
or other system entity are valid.
Authorization: The granting of a right or permission to a
system entity to access a system resource. This function
determines who is trusted for a given purpose.
Audit: An independent review and examination of system
records and activities in order to test for adequacy of
• System controls, to ensure compliance with
established policy and operational procedures, to
detect breaches in security, and to recommend any
indicated changes in control, policy and procedures.
Chapter 4: Access Control 54
Chapter 4: Access Control

Fig: Relationship Among Access Control

and Other Security Functions
Access Control Context…

55
 Access Control Policies
 An access control policy, which can be
embodied in an authorization database, dictates
what types of access are permitted, under what
circumstances, and by whom.
 Access control policies are generally grouped
into the following categories:
Discretionary access control (DAC): Controls access
based on the identity of the requestor and on access rules
(authorizations) stating what requestors are (or are not)
allowed to do.

Chapter 4: Access Control 56

 Access Control Policies…
Mandatory access control (MAC): Controls access
based on comparing security labels (which indicate how
sensitive or critical system resources are) with security
clearances (which indicate system entities are eligible to
access certain resources).
Role-based access control (RBAC): Controls access
based on the roles that users have within the system and
on rules stating what accesses are allowed to users in
given roles.
Attribute-based access control (ABAC): Controls
access based on attributes of the user, the resource to be
accessed, and current environmental conditions.
Chapter 4: Access Control 57
 Subjects, objects and Access Rights
 The basic elements of access control are: subject,
object, and access right.
 A subject is an entity capable of accessing
objects.
The concept of subject equates with that of process.
 Any user or application actually gains access to an object
by means of a process that represents that user or
application.
A subject is typically held accountable for the actions they
have initiated, and an audit trail may be used to record
that.
Chapter 4: Access Control 58
 Subjects,…
 Basic access control systems typically define
three classes of subject, with different access
rights for each class:
Owner: This may be the creator of a resource, such as a
file.
Group: In addition to the privileges assigned to an owner,
a named group of users may also be granted access rights.
World: The least amount of access is granted to users who
are able to access the system but are not included in the
categories owner and group for this resource.

Chapter 4: Access Control 59

 Subjects,…
 An object is a resource to which access is
controlled.
Examples include records, blocks, pages, segments, files,
portions of files, directories, directory trees, mailboxes,
messages, and programs.
Some access control systems also encompass, bits, bytes,
words, processors, communication ports, clocks, and
network nodes.

Chapter 4: Access Control 60

 Subjects,…
 An access right describes the way in which a
subject may access an object.
 Access rights could include the following:
Read: User may view information in a system resource
(e.g., a file). Read access includes the ability to copy or
print.
Write: User may add, modify, or delete data in system
resource (e.g., files, records, programs). Write access
includes read access.
Execute: User may execute specified programs.

Chapter 4: Access Control 61

 Subjects,…
Delete: User may delete certain system resources, such as
files or records.
Create: User may create new files, records, or fields.
Search: User may list the files in a directory or otherwise
search the directory.

Chapter 4: Access Control 62

 Discretionary Access Control
 Entity may be granted access rights that permit
the entity, by its own volition, to enable another
entity to access some resource.
 A general approach to DAC, as exercised by an
operating system or a database management
system, is that of an access matrix.
One dimension of the matrix consists of identified subjects
that may attempt data access to the resources.
• Typically, this list will consist of individual users
or user groups, although access could be controlled
for terminals, network equipment, hosts, or
applications instead of or in addition to users.
Chapter 4: Access Control 63
 DAC…
The other dimension lists the objects that may be accessed.
At the greatest level of detail, objects may be individual
data fields.
• More aggregate groupings, such as records, files, or
even the entire database, may also be objects in the
matrix.
Each entry in the matrix indicates the access rights of a
particular subject for a particular object.

Chapter 4: Access Control 64

 DAC…

Chapter 4: Access Control 65

 DAC…
 In practice, an access matrix is usually sparse
and is implemented by decomposition in one of
two ways.
The matrix may be decomposed by columns, yielding
Access Control Lists (ACLs).
• For each object, an ACL lists users and their
permitted access rights.
Decomposition by rows yields capability tickets.
• A capability ticket specifies authorized objects and
operations for a particular user.
• Each user has a number of tickets and may be
authorized to loan or give them to others.

Chapter 4: Access Control 66

 DAC…

Chapter 4: Access Control 67

 DAC…

Chapter 4: Access Control 68

 Role Based Access Control
 Traditional DAC systems define the access
rights of individual users and groups of users.
 In contrast, RBAC is based on the roles that
users assume in a system rather than the user’s
identity.
 RBAC systems assign access rights to roles
instead of individual users.
In turn, users are assigned to different roles, either
statically or dynamically, according to their
responsibilities.

Chapter 4: Access Control 69

 RBAC…
 The relationship of users to roles is many to
many, as is the relationship of roles to resources,
or system objects.
 The set of roles in the system in most
environments is relatively static, with only
occasional additions or deletions.
Each role will have specific access rights to one or more
resources.

Chapter 4: Access Control 70

 RBAC…

Role Based Access Control

Chapter 4: Access Control 71
 RBAC…

Access Matrix Representation of RBAC

Chapter 4: Access Control 72