name of programme: B.

TECH-CSE

semester / YEAR: VIII/IV

Subject Name (SUBJECT CODE): CRYPTOGRAPHY & NETWOK SECURITY

(DECS-014)

LONG QUESTION / ANSWERS

UNIT -1
a) Classical Transposition Encryption Technique with Example

Transposition encryption is a classical technique where the positions of characters in

the plaintext are shifted according to a certain system, without changing the actual
characters themselves. The main goal is to rearrange the order of the letters to hide
the original message.

Key Points:
• Only the order of characters is changed, not the characters themselves.

• Common types: Rail Fence cipher, Columnar Transposition cipher.

Example: Rail Fence Cipher

Suppose the plaintext is: "HELLO WORLD"
Using 2 rails:
1. Write the message in a zigzag pattern:

text

HLOWRD

EL OL

2. Read off row by row:

Ciphertext: "HLOWRDEL OL"

This rearrangement hides the original structure, making it harder to decipher without
the key.

b) Classical Encryption Techniques & Categories of Substitution Cipher

Classical Encryption Techniques:

• Substitution Cipher: Each letter or group of letters is replaced by another

letter or group.

• Transposition Cipher: The positions of the letters are shifted according to a

pattern.
Categories of Substitution Cipher:

Category Description Example

Each letter is replaced by the same Caesar

Simple/Monoalphabetic letter every time it appears. Cipher

Uses multiple substitution alphabets

to encrypt the message, changing Vigenère
Polyalphabetic substitution. Cipher

One plaintext letter can be replaced

by multiple possible ciphertext Homophonic
Homophonic symbols. Sub.

Substitutes groups of letters

(digraphs, trigraphs) instead of Playfair
Polygraphic single letters. Cipher

• Monoalphabetic substitution: Simple, but vulnerable to frequency analysis.

• Polyalphabetic substitution: More secure, as the same letter can be

encrypted differently.

• Homophonic substitution: Reduces frequency analysis by mapping one

letter to several symbols.

• Polygraphic substitution: Substitutes blocks of letters, e.g., Playfair Cipher.

c) Block Diagram of DES Algorithm & Its Functionality

Block Diagram of DES:

text

+-------------------+

| Initial Permutation|

+-------------------+

v
+-------------------+
| 16 Rounds of |

| Substitution and |

| Permutation |

+-------------------+
|

+-------------------+

| Final Permutation |

+-------------------+

Ciphertext
Functionality Explained:

• Initial Permutation (IP): Rearranges the bits of the plaintext.

• Rounds (16 total): Each round uses a different subkey and consists of:

• Expansion (E): Expands 32 bits to 48 bits.

• Key Mixing: XOR with round subkey.

• Substitution (S-boxes): Substitutes bits using fixed tables for confusion.

• Permutation (P): Rearranges bits for diffusion.
• Final Permutation (FP): Inverse of the initial permutation.

Each round increases security by mixing and spreading the influence of each bit
(confusion and diffusion).

d) Strengths of DES & Explanation of Triple DES

Strengths of DES:

• Simple and fast in hardware.

• Strong against many attacks due to multiple rounds of substitution and

permutation.

• Widely analyzed and used as a standard for many years.

Triple DES (3DES):
 • DES uses a 56-bit key, which is now vulnerable to brute force.

• Triple DES increases security by applying DES three times:

1. Encrypt with key 1.

2. Decrypt with key 2.

3. Encrypt again with key 3.

• Effective key length is 168 bits (if all keys are independent).

• Much stronger than single DES, but slower.

e) Shannon’s Theory of Confusion and Diffusion in Information Security

Claude Shannon introduced the concepts of confusion and diffusion as essential

properties for secure encryption:

• Confusion: Makes the relationship between the ciphertext and the key as
complex as possible. Achieved mainly through substitution. It ensures that
changing one bit of the key changes many bits of the ciphertext, making it
hard to deduce the key from the ciphertext.

• Diffusion: Spreads the influence of each plaintext symbol over many

ciphertext symbols. Achieved mainly through transposition. It hides statistical
properties of the plaintext, so that changing one bit of the plaintext affects
many bits of the ciphertext.

By combining both, modern ciphers make cryptanalysis and pattern detection

extremely difficult, ensuring strong security for encrypted data.

Summary Table: Confusion vs Diffusion

Property Achieved Purpose Example

By

Confusion Substitution Obscure relationship with key S-box in DES

Spread plaintext statistics in Bit

Diffusion Transposition ciphertext permutation

f) Mono-Alphabetic Cipher and Its Difference from Caesar Cipher (with

Example)
A mono-alphabetic cipher is a type of substitution cipher where each letter in the
plaintext is replaced by another fixed letter from the alphabet. The substitution rule
remains the same throughout the message. There are 26! (factorial) possible keys,
making it much stronger than the Caesar cipher.
• Caesar Cipher is a special case of mono-alphabetic cipher, where each letter
is shifted by a fixed number (usually 3). The substitution rule is always the
same shift for all letters.

Key Differences:

Feature Mono-Alphabetic Cipher Caesar Cipher

Substitution Rule Any fixed mapping Fixed shift

Number of Keys 26! (very large) 25 (for English)

Security More secure than Caesar Less secure

Example:

• Mono-alphabetic cipher mapping:

Plain: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cipher: Q W E R T Y U I O P A S D F G H J K L Z X C V B N M

Plaintext: HELLO
Ciphertext: IATTD

• Caesar cipher with shift 3:

Plain: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cipher: D E F G H I J K L M N O P Q R S T U V W X Y Z A B C

Plaintext: HELLO
Ciphertext: KHOOR

g) Explanation of Key Security Concepts

a) Message Integrity

• Ensures data is not altered during transmission.

• The receiver gets the exact data sent by the sender.

• Example: Changing a bank transfer from $100 to $10,000 would violate

integrity.
b) Denial of Service (DoS)
 • Attack that disrupts or blocks access to services or resources.

• Can be targeted at a website, server, or network to make it unavailable to

users.

• Example: Flooding a website with traffic so legitimate users can't access it.

c) Availability

• Ensures that authorized users have reliable and timely access to information
and resources.

• Systems must be up and running when needed, even during attacks or

failures.

d) Authentication

• Verifies the identity of users or systems before granting access.

• Example: Logging in with a username and password to access an account.

h) Differential Cryptanalysis & Four Types of Cryptanalytic Attacks

Differential Cryptanalysis:

• A method used to analyze block ciphers by studying how differences in input

affect differences in output.

• Attackers observe how changes in plaintext pairs propagate through the

encryption process to deduce the secret key.

Four Types of Cryptanalytic Attacks:

Attack Type Description

Ciphertext-only Attacker has only ciphertext; tries to deduce plaintext or key.

Attacker knows some plaintext-ciphertext pairs; tries to find the

Known-plaintext key.

Attacker can encrypt plaintexts of their choice to study

Chosen-plaintext ciphertext output.
 Attack Type Description

Chosen- Attacker can decrypt ciphertexts of their choice to study

ciphertext plaintext output.

i) Need for Various Modes of Operation for Block Cipher (with Example)

Block ciphers encrypt fixed-size blocks (e.g., 64 or 128 bits). To encrypt data longer
than one block or provide different security properties, modes of operation are
used.

Why Needed:

• To handle messages of arbitrary length.

• To add properties like error propagation, parallelism, or resistance to certain
attacks.

Example:
• ECB (Electronic Codebook) Mode: Encrypts each block independently.
Weak because identical plaintext blocks produce identical ciphertext blocks.

• CBC (Cipher Block Chaining) Mode: Each plaintext block is XORed with the
previous ciphertext block before encryption. This ensures identical plaintext
blocks result in different ciphertext.

Diagram Example:
text

Plaintext Block 1 -->[Encrypt]--> Ciphertext Block 1

Plaintext Block 2 XOR Ciphertext Block 1 -->[Encrypt]--> Ciphertext Block 2

...

j) Security Attacks and Security Services in Network Security

Security Attacks:

• Passive Attacks: Eavesdropping, monitoring transmissions (e.g.,

wiretapping).

• Active Attacks: Altering data or disrupting services (e.g., DoS, masquerade,

modification, replay).
 • Types of Attacks:

• Malware (viruses, worms)

• Phishing

• Password attacks (brute force, dictionary)

• Denial-of-Service (DoS)

Security Services:

• Confidentiality: Ensures only authorized parties can read the data.

• Integrity: Prevents unauthorized alteration of data.

• Authentication: Verifies identity of users/systems.

• Non-repudiation: Prevents denial of actions (e.g., sender can't deny sending

a message).

• Availability: Ensures resources are accessible when needed.

Summary Diagram:

text
[ Security Attacks ]

| |

[ Passive ] [ Active ]

| |

Eavesdropping DoS, Modification, Replay

[ Security Services ]
Confidentiality | Integrity | Authentication | Non-repudiation | Availability
These services and countermeasures are essential for robust network security,
protecting data and resources from a wide range of threats.

UNIT – 2

a) RSA Algorithm and Example (p=3, q=11, e=7, m=5)

RSA Algorithm Steps:

1. Key Generation:
 • Choose two distinct prime numbers: p=3p=3, q=11q=11.

• Compute n=p×q=3×11=33n=p×q=3×11=33.

• Compute Euler’s
totient: ϕ(n)=(p−1)(q−1)=2×10=20ϕ(n)=(p−1)(q−1)=2×10=20.

• Choose public exponent e=7e=7 (must be 1<e<ϕ(n)1<e<ϕ(n),

and gcd⁡(e,ϕ(n))=1gcd(e,ϕ(n))=1).

• Compute private exponent dd such that d×e≡1(mod20)d×e≡1(mod20).

• 7×d≡1(mod20) ⟹
d=37×d≡1(mod20)⟹d=3 (since 7×3=21≡1(mod20)7×3=21≡1(m
od20)).

• Public Key: (e, n) = (7, 33)

• Private Key: (d, n) = (3, 33)

2. Encryption:
• Plaintext m=5m=5.

• Ciphertext c=memod n=57mod 33c=memodn=57mod33.

Calculate 5757:

• 51=551=5

• 52=2552=25

• 53=12553=125

• 54=62554=625
• 55=312555=3125

• 56=1562556=15625

• 57=7812557=78125

Now, 57mod 3357mod33:

• 52=2552=25

• 53=25×5=125mod 33=125−3×33=125−99=2653=25×5=125mod33=12
5−3×33=125−99=26

• 54=26×5=130mod 33=130−3×33=130−99=3154=26×5=130mod33=13
0−3×33=130−99=31

• 55=31×5=155mod 33=155−4×33=155−132=2355=31×5=155mod33=1
55−4×33=155−132=23
 • 56=23×5=115mod 33=115−3×33=115−99=1656=23×5=115mod33=115
−3×33=115−99=16

• 57=16×5=80mod 33=80−2×33=80−66=1457=16×5=80mod33=80−2×3
3=80−66=14

So, c=14c=14.

3. Decryption:

• Ciphertext c=14c=14.

• Plaintext m=cdmod n=143mod 33m=cdmodn=143mod33.

• 142=196mod 33=196−5×33=196−165=31142=196mod33=196−5×33=
196−165=31

• 143=31×14=434mod 33=434−13×33=434−429=5143=31×14=434mod
33=434−13×33=434−429=5

So, decrypted message m=5m=5.

Summary Table:

Step Value

p, q 3, 11

n 33

ϕ(n)ϕ(n) 20

e, d 7, 3

Public Key (7, 33)

Private Key (3, 33)

Plaintext m 5

Ciphertext c 14

Decrypted m 5

Result: Encryption and decryption work as expected.

b) Prime and Relative Prime Numbers in Cryptography

• Prime Number: An integer greater than 1 that has no divisors other than 1
and itself.
Examples: 2, 3, 5, 7, 11, 13, etc.

• Relative Prime (Coprime): Two integers are relatively prime if their greatest
common divisor (gcd) is 1.
Example: 7 and 20 are relatively prime because gcd⁡(7,20)=1gcd(7,20)=1.

In Cryptography:

• Prime numbers are used in algorithms like RSA to generate secure keys.

• The public exponent ee in RSA must be relatively prime to ϕ(n)ϕ(n) to ensure

the existence of a modular inverse for decryption.

c) Chinese Remainder Theorem (CRT): Statement and Proof

Statement:
If n1,n2,...,nkn1,n2,...,nk are pairwise coprime positive integers,
and a1,a2,...,aka1,a2,...,ak are any integers, then the system:

x≡a1(modn1)x≡a2(modn2)⋮x≡ak(modnk)xxx≡a1(modn1)≡a2(modn2)⋮≡ak(modnk)

has a unique solution modulo N=n1n2⋯nkN=n1n2⋯nk5.

Proof Outline:

• Let N=n1n2⋯nkN=n1n2⋯nk.

• For each ii, set Ni=N/niNi=N/ni.

• Since nini and NiNi are coprime, there exists yiyi such
that Niyi≡1(modni)Niyi≡1(modni).

• The solution is:

x=∑i=1kaiNiyi(modN)x=i=1∑kaiNiyi(modN)

• This xx satisfies all the congruences, and any two solutions differ by a multiple
of NN5.

d) Advanced Encryption Standard (AES) and Its Functioning

• AES is a symmetric block cipher used worldwide to encrypt sensitive data.

• It operates on 128-bit blocks and supports key sizes of 128, 192, or 256 bits.
 • Number of rounds: 10 (128-bit key), 12 (192-bit key), 14 (256-bit key).

AES Functioning Steps:

1. Key Expansion: Generates round keys from the cipher key.

2. Initial Round: AddRoundKey (XOR state with round key).

3. Rounds (9/11/13 times):

• SubBytes (byte substitution using S-box)

• ShiftRows (row-wise permutation)

• MixColumns (column mixing for diffusion)

• AddRoundKey

4. Final Round: SubBytes, ShiftRows, AddRoundKey (no MixColumns).

Decryption: Inverse operations are applied to recover the plaintext.

e) Discrete Logarithmic Problem (DLP) with Example

• The DLP asks: Given a group GG, a generator gg, and an element hh in GG,
find the integer xx such that gx=hgx=h.

• In modular arithmetic: Given gg, hh, and prime pp, find xx such
that gx≡h(modp)gx≡h(modp).

Example:
Let p=17p=17, g=3g=3, h=13h=13. Find xx such that 3x≡13(mod17)3x≡13(mod17).
Try x=4x=4: 34=8134=81, 81mod 17=1381mod17=13.

So, x=4x=4 is a solution.

Importance:
The DLP is hard for large values, forming the basis for cryptosystems like Diffie-
Hellman and ElGamal.
f) Encryption Using Advanced Encryption Standard (AES) with Diagram

AES Encryption Process:

AES is a symmetric block cipher that encrypts data in fixed-size blocks of 128 bits
using keys of 128, 192, or 256 bits. The encryption process consists of multiple
rounds (10, 12, or 14 depending on key size), each including a series of well-defined
steps to ensure security.

Main Steps in AES Encryption:

1. Initial Round:
 • AddRoundKey: The plaintext block is XORed with the initial round key.

2. Main Rounds (Repeated 9/11/13 times):

• SubBytes: Each byte in the state matrix is replaced using a

substitution box (S-box) for non-linearity.

• ShiftRows: Each row in the state matrix is shifted cyclically to the left
by different offsets.

• MixColumns: Each column is mixed using a mathematical

transformation to spread the influence of each byte (not performed in
the final round).

• AddRoundKey: The state is XORed with a round key derived from the
main key.

3. Final Round:

• SubBytes

• ShiftRows

• AddRoundKey (no MixColumns)

AES Encryption Block Diagram:

text

+-------------------+

| Plaintext |

+-------------------+

+-------------------+

| AddRoundKey | <-- Initial Round

+-------------------+

+-------------------+

| SubBytes | <-- Round 1

+-------------------+
|
 v

+-------------------+

| ShiftRows |

+-------------------+
|

+-------------------+

| MixColumns |

+-------------------+

+-------------------+
| AddRoundKey |

+-------------------+

[Repeat Rounds]

|
v
+-------------------+

| SubBytes | <-- Final Round

+-------------------+

+-------------------+

| ShiftRows |
+-------------------+

|
v
+-------------------+

| AddRoundKey |

+-------------------+

|
v

+-------------------+

| Ciphertext |

+-------------------+

Summary:
AES uses a combination of substitution, permutation, and mixing operations in
several rounds, with each round using a different round key derived from the original
key. This structure provides strong security against cryptanalysis.

g) Extended Euclidean Algorithm with Example

The Extended Euclidean Algorithm not only computes the greatest common
divisor (gcd) of two integers aa and bb, but also finds integers xx and yy such that:

ax+by=gcd⁡(a,b)ax+by=gcd(a,b)

Steps:
1. Apply the Euclidean algorithm to find the gcd.

2. Work backwards to express the gcd as a linear combination of aa and bb.

Example:
Find xx and yy such that 240x+46y=gcd⁡(240,46)240x+46y=gcd(240,46):

• 240=46×5+10240=46×5+10

• 46=10×4+646=10×4+6

• 10=6×1+410=6×1+4
• 6=4×1+26=4×1+2

• 4=2×2+04=2×2+0

So, gcd⁡(240,46)=2gcd(240,46)=2.

Now, backtrack:

• 2=6−4×12=6−4×1
• 4=10−6×14=10−6×1
 • 6=46−10×46=46−10×4

• 10=240−46×510=240−46×5

Express 22 as a combination:

• 2=6−(10−6×1)=2×6−102=6−(10−6×1)=2×6−10
• 2=2×(46−10×4)−10=2×46−8×10−10=2×46−9×102=2×(46−10×4)−10=2×46−8
×10−10=2×46−9×10

• 2=2×46−9×(240−46×5)=2×46−9×240+45×46=47×46−9×2402=2×46−9×(240−
46×5)=2×46−9×240+45×46=47×46−9×240

Result: x=−9x=−9, y=47y=47, so 240×(−9)+46×47=2240×(−9)+46×47=229.

h) Principles of Public Key Cryptosystem

• Two Keys: Uses a pair of mathematically related keys—public (for

encryption/verification) and private (for decryption/signing).

• Asymmetric: Encryption and decryption use different keys; knowledge of the

public key does not reveal the private key.

• Key Distribution: Solves the key distribution problem of symmetric

cryptography by allowing public keys to be shared openly.

• Security: Security relies on the computational difficulty of certain

mathematical problems (like factoring large numbers or discrete logarithms).
• Digital Signatures: Enables authentication and non-repudiation by allowing
users to sign messages with their private key, which can be verified by
anyone with the public key.

• Ingredients: Plaintext, encryption algorithm, public key, private key,

ciphertext, decryption algorithm.

i) Discrete Logarithm Problem in Network Security and Related Algorithms

The Discrete Logarithm Problem (DLP) is:
Given a finite cyclic group GG, a generator gg, and an element hh in GG, find the
integer xx such that:

gx=hgx=h

or, in modular arithmetic, gx≡h(modp)gx≡h(modp).

Importance:
The DLP is considered computationally hard for large groups, forming the security
foundation for several cryptographic algorithms.

Algorithms Based on DLP:

• Diffie-Hellman Key Exchange

• ElGamal Encryption

• Digital Signature Algorithm (DSA)

• Elliptic Curve Cryptography (ECC).

j) Three Main Applications of Public Key Cryptosystems

1. Encryption/Decryption:

• Ensures confidentiality; messages encrypted with the recipient’s public

key can only be decrypted by their private key.

2. Digital Signatures:

• Provides authentication, integrity, and non-repudiation; a sender signs

a message with their private key, and anyone can verify it with the
public key.

3. Key Exchange:

• Securely establishes a shared secret key over an insecure channel

(e.g., Diffie-Hellman key exchange), which can be used for subsequent
symmetric encryption.

UNIT-3
a) Secure Hash Algorithm (SHA) to Generate Message Digest in Detail

The Secure Hash Algorithm (SHA) family (including SHA-1, SHA-2, and SHA-3) is
widely used to generate a fixed-size hash (message digest) from data of any length.
Here’s how SHA works to generate a message digest:

Steps in SHA (e.g., SHA-256 or SHA-512):

1. Padding the Message:

• The original message is padded so its length is congruent to a specific

value modulo the block size (e.g., 512 or 1024 bits).
 • Padding starts with a single ‘1’ bit, followed by enough ‘0’ bits, and
ends with a 64-bit representation of the original message length.

2. Parsing the Padded Message:

• The padded message is split into fixed-length blocks (e.g., 512 bits for
SHA-256, 1024 bits for SHA-512).

3. Setting Initial Hash Values:

• SHA uses a set of initial hash values (constants), which are derived
from the fractional parts of the square roots of prime numbers.

4. Processing Message Blocks:

• Each message block is processed in a series of rounds (64 for SHA-

256, 80 for SHA-512).

• In each round, the block undergoes a sequence of bitwise operations,

logical functions, modular additions, and mixing with constants.

• The result of each round updates the hash buffer, propagating changes
throughout the hash state (ensuring the avalanche effect).

5. Producing the Final Hash (Digest):

• After all blocks are processed, the final hash value is constructed by
concatenating the hash buffer’s contents.

• The output is a fixed-size hash (e.g., 256 or 512 bits), which serves as
the message digest.

Key Properties:

• Any change in the input (even a single bit) produces a completely different
hash (avalanche effect).

• The process is deterministic—same input always gives the same output.

• The hash is a one-way function: infeasible to reconstruct the original message

from the digest.

b) Role of Compression Function in Hash Function

The compression function is a core component of cryptographic hash functions. Its

main roles are:

• Reduces Input Size: It takes a fixed-size input (from the message block and
the current hash value) and compresses it into a smaller, fixed-size output.
 • Ensures Security: By mixing input data with the current hash state using
complex operations, it ensures that small changes in input lead to large,
unpredictable changes in output (avalanche effect).

• Enables Iterative Processing: The compression function allows the hash

function to process messages of any length by iteratively processing each
block and updating the hash state.

• Collision Resistance: Makes it difficult to find two different inputs that

produce the same output, a key property for secure hash functions.

c) Message Authentication Codes (MAC) and Authentication Requirements in

MAC

A Message Authentication Code (MAC) is a short piece of information (tag) used

to authenticate a message and ensure its integrity. MACs are generated and verified
using a secret key shared between sender and receiver.

How MAC Works:

• Key Generation: A secret key is generated and shared.

• MAC Generation: The sender computes a MAC tag for the message using
the key.

• Verification: The receiver recomputes the MAC using the same key and
checks if it matches the received tag. If it matches, the message is authentic.

Authentication Requirements for MAC:

• Data Origin Authentication: Confirms the message was sent by the
legitimate sender.

• Data Integrity: Ensures the message has not been altered in transit.
• Key Secrecy: Only parties with the secret key can generate or verify the
MAC.
• Resistance to Forgery: It must be computationally infeasible for an attacker
to create a valid MAC without the secret key.

MACs are widely used in network protocols (e.g., TLS, IPsec) for secure
communication.

d) Digital Signature Algorithm (DSA): Key Generation and Verification in Detail

Key Generation:
1. Select large primes pp and qq such that qq divides p−1p−1.
 2. Choose a generator gg of order qq modulo pp.

3. Select a random private key xx (where 1<x<q1<x<q).

4. Compute the public key y=gxmod py=gxmodp.

Signing:
1. Hash the message using a cryptographic hash function (e.g., SHA-256) to get
digest mm.

2. Select a random integer kk (where 1<k<q1<k<q).

3. Compute r=(gkmod p)mod qr=(gkmodp)modq.

4. Compute s=(k−1⋅(m+x⋅r))mod qs=(k−1⋅(m+x⋅r))modq.

5. The signature is the pair (r,s)(r,s).

Verification:
1. Receive the message, signature (r,s)(r,s), and public key yy.

2. Hash the message to get digest mm.

3. Compute w=s−1mod qw=s−1modq.

4. Compute u1=(m⋅w)mod qu1=(m⋅w)modq, u2=(r⋅w)mod qu2=(r⋅w)modq.

5. Compute v=((gu1⋅yu2)mod p)mod qv=((gu1⋅yu2)modp)modq.

6. If v=rv=r, the signature is valid; otherwise, it is invalid.

DSA ensures authenticity, integrity, and non-repudiation of digital messages.

e) Hash Functions and Working of SHA in Message Authentication

Hash Functions:

• A hash function takes an input of any length and produces a fixed-size string
(digest).

• Used to verify data integrity, create digital signatures, and support

authentication.
• Key properties: pre-image resistance, second pre-image resistance, collision
resistance, determinism, and efficiency.
Working of SHA in Message Authentication:

1. The sender computes the SHA hash of the message.

2. The hash (message digest) is sent along with the message or used in a digital
signature.
 3. The receiver computes the hash of the received message and compares it
with the received digest.

4. If the hashes match, the message is authentic and unaltered; otherwise, it has
been tampered with.

SHA is fundamental in protocols like TLS, digital certificates, and digital signatures to
ensure message authenticity and integrity.

f) Digital Signatures and Elgamal Digital Signature Technique

Digital Signatures:

A digital signature is a cryptographic scheme that verifies the authenticity and

integrity of digital messages or documents. It uses asymmetric cryptography, where
the sender signs a message using their private key, and anyone can verify the
signature using the sender’s public key. Digital signatures provide:

• Authentication: Confirms the sender’s identity.

• Integrity: Ensures the message hasn’t been altered.

• Non-repudiation: Prevents the sender from denying the signature later.

General Digital Signature Process:

1. Key Generation: Create a private key (kept secret) and a public key (shared).
2. Signing: Hash the message, then use the private key to generate a signature
on the hash.
3. Verification: The recipient uses the sender’s public key to verify the signature
against the message hash.

Elgamal Digital Signature Technique:

The Elgamal digital signature scheme is a public key algorithm that ensures
message authenticity and integrity. Here’s how it works:

1. Key Generation:

• Select a large prime number pp and a primitive root gg modulo pp.

• Choose a random private key xx such that 1≤x≤p−21≤x≤p−2.

• Compute the public key y=gxmod py=gxmodp.

• Public key: (p,g,y)(p,g,y), Private key: xx.
2. Signature Generation:

• For message mm, compute its hash H(m)H(m).

• Choose a random integer kk (with gcd⁡(k,p−1)=1gcd(k,p−1)=1).

• Compute r=gkmod pr=gkmodp.

• Compute s=k−1(H(m)−x⋅r)mod (p−1)s=k−1(H(m)−x⋅r)mod(p−1),

where k−1k−1 is the modular inverse of kk.

• The signature is the pair (r,s)(r,s).

3. Signature Verification:
• Compute H(m)H(m).

• Verify if yr⋅rs≡gH(m)mod pyr⋅rs≡gH(m)modp.

• If true, the signature is valid.

Properties:

• Message Integrity: Ensures the message wasn’t changed.

• Authentication: Confirms the signer’s identity.

• Non-repudiation: The signer cannot deny the signature.

Example:
Alice signs a message using her private key and sends both the message and
signature to Bob. Bob uses Alice’s public key to verify authenticity and integrity.

g) Direct Digital Signature vs. Arbitrated Digital Signature

Feature Direct Digital Signature Arbitrated Digital Signature

Third Party Not involved; only sender and Involves a trusted third party
Involvement receiver participate (arbiter or CA)

Signature Sender signs with their private Arbiter creates/validates the

Creation key signature

Receiver verifies using Receiver verifies using arbiter’s

Verification sender’s public key public key
 Feature Direct Digital Signature Arbitrated Digital Signature

Requires trust between sender

Trust Model and receiver Trust is placed in the third party

Higher (arbiter verifies identity

Security Level Lower (no external validation) and integrity)

Peer-to-peer, trusted Finance, legal, healthcare—high

Use Cases environments assurance needed

Higher (third party services

Cost Lower (no third party fees) required)

Direct Digital Signature:

• Only sender and receiver are involved.

• Sender signs message/hash with their private key; receiver verifies with
sender’s public key.
• Used where parties trust each other.

Arbitrated Digital Signature:

• Involves a trusted third party (like a Certificate Authority).

• Sender sends message and hash to the arbiter, who signs it with their private
key.

• Receiver verifies using arbiter’s public key.

• Used where high trust and legal assurance are needed.

h) Steps in Message Digest Generation in Secure Hash Algorithm (SHA)

1. Message Padding:
• The message is padded so its length is a multiple of the block size
(e.g., 1024 bits for SHA-512).
• Padding includes a ‘1’ bit, followed by ‘0’s, and the original message
length at the end.

2. Initialization:
• Set initial hash values (constants derived from prime numbers).
 3. Parsing:

• Divide the padded message into fixed-size blocks (e.g., 1024 bits).

4. Processing (Main Loop):

• For each block, perform multiple rounds (e.g., 80 rounds for SHA-512)
of bitwise operations, logical functions, and modular arithmetic to mix
the data.

5. Final Hash Value:

• After all blocks are processed, the output is a fixed-length message

digest (e.g., 512 bits for SHA-512).

6. Output:

• The message digest (hash) uniquely represents the original message.

i) Digital Signature Scheme (DSS) and Digital Signature Algorithm (DSA)

Digital Signature Standard (DSS):

• Developed by the U.S. National Institute of Standards and Technology (NIST)

for authenticating electronic documents.

• Specifies approved digital signature algorithms, including DSA, RSA, and

ECDSA.

• Uses a hash function to produce a message digest, which is then signed

using a private key.

• The signature is verified using the corresponding public key.

Digital Signature Algorithm (DSA):

• The original algorithm specified in DSS.

• Uses domain parameters (prime modulus pp, prime divisor qq, generator gg),
a private key xx, and public key yy.

• Signature generation involves hashing the message, generating a random

value kk, and computing signature values rr and ss.

• Signature verification checks the validity of rr and ss using the public key and
the hash of the message.

j) Purpose, Properties, and Requirements of Digital Signature

Purpose:
 • To verify the authenticity of the sender.

• To ensure the integrity of the message.

• To provide non-repudiation, so the sender cannot deny having sent the

message.

Properties:

• Authenticity: Confirms the signer’s identity.

• Integrity: Detects any changes to the message.

• Non-repudiation: Prevents the signer from denying the signature.

• Unforgeability: Only the private key holder can create a valid signature.

• Time-stamping: Can record the time of signing.

Requirements:

• Signature must be unique to the sender and message.

• Must be computationally infeasible to forge or alter.

• Should be easy to generate and verify.

• Secure storage and management of keys and signatures.

Digital signatures are essential for secure digital communication, legal transactions,
and document management, providing high assurance of identity, integrity, and non-
repudiation.

UNIT-4
a) Sequence of Steps in Message Generation and Reception in Pretty Good
Privacy (PGP) with Block Diagram

PGP Message Generation Steps:

1. Compression: The original message is compressed to reduce size and

enhance security.

2. Session Key Generation: A random session key is generated for a

symmetric cipher (e.g., AES).

3. Symmetric Encryption: The compressed message is encrypted using the

session key.

4. Public Key Encryption of Session Key: The session key is encrypted using
the recipient’s public key (asymmetric encryption).
5. Digital Signature (Optional): The sender may create a hash of the original
message and sign it with their private key to ensure authenticity and integrity.
 6. Packaging: The encrypted message, encrypted session key, and digital
signature are combined into a single package for transmission.

PGP Message Reception Steps:

1. Session Key Decryption: The recipient uses their private key to decrypt the
session key.

2. Message Decryption: The encrypted message is decrypted using the

recovered session key.

3. Decompression: The decrypted message is decompressed to obtain the

original plaintext.

4. Signature Verification (if present): The recipient verifies the digital signature
using the sender’s public key.

Block Diagram:

text

Sender Side: Receiver Side:

+-------------+ +-------------+

| Plaintext | | Received |
+-------------+ | Message |

| +-------------+

v |

[Compression] v

| [Session Key Decryption]

v |

[Hash & Sign (optional)] v

| [Message Decryption]
v |

[Symmetric Encryption] v

| [Decompression]

v |

[Encrypt Session Key] v

| [Signature Verification]
v |
[Package & Send] v

| +-------------+

v | Plaintext |

+-------------+ +-------------+

b) Obtaining a User Certificate from Another Certification Authority in X.509

Scheme (with Example)
Process:

1. User Registration: The user (Alice) applies for a certificate from a

Certification Authority (CA).

2. Identity Verification: The CA verifies Alice’s identity using documents or

other means.
3. Key Pair Generation: Alice generates a public-private key pair.

4. Certificate Signing Request (CSR): Alice creates a CSR containing her

public key and identification details, and sends it to the CA.

5. Certificate Issuance: The CA signs Alice’s public key and details with its
private key to create an X.509 certificate.

6. Certificate Distribution: The CA sends the signed certificate to Alice, who

can now use it to prove her identity.
Example:
Alice wants a certificate from CA2, but she already has a certificate from CA1. CA2
verifies Alice’s identity, receives her CSR, and issues a new certificate signed by
CA2’s private key. Alice can now use both certificates as needed, and users trusting
CA2’s public key can verify her identity using the new certificate.

c) Kerberos and Differences Between Kerberos V4 and Kerberos V5

Kerberos:
A network authentication protocol designed to provide secure authentication for
users and services in an insecure network. It uses secret-key cryptography and a
trusted third party (Key Distribution Center, KDC).

Kerberos V4 vs. Kerberos V5:

 Feature Kerberos V4 Kerberos V5

Protocol Support Only IPv4 IPv4, IPv6, and other protocols

Encryption Limited to DES Supports multiple encryption types

Ticket Lifetime Fixed, not flexible Configurable and flexible

Cross-Realm Auth. Limited and complex Improved and standardized

Message Format Proprietary, less extensible Uses ASN.1, highly extensible

Delegation Not supported Supports proxy and forwarding

Pre-authentication Not required Required for better security

d) Diffie-Hellman Key Exchange Algorithm

Purpose:
Allows two parties to securely establish a shared secret over an insecure channel.
Steps:

1. Both agree on a large prime number pp and a primitive root gg.

2. Alice selects a secret aa, computes A=gamod pA=gamodp, and sends AA to

Bob.

3. Bob selects a secret bb, computes B=gbmod pB=gbmodp, and sends BB to

Alice.

4. Alice computes shared key: K=Bamod pK=Bamodp.

5. Bob computes shared key: K=Abmod pK=Abmodp.

6. Both arrive at the same shared secret KK.

Security:
An eavesdropper cannot compute KK without knowing aa or bb.

e) Authentication Procedure and Types

Authentication Procedure:
The process of verifying a user’s or device’s identity before granting access to
resources. It usually follows these steps:

1. Identification: User provides an identifier (e.g., username).

2. Authentication: User proves identity (e.g., password, token).

3. Authorization: System grants access if authentication is successful.

Types of Authentication:

One-Way Authentication:

• Only one party (usually the client) is authenticated to the other (the server).
• Example: Logging into a website with username and password.

Two-Way Authentication (Mutual Authentication):

• Both parties authenticate each other before communication.

• Example: Client and server both verify each other’s certificates in SSL/TLS.

Three-Way Authentication (Three-Factor Authentication, 3FA):

• Uses three different authentication factors: something you know (password),

something you have (token), and something you are (biometrics).

• Example: Logging in with a password, entering a code from a hardware token,

and fingerprint scan.

These layered authentication methods provide increasing levels of security for

sensitive systems and data.

f) Operations Description of PGP and Its Services

Operations of PGP:
Pretty Good Privacy (PGP) is a security program used for encrypting and decrypting
emails, files, and other data, as well as for digital signature verification. PGP
combines symmetric and asymmetric encryption, data compression, and hashing to
provide robust security for digital communications.
PGP Operation Steps:

1. Message Creation: The sender writes the message to be sent.

2. Hashing: The message is hashed (e.g., with SHA-1) to create a message

digest for integrity and digital signature purposes.

3. Digital Signature (Optional): The sender’s private key is used to encrypt the
hash, creating a digital signature attached to the message for authentication.
 4. Compression: The message (and signature, if present) is compressed to
save space and add an extra layer of security.

5. Session Key Generation: A random session key is generated for symmetric

encryption (e.g., CAST-128, IDEA, or 3DES).

6. Symmetric Encryption: The compressed message is encrypted with the

session key.

7. Session Key Encryption: The session key is encrypted using the recipient’s
public key (asymmetric encryption).

8. Packaging: The encrypted session key and encrypted message are bundled
together and sent to the recipient.

At the Receiver’s End:

1. Session Key Decryption: The recipient uses their private key to decrypt the
session key.
2. Message Decryption: The session key decrypts the message.

3. Decompression: The message is decompressed.

4. Signature Verification: If a signature is present, the recipient uses the

sender’s public key to verify the digital signature and the message hash.

Block Diagram:

text

Sender Side: Receiver Side:

Plaintext Encrypted data received

| |

[Hash] (optional) v

| [Decrypt session key with private key]

[Sign with private key] v

| [Decrypt message with session key]

[Compress] v

| [Decompress]

[Encrypt with session key] v

| [Verify digital signature]
[Encrypt session key with public key] v
 | Plaintext recovered

[Send]

PGP Services:

• Authentication: Uses digital signatures to verify sender identity and message

integrity.

• Confidentiality: Encrypts messages and files so only intended recipients can

read them.

• Data Integrity: Ensures messages have not been altered in transit through
hashing and signature verification.

• Compression: Reduces message size and adds extra security.

• Email and File Security: Used for secure email, file encryption, digital
signatures, and more.

g) What is PGP? How Does PGP Maintain Authentication and Confidentiality?

What is PGP?
Pretty Good Privacy (PGP) is an encryption and decryption system that provides
cryptographic privacy and authentication for data communication. It is widely used
for securing emails, files, and digital signatures.

How PGP Maintains Authentication:

• Digital Signatures: PGP uses the sender’s private key to sign a hash of the
message. The recipient can verify the signature using the sender’s public key,
ensuring the message is authentic and unaltered.

• Hash Functions: The message is hashed before signing, so even a small

change in the message will result in a different hash, alerting the recipient to
tampering.

How PGP Maintains Confidentiality:

• Hybrid Encryption: PGP uses a randomly generated symmetric session key

to encrypt the message. This session key is then encrypted with the
recipient’s public key and sent along with the message.
• Public/Private Key Pair: Only the recipient’s private key can decrypt the
session key, ensuring that only the intended recipient can access the
message content.

Summary:
PGP ensures that only authorized recipients can read the message (confidentiality)
and that the sender’s identity and message integrity are verifiable (authentication)3.
h) X.509 Certificates with Diagram

X.509 Certificate Overview:

An X.509 certificate is a digital document that uses the X.509 standard to associate a
public key with an entity’s identity (e.g., a user, website, or device).

Key Components:

• Version Number: Indicates the X.509 version.

• Serial Number: Unique identifier for the certificate.

• Signature Algorithm: Algorithm used by the CA to sign the certificate.

• Issuer: The Certificate Authority (CA) that issued the certificate.

• Validity Period: Start and end dates for certificate validity.

• Subject: The entity to which the certificate is issued.

• Subject Public Key Info: The public key and algorithm.

• Extensions: Additional information (e.g., usage, alternative names).

• Digital Signature: The CA’s signature authenticating the certificate.

How X.509 Certificates Work:

1. The entity generates a key pair and submits a certificate request to a CA.

2. The CA verifies the identity and issues a certificate, signing it with its private
key.
3. The certificate is distributed and used for secure communication.

4. Recipients verify the certificate using the CA’s public key.

Diagram:

text

+---------------------------------------------------+

| X.509 Certificate |

|---------------------------------------------------|
| Version | Serial Number |

| Signature Alg. | Issuer |

| Validity Period | Subject |

| Subject Public Key| Extensions |
| Digital Signature (by CA) |

+---------------------------------------------------+

i) S/MIME Explained in Detail

S/MIME (Secure/Multipurpose Internet Mail Extensions):
S/MIME is a widely adopted protocol for securing email communications through
encryption and digital signatures.

How S/MIME Works:

• Public Key Infrastructure (PKI): S/MIME uses digital certificates issued by

trusted Certificate Authorities (CAs) to bind public keys to user identities.

• Encryption: Before sending an email, the sender retrieves the recipient’s

public key from their S/MIME certificate and uses it to encrypt the email. Only
the recipient’s private key can decrypt it.

• Digital Signing: The sender can sign the email with their private key. The
recipient uses the sender’s public key (from the certificate) to verify the
signature, ensuring authenticity and integrity.

• Certificate Validation: S/MIME clients check certificate validity, revocation

status, and trust chain to ensure security.

Types of S/MIME Certificates:

• Mailbox Validated (MV): Minimal verification, suitable for basic needs.

• Organization Validated (OV): Includes organization details, higher trust.

• Individual Validated (IV): For individuals, proves identity.

• Sponsor Validated (SV): For linking emails to individuals in organizations.

Benefits:
• Confidentiality, authenticity, integrity, and non-repudiation for email.

• Supports encryption of not just text but also attachments and multimedia.

j) Intrusion Detection System (IDS) Explained with Example

What is an IDS?
An Intrusion Detection System (IDS) is a network security tool that monitors network
traffic or host activity to detect malicious activity, suspicious behavior, or policy
violations.
How IDS Works:
 • Signature-Based Detection: Compares network or system activity against a
database of known attack patterns (signatures). If a match is found, it triggers
an alert.

• Anomaly-Based Detection: Establishes a baseline of normal activity and

flags deviations as potential threats. Useful for detecting new or unknown
attacks.

• Hybrid IDS: Combines both methods for greater effectiveness.

Types of IDS:

• Network-based IDS (NIDS): Monitors network traffic at strategic points (e.g.,

behind firewalls).

• Host-based IDS (HIDS): Monitors activity on individual devices or servers.

Example:

• Snort: A popular open-source NIDS that analyzes real-time network traffic for
suspicious patterns.

• Suricata: Another open-source IDS/IPS tool that supports both signature and
anomaly detection.

Function:

• When suspicious activity is detected, the IDS generates alerts for security
teams, logs incidents, and helps organizations respond to threats quickly.

Summary:
IDS plays a critical role in identifying and alerting on network or system intrusions,
supporting compliance, and strengthening overall cybersecurity defenses.

UNIT-5
a) IPSec Protocols in Detail, Applications, and Advantages

IPSec (Internet Protocol Security) is a suite of protocols that secures data

transmitted over IP networks by providing authentication, integrity, and confidentiality
at the network layer.

Key IPSec Protocols

• Authentication Header (AH):

• Provides data integrity, data origin authentication, and optional replay

protection.

• Authenticates the entire IP packet (except mutable fields like TTL).

 • Does not provide encryption (no confidentiality), only authentication
and integrity.

• Encapsulating Security Payload (ESP):

• Provides confidentiality (encryption), as well as optional authentication,

integrity, and replay protection.

• Encrypts the payload of the IP packet and can optionally authenticate

it.

• Can be used with or without authentication, but using encryption

without authentication is discouraged.

• Internet Key Exchange (IKE):

• Used for negotiating, establishing, and managing Security Associations

(SAs) and cryptographic keys.

• IKE operates in two phases: Phase 1 establishes a secure channel;

Phase 2 negotiates SAs for data transfer.

• IKE uses the Diffie-Hellman key exchange for secure key negotiation.

• ISAKMP (Internet Security Association and Key Management Protocol):

• Framework for key exchange and SA negotiation, often used as part of

IKE.

How IPSec Works (Steps)

1. Host Recognition: System identifies traffic that needs IPSec protection.

2. Negotiation (IKE Phase 1): Hosts authenticate and set up a secure channel
for negotiation.

3. IPSec Circuit (IKE Phase 2): Hosts agree on encryption/authentication

algorithms and exchange keys.

4. IPSec Transmission: Data is securely transmitted using established SAs.

5. IPSec Termination: Tunnel ends after a set time or data volume; keys are
discarded.

Applications of IPSec
• Virtual Private Networks (VPNs): Secure remote access, site-to-site, and
extranet VPNs.
• Secure Data Transmission: Protects data between servers, clients, and
devices.
 • Voice over IP (VoIP): Secures voice communications over IP networks.

• Secure Web Communication: Encrypts and authenticates web traffic.

• Internet of Things (IoT): Secures device-to-device communications.

• Secure Email and File Transfer: Protects email and file transfer protocols
(SMTP, FTP, SFTP).

• Remote Management: Secures protocols like SSH and RDP for

administrative access.

Advantages of IPSec
• Comprehensive Security: Provides authentication, integrity, and
confidentiality at the IP layer.

• Application-Independent: Works for all IP-based applications without

modification.

• Transparent to Users: No changes needed at the user or application level.

• Scalable: Can be deployed across LANs, WANs, and the internet.

• Fine-Grained Security: Allows per-flow or per-connection security.

• Replay Protection: Prevents attackers from reusing captured packets.

• Automated Key Management: Simplifies cryptographic key handling through

IKE.

b) Protocols Used in SSL and IPSec ESP Format

Protocols Used in SSL

• Handshake Protocol: Establishes the secure connection, negotiates

encryption algorithms, and authenticates parties.

• Change Cipher Spec Protocol: Signals the transition to encrypted

communication.

• Alert Protocol: Communicates errors and session termination.

• Record Protocol: Handles the fragmentation, compression, encryption, and

transmission of data.

SSL uses digital certificates for authentication and establishes a secure, encrypted
channel (HTTPS for web traffic).
IPSec ESP Format (with Diagram and Explanation)

ESP (Encapsulating Security Payload) Format:

text

+-------------------+-------------------+-------------------+-------------------+
| Security Parameters Index (SPI) (32 bits) |

+-------------------+-------------------+-------------------+-------------------+

| Sequence Number (32 bits) |

+-------------------+-------------------+-------------------+-------------------+

| Payload Data (variable) |

+-------------------+-------------------+-------------------+-------------------+

| Padding (0-255 bytes) | Pad Length (8 bits) | Next Header (8 bits) |

+-------------------+-------------------+-------------------+-------------------+
| Integrity Check Value (ICV, variable, optional) |

+-------------------+-------------------+-------------------+-------------------+

Field Descriptions:

• SPI: Identifies the security association.

• Sequence Number: Protects against replay attacks.

• Payload Data: Encrypted data (original IP packet payload).

• Padding/Pad Length: Ensures data aligns with encryption block size.
• Next Header: Indicates the type of data (e.g., TCP, UDP).

• ICV: Optional field for integrity/authentication.

ESP can be used in transport mode (encrypts only payload) or tunnel mode
(encrypts entire IP packet).

c) Working Structure and Applications of Firewall

Working Structure of Firewall

• Traffic Filtering: Inspects incoming and outgoing network packets based on

rules.

• Rule-Based Decisions: Allows or blocks traffic based on IP addresses, ports,

protocols, and application data.
 • Types of Inspection: Packet filtering, stateful inspection, deep packet
inspection, and proxying.

• Zones and Interfaces: Segregates network into security zones; controls

traffic between them.

• Access Control Lists (ACLs): Define what traffic is permitted or denied.

Typical Steps:

1. Packet arrives at the firewall.

2. Firewall examines packet header and content.

3. Compares with rule set (ACLs).

4. Decides to allow, block, or log the packet.

5. May require authentication or NAT translation.

Applications of Firewall

• Network Perimeter Security: Blocks unauthorized external access.

• Content Filtering: Restricts access to malicious or inappropriate websites.

• Intrusion Prevention: Detects and blocks suspicious activities.

• Data Loss Prevention: Prevents sensitive data from leaving the network.

• VPN Support: Facilitates secure remote connections.

• Segmentation: Divides network into secure zones for better control.

d) How Firewalls Prevent Intrusions

• Traffic Analysis: Monitors all incoming and outgoing packets for suspicious
patterns.

• Rule Enforcement: Blocks traffic that violates security policies.

• Session Monitoring: Tracks ongoing connections (stateful inspection) to

detect anomalies.

• Application Layer Filtering: Inspects application data for malicious content.

• Logging and Alerts: Records security events and notifies administrators of

threats.

• Anti-Spoofing and NAT: Prevents attackers from masquerading as trusted

sources.
 Firewalls act as barriers, only allowing trusted traffic and blocking potentially harmful
data, thus preventing intrusions.
Type Description Configuration/Deployment

Inspects headers (IP,

port, protocol) to Simple rule sets; stateless;
Packet Filtering allow/block traffic. fast.

Tracks active
connections and session Maintains session tables;
Stateful Inspection state. more secure.

Intercepts all traffic at

Proxy/Application application layer; can Acts as intermediary; deep
Gateway inspect content. inspection.

Monitors TCP
Circuit-Level handshakes, ensures Checks session setup, not
Gateway session legitimacy. packet data.

Integrates deep packet

inspection, intrusion
Next-Generation prevention, and Advanced; often cloud-based
Firewall (NGFW) application awareness. or hybrid.

Hides internal IP
addresses, prevents
direct access from Translates addresses;
NAT Firewall outside. enhances privacy.

Installed on individual
devices for granular
Host-Based Firewall control. Per-device configuration.

Delivered as a service,
Cloud-Based scalable for distributed
Firewall environments. Managed via cloud consoles.

e) Types of Firewalls and Their Configuration

Configuration Best Practices:

 • Define security zones and assign interfaces.

• Set up granular ACLs for each interface.

• Use “deny all” as a default rule.

• Regularly update firmware and rules.

• Disable unused services and management interfaces.

• Enable logging and monitoring for compliance and threat detection.

Firewalls are essential for layered security, protecting networks from a wide range of
threats by filtering, monitoring, and controlling traffic at multiple layers.

f) Encapsulating Security Payloads (ESP) and Combining Security

Associations

Encapsulating Security Payload (ESP):

• ESP is a core protocol within IPSec that provides confidentiality, data origin
authentication, connectionless integrity, and optional anti-replay protection for
IP packets.
• How ESP Works:

• ESP encrypts the payload (data portion) of the IP packet, ensuring that
only the intended recipient can read the data.

• Optionally, ESP can also provide authentication and integrity by adding

an Integrity Check Value (ICV) to ensure the data hasn’t been
tampered with.

• ESP does not protect the IP header unless used in tunnel mode, where
the entire original IP packet is encapsulated within a new IP header.

• ESP format includes fields such as Security Parameters Index (SPI),

Sequence Number, Payload Data, Padding, Pad Length, Next Header,
and optional Authentication Data (ICV).
ESP Format Diagram:

text

+-------------------+-------------------+

| ESP Header | |
| (SPI, Seq No.) | |

+-------------------+-------------------+
| Encrypted Payload Data (variable) |
+-------------------+-------------------+

| Padding | Pad Length | Next Header |

+-------------------+-------------------+

| Authentication Data (optional) |

+-------------------+-------------------+

Combining Security Associations (SAs):

• An individual Security Association (SA) implements either the AH

(Authentication Header) or ESP protocol, but not both.

• Sometimes, a traffic flow may require multiple IPSec services (e.g., both
authentication and encryption, or different protections between hosts and
gateways). In these cases, multiple SAs must be applied to the same traffic
flow, forming a security association bundle.

• Methods of Combining SAs:

• Transport Adjacency: Multiple security protocols (e.g., AH and ESP)

are applied to the same IP packet without tunneling. This allows a
single packet to be processed by more than one IPSec protocol at the
destination.

• Iterated Tunneling: Multiple layers of security protocols are applied by

nesting tunnels. For example, a packet can be tunneled through
multiple IPSec gateways, each applying its own SA.

Summary Table:

Method Description

Transport Adjacency Multiple protocols applied to the same packet (no tunneling)

Iterated Tunneling Multiple tunnels, each with its own set of SAs

These mechanisms allow IPSec to provide flexible, layered security tailored to

different network architectures and security requirements.

g) Secure Electronic Transaction (SET) with Diagram

Overview:
 • Secure Electronic Transaction (SET) is a protocol designed to secure credit
card transactions over the Internet, ensuring confidentiality, integrity, and
authentication for all participants in an online payment.

Key Features:

• Uses public key infrastructure (PKI) for digital certificates and digital
signatures.

• Ensures that sensitive payment information (like credit card numbers) is

encrypted and never revealed to unauthorized parties, not even to merchants.

• Employs dual signatures to separately encrypt order and payment information

for the merchant and the bank.

Participants:

• Cardholder (Customer)

• Merchant

• Issuer (Customer’s Bank)

• Acquirer (Merchant’s Bank)

• Payment Gateway
• Certification Authority (CA)

SET Transaction Flow (with Diagram):

text

Customer Merchant Payment Gateway Issuer/Acquirer

| | | |

1. |---Order+Payment->| | |

| | | |

2. | |---Payment Info--->| |
| | | |

3. | | |---Authorization----->|

| | | |

4. | | |<--Authorization------|

| |<--Confirmation----| |

5. |<--Order Confirm-| | |
How SET Works:
 1. Initialization: Customer and merchant register with a CA and receive digital
certificates.

2. Purchase: Customer selects goods and sends order + payment info (order for
merchant, payment for bank) encrypted with respective public keys.

3. Authorization: Merchant forwards payment info to payment gateway, which

verifies with the issuer.

4. Confirmation: Merchant receives authorization, completes the order, and

sends confirmation to the customer.

5. Settlement: Acquirer settles payment with the issuer.

Security Mechanisms:

• Digital Certificates: Authenticate all parties.

• Encryption: Protects payment and order information.

• Digital Signatures: Ensure authenticity and integrity.

• Dual Signature: Keeps order and payment information confidential from

unauthorized parties.

h) Architecture of Distributed Intrusion Detection System (DIDS) with Diagram

Overview:

• A Distributed Intrusion Detection System (DIDS) consists of multiple IDS

agents distributed across a network, working together to detect and respond
to security threats.
• DIDS combines local monitoring (at hosts and network segments) with
centralized or hierarchical analysis.

Typical DIDS Architecture:

• Agents: Deployed on hosts or network segments, monitoring local events and
traffic.
• Analyzer/Controller Nodes: Aggregate and analyze data from multiple
agents.

• Central Analyzer and Controller (CAC): The core component, aggregating

alerts, identifying attack patterns, and supporting incident response.

Hierarchical DIDS Architecture Diagram:

text
+------------------+
| Central Analyzer |

| & Controller |

+--------+---------+

|
+------+------+------+

| | |

+-----+ +-----+ +-----+

| IDS | ... | IDS | | IDS |

+-----+ +-----+ +-----+

(Agents on hosts or network segments)

• Data Flow: Agents detect suspicious activity and send alerts up to

analyzer/controller nodes, which aggregate and analyze the data for
coordinated response.

i) Role and Benefits of Intrusion Detection System (IDS)

Role of IDS:
• Monitors network or system activity for malicious actions or policy violations.

• Detects and alerts on suspicious behavior, potential attacks, or unauthorized

access.
Three Key Benefits of IDS:

1. Early Threat Detection:

IDS provides real-time monitoring and can identify threats before they
escalate into serious incidents, allowing organizations to respond proactively.

2. Improved Incident Response:

By generating alerts and providing detailed information about suspicious
activity, IDS helps security teams prioritize and respond to incidents quickly
and effectively.

3. Enhanced Security Visibility:

IDS offers comprehensive insights into network traffic and system activity,
helping organizations identify vulnerabilities, comply with regulations, and
maintain a strong security posture.

j) Participants of SET System and Their Roles

Main Participants in Secure Electronic Transaction (SET):

Participant Role

The customer making a purchase with a credit card. Initiates

Cardholder transactions and encrypts payment info.

The business selling goods/services. Receives order info,

Merchant authenticates with a digital certificate.

The bank/financial institution that issued the card to the cardholder.

Issuer Authenticates and authorizes transactions.

The bank/financial institution that processes payments for the

Acquirer merchant. Receives and settles payment requests.

Intermediary that securely processes payment info between

Payment Gateway merchant and acquirer, handling authorization and settlement.

Certificate Trusted third party that issues digital certificates to all participants,
Authority (CA) ensuring authenticity and trust.

Detailed Explanation:

• Cardholder: Initiates the transaction, encrypts payment info with the

merchant’s public key, and uses digital certificates for authentication.
• Merchant: Provides goods/services, verifies cardholder’s certificate, and
forwards payment info to the payment gateway.
• Issuer: Verifies the cardholder’s identity and authorizes or declines the
transaction.

• Acquirer: Processes the payment on behalf of the merchant and settles

funds.

• Payment Gateway: Handles secure transmission of payment data,

communicates with issuer and acquirer for authorization.

• Certificate Authority: Issues and manages digital certificates for all parties,
ensuring secure and authenticated transactions.

These participants work together to ensure SET transactions are confidential,

authenticated, and protected from fraud.