AR ENGINEERING COLLEGE

DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING

CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

UNIT I - INTRODUCTION TO SECURITY

Computer Security Concepts – The OSI Security Architecture – Security Attacks – Security Services and
Mechanisms – A Model for Network Security – Classical encryption techniques: Substitution techniques,
Transposition techniques, Steganography – Foundations of modern cryptography: Perfect security – Information
Theory – Product Cryptosystem – Cryptanalysis.

PART - A
1. What is the OSI security architecture?
 The OSI (open system interconnection) security architecture provides a systematic framework for
defining security attacks, mechanisms and services.
2. Difference between passive and active attacks. (NOV/DEC 2020)

S.NO PASSIVE ATTACKS ACTIVE ATTACKS

In a passive attack, Modification in the In an active attack, Modification in
1
information does not take place. information takes place.
Passive Attack is a danger Active Attack is a danger to Integrity as
2
to Confidentiality well as availability.
While in passive attack attention is on In an active attack, attention is on
3
detection. prevention.
While due to passive attack, there is no Due to active attacks, the execution system
4
harm to the system. is always damaged.
5 Very difficult to detect. Can be easily detected.

6 Complexity is low. Complexity is High

Table 1.1 – Difference between Passive and Active Attacks

3. List the categories of passive attacks. [NOV/DEC 2017]
 Release of message contents
 Traffic analysis

Page 1
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

4. List the categories of active attacks. [NOV/DEC 2017]

 Masquerade
 Replay
 Modification of massage
 Denial of service
5. List the categories of security services.
 Authentication
 Access control
 Data confidentiality
 Data integrity
 Non repudiation
6. List the categories of security mechanisms.
 Specific security mechanism
 Pervasive security mechanism
7. What are the essential ingredients of a symmetric cipher?
A symmetric cipher encryption has five ingredients. They are:
• Plaintext
• Encryption algorithm
• Secret key
• Cipher text
• Decryption algorithm
8. What are the two basic functions used in encryption algorithms?
The two basic functions used in encryption algorithms are,
• Substitution
• Transposition
9. How many keys are required for two people to communicate via a cipher?
 If both sender and receiver use the same key, the system is referred to as symmetric, single key, secret
key, or conventional encryption. (Single key)
 If the sender and receiver each use a different key, the system is referred to as asymmetric, two-key, or
public-key encryption. (multiple keys)

Page 2
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

10. List out the difference between a block cipher and a stream cipher.
S.NO BLOCK CIPHER STREAM CIPHER
Block cipher Converts the plain text into Stream cipher Converts the plain text into
1 cipher text by taking plain text’s block at cipher text by taking 1 byte of plain text at a
a time. time.
Block cipher uses either 64 bits or more
2 While stream cipher uses 8 bits.
than 64 bits.
The complexity of block cipher is
3 simple. While stream cipher is more complex.

Block cipher Uses confusion as well as

4 While stream cipher uses only confusion.
diffusion.
In block cipher, reverse encrypted text is While in-stream cipher, reverse encrypted
5
hard. text is easy.
Table 1.2 – Difference between block cipher and stream cipher
11. What are the two approaches to attacking a cipher?
The two approaches to attack a cipher are:
• Cryptanalysis
• Brute-force attack
12. Briefly define the Caesar cipher. (NOV/DEC 2012) (NOV/DEC 2013)
 The Caesar cipher involves replacing each letter of the alphabet with the letter standing:
 Three places further down the alphabet. For example:
 Plain: meet me after the toga party
 Cipher: PHHW PH DIWHU WKH WRJD SDUWB
13. What are the two problems with one-time pad?
 It makes the problem of making large quantities of random keys.
 It also makes the problem of key distribution and protection.

Page 3
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

14. What is the difference between an unconditionally secure cipher and a computationally secure cipher?
S.No Unconditionally Secure Cipher Computationally Secure Cipher
An unconditionally secure cipher is a scheme A computationally secure scheme is such
such that if the cipher text generated by the that the cost of breaking the cipher exceeds
scheme does not contain enough information the value of the encrypted information and
1
to determine uniquely the corresponding plain the time required to break the cipher
text, no matter how much cipher text is exceeds the useful lifetime of the
available information.
The cipher cannot be broken no matter how The cipher cannot be broken given limited
2
much computer power or time is available computing resources
Ex: The only example is OTP (one time
3 Ex: DES,AES,RC4,etc.,
passwords)
Table 1.3 – Unconditionally secure cipher vs. computationally secure cipher
15. Briefly define the Playfair cipher. (MAY /JUNE 2011)
The Playfair cipher treats the diagrams in the plaintext as single units and translates these units
into cipher text diagrams.
 This algorithm is based on the use of a 5 by 5 matrix of letters constructed using keyword.
Consider keyword as monarchy.
 The matrix is constructed by filling in the letters of the keyword from left to right and from top
to bottom, and then filling in the remainder of the matrix with the remaining letters. The letters
I, J count as one letter
M O N A R
C H Y B D
E F G I/J K
L P Q S T
U V W X Z
The rules to be followed are:
 Repeating plaintext letters that come in the same pair are separated with a filer letter, such as x.
 Plaintext letters that fall in the same row are replaced by the letter to the right, with the first
element of the row circularly following the first.
 Plaintext letters that fall in the same column are replaced by the letter beneath, with the top
element circularly following the last.
 Otherwise each letter is replaced by the letter that lies in its own row and the column occupied by
the other plaintext.

Page 4
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

16. What is a transposition cipher? (NOV/DEC 2013)

 Transposition cipher is a cipher, which is achieved by performing some sort of permutation on the
plaintext letters.
Example: Plain text: meet me after the toga party
17. What is Steganography? (MAY/JUNE 2013)
 In stenography the plain text is hidden. The existence of the message is concealed. For example the
sequence of first letters of each word of the overall message in the hidden message.
18. Explain the avalanche effect. (NOV/DEC 2012)
 It is that a small change in either the plaintext or the key should produce a significant change in the
cipher text. A change in one of the bit of the plaintext or one bit of the key should produce a change
in many bits of the cipher text.
19. List the types of cryptanalytic attacks.
• Cipher text only attack
• Known plaintext attack
• Chosen plaintext attack
• Chosen cipher text attack
• Chosen text attack
20. What is the difference between a mono alphabetic cipher and a poly alphabetic cipher?
(NOV/DEC 2012)
S.No Mono Alphabetic Cipher Poly Alphabetic Cipher
Monoalphabetic cipher is one where Polyalphabetic cipher is any cipher
1 each symbol in plain text is mapped based on substitution, using multiple
to a fixed symbol in cipher text. substitution alphabets.
The relationship between a character The relationship between a character in
2 in the plain text and the characters in the plain text and the characters in the
the cipher text is one-to-one. cipher text is one-to-many.
It includes additive, multiplicative, It includes autokey, Playfair, Vigenere,
3 affine and monoalphabetic Hill, one-time pad, rotor, and Enigma
substitution cipher. cipher.
4 It is a simple substitution cipher. It is multiple substitutions cipher.
Monoalphabetic ciphers are not that Polyalphabetic ciphers are much
5 strong as compared to polyalphabetic stronger.
cipher.
Table 1.4 – Mono Alphabetic vs. Poly Alphabetic Ciphers
21. When an encryption algorithm is said to be computationally secured?
The encryption algorithm is said to be computationally secure if,

Page 5
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 The cost of breaking the cipher exceeds the value of the encrypted information
 The time required to break the cipher exceeds the useful time of the information.
22. What are the key principles of security?
Key properties of security are,
 To protect the data during transmission across the networks
 Authentication
 Confidentiality
 Integrity
 Access control
23. What types of information might be derived from a traffic analysis attack?
The following types of information can be derived from traffic analysis attack,
 Identities of partners
 How frequently the partners are communicating
 Message pattern, message length, or quantity of messages that suggest important
information is being exchanged
 The events that correlate with special conversations between particular partners.
24. What is Rail fence Transposition Technique?
 In this technique plaintext is written down as a sequence of diagonals and then read off as a sequence
of rows.
25. Define Threats.
 Information access threats or threats intercept or modify data on behalf of users who should not have
access to that data. Service threats exploit service flaws in computers to inhibit use by legitimate users.
26. What are the aspects of information security?
There are three aspects of the information security.
 Security attack
 Security mechanism
 Security Service
27. List some common information integrity functions.
 Identification
 Authorization
Page 6
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Concurrence
 Liability
 Endorsement
 Validation
 Time of occurrence
28. What is meant by attack?
 An attack on system security that derives from an intelligent threat: that is an intelligent act that is a
deliberate attempt (especially in the sense of a method or technique) to evade security services and
violate the security policy of a system.
29. What are the essential ingredients of a symmetric cipher?
A symmetric encryption scheme has five ingredients:
 Plaintext: This is the original intelligible message or data that is fed into the algorithm as input.
 Encryption algorithm: The encryption algorithm performs various substitutions and transformations
on the plaintext.
 Secret Key: The secret key is also input to the encryption algorithm. The key is the value independent
of the plaintext. The algorithm will produce a different output depending on the specific key being
used at the time. The exact substitutions and transformations performed by the algorithm depend on
the key.
 Cipher text: This is the scrambled message produced as output. It depends on the plaintext and the
key.
 Decryption algorithm: This is essentially the encryption algorithm in reverse. It takes the cipher text
and the secret key and produces the original plaintext.
30. What are the two basic functions used in the encryption algorithm?
All the encryption algorithms are based on two general principles:
 Substitution: In which each element in the plaintext (bit, letter, group of bits or letters) is mapped
into another element.
 Transposition: In which elements in the plaintext are rearranged.
31. Briefly define the Caesar cipher. (NOV/DEC 2021)
The Caesar cipher involves replacing each letter of the alphabet with the letter standing three places
down the alphabet .The alphabet is wrapped around, so that the letter following Z is A.
C = E (p) = (p + 3) mod (26)
The general Caesar cipher algorithm is
C = E (p) = (p + k) mod (26)
EX: Let message = “Anna”, and k = 3, find the cipher text using Caesar
Cipher text: cppc
Where k takes the value in the range 1 to 25
Page 7
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

The decryption algorithm is

p = D(C) = (C - k) mod (26)
32. Briefly define the monoalphabetic cipher. (NOV/DEC 2012)
 A monoalphabetic cipher maps from a plain alphabet to cipher alphabet. Here a single cipher
alphabet is used per message
 A dramatic increase in the key space is achieved by allowing an arbitrary substitution. There are
26! Possible keys. It is referred to as monoalphabetic substitution cipher, because a single cipher
alphabet is used per message.
33. What is polyalphabetic cipher?
 In monoalphabetic cipher single cipher alphabet is used per message.
 But in polyalphabetic cipher there are multiple cipher text letters for each plaintext letter, one
for each unique letter of keyword.
34. Define LFSR.
 A linear feedback shift register is a shift register whose input is a linear function of its previous
state. Also called linear recursive sequence.
35. What is prime number?
 A prime number is an integer that can only be divided without remainder by positive values of
itself and by one.
36. What is the meaning of the expression a divides b?
 Integer a is said to be a divisor of integer b if there is no remainder on division.
37. What is Euler’s totient function?
 Euler’s totient function Φ(n) defined as the number of positive integers less than n and
Relatively prime to n. by conversion Φ(1)=1.
38. What is Fermat’s theorem? (May 2017)
Fermat’s theorem states the following:
If p is prime and a is a positive integer not divisible by p, then
Ap-1 = 1(mod p)
39. What is Euler’s theorem? (AU May/Jun 2014)
Euler’s theorem states that for every a and n that are relatively prime.
a Φ(n) = 1(mod n)
40. Briefly define a group.

Page 8
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 A group G, sometimes denoted by {G, .} is a set of elements with a binary operation, denoted
by . , that associates
41. What is the difference between a Caesar cipher and monoalphabetic cipher? (NOV/DEC 2020)
S.No Caesar Cipher Mono alphabetic Cipher
The Caesar cipher is the simplest and oldest
Monoalphabetic cipher is one where each
method of cryptography. The Caesar cipher
1 character of a plain text is mapped to a
method is based on a mono-alphabetic
fixed other character of cipher text.
cipher
The Caesar cipher is a kind of replacement The relationship between a character in the
2 (substitution) cipher, where all letter of plain plain text and the characters in the cipher
text is replaced by another letter. text is one-to-one.
Caesar ciphers is a weak method of It is a simple type of substitution cipher.
cryptography. It can be easily hacked. It Monoalphabetic ciphers are not that
3
means the message encrypted by this stronger as compared to polyalphabetic
method can be easily decrypted. cipher.
Table 1.5 – Caesar cipher vs Mono alphabetic cipher
42. Convert the given text “Anna University” into cipher text using rail fence technique.
 Plain text: Anna University
 Cipher text: anuiestnanvry
43. Why modular arithmetic has been used in cryptography? (AU NOV/DEC 2013)
 Because it is used to find multiplicative inverse in cryptography. so modular arithmetic has been
used in cryptography
44. What are active and passive attacks that compromise information security? (NOV/DEC 2020)
1. Passive Attacks: These attacks are in the nature of eavesdropping on, or monitoring of, transmissions. The
goal of the opponent is to obtain information that is being transmitted.
Two types of passive attacks are,
 Release of message contents where an eavesdropper tries to learn the contents of what is being
transmitted.
 Traffic analysis, where the opponent tries to observe the pattern, frequency and length of messages being
exchanged which could be used in guessing the nature of the communication that is taking place.
Page 9
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

2. Active Attacks: Active attacks involve some modification of the data stream or the creation of a false stream.
These attacks present the opposite characteristics of passive attacks. It is difficult to prevent active attacks
absolutely because to do so would require physical protection of all communications facilities and paths at all
times.
45. Why random numbers are used in network security? (AU May/Jun 2014)
 Nonce’s in authentication protocols to prevent replay
 Session keys
 Public key generation
 Key stream for a one‐time pad
46. What are the two basic functions used in encryption algorithms? (AU Nov/Dec 2014)
The two basic functions used in encryption algorithms are
 Substitution
 Transposition
47. Let message = “Anna”, and k = 3, find the cipher text using Caesar. (Nov/Dec-2021)
Encryption
A n n A
+3 +3 +3 +3
D q q D

48. What is called block cipher and a stream cipher? (AU Nov/Dec 2014)
 A block cipher processes the input one block of elements at a time, producing an output block for each
input block.
 A stream cipher processes the input elements continuously, producing output one element at a time, as it
goes along.
49. Decipher the following cipher text using brute force attack. (AU NOV/DEC 2014)
CMTMROOEOORW using Rail fence
Solution:
CTROORMMOEOW
50. Describe in general terms an efficient procedure for picking a prime number.
The procedure for picking a prime number is as follows:
1. Pick an odd integer n at random (eg., using a pseudorandom number generator).
2. Pick an integer a<n at random.
3. Perform the probabilistic primality test, such as Miller-Rabin. If n fails the test, reject the
value n and go to step 1.
4. If n has passed a sufficient number of tests, accept n; otherwise, go to step 2.
51. Define Fermat Theorem.
 Fermat Theorem states the following: If p is prime and a is a positive integer not divisible by p, then

Page 10
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Ap-1=a mod n
52. Determine the gcd(24140,16762) using Euclid’s algorithm.(NOV/DEC 2021)
Soln:
We know,
gcd(a,b)=gcd(b,amod b) gcd(24140,16762)=gcd(16762,7378) gcd(7378,2006)=gcd(2006,1360)
gcd(1360,646)=gcd(646,68) gcd(68,34)=34 gcd(24140,16762) = 34.
53. Define Fermat's Theorem.
 ap-1 = 1 (mod p)
 where p is prime and gcd(a,p)=1
 Also known as Fermat’s Little Theorem
 Also ap = p (mod p)
 Useful in public key and primality testing
54. Define Euler Totient Function ø(n). (NOV/DEC 2021)
 To compute ø(n) need to count number of residues to be excluded
 In general need prime factorization, but
 for p (p prime) ø(p) = p-1
 for p.q (p,q prime) ø(pq) = (p-1)x(q-1)
 Ex.
ø (37) = 36
ø (21) = (3–1)x(7–1) = 2x6 = 12
55. Define Euler's Theorem. (Nov/Dec 2009)
 A generalisation of Fermat's Theorem
aø(n) = 1 (mod n)
 For any a,n where gcd(a,n)=1
 Ex.
a=3; n=10; ø(10)=4;
hence, 34 = 81 = 1 mod 10
a=2; n=11; ø(11)=10;
hence, 210 = 1024 = 1 mod 11

Page 11
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

56. Define Chinese Remainder Theorem.

 Can implement CRT in several ways
 To compute A(mod M)
 First compute all ai = A mod mi separately
 Determine constants ci below, where Mi = M/mi
 Then combine results to get answer using:

57. What are the goals of security?

1. Prevention: It means that an attack will fail

2. Detection: It is most useful when an attack cannot be prevented, but it can also indicate the
effectiveness of preventative measures.
3. Recovery: To stop an attack and to assess and repair any damage caused by that attack, the system
continuous to function correctly while an attack is underway.
58. Encrypt the plaintext to be or not to be using the vigenere cipher.
 The inverse problem to exponentiation is to find the discrete logarithm of a number modulo p
 That is to find x such that y = gx (mod p)
 This is written as x = logg y (mod p)
 if g is a primitive root then it always exists, otherwise it may not, eg.
x = log3 4 mod 13 has no answer
x = log2 3 mod 13 = 4 by trying successive powers
whilst exponentiation is relatively easy, finding discrete logarithms is generally a hard
59. What are the types of security policies?
1. Military security policy
2. Commercial security policy
3. Transaction oriented integrity security policy
4. Confidentiality security policy
5. Integrity policy

Page 12
 AR ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

60. What are the types of access control?

1. Identity based access control
2. Mandatory access control
3. Originator controlled access control
61. What is an identity based access control?
 If an individual user can set an access control mechanism to allow or deny access to an object, that
mechanism is a discretionary access control also called an identity based access control.
62. What is a mandatory access control?
 When a system mechanism controls access to an object and an individual user can not alter
that access, the control is a mandatory access control, occasionally called as rule-based access
control.
63. What is meant by Denial of Service attack? Is it Active Attack or Passive Attack? (NOV/DEC 2021)
 A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making
it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with
traffic, or sending it information that triggers a crash.
 Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks are also examples
of active attacks, both of which work by preventing authorized users from accessing a specific
resource on a network or the internet (for example, flooding a web server with more traffic than
it can handle).
64. Encrypt the plaintext to be or not to be using the vigenere cipher for the key value now. (NOV/DEC
2020)

 Vigenere Cipher is a method of encrypting alphabetic text. It uses a simple form of polyalphabetic
substitution. A polyalphabetic cipher is any cipher based on substitution, using multiple
substitution alphabets. The encryption of the original text is done using the Vigenère square or
Vigenère table.
 The table consists of the alphabets written out 26 times in different rows,each alphabet shifted
cyclically to the left compared to the previous alphabet, corresponding to the 26 possible Caesar
Ciphers.

 At different points in the encryption process, the cipher uses a different alphabet from one of the
rows. The alphabet used at each point depends on a repeating keyword

Page 13
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

PART – B
1. Explain in detail about Computer Security Concepts.
Computer Security:
 The protection afforded to an automated information system in order to attain the applicable
objectives of preserving the integrity, availability, and confidentiality of information system
resources (includes hardware, software, firmware, information/data, and
telecommunications).
 This definition introduces three key objectives that are at the heart of computer security:
■ Confidentiality: This term covers two related concepts:
o Data confidentiality: Assures that private or confidential information is not made
available or disclosed to unauthorized individuals.
o Privacy: Assures that individuals control or influence what information related to them
may be collected and stored and by whom and to whom that information may be disclosed.
■ Integrity: This term covers two related concepts:
o Data integrity: Assures that information (both stored and in transmitted packets) and
programs are changed only in a specified and authorized manner.
o System integrity: Assures that a system performs its intended function in an unimpaired
manner, free from deliberate or inadvertent unauthorized manipulation of the system.
■ Availability: Assures that systems work promptly and service is not denied to authorized users.
These three concepts form what is often referred to as the CIA triad.
 The three concepts embody the fundamental security objectives for both data and for
information and computing services.
 For example, the NIST standard FIPS 199 (Standards for Security Categorization of Federal
Information and Information Systems) lists confidentiality, integrity, and availability as the
three security objectives for information and for information systems.
 FIPS 199 provides a useful characterization of these three objectives in terms of requirements
and the definition of a loss of security in each category:

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 14

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

■ Confidentiality: Preserving authorized restrictions on information access and disclosure, including

means for protecting personal privacy and proprietary information. A loss of confidentiality is the
unauthorized disclosure of information.
■ Integrity: Guarding against improper information modification or destruction, including ensuring
information nonrepudiation and authenticity. A loss of integrity is the unauthorized modification or
destruction of information.
■ Availability: Ensuring timely and reliable access to and use of information. A loss of availability is
the disruption of access to or use of information or an information system. Although the use of the
CIA triad to define security objectives is well established, some in the security field feel that
additional concepts are needed to present a complete picture (Figure 1.1). Two of the most commonly
mentioned are as follows:
■ Authenticity: The property of being genuine and being able to be verified and trusted; confidence
in the validity of a transmission, a message, or message originator. This means verifying that users
are who they say they are and that each input arriving at the system came from a trusted source.
■ Accountability: The security goal that generates the requirement for actions of an entity to be
traced uniquely to that entity. This supports non repudiation, deterrence, fault isolation, intrusion
detection and prevention, and after action recovery and legal action. Because truly secure systems are
not yet an achievable goal, we must be able to trace a security breach to a responsible party. Systems
must keep records of their activities to permit later forensic analysis to trace security breaches or to
aid in transaction disputes.
The Challenges of Computer Security
 Computer and network security is both fascinating and complex. Some of the reasons follow:
1. Security is not as simple as it might first appear to the novice. The requirements seem to be
straightforward; indeed, most of the major requirements for security services can be given self-
explanatory, one-word labels: confidentiality, authentication, non repudiation, or integrity. But
the mechanisms used to meet those requirements can be quite complex, and understanding them
may involve rather subtle reasoning.
2. In developing a particular security mechanism or algorithm, one must always consider
potential attacks on those security features. In many cases, successful attacks are designed by
looking at the problem in a completely different way, therefore exploiting an unexpected
weakness in the mechanism.
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 15
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

3. Because of point 2, the procedures used to provide particular services are often
counterintuitive. Typically, a security mechanism is complex, and it is not obvious from the
statement of a particular requirement that such elaborate measures are needed. It is only when the
various aspects of the threat are considered that elaborate security mechanisms make sense.
4. Having designed various security mechanisms, it is necessary to decide where to use them.
This is true both in terms of physical placement (e.g., at what points in a network are certain
security mechanisms needed) and in a logical sense (e.g., at what layer or layers of an
architecture such as TCP/IP [Transmission Control Protocol/Internet Protocol] should
mechanisms be placed).
5. Security mechanisms typically involve more than a particular algorithm or protocol. They also
require that participants be in possession of some secret information (e.g., an encryption key),
which raises questions about the creation, distribution, and protection of that secret information.
There also may be a reliance on communications protocols whose behavior may complicate the
task of developing the security mechanism.
 For example, if the proper functioning of the security mechanism requires setting time limits
on the transit time of a message from sender to receiver, then any protocol or network that
introduces variable, unpredictable delays may render such time limits meaningless.
6. Computer and network security is essentially a battle of wits between a perpetrator who tries
to find holes and the designer or administrator who tries to close them. The great advantage that
the attacker has is that he or she need only find a single weakness, while the designer must find
and eliminate all weaknesses to achieve perfect security.
7. There is a natural tendency on the part of users and system managers to perceive little benefit
from security investment until a security failure occurs.
8. Security requires regular, even constant, monitoring, and this is difficult in today’s short-term,
overloaded environment.
9. Security is still too often an afterthought to be incorporated into a system after the design is
complete rather than being an integral part of the design process.
10. Many users and even security administrators view strong security as an impediment to
efficient and user-friendly operation of an information system or use of information.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 16

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

2. List and briefly define categories of security services. (NOV/DEC 2020)

OVER VIEW

CONTENTS
1. Introduction
2. Authentication
• Peer Entity Authentication
• Data Origin Authentication
3. Access Control
4. Data Confidentiality
• Connection Confidentiality
• Connectionless Confidentiality
• Selective-Field Confidentiality
• Traffic Flow Confidentiality
5. Data Integrity
 Connection Integrity with Recovery
 Connection Integrity without Recovery
 Selective-Field Connection Integrity
 Connectionless Integrity
 Selective-Field Connectionless Integrity
6. Nonrepudiation
• Nonrepudiation, Origin
• Nonrepudiation, Destination
7. Availability Service

1. Introduction

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 17

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 X.800 defines a security service as a service that is provided by a protocol layer of communicating
open systems and that ensures adequate security of the systems or of data transfers.
 Perhaps a clearer definition is found in RFC 2828, which provides the following definition: a
processing or communication service that is provided by a system to give a specific kind of
protection to system resources; security services implement security policies and are implemented by
security mechanisms.
 X.800 divides these services into five categories and fourteen specific services.
2. Authentication
 The authentication service is concerned with assuring that a communication is authentic. In the
case of a single message, such as a warning or alarm signal, the function of the authentication
service is to assure the recipient that the message is from the source that it claims to be from.
 In the case of an ongoing interaction, such as the connection of a terminal to a host, two
aspects are involved.
 First, at the time of connection initiation, the service assures that the two entities are
authentic, that is, that each is the entity that it claims to be.
 Second, the service must assure that the connection is not interfered with in such a way that a
third party can masquerade as one of the two legitimate parties for the purposes of
unauthorized transmission or reception.
Two specific authentication services are defined in X.800:
o Peer Entity Authentication
 Used in association with a logical connection to provide confidence in the identity of the
entities connected.
o Data Origin Authentication
 In a connectionless transfer, provides assurance that the source of received data is as claimed.
3. Access Control
 The prevention of unauthorized use of a resource (i.e., this service controls who can have
access to a resource, under what conditions access can occur, and what those accessing the
resource are allowed to do).
4. Data Confidentiality

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 18

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Confidentiality is the protection of transmitted data from passive attacks. With respect to the
content of a data transmission, several levels of protection can be identified. The broadest
service protects all user data transmitted between two users over a period of time
 The protection of data from unauthorized disclosure.
o Connection Confidentiality
 The protection of all user data on a connection.
o Connectionless Confidentiality
 The protection of all user data in a single data block
o Selective-Field Confidentiality
 The confidentiality of selected fields within the user data on a connection or in a single
data block.
o Traffic Flow Confidentiality
 The protection of the information that might be derived from observation of traffic
flows.
5. Data Integrity
 As with confidentiality, integrity can apply to a stream of messages, a single message, or
selected fields within a message. Again, the most useful and straightforward approach is total
stream protection.
 A connection-oriented integrity service, one that deals with a stream of messages, assures that
messages are received as sent with no duplication, insertion, modification, reordering, or
replays. The destruction of data is also covered under this service. Thus, the connection-oriented
integrity service addresses both message stream modification and denial of service.
 On the other hand, a connectionless integrity service, one that deals with individual messages
without regard to any larger context, generally provides protection against message modification
only.
 We can make a distinction between service with and without recovery. Because the integrity
service relates to active attacks, we are concerned with detection rather than prevention. If a
violation of integrity is detected, then the service may simply report this violation, and some
other portion of software or human intervention is required to recover from the violation.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 19

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Alternatively, there are mechanisms available to recover from the loss of integrity of data,
as we will review subsequently. The incorporation of automated recovery mechanisms is, in
general, the more attractive alternative.
Note -The assurance that data received are exactly as sent by an authorized entity (i.e.,contain no
modification, insertion, deletion, or replay).

o Connection Integrity with Recovery

Provides for the integrity of all user data on a connection and detects any modification, insertion,
deletion, or replay of any data within an entire data sequence, with recovery attempted.
o Connection Integrity without Recovery
As above, but provides only detection without recovery.
o Selective-Field Connection Integrity
Provides for the integrity of selected fields within the user data of a data block transferred over a
connection and takes the form of determination of whether the selected fields have been modified,
inserted, deleted, or replayed.
o Connectionless Integrity
Provides for the integrity of a single connectionless data block and may take the form of detection of
data modification. Additionally, a limited form of replay detection may be provided.
o Selective-Field Connectionless Integrity
Provides for the integrity of selected fields within a single connectionless data block; takes the form of
determination of whether the selected fields have been modified.
6. Non repudiation
 Non repudiation prevents either sender or receiver from denying a transmitted message. Thus,
when a message is sent, the receiver can prove that the alleged sender in fact sent the message.
Similarly, when a message is received, the sender can prove that the alleged receiver in fact
received the message.
Note - Provides protection against denial by one of the entities involved in a communication of having
participated in all or part of the communication.
o Non repudiation, Origin
Proof that the message was sent by the specified party.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 20

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

o Non repudiation, Destination

Proof that the message was received by the specified party.
7. Availability Service
 Both X.800 and RFC 2828 define availability to be the property of a system or a system
resource being accessible and usable upon demand by an authorized system entity, according
to performance specifications for the system
 A variety of attacks can result in the loss of or reduction in availability. Some of these attacks
are amenable to automated countermeasures, such as authentication and encryption, whereas
others require some sort of physical action to prevent or recover from loss of availability of
elements of a distributed system.
3. List and briefly define categories of security mechanisms. (NOV/DEC 2020)
OVERVIEW
Contents
 Introduction
 Encipherment
 Digital Signature
 Access Control
 Data Integrity
 Authentication Exchange
 Traffic Padding
 Routing Control
 Notarization
 Pervasive Security Mechanisms
 Trusted Functionality
 Security Label
 Event Detection
 Security Audit Trail
Introduction
The mechanisms are divided into those that are implemented in a specific protocol layer,
such as TCP or an application-layer protocol, and those that are not specific to any particular

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 21

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

protocol layer or security service. Figure 1: shows the Relationship between security and
mechanisms.
Encipherment
 The use of mathematical algorithms to transform data into a form that is not readily
intelligible. The transformation and subsequent recovery of the data depend on an
algorithm and zero or more encryption keys.
Digital Signature
 Data appended to, or a cryptographic transformation of, a data unit that allows a recipient
of the data unit to prove the source and integrity of the data unit and protect against
forgery (e.g., by the recipient).
Access Control
 A variety of mechanisms that enforce access rights to resources.
Data Integrity
 A variety of mechanisms used to assure the integrity of a data unit or stream of data units.
Authentication Exchange
 A mechanism intended to ensure the identity of an entity by means of information
exchange.
Traffic Padding
 The insertion of bits into gaps in a data stream to frustrate traffic analysis attempts.
Routing Control
 Enables selection of particular physically secure routes for certain data and allows routing
changes, especially when a breach of security is suspected.
Notarization
 The use of a trusted third party to assure certain properties of a data exchange.
Pervasive Security Mechanisms
 Mechanisms those are not specific to any particular OSI security service or protocol layer.
Trusted Functionality
 That which is perceived to be correct with respect to some criteria
 e.g., as established by a security policy.
Security Label
 The marking bound to a resource (which may be a data unit) that names or designates the
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 22
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

security attributes of that resource.

Event Detection
 Detection of security-relevant events.
Security Audit Trail
 Data collected and potentially used to facilitate a security audit, which is an independent
review and examination of system records and activities.
 A reversible encipherment mechanism is simply an encryption algorithm that allows data
to be encrypted and subsequently decrypted.
 Irreversible encipherment mechanisms include hash algorithms and message
authentication codes, which are used in digital signature and message authentication
applications. Based on one in X.800, indicates the relationship between security services
and security mechanisms.

Fig 1.1: Relationship between security and mechanisms

4. List and briefly define categories of passive and active security attacks. Or what are the different
types of attacks? or Explain detail about security attacks. (NOV/DEC 2013)
Contents
 Introduction
 Passive Attacks
o The release of message contents

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 23

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

o Traffic analysis.
 Active Attacks
o Masquerade,
o Replay,
o Modification of messages, and
o Denial of service.
Introduction

 Security attacks, uses both in X.800 and RFC 2828, are in terms of passive attacks and
active attacks. A passive attack attempts to learn or make use of information from the
system but does not affect system resources.
 An active attack attempts to alter system resources or affect their operation. Passive
attacks are in the nature of eavesdropping on, or monitoring of, transmissions.
 The goal of the opponent is to obtain information that is being transmitted. Two types of
passive attacks are the release of message contents and traffic analysis.
 The release of message contents is easily understood.
Passive Attacks
 Passive attacks (Refer Figure 1.2) are in the nature of eavesdropping on, or monitoring
of, transmissions. The goal of the opponent is to obtain information that is being
transmitted.
Two types of passive attacks are:
 The release of message contents and
 Traffic analysis.
 The release of message contents is easily understood. A telephone conversation, an
electronic mail message, and a transferred file may contain sensitive or confidential
information.
 A second type of passive attack, traffic analysis, is subtler. Suppose that we had a way
of masking the contents of messages or other information traffic so that opponents, even
if they captured the message, could not extract the information from the message.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 24

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig 1.2 Passive Attacks

Active Attacks
 Active attacks (Refer Figure 1.3) involve some modification of the data stream or the
creation of a false stream and can be subdivided into four categories:
 masquerade,
 replay,
 modification of messages, and
 Denial of service.
 A masquerade - A masquerade attack usually includes one of the other forms of active
attack.
 Replay involves the passive capture of a data unit and its subsequent retransmission to
produce an unauthorized effect.
 Modification of messages simply means that some portion of a legitimate message is
altered, or that messages are delayed or reordered, to produce an unauthorized effect.
 The denial of service prevents or inhibits the normal use or management of communications
facilities.

Fig 1.3 Active Attacks

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 25
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

5. Explain in detail about The OSI Security Architecture. (NOV/DEC 2020)

Contents
 Introduction
 Security attack
 Security mechanism
 Security service
Introduction

 ITU-T3 Recommendation X.800, Security Architecture for OSI, defines such a systematic
approach.4 The OSI security architecture is useful to managers as a way of organizing the task of
providing security.
 These can be defined briefly as
 Security attack: Any action that compromises the security of information owned by an
organization.

 Security mechanism: A process (or a device incorporating such a process) that is

designed to detect, prevent, or recover from a security attack.

 Security service: A processing or communication service that enhances the security of the
data processing systems and the information transfers of an organization. The services are
intended to counter security attacks, and they make use of one or more security
mechanisms to provide the service.

Threat

 A potential for violation of security, which exists when there is a circumstance, Capability,
action, or event that could breach security and cause harm. That is, a threat is a possible
danger that might exploit vulnerability.
Attack

 An assault on system security that derives from an intelligent threat; that is, an intelligent
act that is a deliberate attempt (especially in the sense of a method or technique) to evade
security services and violate the security policy of a system.
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 26
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Security Attacks

 A useful means of classifying security attacks, used both in X.800 and RFC 2828, is in terms
passive attacks and active attacks.
 A passive attack attempts to learn or make use of information from the system but does not
affect system resources.
 An active attack attempts to alter system resources or affect their operation.
Passive Attacks

 Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions. The
goal of the opponent is to obtain information that is being transmitted.
 Two types of passive attacks are release of message contents and traffic analysis.
(Refer Figure 1.4.a and 1.4 b)
 The release of message contents is easily understood .A telephone conversation, an electronic
mail message, and a transferred file may contain sensitive or confidential information.

.
Fig 1.4 (a) Releases of message contents and (b).Traffic analysis

6. Write short notes on Network security model.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 27

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 A message is to be transferred from one party to another across some sort of Internet service. The
two parties, who are the principals in this transaction, must cooperate for the exchange to take
place.
 A logical information channel is established by defining a route through the Internet from source
to destination and by the cooperative use of communication protocols (e.g., TCP/IP) by the two
principals.
 Security aspects come into play when it is necessary or desirable to protect the information
transmission from an opponent who may present a threat to confidentiality, authenticity, and so on.
All the techniques for providing security have two components:
All the techniques for providing security have two components:
 A security-related transformation on the information to be sent.
 Some secret information shared by the two principals and, it is hoped, unknown to the
opponent. A trusted third party may be needed to achieve secure transmission.
 This general model shows that there are four basic tasks in designing a particular security
service:
1. Design an algorithm for performing the security-related transformation. The algorithm
should be such that an opponent cannot defeat its purpose.
2. Generate the secret information to be used with the algorithm.
3. Develop methods for the distribution and sharing of the secret information.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 28

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

4. Specify a protocol to be used by the two principals that makes use of the security
algorithm and the secret information to achieve a particular security service.

Fig 1.5 Model for network Security

 A general model of these other situations is illustrated in Figure 1.5, which reflects a concern for
protecting an information system from unwanted access. The hacker can be someone who, with no
malign intent, simply gets satisfaction from breaking and entering a computer system.
o Programs can present two kinds of threats:
• Information access threats: Intercept or modify data on behalf of users who should not
have access to that data.
• Service threats: Exploit service flaws in computers to inhibit use by legitimate users.

Fig 1.6 Network Access Security Model

 Viruses and worms are two examples of software attacks. They can also be inserted into a
system across a network.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 29

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 The security mechanisms needed to cope with unwanted access fall into two broad categories
(Refer Figure 1.6).
 The first category might be termed a gatekeeper function. It includes password-
based login procedures and screening logic that is designed to detect and reject
worms, viruses.
 The second line of defense consists of a variety of internal controls that monitor
activity and analyze stored information in an attempt to detect the presence of
unwanted intruders.
7. What are the essential ingredients classical encryption techniques of a symmetric cipher?

Contents
 Ingredients
 Requirements
 Cryptography
 Cryptanalysis and Brute-Force Attack
 Cryptanalysis:
 Brute-force attack:

Ingredients

A symmetric encryption scheme has five ingredients (Refer Figure 1.7):

• Plaintext: This is the original intelligible message or data that is fed into the algorithm
as input.
• Encryption algorithm: The encryption algorithm performs various substitutions and
transformations on the plaintext.
• Secret key: The secret key is also input to the encryption algorithm. The key is a value
independent of the plaintext and of the algorithm.
• Ciphertext: This is the scrambled message produced as output. It depends on the
plaintext and the secret key.
• Decryption algorithm: This is essentially the encryption algorithm run in reverse. It
takes the ciphertext and the secret key and produces the original plaintext.
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 30
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig 1.7 : Simplified Model of Symmetric Eccryption

Requirements

There are two requirements for secure use of conventional encryption:

1. We need a strong encryption algorithm. At a minimum, we would like the algorithm
to be such that an opponent who knows the algorithm and has access to one or more
ciphertexts would be unable to decipher the ciphertext or figure out the key.
2. Sender and receiver must have obtained copies of the secret key in a secure fashion
and must keep the key secure. If someone can discover the key and knows the algorithm,
all communication using this key is readable.
 With the use of symmetric encryption, the principal security problem is maintaining the
secrecy of the key. Let us take a closer look at the essential elements of a symmetric
encryption scheme, using Figure 1.8. A source produces a message in plaintext, X = [X1,
X2, c, XM]. The M elements of X are letters in some finite alphabet.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 31

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig.1.8. Model of Symmetric Cryptosystem

 Traditionally, the alphabet usually consisted of the 26 capital letters. Nowadays, the
binary alphabet {0, 1} is typically used. For encryption, a key of the form K = [K1, K2, c,
KJ] is generated. If the key is generated at the message source, then it must also be
provided to the destination by means of some secure channel. With the message X and
the encryption key K as input, the encryption algorithm forms the ciphertext Y = [Y1, Y2,
c, YN]. We can write this as

 This notation indicates that Y is produced by using encryption algorithm E as a function

of the plaintext X, with the specific function determined by the value of the key K.
 The intended receiver, in possession of the key, is able to invert the transformation:

 An opponent, observing Y but not having access to K or X, may attempt to recover X or K

or both X and K. It is assumed that the opponent knows the encryption (E) and decryption
(D) algorithms. If the opponent is interested in only this particular message, then the
focus of the effort is to recover X by generating a plaintext estimate
 Often, however, the opponent is interested in being able to read future messages as well,
in which case an attempt is made to recover K by generating an estimate
Cryptography
Cryptographic systems are characterized along three independent dimensions:
1. The type of operations used for transforming plaintext to ciphertext.
2. The number of keys used.
3. The way in which the plaintext is processed.
Cryptanalysis and Brute-Force Attack
There are two general approaches to attacking a conventional encryption scheme:
• Cryptanalysis: Cryptanalytic attacks rely on the nature of the algorithm plus perhaps
some knowledge of the general characteristics of the plaintext or even some sample
plaintext–ciphertext pairs.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 32

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

• Brute-force attack: The attacker tries every possible key on a piece of ciphertext until
an intelligible translation into plaintext is obtained. On average, half of all possible keys
must be tried to achieve success.
8. What is the different substitution techniques involved in classic encryption technique in
Substitution Techniques? (OR) Briefly define the Caesar cipher. Briefly define the
monoalphabetic cipher. Briefly define the Playfair cipher, Hill Cipher, Polyalphabetic Ciphers
and one time pad. (NOV/DEC 2021) (NOV/DEC 2020)
Contents
 Introduction
 Caesar Cipher
 Monoalphabetic Ciphers
 Playfair Cipher
 Hill Cipher
 Polyalphabetic Ciphers
 One-Time Pad
Introduction

 The two basic building blocks of all encryption techniques are substitution and
transposition.
 A substitution technique is one in which the letters of plaintext are replaced by other
letters or by numbers or symbols. If the plaintext is viewed as a sequence of bits, then
substitution involves replacing plaintext bit patterns with ciphertext bit patterns.
Caesar Cipher (Apr/May-2019)
 The earliest known, and the simplest, use of a substitution cipher was by Julius Caesar.
The Caesar cipher involves replacing each letter of the alphabet with the letter standing
three places further down the alphabet. For example,

 Note that the alphabet is wrapped around, so that the letter following Z is A. We can
define the transformation by listing all possibilities, as follows:

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 33

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Let us assign a numerical equivalent to each letter:

 Then the algorithm can be expressed as follows. For each plaintext letter p, substitute the
ciphertext letter C:

 A shift may be of any amount, so that the general Caesar algorithm is

Where, k takes on a value in the range 1 to 25. The decryption algorithm is simply

 If it is known that a given cipher text is a Caesar cipher, then a brute-force cryptanalysis
is easily performed: simply try all the 25 possible keys.
 Figure 1.9. Shows the results of Brute-Force applying this strategy is the example of
cipher text. In this case, the plaintext leaps out as occupying the third line.
 Three important characteristics of this problem enabled us to use a brute force
cryptanalysis:
1. The encryption and decryption algorithms are known.
2. There are only 25 keys to try.
3. The language of the plaintext is known and easily recognizable.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 34

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig. 1.9.Brute – Force Cryptanalysis of Caesar cipher

Monoalphabetic Ciphers
What is monoalphabetic cipher? Examine how it differs from Caesar cipher?
(Nov/Dec-2020)
 With only 25 possible keys, the Caesar cipher is far from secure. A dramatic increase in
the key space can be achieved by allowing an arbitrary substitution.
 Before proceeding, we define the term permutation. A permutation of a finite set of
elements S is an ordered sequence of all the elements of S, with each element appearing
exactly once.
 For example, if S = {a, b, c}, there are six permutations of S:
abc, acb, bac, bca, cab, cba
 If, instead, the “cipher” line can be any permutation of the 26 alphabetic characters, then
there are 26! or greater than 4 * 1026 possible keys. This is 10 orders of magnitude
greater than the key space for DES and would seem to eliminate brute-force techniques
for cryptanalysis. Such an approach is referred to as a monoalphabetic substitution
cipher, because a single cipher alphabet (mapping from plain alphabet to cipher alphabet)
is used per message.
 Playfair Cipher
 The best-known multiple-letter encryption cipher is the Playfair, which treats digrams in
the plaintext as single units and translates these units into cipher text diagrams.
 The Playfair algorithm is based on the use of a 5 * 5 matrix of letters constructed using a
keyword. Here is an example, solved by Lord Peter Wimsey in Dorothy Sayers’s Have
His Carcase:

 In this case, the keyword is monarchy. The matrix is constructed by filling in the letters
of the keyword (minus duplicates) from left to right and from top to bottom, and then

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 35

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

filling in the remainder of the matrix with the remaining letters in alphabetic order. The
letters I and J count as one letter.
 Hill Cipher
Demonstrate encryption and decryption process in hill cipher. Consider m = “sh”
and key = hill”. (NOV/DEC-2021)

 The Hill Algorithm This encryption algorithm takes m successive plaintext letters and
substitutes for them m cipher text letters. The substitution is determined by m linear
equations in which each character is assigned a numerical value (a = 0, b = 1, c, z = 25).
For m = 3, the system can be described as

 For example1, consider the plaintext “paymoremoney” and use the encryption Key The
first three letters of the plaintext are represented by the vector (15 0 24). Then(15 0 24)K
= (303 303 531) mod 26 = (17 17 11) = RRL. Continuing in this fashion, the cipher text
for the entire plaintext is RRLMWBKASPDH.
 For example2, consider the plaintext “sh” and use the encryption Key .The first three
letters of the plaintext are represented by the vector (8 9 12). Then(8 9)K = (305 305 531)
mod 26 = (16 16 2) = PPB. Continuing in this fashion, the cipher text for the entire
plaintext is PPB.

Polyalphabetic Ciphers
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 36
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Another way to improve on the simple monoalphabetic technique is to use different

monoalphabetic substitutions as one proceeds through the plaintext message.
 The general name for this approach is polyalphabetic substitution cipher. All these
techniques have the following features in common:
1. A set of related monoalphabetic substitution rules is used.
2. A key determines which particular rule is chosen for a given transformation.
A general equation of the encryption process is

Similarly, decryption is

 To encrypt a message, a key is needed that is as long as the message. Usually, the key is a
repeating keyword. For example, if the keyword is deceptive, the message “we are
discovered save yourself” is encrypted as

Expressed numerically, we have the following result.

One-Time Pad (Using Vernam Cipher)

 An Army Signal Corp officer, Joseph Mauborgne, proposed an improvement to the
Vernam cipher that yields the ultimate in security. Mauborgne suggested using a random
key that is as long as the message, so that the key need not be repeated. (Refer Figure
1.10)

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 37

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 In addition, the key is to be used to encrypt and decrypt a single message, and then is
discarded. Each new message requires a new key of the same length as the new message.
Such a scheme, known as a one-time pad, is unbreakable.
 It produces random output that bears no statistical relationship to the plaintext. Because
the ciphertext contains no information whatsoever about the plaintext, there is simply no
way to break the code.
 For Example

Fig 1.10: Vernam Cipher

9. What are the different techniques involved in transposition techniques of Classical

Encryption techniques?
 A very different kind of mapping is achieved by performing some sort of permutation on the
plaintext letters. This technique is referred to as a transposition cipher.
 The simplest such cipher is the rail fence technique, in which the plaintext is written down as
a sequence of diagonals and then read off as a sequence of rows. For example, to encipher the
message “meet me after the toga party” with a rail fence of depth 2, we write the following:

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 38

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 This sort of thing would be trivial to cryptanalyze. A more complex scheme is to write the
message in a rectangle, row by row, and read the message off, column by column, but permute
the order of the columns. The order of the columns then becomes the key to the algorithm. For
example,

 Thus, in this example, the key is 4312567. To encrypt, start with the column that is
labeled 1, in this case column 3. Write down all the letters in that column. Proceed to
column 4, which is labeled 2, then column 2, then column 1, then columns 5, 6, and 7.
 The transposition cipher can be made significantly more secure by performing more than
one stage of transposition. The result is a more complex permutation that is not easily
reconstructed. Thus, if the foregoing message is reencrypted using the same algorithm,

 To visualize the result of this double transposition, designate the letters in the original
plaintext message by the numbers designating their position. Thus, with 28 letters in the
message, the original sequence of letters is

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 39

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 This is a much less structured permutation and is much more difficult to crypt analyze.

10. Explain in detail about the Steganography. (Apr/May -2019)

Contents
 Techniques
 Character marking
 Invisible ink
 Pin punctures
 Typewriter correction ribbon
Techniques
 The methods of steganography conceal the existence of the message, whereas the methods of
cryptography render the message unintelligible to outsiders by various transformations of the
text.
 A simple form of steganography, but one that is time-consuming to construct, is one in which an
arrangement of words or letters within an apparently innocuous text spells out the real message.
 For example, the sequence of first letters of each word of the overall message spells out the
hidden message. Consider an example A Puzzle for Inspector Morse in which a subset of the
words of the overall message is used to convey the hidden message. See if you can decipher this;
it’s not too hard.(Refer figure 1.11 Conversion of plain text into cipher text)

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 40

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig. 1.11 A Puzzle for Inspector Morse

Various other techniques have been used historically; some examples are the following:
• Character marking: Selected letters of printed or typewritten text are overwritten in pencil. The
marks are ordinarily not visible unless the paper is held at an angle to bright light.
• Invisible ink: A number of substances can be used for writing but leave no visible trace until heat
or some chemical is applied to the paper.
• Pin punctures: Small pin punctures on selected letters are ordinarily not visible unless the paper
is held up in front of a light.
• Typewriter correction ribbon: Used between lines typed with a black ribbon, the results of
typing with the correction tape are visible only under a strong light.
 The advantage of steganography is that it can be employed by parties who have something to
lose should the fact of their secret communication (not necessarily the content) be discovered.
 Encryption flags traffic as important or secret or may identify the sender or receiver as someone
with something to hide. Steganography has a number of drawbacks when compared to
encryption.
 It requires a lot of overhead to hide a relatively few bits of information, although using a scheme
like that proposed in the preceding paragraph may make it more effective.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 41

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

11. Encrypt the message “this is an exercise” using additive cipher with key = 20. Ignore the
space between words. Decrypt the message to get the Original plaintext.
(NOV/DEC 2021)
Encryption :
 In the shift cipher, the encryption algorithm is “shift key characters down”, with equal to some
number. Shifting characters down is to move the characters to the end of the alphabet. If we
reach the end of the alphabet, we wrap around.
 Given key = 20 and the message to be encrypted is “THIS IS AN EXERCISE”
 We encode the characters A to Z as 1 to 26. To wrap around, we subtract 26
 We first encode each letter in order encode the entire message.
T – 20 + 20 = 40 – 26 = 14 N
H – 8 + 20 = 28 − 26 = 2 B
I – 9 + 20 = 29 − 26 = 3 C
S – 19 + 20 = 39 − 26 = 13 M
I – 9 + 20 = 29 − 26 = 03 C
S – 19 + 20 = 39 − 26 = 13 M
A – 0 + 20 = 20 U
N –14 + 20 = 34 − 26 = 08 H
E – 5 + 20 = 25 Y
X – 24 + 20 = 44 − 26 = 18 R
E – 5 + 20 = 25 Y
R – 18 + 20 = 38 − 26 = 12 L
C – 3 + 20 = 23 W
I – 9 + 20 = 29 − 26 = 03 C
S – 19 + 20 = 39 − 26 = 13 M
E – 5 + 20 = 25 Y
Therefore the encoded message is NBCM CM UH YRYLWCMY

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 42

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

12. Explain in detail about Foundations of modern cryptography.

 Modern cryptography is the cornerstone of computer and communications security.
Its foundation is based on various concepts of mathematics such as number theory,
computational-complexity theory, and probability theory.

Characteristics of Modern Cryptography (Refer Table 1.6)

 There are three major characteristics that separate modern cryptography from the
classical approach.

Classic Cryptography Modern Cryptography

It manipulates traditional characters, i.e., letters and
It operates on binary bit sequences.
digits directly.
It relies on publicly known mathematical
algorithms for coding the information.
Secrecy is obtained through a secrete key
It is mainly based on ‘security through obscurity’.
which is used as the seed for the
The techniques employed for coding were kept
algorithms. The computational difficulty of
secret and only the parties involved in
algorithms, absence of secret key, etc.,
communication knew about them.
make it impossible for an attacker to obtain
the original information even if he knows
the algorithm used for coding.
Modern cryptography requires parties
It requires the entire cryptosystem for
interested in secure communication to
communicating confidentially.
possess the secret key only.

Table 1.6 – Differentiation of Modern cryptography from classic cryptography

Fig.1.12 shows the types of Cryptology, the study of cryptosystems, can be subdivided into two
branches −
 Cryptography
 Cryptanalysis

Fig. 1.12. Cryptology

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 43

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Cryptosystems
 A cryptosystem is an implementation of cryptographic techniques and their
accompanying infrastructure to provide information security services. A cryptosystem is
also referred to as a cipher system.

 Let us discuss a simple model of a cryptosystem that provides confidentiality to the

information being transmitted. This basic model is depicted in the illustration below −

Fig. 1.13. Cryptosystems

 The illustration Fig. 1.13 shows a sender who wants to transfer some sensitive data to a
receiver in such a way that any party intercepting or eavesdropping on the communication
channel cannot extract the data.

 The objective of this simple cryptosystem is that at the end of the process, only the sender
and the receiver will know the plaintext.

Components of a Cryptosystem
 The various components of a basic cryptosystem are as follows −

 d by the encryption algorithm using a specific the encryption key. Plaintext. It is the data to
be protected during transmission.

 Encryption Algorithm. It is a mathematical process that produces a cipher text for any
given plaintext and encryption key. It is a cryptographic algorithm that takes plaintext and
an encryption key as input and produces a cipher text.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 44

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Cipher text. It is the scrambled version of the plaintext produce The cipher text is not
guarded. It flows on public channel. It can be intercepted or compromised by anyone who
has access to the communication channel.

 Decryption Algorithm, It is a mathematical process, that produces a unique plaintext for

any given cipher text and decryption key. It is a cryptographic algorithm that takes a cipher
text and a decryption key as input, and outputs a plaintext. The decryption algorithm
essentially reverses the encryption algorithm and is thus closely related to it.

 Encryption Key. It is a value that is known to the sender. The sender inputs the encryption
key into the encryption algorithm along with the plaintext in order to compute the cipher
text.

 Decryption Key. It is a value that is known to the receiver. The decryption key is related to
the encryption key, but is not always identical to it. The receiver inputs the decryption key
into the decryption algorithm along with the cipher text in order to compute the plaintext.

For a given cryptosystem, a collection of all possible decryption keys is called a key space.

An interceptor (an attacker) is an unauthorized entity who attempts to determine the plaintext. He
can see the cipher text and may know the decryption algorithm. He, however, must never know
the decryption key.

Types of Cryptosystems

Fundamentally, there are two types of cryptosystems based on the manner in which
encryption- decryption is carried out in the system −
 Symmetric Key Encryption

 Asymmetric Key Encryption

The main difference between these cryptosystems is the relationship between the encryption and
the decryption key.

Logically, in any cryptosystem, both the keys are closely associated. It is practically impossible to
decrypt the cipher text with the key that is unrelated to the encryption key.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 45

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Symmetric Key Encryption

The encryption process where same keys are used for encrypting and decrypting the
information is known as Symmetric Key Encryption. (Refer figure 1.14)
The study of symmetric cryptosystems is referred to as symmetric cryptography. Symmetric
cryptosystems are also sometimes referred to as secret key cryptosystems.
A few well-known examples of symmetric key encryption methods are − Digital
Encryption Standard (DES), Triple-DES (3DES), IDEA, and BLOWFISH.

Fig.1.14.Symmetric Key Encryption

Prior to 1970, all cryptosystems employed symmetric key encryption. Even today, its
relevance is very high and it is being used extensively in many cryptosystems. It is very
unlikely that this encryption will fade away, as it has certain advantages over asymmetric
key encryption.
The salient features of cryptosystem based on symmetric key encryption are −
 Persons using symmetric key encryption must share a common key prior to
exchange of information.
 Keys are recommended to be changed regularly to prevent any attack on the system.
 A robust mechanism needs to exist to exchange the key between the communicating
parties. As keys are required to be changed regularly, this mechanism becomes expensive
and cumbersome. In a group of n people, to enable two-party communication between any
two persons, the number of keys required for group is n × (n – 1)/2.
 Length of Key (number of bits) in this encryption is smaller and hence, process of

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 46

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

encryption - decryption is faster than asymmetric key encryption.

• Processing power of computer system required to run symmetric algorithm is less.
Challenge of Symmetric Key Cryptosystem

There are two restrictive challenges of employing symmetric key cryptography.

 Key establishment − before any communication, both the sender and the receiver need to agree
on a secret symmetric key. It requires a secure key establishment mechanism in place.
 Trust Issue − Since the sender and the receiver use the same symmetric key, there is an implicit
requirement that the sender and the receiver ‘trust’ each other. For example, it may happen that
the receiver has lost the key to an attacker and the sender is not informed.
These two challenges are highly restraining for modern day communication. Today, people need to
exchange information with non-familiar and non-trusted parties. For example, a communication
between online seller and customer. These limitations of symmetric key encryption gave rise to
asymmetric key encryption schemes.
Asymmetric Key Encryption
The encryption process where different keys are used for encrypting and decrypting the
information is known as Asymmetric Key Encryption. Though the keys are different, they are
mathematically related and hence, retrieving the plaintext by decrypting cipher text is feasible.
The process is depicted in the following Fig 1.15

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 47

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Fig.1.15.Asymmetric Key Encryption

Asymmetric Key Encryption was invented in the 20th century to come over the necessity
of pre- shared secret key between communicating persons. The salient features of this
encryption scheme are as follows –

 Every user in this system needs to have a pair of dissimilar keys, private key and
public key. These keys are mathematically related when one key is used for
encryption, the other can decrypt the cipher text back to the original plaintext.
 It requires to put the public key in public repository and the private key as a well-
guarded secret. Hence, this scheme of encryption is also called Public Key
Encryption.
 Though public and private keys of the user are related, it is computationally not
feasible to find one from another. This is a strength of this scheme.

 When Host1 needs to send data to Host2, he obtains the public key of Host2 from
repository, encrypts the data, and transmits.
 Host2 uses his private key to extract the plaintext.
 Length of Keys (number of bits) in this encryption is large and hence, the process
of encryption-decryption is slower than symmetric key encryption.
 Processing power of computer system required to run asymmetric algorithm is higher.
Symmetric cryptosystems are a natural concept. In contrast, public-key
cryptosystems are quite difficult to comprehend.
• You may think, how can the encryption key and the decryption key are ‘related’,
and yet it is impossible to determine the decryption key from the encryption key?
The answer lies in the mathematical concepts.
• It is possible to design a cryptosystem whose keys have this property. The concept
of public-key cryptography is relatively new. There are fewer public-key
algorithms known than symmetric algorithms.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 48

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Challenge of Public Key Cryptosystem

 Public-key cryptosystems have one significant challenge − the user needs to trust that
the public key that he is using in communications with a person really is the public key
of that person and has not been spoofed by a malicious third party.

 This is usually accomplished through a Public Key Infrastructure (PKI) consisting a

trusted third party. The third party securely manages and attests to the authenticity of
public keys. When the third party is requested to provide the public key for any
communicating person X, they are trusted to provide the correct public key.

 The third party satisfies itself about user identity by the process of attestation,
notarization, or some other process − that X is the one and only, or globally unique, X.
The most common method of making the verified public keys available is to embed
them in a certificate which is digitally signed by the trusted third party.

Relation between Encryption Schemes

A summary of basic key properties of two types of cryptosystems is given below – (Refer
Table 1.7)

Symmetric Cryptosystems Public Key Cryptosystems

Relation between Keys Same Different, but mathematically related

Encryption Key Symmetric Public

Decryption Key Symmetric Private

Table 1.7 – Properties of Cryptosystems

Due to the advantages and disadvantage of both the systems, symmetric key and public-key
cryptosystems are often used together in the practical information security systems
13. List out any two di-gram, two tri-gram. Shortly describe the application of di-gram and tri-
gram in cryptography. (NOV/DEC 2021)
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 49
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Monogram
 Bigram
 Trigram

 Frequency counts
Introduction to Frequency Analysis

 Frequency analysis is the practice of counting the number of occurrences of different

cipher text characters in the hope that the information can be used to break ciphers.
Frequency analysis is not only for single characters, it is also possible to measure the
frequency of bigrams (also called digraphs), which is how often pairs of characters occur
in text.
 Trigram frequency counts measure the occurrence of 3 letter combinations.
 When talking about bigram and trigram frequency counts, this will concentrate on text
characterization as opposed to solving polygraphic ciphers e.g. playfair. The difference is
that text characterization depends on all possible 2 character combinations, since we wish
to know about as many bigrams as we can (this means we allow the bigrams to overlap).
When cracking playfair, we do not allow the bigrams to overlap.
 If you want monogram, bigram, trigram or quadgram frequencies pre-calculated for a
certain language.
Monogram Counts
 Monogram frequency counts are most effective on substitution type ciphers such as
the caesar cipher, substitution cipher, polybius square etc. It works because natural
english text follows a very specific frequency distribution, which is not masked by
substitution ciphers. The distribution looks like:
Bigram Counts
 Bigram counts maintain the same principle as monogram counts, but instead of counting
occurances of single characters, bigram counts count the frequency of pairs of characters
Trigram Counts
 Just as bigram counts count the frequency of pairs of characters, trigram counts count the
frequency of triple characters.
Application

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 50

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 Computational linguistics (for instance, statistical natural language

processing), computational biology (for instance, biological sequence analysis), and data
compression.

14. Using Fermat’s theorem, find a mod p and prove Euler’s totient value of any prime number
p is p-1 and the Euler’s totient value of any non prime number n is (p-1)*(q-9). (NOV/DEC
2021)
Contents
 Fermat’s Theorem
 Proof:
 Euler’s Totient Function
 Euler’s Theorem
 Proof:

 Two theorems that play important roles in public-key cryptography are Fermat’s theorem
and Euler’s theorem.
Fermat’s Theorem
 Fermat’s theorem states the following: If p is prime and a is a positive integer not
divisible by p, then

Proof:
 Consider the set of positive integers less than p: {1, 2, c, p - 1} and multiply each element
by a, modulo p, to get the set X = {a mod p, 2a mod p, c, (p - 1)a mod p}.
Multiplying the numbers in both sets (p and X) and taking the result mod p yields

 We can cancel the (p - 1)! term because it is relatively prime to p . This yields Equation
which completes the proof.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 51

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 An alternative form of Fermat’s theorem is also useful: If p is prime and a is a positive

integer, then

 Note that the first form of the theorem [Equation (8.2)] requires that a be relatively prime
to p, but this form does not.

Euler’s Totient Function

 Before presenting Euler’s theorem, we need to introduce an important quantity in number
theory, referred to as Euler’s totient function, written f(n), and defined as the number of
positive integers less than n and relatively prime to n. By convention, f(1) = 1.
 It should be clear that, for a prime number p,

 Now suppose that we have two prime numbers p and q with p≠ q. Then we can show that,
for n = pq,

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 52

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

Euler’s Theorem
Euler’s theorem states that for every a and n that are relatively prime:

Proof:
 f(n) = (n - 1) and Fermat’s theorem holds. However, it also holds for any integer n.
Recall that f(n) is the number of positive integers less than n that are relatively prime to n.
Consider the set of such integers, labeled as

 That is, each element xi of R is a unique positive integer less than n with gcd(xi, n) = 1.
Now multiply each element by a, modulo n:

The set S is a permutation of R, by the following line of reasoning:

1. Because a is relatively prime to n and xi is relatively prime to n, axi must also be
relatively prime to n. Thus, all the members of S are integers that are less than n and that
are relatively prime to n.
2. There are no duplicates in S. Refer to Equation (4.5). If axi mod n = axj mod n, then xi =
x j.
Therefore,

 This completes the proof. This is the same line of reasoning applied to the proof of
Fermat’s theorem.

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 53

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

 As is the case for Fermat’s theorem, an alternative form of the theorem is also useful:

Anna University Questions

PART-A

1. Briefly define the Caesar cipher. (NOV/DEC 2012)

2. Explain the avalanche effect (NOV/DEC 2012)
3. What is the difference between a mono alphabetic cipher and a polyalphabetic?
4. What is the difference between a Caesar cipher and a polyalphabetic cipher? (NOV/DEC
2012)
5. Briefly define the Playfair cipher. (MAY/JUNE 2011)
6. What are the two general approaches to attacking a cipher? (MAY/JUNE 2011)
7. Convert the given text “anna university” into cipher text using rail fence technique.
8. Define Steganography. (MAY/JUNE 2013)
9. Give an example each for substitution and transposition ciphers. (NOV/DEC 2013)
10. Why modular arithmetic has been used in cryptography? (NOV/DEC 2013)
11. What are active and passive attacks that compromise information security?
12. Why random numbers are used in network security? (AU May/Jun 2014)
13. State Euler’s theorem. (AU May/Jun 2014)
14. What are the two basic functions used in encryption algorithms?
17. List the types of cryptanalytic attacks. (AU Nov/Dec 2014)
18. What is the difference between a block cipher and a stream cipher?
19. Decipher the following cipher text using brute force attack. (AU NOV/DEC 2014)
20. State fermat’s theorem. (AU May-June 2017)
21. Determine the gcd(24140,16762) using Euclid’s algorithm. (AU May-June 2017)
PART-B

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 54

 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

1. Write about Fermat and Euler’s theorem in detail. (MAY/JUNE 2013) (AU APRIL /
MAY2011) (AU Nov/Dec 2012)
2. Explain Substitution Techniques in cryptography. (NOV/DEC 2012) (June2013)
3. Write about any two classical cryptosystem (substitution and transposition) with example.
(MAY/JUNE 2013)(MAY/JUN 2014)
4. What are the different types of attacks? Explain. (NOV/DEC 2013)
5. State and explain Chinese remainder theorem with example. (NOV/DEC 2013)
6. State Fermat’s theorem. (NOV/DEC 2013)
7. Find 321 mod 11 using Fermat’s theorem. (NOV/DEC 2013)
8. State Euler’s theorem to find gcd with example. (NOV/DEC 2013)
9. Explain Monoalphabetic Ciphers & playfair cipher, Hill cipher.
10. Explain classical encryption techniques. (April/ May 2017)
11. Explain in detail about Finite fields. (MAY/JUN 2014)
12. Encrypt the message “PAY” using Hill cipher with the following key matrix and show the
decryption to get the original plaintext. (NOV/DEC 2014)
K= 17 17 5
21 18 21
2 2 19
13. Describe : a) playfair cipher b) Railfence cipher C) Vigenere cipher.(AU MAY 2017)
14. State Chinese Reminder theorem and find X for the given set of congruent equations using
CRT. X=1(mod 5) X=2(mod 7) X=3(mod 9) X=4(mod 11). (MAY 2017)

NOV/DEC-2021
PART-A
1. What is meant by Denial of Service attack? Is it Active Attack or Passive Attack?
2. Let message = “Anna”, and k = 3, find the cipher text using Caesar.
PART-B
11. (a) (i) Let message = “graduate”, Key = “word”, find ciphertext using playfair cipher. (8)
(ii) List out any two di-gram, two tri-gram. Shortly describe the application of di-gram and tri-
gram in cryptography. (5)
Or
PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 55
 MAILAM ENGINEERING COLLEGE
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
CB3491 CRYPTOGRAPHY AND CYBER SECURITY - UNIT 1

(b) Demonstrate encryption and decryption process in hill cipher. Consider m = “sh” and key =
hill”. (13)

NOV/DEC-2020
PART-A
1. Compare active and passive attack.
2. Encrypt the plaintext to be or not to be using the vigenere cipher for the key value Now.
PART-B
11. a) i) What is monoalphabetic cipher ? Examine how it differs from Caesar cipher. (7)
ii) Encrypt the message “this is an exercise” using additive cipher with key = 20. Ignore the
space between words. Decrypt the message to get the original plaintext. (6)
(or)
11. b) i) Explain OSI Security Architecture model with neat diagram. (7)
ii) Describe the various security mechanisms. (6)

PREPARED BY: Ms.G.SARASWATHI AP/CSE, Mrs.S.M.SASSIREKHA AP/CSE, Mrs.S.ASWINI AP/CSE Page 56