Computer Security Principles and Cryptographic Systems

Foundations of Computer Security

The CIA Triad and Security Design Principles

• Confidentiality: Ensures data is accessible only to authorized entities. It prevents unauthorized disclosure of sensitive information using encryption, access controls, and data masking.
• Integrity: Guarantees that data remains accurate, complete, and uncorrupted by unauthorized modification or deletion. Maintained using hash functions, checksums, and digital signatures.
• Availability: Ensures systems, networks, and data remain operational and accessible to authorized users when needed. Protected via hardware redundancy, backups, and DDoS mitigation.
• Key Design Principles:
  • Least Privilege: Give entities only the minimum permissions necessary to perform their functions.
  • Fail-Safe Defaults: Access decisions should default to "deny" unless explicitly allowed.
  • Economy of Mechanism: Keep security designs as simple and small as possible to minimize flaws.
  • Complete Mediation: Every access attempt to every object must be checked against the security policy.
  • Open Design: Security mechanisms should not depend on secrecy of design (Kerckhoffs's principle).
  • Separation of Privilege: Require multiple conditions or keys to grant access.

Active vs Passive Security Attacks

• Passive Attacks: The attacker monitors or eavesdrops on communications without altering data or system resources.
  • Goal: Learn confidential information.
  • Detection: Extremely difficult to detect because system resources are not modified.
  • Defense: Focuses on prevention (e.g., strong encryption).
  • Examples: Eavesdropping, network packet sniffing, and traffic analysis.
• Active Attacks: The attacker attempts to alter system resources, modify data streams, or disrupt network operations.
  • Goal: Cause damage, gain unauthorized access, or disrupt services.
  • Detection: Easier to detect due to abnormal system behavior or altered records.
  • Defense: Focuses on detection and recovery alongside prevention.
  • Examples: Masquerading (identity theft), Replay attacks, Message modification, and Denial of Service (DoS).

OSI Security Architecture Model

Defined under the ITU-T X.800 recommendation, it organizes security into three core components:

• Security Attacks: Actions that compromise the security of information belonging to an organization. Classified as Passive (Release of message contents, traffic analysis) and Active (Masquerade, replay, modification, DoS).
• Security Services: Processing or communication services provided by a system to ensure adequate security of data transfers. Includes Authentication, Access Control, Data Confidentiality, Data Integrity, Non-repudiation, and Availability.
• Security Mechanisms: Technical processes designed to detect, prevent, or recover from security attacks. Includes Encipherment, Digital Signatures, Access Control mechanisms, Data Integrity mechanisms, Authentication Exchange, Traffic Padding, Routing Control, and Notarization.

Security Concepts and Implementation Challenges

• Fundamental Concepts: Computer security focuses on protecting digital assets (hardware, software, data) across three core dimensions: Threats (potential dangers), Vulnerabilities (flaws in system design/implementation), and Controls/Countermeasures (defenses put in place to mitigate risk).
• Challenges of Security Implementation:
  • Security is not simple; mechanisms often have subtle, unexpected edge-case vulnerabilities.
  • Defenders must anticipate all possible attack vectors, while attackers only need to find one weak point.
  • Security procedures often impose user friction, leading people to bypass safety controls.
  • Security requires continuous operational upkeep, updates, and monitoring, rather than a single static setup.

Cryptographic Algorithms and Techniques

Classical Encryption and Cipher Types

Classical ciphers operate on characters or alphabets using manual algorithms or basic mechanical hardware.

• Substitution Ciphers: Plaintext characters are replaced by other characters, numbers, or symbols while preserving their positions.
  • Types: Monoalphabetic (Caesar Cipher) and Polyalphabetic (Vigenère Cipher, Playfair Cipher).
• Transposition Ciphers: Plaintext characters retain their original identity, but their positions are rearranged or shuffled.
  • Types: Rail Fence Cipher, Row Columnar Transposition.

Mathematical Procedures for Classical Ciphers

• Caesar Cipher: Shifts each letter by key K.
  • Encryption: C = (P + K) mod 26
  • Decryption: P = (C - K) mod 26
• Playfair Cipher: Encrypts pairs of letters (digraphs) using a 5x5 grid of letters based on a key phrase. Letters in the same row shift right; letters in the same column shift down; otherwise, they form a rectangle and take letters from opposite corners.
• Vigenère Cipher: Uses a repeating keyword K matched with plaintext P.
  • Encryption: C_i = (P_i + K_i) mod 26
• Rail Fence Cipher: Writes plaintext diagonally down and up across N predefined rows ("rails"), then reads off character sequences row by row.

Symmetric vs Asymmetric Cryptography

Data Encryption Standard (DES) Architecture

DES is a symmetric block cipher that processes 64-bit plaintext blocks using a 56-bit effective key size over a 16-round Feistel network structure.

1. Initial Permutation (IP): Shuffles the 64-bit input block.
2. 16 Rounds of Feistel Processing: The block is split into 32-bit Left (L) and Right (R) halves:
   • L_i = R_i-1
   • R_i = L_i-1 ⊕ f(R_i-1, K_i)
   • The Round Function f expands R_i-1 from 32 to 48 bits, XORs it with a 48-bit subkey, passes it through 8 S-Boxes (non-linear substitution), and processes it through a P-Box (permutation).
3. 32-Bit Swap & Inverse IP (IP^-1): Final right and left halves are recombined and permuted to output the 64-bit ciphertext.

Advanced Encryption Standard (AES) Functions

AES is a non-Feistel symmetric block cipher (128-bit block size) with key sizes of 128, 192, or 256 bits (requiring 10, 12, or 14 rounds respectively). The internal array of bytes is structured as a 4x4 matrix called the State.

• Round Functions:
  1. SubBytes: Non-linear byte substitution using a fixed S-Box lookup table.
  2. ShiftRows: Cyclically shifts bytes in the bottom three rows of the State matrix to the left by different offsets.
  3. MixColumns: Applies a mathematical transformation operating on columns using Galois Field GF(2⁸) arithmetic (omitted in the final round).
  4. AddRoundKey: XORs the 128-bit State with a round key generated by the AES Key Schedule.

Block Ciphers vs Stream Ciphers

• Block Ciphers: Encrypts fixed-size groups of bits (e.g., 64-bit or 128-bit blocks) simultaneously. They use feedback modes (CBC, CTR, GCM) for variable data stream handling. High diffusion. Examples: AES, DES, 3DES.
• Stream Ciphers: Encrypts continuous streams of plaintext data character by character or bit by bit by XORing plaintext with a pseudo-random keystream generated from a seed key. Faster processing with low memory overhead. Examples: RC4, ChaCha20.

The RSA Algorithm and Key Generation

RSA relies on the practical difficulty of factoring the product of two large prime numbers.

1. Key Generation:
   • Select two large distinct prime numbers p and q.
   • Calculate n = p × q and Euler's totient φ(n) = (p - 1)(q - 1).
   • Choose an integer e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1.
   • Calculate private key exponent d such that d · e ≡ 1 (mod φ(n)).
   • Public Key: (e, n); Private Key: (d, n).
2. Encryption: C = M^e mod n
3. Decryption: M = C^d mod n

Diffie-Hellman Key Exchange and MITM Risks

Diffie-Hellman allows two parties over an insecure channel to establish a shared secret key without sending the key itself.

• Algorithm Steps:
  1. Public shared parameters: Large prime p and primitive root g.
  2. Alice picks secret a, computes A = g^a mod p, and sends A to Bob.
  3. Bob picks secret b, computes B = g^b mod p, and sends B to Alice.
  4. Alice computes K = B^a mod p. Bob computes K = A^b mod p. Shared secret K = g^ab mod p.
• Man-in-the-Middle (MITM) Vulnerability: Diffie-Hellman lacks built-in identity authentication. An attacker in the network middle can intercept messages, exchange independent keys with both Alice and Bob separately, and decrypt or tamper with all traffic unobserved.

Message Authentication and Hash Functions

Properties of Secure Cryptographic Hash Functions

A cryptographic hash function H(M) takes an input string of arbitrary length and transforms it into a fixed-length output string (digest).

• Key Properties:
  • Pre-image Resistance (One-way): Given a hash value h, it is computationally infeasible to find input m such that H(m) = h.
  • Second Pre-image Resistance: Given input m₁, it is infeasible to find a different input m₂ such that H(m₁) = H(m₂).
  • Collision Resistance: It is computationally infeasible to find any two arbitrary distinct inputs m₁ and m₂ such that H(m₁) = H(m₂).
  • Avalanche Effect: Changing even a single bit in the input dramatically alters the output hash.

Hash-based Message Authentication Code (HMAC)

HMAC is a specific construction for calculating a Message Authentication Code involving a cryptographic hash function (such as SHA-256) combined with a shared secret key.

• Formula: HMAC(K, M) = H((K⁺ ⊕ opad) || H((K⁺ ⊕ ipad) || M))
• Objectives: Verify both data integrity and data origin authenticity simultaneously using fast hash operations without relying on asymmetric key primitives.

Comparing MD5 and the SHA Family

Digital Signatures and Security Services

A digital signature is a cryptographic mechanism produced by hashing a message M and encrypting that digest using the sender's Private Key.

• Authentication: The receiver uses the sender's Public Key to decrypt the signature. Successful decryption verifies the sender's identity.
• Integrity: The recipient hashes the received message and compares it to the decrypted signature hash. If they match, data was not altered.
• Non-repudiation: Since only the sender possesses their secret Private Key, they cannot deny signing the message once verified.

Digital Signature Standard (DSS) Structure

DSS is a FIPS standard (FIPS PUB 186) specifying algorithms allowed for digital signatures, including DSA, RSA, and ECDSA.

• Operational Structure:
  1. Signing: Sender calculates hash H(M) of message M. H(M) and a random value k are fed into the signing algorithm along with the sender's private key to output signature components (r, s).
  2. Verification: Recipient inputs message M, signature (r, s), and sender's public key into the verification algorithm. The output validates or rejects the signature based on algebraic equivalence.

User Authentication Mechanisms

Password-Based Authentication Vulnerabilities

• Weak Passwords: Users often choose predictable passwords vulnerable to dictionary and brute-force attacks.
• Eavesdropping & Keylogging: Passwords captured over unencrypted channels or via local keystroke malware.
• Rainbow Table Attacks: Precomputed tables of hashed passwords used to rapidly reverse unsalted hashes.
• Credential Stuffing: Automated reuse of compromised username/password pairs across multiple services.

Password Strategies and Token Authentication

• Password Selection Strategies:
  • Complexity Enforcements: Minimum length rules, mixed character classes.
  • Salting Hashes: Adding a unique random string to each password before hashing to disable rainbow table usage.
  • Passphrases: Encouraging long sequence phrases instead of complex short words.
• Token-Based Authentication: Employs physical or digital objects owned by the user (Something You Have).
  • Hardware Tokens: USB tokens (YubiKey), Smart Cards.
  • OTP Tokens: Time-based One-Time Passwords (TOTP) or HMAC-based Passwords (HOTP).

Biometric Authentication Systems

Biometrics verifies identity using unique physical (fingerprint, iris, retina, face) or behavioral characteristics (signature dynamics, keystroke rhythm).

• Mechanism: Capture Trait → Extract Feature Vector → Compare with stored Template → Output Match/No Match decision based on threshold.
• Advantages: High convenience, impossible to lose, non-transferable between people.
• Limitations: High computational overhead; false acceptances (FAR) / false rejections (FRR); biometric data cannot be changed if stolen.

Remote User Authentication and Challenge-Response

Remote authentication proves a user's identity across an untrusted network connection without transmitting sensitive authentication credentials in cleartext.

• Challenge-Response Framework:
  1. Client requests access from Server.
  2. Server generates a random, non-repeating value called a Challenge (Nonce) R and sends it to Client.
  3. Client computes Response Res = H(Secret Password || R) using its shared secret key and sends Res back.
  4. Server performs the identical calculation locally. If calculated output equals Res, authentication succeeds.

Kerberos Architecture and Authentication Process

Kerberos is a trusted third-party authentication protocol based on symmetric cryptography (Needham-Schroeder protocol).

• Core Entities: Client, Authentication Server (AS), Ticket Granting Server (TGS), and Application Server.
• Steps:
  1. AS Request: Client sends identity request to AS.
  2. AS Response: AS verifies client and returns a Ticket Granting Ticket (TGT) encrypted with TGS key, plus a Session Key.
  3. TGS Request: Client sends TGT and access request to TGS.
  4. TGS Response: TGS validates TGT and returns a Service Ticket (ST) encrypted with Application Server key.
  5. Server Access: Client presents Service Ticket to Application Server to gain resource access.

Access Control Models and Frameworks

Discretionary vs Mandatory Access Control

• Discretionary Access Control (DAC): The resource owner has complete control to grant or revoke access privileges to other users at their discretion (e.g., standard Unix chmod file permissions). Highly flexible, but vulnerable to malicious code transferring permissions without authorization.
• Mandatory Access Control (MAC): Centralized system policy dictates access. Users cannot alter permissions. Access is determined by matching subject security clearance levels (Unclassified, Confidential, Secret) with object security classifications (e.g., Bell-LaPadula framework).

Role-Based and Attribute-Based Access Control

• RBAC: Permissions are associated with specific job roles (e.g., Manager, Doctor, Auditor) rather than individual users. Users are assigned roles, simplifying rights administration in large organizations.
• ABAC: Granular access policy engine evaluating dynamic rules based on multiple attributes: Subject attributes (role, clearance), Object attributes (file sensitivity), Action attributes (read/write), and Environmental attributes (time of day, source IP address).

Access Rights and Trust Frameworks

• Access Rights: Specific permissions granted to an identity to execute actions on a target resource (Read, Write, Execute, Delete, Append, Modify).
• Trust Framework: An established set of identities, policies, specifications, and contractual agreements that allow different technical systems to recognize and trust identity credentials across organizational boundaries (e.g., Federated Identity using SAML or OAuth 2.0/OIDC).

Access Control Matrix, ACLs, and Capability Lists

• Access Control Matrix: A 2D conceptual grid where rows represent Subjects (Users), columns represent Objects (Files/Devices), and cells list granted rights.
• Access Control List (ACL): Matrix decomposed column-wise. Attached directly to the object (lists all subjects and their permissions for that specific file).
• Capability List: Matrix decomposed row-wise. Attached directly to the subject (acts like an unforgeable ticket listing all objects the user can access).

Malicious Software and Intrusion Detection

Classification of Malicious Software

• Virus: Malicious code that attaches itself to legitimate host executable files and replicates when host files run.
• Worm: Standalone self-replicating program that spreads autonomously over network connections without needing human interaction.
• Trojan Horse: Software that appears useful or legitimate but conceals malicious payload actions.
• Ransomware: Encrypts user system files and demands financial ransom for decryption keys.
• Spyware: Secretly monitors user activities, logging keystrokes, personal data, and browsing habits.

Virus Life Cycle and Countermeasures

• Life Cycle:
  1. Dormant Phase: Idle stage until triggered by a specific date, event, or condition.
  2. Propagation Phase: Virus places copies of itself into other executable programs or disks.
  3. Triggering Phase: Activated to perform its intended payload action.
  4. Execution Phase: Payload executes (displaying messages, corrupting files).
• Countermeasures: Signature matching scanning, heuristic behavior analysis, integrity checking (hash checks of system files), and isolated sandboxing environments.

Intrusion Detection Systems: HIDS and NIDS

An IDS acts as a proactive defense monitor that inspects system/network activities for malicious behavior or policy violations.

• HIDS (Host-based IDS): Monitors internal operational events, system call logs, file integrity, and process activity on a single specific host.
• NIDS (Network-based IDS): Placed at strategic network tap points to analyze real-time packet traffic flows across an entire network segment.

Signature-based vs Anomaly-based Detection

• Signature-based Detection: Compares active traffic/logs against a database of known threat signatures. Fast with near-zero false positives for known threats, but ineffective against Zero-Day attacks.
• Anomaly-based Detection: Establishes a baseline model of normal operational behavior. Any significant deviation from the baseline is flagged as an intrusion. Capable of catching Zero-Day threats, but prone to higher false-positive rates.

Honeypot Types and Defensive Deployment

A Honeypot is a decoy system deployed to lure attackers away from critical servers, record attack vectors, and study hacker behavior.

• Low-Interaction Honeypot: Emulates only basic network services/ports (e.g., standard SSH/HTTP ports). Requires minimal resources and is safe, but gathers limited attack depth data.
• High-Interaction Honeypot: Uses actual real operating systems and application stacks. Captures extensive attacker behavior, but poses higher operational risk if fully compromised.

Denial of Service (DoS) and DDoS Mechanisms

• DoS Attack: A single source floods target servers with bogus requests (SYN Floods, ICMP Floods, Ping of Death) to exhaust processing power, memory, or network bandwidth.
• DDoS Attack: An attacker uses a centralized Command-and-Control (C2) server to direct thousands of compromised zombie devices (Botnet) to flood the target simultaneously. Hard to mitigate due to massive traffic volume.

Network and Internet Security Protocols

IP Security (IPsec) Architecture and Modes

IPsec provides security services at the Network Layer (Layer 3) for IP communications.

• Core Protocols:
  • Authentication Header (AH): Provides connectionless integrity, data origin authentication, and anti-replay protection. Does not provide confidentiality.
  • Encapsulating Security Payload (ESP): Provides data confidentiality (encryption), along with origin authentication, integrity, and anti-replay services.
• Modes:
  • Transport Mode: Encrypts/authenticates only the IP payload; original IP headers remain visible (used host-to-host).
  • Tunnel Mode: Encrypts/authenticates the entire original IP packet, wrapping it with a new outer IP header (used for VPNs).

TLS/SSL and the Handshake Protocol

TLS/SSL operates at Layer 4 (Transport Layer) to secure communications over TCP.

• Handshake Protocol Steps:
  1. Client Hello: Client sends supported cipher suites, TLS version, and a client random number R_c.
  2. Server Hello: Server responds with selected cipher suite, server random number R_s, and its Digital Certificate.
  3. Authentication & Key Exchange: Client verifies server certificate. Client generates a Pre-Master Secret, encrypts it with Server Public Key, and sends it to Server.
  4. Key Generation: Both parties independently derive the Master Key and Session Keys using R_c, R_s, and Pre-Master Secret.
  5. Finished: Both sides send encrypted "Finished" messages to switch to symmetric session key encryption.

Secure Web Communication via HTTPS

HTTPS (HTTP Secure) is the integration of standard HTTP application protocol traffic layered directly over an encrypted TLS/SSL session (default port 443).

• It protects sensitive web traffic by ensuring:
  • Confidentiality: Encrypts request/response URLs, headers, POST data, and cookies.
  • Integrity: Hash checks prevent dynamic packet modification or injection mid-transit.
  • Authentication: Validates identity of website domain using SSL/TLS digital certificates signed by trusted Certificate Authorities (CAs).

Firewall Types and Filtering Mechanisms

A firewall is a network security device that controls incoming and outgoing network traffic based on predetermined security rules.

• Packet-Filtering Firewall: Inspects individual packets at Network/Transport layers (Layer 3/4) based on IP addresses, ports, and protocol types. Stateless and fast.
• Stateful Inspection Firewall: Tracks active connection states in a state table. Verifies whether incoming packets belong to an established, valid ongoing session.
• Application-Level Gateway (Proxy Firewall): Filters network traffic at the Application Layer (Layer 7). Inspects deep payload content (HTTP, FTP), offering high security at the cost of higher latency.

Email Security: PGP and S/MIME Protocols

• PGP (Pretty Good Privacy): Uses a decentralized Web of Trust model without central Certificate Authorities. Combines symmetric key encryption for content and public key cryptography for key exchange and digital signing.
• S/MIME (Secure/Multipurpose Internet Mail Extensions): Industry standard email security using centralized PKI (Public Key Infrastructure) with X.509 certificates to provide digital signing and encryption.

Security Auditing and Administration

Security Auditing Architecture

A security audit is an independent, systematic evaluation of an organization's system logs, security controls, procedures, and infrastructure to confirm compliance and security policy adherence.

• Auditing Architecture Components:
  • Event Generator: Collects raw security events from OS, network, and applications.
  • Audit Log Collector: Filters, normalizes, and routes generated audit records.
  • Audit Log Storage: Secure, tamper-proof repository storing log trails.
  • Analyzer/Reporting Unit: Automated analytics tool generating alerts and reports for administrators.

Audit Trail Analysis and Review Mechanisms

Audit trail analysis involves analyzing chronological event records to reconstruct user actions, investigate security breaches, and detect policy violations.

• Review Mechanisms:
  • Static Analysis/Batch Review: Scheduled parsing of logs using rule sets or automated log management tools.
  • Real-Time Analysis (SIEM): Security Information and Event Management systems aggregate logs live across enterprise nodes to correlate events.
  • Behavioral Baselining: Detecting anomaly deviations against statistical historical usage logs.

Risk Assessment and Management Processes

Risk Management is the structured process of identifying, assessing, and reducing technical risks to an acceptable level.

• Core Process Steps:
  1. Asset Identification: Catalog all valuable digital and physical systems.
  2. Threat & Vulnerability Assessment: Identify potential threats and system vulnerabilities.
  3. Risk Calculation: Risk Level = Likelihood of Occurrence × Business Impact.
  4. Risk Treatment Strategies:
     • Mitigation: Implement controls or firewalls to lower risk.
     • Avoidance: Stop high-risk activities entirely.
     • Transfer: Shift financial/operational risk (e.g., buying Cyber Insurance).
     • Acceptance: Formally acknowledge and absorb low-level risks when control costs exceed risk impact values.