Cyber and Information Security Notes | B.Sc. (Computer Science) Semester 5 | Mumbai University | munotes

Contents

Module I Introduction, classical encryption, public-key cryptography and RSA, key management, message authentication and hash functions

1. What Security Means: Confidentiality, Integrity and Availability 1
2. The Security Trend: Why Attacks Got Easier as Attackers Got Less Skilled 5
3. The OSI Security Architecture: The Words This Subject Is Spoken In 10
4. Security Attacks: Passive and Active 15
5. Security Services: The Five Things Security Promises 20
6. Security Mechanisms, and Which Service Each One Serves 25
7. The Symmetric Cipher Model 30
8. Cryptanalysis and the Attack Models 35
9. The Caesar Cipher, and Breaking It in Twenty-five Tries 41
10. Monoalphabetic Substitution, and Breaking It by Frequency 46
11. The Playfair Cipher 51
12. The Hill Cipher 57
13. Polyalphabetic Ciphers: Vigenere and the Autokey 64
14. The One-Time Pad, and What Perfect Secrecy Means 70
15. Transposition Techniques: Rail Fence and Row Transposition 75
16. Steganography: Hiding That There Is a Message at All 81
17. Block Ciphers and Stream Ciphers: The Difference That Decides Everything 86
18. The Feistel Cipher Structure, Confusion and Diffusion 91
19. The Data Encryption Standard: The Shape of It 97
20. Inside a DES Round: Expansion, the S-boxes and the Permutation 102
21. The DES Key Schedule 110
22. DES Run End to End: Decryption, and the Avalanche Effect 116
23. The Strength of DES: Fifty-six Bits, and the Machines That Broke It 125
24. The Advanced Encryption Standard 131
25. Multiple Encryption, Double DES and the Meet-in-the-Middle Attack 138
26. Triple DES, and Where It Stands Now 145
27. Electronic Codebook Mode, and Why It Leaks 154
28. Cipher Block Chaining 160
29. Cipher Feedback, Output Feedback and Counter Mode 166
30. Stream Ciphers and RC4 173
31. The Arithmetic of Public Keys: Modular Arithmetic and the gcd 179
32. Fermat, Euler and the Totient Function 187
33. Fast Modular Exponentiation, and Testing a Number for Primality 194
34. Principles of Public-Key Cryptosystems 202
35. The RSA Algorithm 208
36. Why RSA Works, and How It Is Attacked 215
37. Textbook RSA Is Not RSA: Why Padding Exists 223
38. Distributing a Public Key: Announcement, Directory, Authority, Certificate 230
39. Key Management for Secret Keys: Session Keys and the Key Hierarchy 235
40. Diffie-Hellman Key Exchange 241
41. The Man in the Middle, and Why Diffie-Hellman Needs Authentication 250
42. Authentication Requirements: The Attacks on a Message 256
43. Authentication Functions: Encryption, MAC and Hash 260
44. Message Authentication Codes 265
45. Hash Functions: What One Must Do 271
46. How a Hash Function Is Built, and Breaking a Small One 276
47. Security of Hash Functions and MACs: The Birthday Attack 282
48. The Secure Hash Algorithm: SHA-1, SHA-256 and SHA-512 289
49. HMAC 298
50. Practical: Writing a Substitution and a Transposition Cipher 306
51. Practical: Generating and Verifying a Message Authentication Code 311
52. Practical: A Diffie-Hellman Exchange in Code 316

Module II Digital signatures and authentication, authentication applications, electronic mail security, IP security, web security, intrusion, malicious software and firewalls

1. Digital Signatures: What One Is and What It Must Do 322
2. The RSA Digital Signature 327
3. The ElGamal and Schnorr Signature Schemes 333
4. Direct and Arbitrated Digital Signatures 340
5. Authentication Protocols: Mutual Authentication and the Replay Problem 345
6. One-Way Authentication, and Authentication with a Public Key 352
7. The Digital Signature Standard, and the DSA Algorithm 357
8. What the Signature Standard Says Today, and Why DSA Left It 364
9. Kerberos: The Problem It Solves 371
10. The Kerberos Dialogue, Step by Step 381
11. Kerberos Version 5, Realms and What Changed 392
12. X.509: The Certificate and Its Fields 402
13. Certificate Chains, Revocation and the CRL 413
14. Public-Key Infrastructure 425
15. Pretty Good Privacy: The Five Services 434
16. How a PGP Message Is Built, and Radix-64 443
17. PGP Key Management and the Web of Trust 452
18. S/MIME 460
19. IP Security: What It Is For 468
20. The IPsec Architecture: SA, SPD, Transport and Tunnel Mode 475
21. The Authentication Header 483
22. Encapsulating Security Payload 490
23. Combining Security Associations 496
24. IPsec Key Management: Oakley, ISAKMP and IKE 503
25. Web Security Considerations 512
26. SSL: The Architecture and the Record Protocol 518
27. The SSL and TLS Handshake 525
28. TLS, and What Each Version Fixed 533
29. Secure Electronic Transaction, and the Dual Signature 544
30. Intruders: Who They Are and What They Do 552
31. Intrusion Techniques: Attacking the Password File 558
32. Password Selection and Management 564
33. Intrusion Detection: Statistical Anomaly and Rule-Based 571
34. Audit Records, Distributed Intrusion Detection and Honeypots 577
35. Malicious Software: The Taxonomy 584
36. Viruses: The Four Phases, the Structure and the Types 589
37. Worms, and the Ones That Made History 596
38. Virus Countermeasures 603
39. Denial of Service and Distributed Denial of Service 609
40. DDoS Countermeasures 615
41. Firewall Design Principles 621
42. Types of Firewalls 627
43. Firewall Configurations, and a Rule Base Read Line by Line 634
44. Practical: Signing and Verifying a Message in Code 640
45. Practical: Configuring IPsec, and Reading the Policy Back 645
46. Practical: Certificates and a Secure Session, End to End 651
47. Practical: Setting Up an Intrusion Detection System 657
48. Practical: Analysing a Malware Sample, Safely 662
49. How the Paper Is Set, and How to Answer It 668
50. The Comparisons That Cross Both Modules 673