When the tides of life turn against you... And the current upsets your boat... Don't waste those tears on what might have been... Just lay on your back and float!...

Lab 4 ~Modern Cryptography(extended version)~

Assalamualaikum w.b.t...

Lab 4 kiteorg encek terangkan tentang Modern Cryptography(extended version)...Haaa... yg nie pn makin bertambah fenin.. Aku dgr ajer aper encek terang kat depan.. Apa yg perlu kita tahu dalam lab nie antarenyer:-
• Implement Private and Public Key using RSA algorithm
• Implement Data Encryption Standard (DES) Algorithm.

Data Encryption Standard
Introduction
Nowadays, almost every information whether it is confidential or publicly available is kept in form of digital data. It can be stored in disk storage or even transmit over the internet. Realizing the Important to keep the digital data secure from any unauthorized personnel, National Bureau of Standards (NBS) published a notice in the Federal Register soliciting proposals for cryptographic algorithms to protect data during transmission and storage. After waiting for a year NBS received a proposal from IBM which have submitted a candidate that it had developed internally under the name LUCIFER. After evaluating the algorithm with the help of the National
Security Agency (NSA), the NBS adopted a modification of the LUCIFER algorithm as the new Data Encryption Standard DES works by encrypting groups of 64 message bits, which is the same as 16 hexadecimal numbers. To do the encryption, DES uses "keys" where are also 64 bits long. However, every 8th key bit is ignored in the DES algorithm, so that the effective key size is 56. The Plaintext and the Key will undergo 16 rounds of expansion, substitution, key mixing and permutation process.
The overall Algorithm of DES is illustrated in figure below operation undertaken in each round.









Encryption Using DES
1. This task demonstrates the first round process of the DES algorithm.
2. The plain text message to be encrypted is “HELLOBOB” and the key is “MYKEYISA”
3. Rewriting the plain text message and key in binary format will gives you
M= 01001000 01000101 01001100 01001100 01001111 01000010 01001111 01000010
K= 01001101 01011001 01001011 01000101 01011001 01001001 01010011 01000001
4. Continue the process.....


Ermmm... fenin fenin jugak.. dgr encek ajr pn dgr gakk... macam biaser da abes lab kene la wat review question... yuhuuuu...


alhamdulillah....


"Never doubt in the dark what God told you in the light.."

Read More......

Lecture 4 ~Authentication & Access Control~

Assalamualaikum w.b.t...

Lam kelas lecture 4 kami didedahkan dgn bab Authentication & Access Control.. Lam lecture ni kire pasal camner nk verify identity n password la... Topic yg cover lam lecture nie:-
~Authentication
•Password
•Biometric
~Access control
•Matrix
•List
•Unix access control

What is Authentication?
~Verification of identity of someone who generated some data
~Relates to identity verification
~classifications of identity verification:
•by something known e.g. password
•by something possessed e.g. smart card, passport
•by physical characteristics (biometrics) e.g. finger prints, palm prints, retina,
voice
•by a result of involuntary action : signature


Authentication
~Requirements – must be able to verify that:
•Message came from apparent source or author
•Contents have not been altered
•Sometimes, it was sent at a certain time or sequence
~Protection against active attack (falsification of data and transactions)


Password
~Protection of passwords
•Don’t keep your password to anybody
•Don’t write or login your password at everywhere
•Etc.
~Choosing a good password
•Criteria:
*Hard to guess and easy to remember
•Characteristics of a good password
*Not shorter than six characters
*Not patterns from the keyboard
*Etc.
~Calculations on password
•Password population, N =rs
•Probability of guessing a password = 1/N
•Probability of success, P=nt/N


Example of Password Calculation
~Assume you choose character from a-z and 0-9 and the number of characters required
are 5.
•Determine how much time will be needed to get the right password if your
capability of your computer is 400 MIPS.
•Give your opinion/conclusion from this problem.


Time taken to crack password




Techniques for guessing passwords
•Try default passwords.
•Try all short words, 1 to 3 characters long.
•Try all the words in an electronic dictionary(60,000).
•Collect information about the user’s hobbies, family names, birthday, etc.
•Try user’s phone number, social security number, street address, etc.
•Try all license plate numbers
•Use a Trojan horse
•Tap the line between a remote user and the host system.


Password Selecting Strategies
•User education
•Computer-generated passwords
•Reactive password checking
•Proactive password checking


Example of Password
~Based on the passwords given below, determine which passwords are good or bad,
include one reason for each password :
•UTeM1
•hon05da
•MyviT05
•haikal
•king
•zamrud


What is Biometric?
•The term is derived from the Greek words bio (= life) and metric (= to measure)
•Biometrics is the measurement and statistical analysis of biological data
•In IT, biometrics refers to technologies for measuring and analysing human body
characteristics for authentication purposes
•Definition by Biometrics Consortium – automatically recognising a person using
distinguishing traits


How does it works?
•Each person is unique
•What are the distinguishing traits that make each person unique?
•How can these traits be measured?
•How different are the measurements of these distinguishing traits for different
people?


Verification vs Identification
~Verification (one-to-one comparison) –confirms a claimed identity
•Claim identity using name, user id, …
~Identification (one-to-many comparison) – establishes the identity of a subject
from a set of enrolled persons
•Employee of a company?
•Member of a club?
•Criminal in forensics database?


Biometric Identifiers
•Universality
•Uniqueness
•Stability
•Collectability
•Performance
•Acceptability
•Forge resistance


Biometric Technologies
~Covered in ANSI X9.84-2003:
•Fingerprint biometrics – fingerprint recognition
•Eye biometrics – iris and retinal scanning
•Face biometrics – face recognition using visible or infrared light (called facial
thermography)
•Hand geometry biometrics – also finger geometry
•Signature biometrics – signature recognition
•Voice biometrics – speaker recognition


Other biometric methods
~Found in the literature:
•Vein recognition (hand)
•Palmprint
•Gait recognition
•Body odour measurements
•Ear shape
•DNA
•Keystroke dynamics


Static vs. dynamic biometric methods
~Static (also called physiological) biometric methods – authentication based on a
feature that is always present
~Dynamic (also called behavioural) biometric methods – authentication based on a
certain behaviour pattern


Classification of biometric methods
Static
•Fingerprint recognition
•Retinal scan
•Iris scan
•Hand geometry
Dynamic
•Signature recognition
•Speaker recognition
•Keystroke dynamics


Biometric system architecture
~Major components of a biometric system:
•Data collection
•Signal processing
•Matching
•Decision
•Storage
•Transmission


Biometric system model



Fingerprint Recognition
•Ridge patterns on fingers uniquely identify people
•Classification scheme devised in 1890s
•Major features: arch, loop, whorl
•Each fingerprint has at least one of the major features and many “small features”
•In an automated system, the sensor must minimise the image rotation
•Locate minutiae and compare with reference template
•Minor injuries are a problem
•Liveness detection is important (detached real fingers, gummy fingers, latent
fingerprints)



Features of fingerprints





Fingerprint authentication
~Basic steps for fingerprint authentication:
•Image acquisition
•Noise reduction
•Image enhancement
•Feature extraction
•Matching


Assessment – fingerprint recognition
Advantages
~Mature technology
~Easy to use/non-intrusive
~High accuracy (comparable to PIN authentication)
~Long-term stability
~Ability to enrol multiple fingers
~Comparatively low cost
Disadvantages
~Inability to enrol some users
~Affected by skin condition
~Sensor may get dirty
~Association with forensic applications


Fingerprint recognition: overview
Sensors
•Optical sensors
•Ultrasound sensors
•Chip-based sensors
•Thermal sensors
Integrated products
•For identification – AFIS systems
•For verification


Fingerprint recognition: sensors (I)





Fingerprint recognition: integrated systems (I)




Which biometric method / product is best?
~Depends on the application
•reliability
•security
•performance
•cost
•user acceptance
•liveness detection
•users that are unsuitable
•size of sensor


How good are biometric products?
~How can we find out, how good a biometric product is?
•Empirical tests of the product
~In 2002, there were two independent test series of biometric products
•in Japan
•in Germany



Different threat scenarios




Biometric Conclusions
~Biometric technology has great potential
~There are many biometric products around, regarding the different biometric
technologies
~Since September 11th, biometric products are pushed forward
~Shortcomings of biometric systems due to
•Manufacturers ignorance of security concerns
•Lack of quality control
•Standardisation problems
~Manufacturers have to take security concerns serious



Access Control
~“The prevention of unauthorized use of a resource, including the prevention of use
of a resource in an unauthorized manner“
•central element of computer security
•assume have users and groups
*authenticate to system
*assigned access rights to certain resources on system


Access Control Principles




Access Control Requirements
~reliable input
~fine and coarse specifications
~least privilege
~separation of duty
~open and closed policies
~policy combinations, conflict resolution
~administrative policies



Access Control Elements
~subject - entity that can access objects
•a process representing user/application
•often have 3 classes: owner, group, world
~• object - access controlled resource
•e.g. files, directories, records, programs etc
•number/type depend on environment
~• access right - way in which subject accesses an object
•e.g. read, write, execute, delete, create, search



Discretionary Access Control
~often provided using an access matrix
•lists subjects in one dimension (rows)
•lists objects in the other dimension (columns)
•each entry specifies access rights of the specified
~subject to that object
•access matrix is often sparse
•can decompose by either row or column



Access Control Matrix
~Access Control Matrix or Access Matrix is an abstract, formal security model of
protection state in computer systems, that characterizes the rights of each subject
with respect to every object in the system



Access Control Matrix (ACM)
~An Access Control Matrix is a table in which
*each row represents a subject,
*each column represents an object, and
*each entry is the set of access rights for that subject to that object.

~ACM entry can also be a function that determines rights.
*E.g. one subject may not be able to access an object when another subject is
already writing modifying it



Access control List
In computer security, an access control list (ACL) is a list of permissions attached to an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object. In a typical ACL, each entry in the list specifies a subject and an operation: for example, the entry (Alice, delete) on the ACL for file WXY gives Alice permission to delete file WXY.



UNIX File Concepts
~UNIX files administered using inodes
•control structure with key info on file
~attributes, permissions of a single file
•may have several names for same inode
•have inode table / list for all files on a disk
~copied to memory when disk mounted
~directories form a hierarchical tree
•may contain files or other directories
•are a file of names and inode numbers


UNIX File Access Control


~“set user ID”(SetUID) or “set group ID”(SetGID)
*system temporarily uses rights of the file owner / group in
~addition to the real user’s rights when making access
~control decisions
*enables privileged programs to access files / resources not
~generally accessible
~sticky bit
*on directory limits rename/move/delete to owner
~superuser
*is exempt from usual access control restrictions


UNIX Access Control Lists
•modern UNIX systems support ACLs
•can specify any number of additional users / groups and associated rwx permissions
•ACLs are optional extensions to std perms
•group perms also set max ACL perms
•when access is required
~select most appropriate ACL
•owner, named users, owning / named groups, others
~check if have sufficient permissions for access



File System Security
•in Linux everything as a file
~e.g. memory, device-drivers, named pipes, and
•other system resources
~hence why filesystem security is so important
•I/O to devices is via a “special” file
~e.g. /dev/cdrom
•have other special files like named pipes
~a conduit between processes / programs



Users and Groups
•a user-account (user)
~represents someone capable of using files
~associated both with humans and processes
•a group-account (group)
~is a list of user-accounts
~users have a main group
~may also belong to other groups
•users & groups are not files
•user's details are kept in /etc/password
maestro:x:200:100:Maestro Edward Hizzersands:/home/maestro:/bin/bash
• additional group details in /etc/group
conductors:x:100:
pianists:x:102:maestro,volodya
•use useradd, usermod, userdel to alter



File Permissions
~files have two owners: a user & a group
~each with its own set of permissions
~with a third set of permissions for other
~permissions are to read/write/execute in order user/group/other, cf.
-rw-rw-r-- 1 maestro user 35414
Mar 25 01:38 baton.txt
~set using chmod command



Directory Permissions
~read = list contents
~write = create or delete files in directory
~execute = use anything in or change working directory to this directory
~e.g.
$ chmod g+rx extreme_casseroles
$ ls -l extreme_casseroles drwxr-x--- 8 biff drummers 288 Mar 25 01:38
extreme_casseroles



Numeric File Permissions



Hmm... lecture nie bg aku xder la susah sgt.. simple jer... ermmm... pkir logik sudahh.. kekekkeeee....


alhamdulillah....


"Thank God for what you have -- Trust God for what you need.."


Read More......

Lab 3 ~Classic Cryptography~

Assalamualaikum w.b.t...

Lab 3 nie kami blajar Classic Cryptography... hmm... mase lab nie kiterog try la mengencrypt & mengdecrypt plaintext laaa... Vigenere Cipher, Caesar cipher bla bla blaaa... Aper yg perlu kite tau seperti:-

•Explain What is Symmetric and Asymmetric Cryptography
•Implementing Caesar Cipher for Symmetric Cryptography.
•Implementing Vigeneré Cipher for Symmetric Cryptography.

What is Symmetric and Asymmetric Cryptography?
Cryptography algorithm used in cryptosystem can be classified into two categories which is symmetric and asymmetric encipherment. In symmetric encipherment, plaintext is encrypted and decrypts using the same key whereas asymmetric encipherment is using different keys to encrypt and decrypt a plaintext.

Symmetric encipherment can be in form of substitution, transposition or both. In substitution encryption method alphabet (character) in the plaintext is always changed with another alphabet (character). Each character can be either change with one character (monoalphabetic) or multiple characters (polyalphabetic). Caesar cipher is an example of monoalphabetic cipher and Vigeneré cipher is an example of polyalphabetic.

Asymmetric encipherment involves two keys to encrypt and decrypt. These algorithms allow the key to be publicized, hence anyone can encrypt using the key, and the proper recipient who knows the decryption key can decrypt the message. The encryption key is called public key and the decryption key is called secret/private key. RSA algorithm is use to produce the public and private key.


Symmetric encipherment
Caesar Cipher
The Caesar Cipher is formed by shifting the letters of the original alphabet. For example by replacing each letter of the alphabet with the letter three places down the alphabet. It is monoalphabetic as only one letter in plaintext is exchanged for one letter of ciphertext.



For an example the plain text in figure 4.2 below can be encrypted using key 3 to get the cipher text:-


A brute-force cryptanalysis is easily performed: by simply trying all the keys available.
The characteristics which enables the use of brute-force cryptanalysis:
1.The encryption and decryption algorithms are known
2.There are only 26 keys to try.
3.The language of the plaintext is known and easily recognizable. The pattern
is obvious.

Deciphering simple substitution cipher text.

1.By using key 9 encrypt the following phrase
•Information Technology Security
•The target is the building on the right of the zoo
•The Truck is heading toward the dock
2.The following cipher text which is intercepted by the Special Forces during a
routine surveillance on a terrorist headquarters. It was known that the cipher
text is an English text containing a word ‘FALL’. Decrypt the cipher text.




Vigeneré Cipher
The cipher text encrypted using Caesar cipher method is easily broken by using a brute force attack. An attacker can easily try every combinations of character to break the code as the number of possibility is just 26. In order to improve the deciphering process we can used the vigeneré cipher method. The Vigenère cipher is a method of encrypting alphabetic text by using a series of different Caesar ciphers based on the letters of a keyword. It is a simple form of polyalphabetic substitution. We can refer to table below for making it easier to encrypt a plaintext using this method:-


A key is needed to encrypt a plaintext; a key can be a word or a phrase. To have a strong cipher text it is advised to use different key on each encryption. This will prevent from a brute force attack on a second message if the first message has been intercepted.




Encrypt and decrypt using vigeneré cipher
1.Encipher the message ‘CHAPTER 2 AUTHENTICATION AND BASIC CRYPTOGRAPHY ‘using
Vigenere cipher and the enciphering key ‘MONEY’.
2.The following ciphertext was intercepted by the MI6 Forces during a routine
surveillance on a terrorist headquarters. It is believe that the first cipher text
can be decrypted into
First ciphertext intercept


The plaintext


and the second ciphertext intercept is


As one of the cryptanalysis for MI6 you are assigned to decrypt the second cipher text using the first ciphertext and its plaintext.


Huhuhuhu.. lab nie lab yg paling aku suker.. syokk dowhh... even penin2 tue aku ske... Pulur gak la bijik mater ijauku inie.. hihihihii...So lepas nie settle kn la review question tue.. uhukksss...


alhamdulillah....


"When we have done what we can, God will do what we can't.."




Read More......

Lecture 3 ~Modern Cryptography~

Assalamualaikum w.b.t..

Lam lecture 3 nie encek ajr kiteorg bab Modern Cryptography... Lecture nie mmg best tp kdg2 tue pening gakk.. tp aku suker.. hehhee.. kalu der yg kire2 lg syok!.. byk guner IQ daaaa...Aku nie mmg ske sgt berpkir... sejak azali lagi.. da mmg sesuai la aku yg fanatik green nie... org yg kuat berfikir.. uhukss... Topics lam lecture nie adalah :-
~Modern Cryptography Algorithm
~Block and Stream
~DES
~AES
~MAC
~Digital Signature, RSA

Modern Cryptography Algorithm
•Most modern ciphers use a sequence of binary digits (bits), that is, zeros and ones such as ASCII.
•This bit sequence representing the plaintext is then encrypted to give the ciphertext as a bit sequence.
•The encryption algorithm may act on a bit-string in a number of ways.
~stream ciphers where the sequence is encrypted bit-by-bit.
~block ciphers, where the sequence is divided into blocks of a predetermined size.
~ASCII requires 8 bits to represent one character, and so for a block cipher that
has 64-bit blocks, the encryption algorithm acts on eight characters at once.
•Since most modern algorithms operate on binary strings we need to be familiar with a method of combining two bits called Exclusive OR and often written as XOR or .

•Stream ciphers
~they convert one symbol of plaintext immediately into a symbol of ciphertext
~depends on symbol, key and control information of encipherment algorithm
•Block ciphers
~encrypt a group of plaintext symbols as one block
~examples are transposition ciphers
•e.g, in columnar transposition, the entire message is translated as one block,
block size need not have any particular relationship to the size of the character

Stream Ciphers
~The plaintext is enciphered bit by bit.
•The value of each bit is changed to the alternative value or leave unchanged.
•If a bit is changed twice, it returns to its original value.
~If an attacker knows that a stream cipher has been used, then their task is to try
to identify the position of those bits which have been changed and to change them
back to their original values.
•If there is any easily detectable pattern that identifies the changed bits then
the attacker task may be simple.
•The position of the changed bits must be unpredictable to the attacker but the
genuine receiver needs to be able to identify them easily.
~The encryption key is often called a keystream sequence.
•0 to mean ‘leave unchanged’, 1 to mean ‘change’.
•Plaintext, ciphertext and keystream are all binary sequences.
~Suppose that we have the plaintext 1100101 and the keystream is 1000110.
•By applying the rule gives 0100011 as the ciphertext.
~Changing a bit twice has the effect of returning it to its original value.
•This means that decryption process is identical to the encryption process, so the
keystream also determines decryption.
~If Pi, Ki and Ci are respectively the plaintext, keystream and ciphertext bits in position i, then the ciphertext bit Ci is given by Ci = Pi  Ki.
•The decryption is defined by Pi = Ci  Ki.
~A stream cipher takes a short key to generate a long keystream.
•This is achieved by using binary sequence generator.
~The keystream bit in position i, Ki = Pi  Ci can be determined as the XOR of the plaintext and ciphertext in position i.
•This highlight the potential weakness for stream ciphers.
•Anyone who is able to launch a known plaintext attack, can deduce parts of the
keystream sequence from the corresponding plaintext and ciphertext bit pairs.
•Thus the keystream must be unpredictable in the sense that knowledge of some of
it should not enable an attacker to deduce the rest.
~If the keystream generator produces the same bit stream every time it is turned on,
the resulting cryptosystem will be trivial to break.
•Anyone who has two different ciphertexts encrypted with the same keystream, can
XOR them together and get two plaintext messages XORed with each other.
•When the interceptor gets a single plaintext/ciphertext pair, they can read
everything.
•That is why all stream ciphers have keys - the output of the keystream generator
is a function of the key.

Block Ciphers
~For a block cipher, the bit-string is divided into blocks of a given size and the
encryption algorithm acts on that block to produce a cryptogram block that, for
most symmetric ciphers, has the same size.
~Block ciphers have many applications.
•Can be used to provide confidentiality, integrity, or user authentication and can
even be used to provide the keystream generator for stream ciphers.
~A symmetric algorithm is said to be well designed if an exhaustive key search is
the simplest form of attack.
~Usual number of blocks are 64,128,256 and 512 bits
~There are a few obvious properties that a strong block cipher should possess.
Diffusion properties - which a small change in the plaintext, may
be one or two positions, should produce an unpredictable change in the ciphertext.
Confusion properties - if an attacker is conducting an exhaustive key search then there should be no indication that they are near to the correct key.
•To prevent divide-and-conquer attacks we require completeness - each bit of a
ciphertext must depend on every bit of the key.
•Statistical testing forms a fundamental component of the assessment of block
ciphers for these three listed properties and others.


Data Encryption Standards (DES)
~Widely used encryption scheme
~Adopted by The national Bureau of standard in 1977
~The plaintext is divided into 64 bit blocks with a key of 56 bits(with 8 bit
parity).
~DES structure is similar to Fiestel Network concept.
~Process through 16 round of Expansion, substitution, key mixing and permutation
process.
~Is it breakable?
~Yes, can try brute force attack using all the 2^56 possible key
~1998, Electronic Frontier Foundation (EFF) has created a USD220,000 machine to go
through the entire 56 bit DES key space in average of 4.5 days.
~Triple DES has been introduced to improve the standard.




Advanced Encryption Standard (AES)
•needed a better replacement for DES
•NIST called for proposals in 1997
•selected Rijndael in Nov 2001
•published as FIPS 197
•symmetric block cipher
•uses 128 bit data & 128/192/256 bit keys
•now widely available commercially


Message Authentication
•protects against active attacks
•verifies received message is authentic
~contents unaltered
~from authentic source
~timely and in correct sequence
•can use conventional encryption
~only sender & receiver have key needed
•or separate authentication mechanisms
~append authentication tag to cleartext message


Message Authentication Codes (MAC)


Hash Function



Hash Function Requirements
~applied to any size data
~H produces a fixed-length output.
~H(x) is relatively easy to compute for any given x
~one-way property
•computationally infeasible to find x such that H(x) = h
~weak collision resistance
•computationally infeasible to find y ? x such that H(y) = H(x)
~strong collision resistance
•computationally infeasible to find any pair (x, y) such thatH(x) = H(y)

Simple Hash Functions
•a one-way or secure hash function used in message authentication, digital
signatures
•all hash functions process input a block at a time in an iterative fashion
•one of simplest hash functions is the bit-by-bit exclusive-OR (XOR) of each block

– effective data integrity check on random data
– less effective on more predictable data
– virtually useless for data security


Hash Functions
~two attack approaches
•cryptanalysis
~exploit logical weakness in alg
•brute-force attack
~trial many inputs
~strength proportional to size of hash code (2n/2)
~SHA most widely used hash algorithm
•SHA-1 gives 160-bit hash
•more recent SHA-256, SHA-384, SHA-512 provide improved size and security
~There are 2 prominent algorithms in Hashing functions.
•First, the most popularly used technique is MD5.
•Second, the well accepted standard is secure hashing algorithm SHA-1.
~Nevertheless, SHA-256 is chosen in this class as it is considered to be the
primary next-generation algorithm.
~MD-5   
•A hash function designed by Ron Rivest, one of the inventors of the RSA public-key
encryption scheme.
•The MD-5 algorithm produces a 128-bit output. Note that MD-5 is now known to have
some weaknesses and should be avoided if possible.
•SHA-1 is generally recommended.

~SHA-1 (Secure Hash Algorithm-1)   
•SHA-1 is an MD-5-like algorithm that was designed to be used with the Digital
Signature Standard (DSS).
•NIST (National Institute of Standards and Technology) and NSA (National Security
Agency) are responsible for SHA-1.
•The SHA-1 algorithm produces a 160-bit MAC.
•This longer output is considered to be more secure than MD-5.


SHA Secure Hash Functions
•SHA originally developed by NIST/NSA in 1993
•was revised in 1995 as SHA-1
– US standard for use with DSA signature scheme
– standard is FIPS 180-1 1995, also Internet RFC3174
– produces 160-bit hash values
•NIST issued revised FIPS 180-2 in 2002
– adds 3 additional versions of SHA
– SHA-256, SHA-384, SHA-512
– with 256/384/512-bit hash values
– same basic structure as SHA-1 but greater security
•NIST intend to phase out SHA-1 use
•For SHA-1 and SHA-256, each message block has 512 bits, which are represented as a
sequence of sixteen 32-bit words.
•SHA-256 uses six logical functions, where each function operates on 32-bit words,
which are

•SHA-1 and SHA-256
•Suppose that the length of the message, M, is l bits. Append the bit “1” to the end
of the message.
•followed by k zero bits, where k is the smallest, non-negative solution to the
equation
•l +1+ k º 448mod 512 . Then append the 64-bit block that is equal to the number l
expressed
•using a binary representation. For example, the (8-bit ASCII) message “abc” has
length 8´3 = 24, so the message is padded with a one bit, then 448 - (24 +1) = 423
zero bits, and then the message length, to become the 512-bit padded message

•For SHA-1 and SHA-256, the padded message is parsed into N 512-bit blocks, M(1), M(2),…,M(N). Since the 512 bits of the input block may be expressed as sixteen 32-bit words, the first 32 bits of message block i are denoted M (i) 0, the next 32 bits are M (i) 1, and so on up to M (i) 15.
•For SHA-256, the initial hash value, H(0), shall consist of the following eight 32-bit words, in hex:


Initial value


SHA-512 Structure


SHA-512 Round


Digital Signatures
~It is the provision of a means of settling disputes between sender and receiver
that distinguishes the digital signature mechanism from the MACing process.
•Such dispute can only be settled if there is asymmetric between sender and
receiver.
~For a digital signature scheme based on RSA or El Gamal:
•Each user has a private key that only they can use and its use is accepted as
identifying them.
•There is a corresponding public key.
•Anyone who knows this public key, can check that the corresponding private key has
been used, but cannot determine the private key.
•This gives the receiver assurance of both the origin and content of the message.


Generating a Digital Signature
•Asymmetric cryptographic processing requires much computational processing.
•Thus a condensed version or hash of the message is produced by applying a hash
function to the message.
•The signature is produced from the hash (which represent the message) by using the
asymmetric algorithm with the private key.
•Thus only the owner of the private key can generate the signature.

Digital signature


Hash Function


How to Create a Digital Signature Using RSA


Verifying a Digital Signature
~The signature can be verified by anyone who knows the corresponding public key.
~To do this a value is produced from the signature using the asymmetric algorithm
with the public key.
~This value should be the hash of the message, which anyone can calculate.
~If this value and the hash agree, the signature is accepted as genuine.


How to Verify a Digital Signature Using RSA


Certification Authority (CA)
AIM:
•To guarantee the authenticity of public keys.
METHOD:
•The CA guarantees the authenticity by signing a certificate containing user’s
identity and public key with its secret key.
REQUIREMENT:
•All users must have an authentic copy of the Certification Authority’s public key.


Certification Process


How Does it Work?
~The certificate can accompany all sender’s messages.
~The recipient must directly or indirectly:
•Trust the CA
•Validate the certificate


Certification Authorities
~Problems / Questions
•Who generates users’ key?
•How is identity established?
•How can certificates be cancelled?
•Any others?


Attacks on Digital Signature
•Suppose digital signatures are being used as a means of identification.
•If user A wishes to impersonate user B, then there are two different forms of
attack:
>A attempts to obtain the use of B’s private key
>A tries to substitute their public key for B’s public key.


Public Key Infrastructure (PKI)
~The motivation of using PKI is to facilitate the use of public key cryptography.
~Three key players in PKI system:
•The certificate owner - who applies for the certificate.
•CA - which issues the certificate that binds the owner’s identity to the owner’s
public key value.
•The relying party - who uses on the certificate.
~Other players:
•Registration Authority (RA) - in some systems the identification verification is
performed by a separate authority.
•Validation Authority (VA) - end users ask the VA if a given certificate is still
valid and receive a yes or no answer.


Establishing a PKI
~When a PKI is established, the following processes need to take place:
•The key pairs for CAs must be generated.
•The key pairs for users must be generated.
•Users must request certificates
•Users’ identities must be verified.
•Users’ key pairs must be verified.
•Certificates must be produced.
•Certificates must be checked.
•Certificates must be removed/updated (when necessary).
•Certificates must be revoked (when necessary).


Key Management
~A typical requirement specification for a symmetric key system might include each
of the following:
•Keys must be generated using a random or pseudorandom process.
•Any key used by a communicating pair must be unique to them.
•A key must be used for only for a purpose, e.g. the same key should not be used
for both encryption and authentication.
•Each key must be replaced within the time deemed necessary to determine it by an
exhaustive search.
•A key must not be used if its compromise is either known or suspected.
•Compromise of a key which is shared between two parties must not compromise any
key used by a third party.
•Keys should only appear in clear form within a highly tamper resistant device.
Elsewhere all keys must be encrypted or in component form.
•Keys must be protected against misuse.
•Unauthorized modification, substitution or replay of any key must be prevented or
detected.


The Key Life Cycle



RSA
~by Rivest, Shamir & Adleman of MIT in 1977
~best known & widely used public-key scheme
~Ingredients of RSA:



RSA Key Setup
~each user generates a public/private key pair by:
~selecting two large primes at random - p, q
~computing their system modulus n=p*q
•note ø(n)=(p-1)(q-1)
~selecting at random the encryption key e
•where 1~solve following equation to find decryption key d
•e*d=1 mod ø(n) and 0≤d≤n
~publish their public encryption key: PU={e,n}
~keep secret private decryption key: PR={d,n}


RSA Use
~to encrypt a message M the sender:
•obtains public key of recipient PU={e,n}
•computes: C = Me mod n, where 0≤M~to decrypt the ciphertext C the owner:
•uses their private key PR={d,n}
•computes: M = Cd mod n
~note that the message M must be smaller than the modulus n (block if needed)


RSA Example - Key Setup
1. Select primes: p=17 & q=11
2. Compute n = pq =17 x 11=187
3. Compute ø(n)=(p–1)(q-1)=16 x 10=160
4. Select e: gcd(e,160)=1; choose e=7
5. Determine d: de=1 mod 160 and d < 160 Value is d=23
6. Publish public key PU={7,187}
7. Keep secret private key PR={23,187}


RSA Example - En/Decryption
sample RSA encryption/decryption is:
•given message M = 88 (number 88<187)
•encryption:
C = Me mod n
C = 887 mod 187 = 11
•decryption:
M = Cd mod n
M = 1123 mod 187 = 88


Exponentiation
~can use the Square and Multiply Algorithm
~a fast, efficient algorithm for exponentiation
~concept is based on repeatedly squaring base
~and multiplying in the ones that are needed to compute the result
~look at binary representation of exponent
~only takes O(log2 n) multiples for number n
•eg. 75 = 74.71 = 3.7 = 10 mod 11
•eg. 3129 = 3128.31 = 5.3 = 4 mod 11


Exponentiation (Algorithm for Computing ab mod n)
c = 0; f = 1
for i = k downto 0
do c = 2 x c
f = (f x f) mod n
if bi == 1 then
c = c + 1
f = (f x a) mod n
return f


Efficient Encryption
~encryption uses exponentiation to power e
~hence if e small, this will be faster
*often choose e=65537 (216-1)
*also see choices of e=3 or e=17
~but if e too small (eg e=3) can attack
*using Chinese remainder theorem & 3 messages with different moduli
~if e fixed must ensure gcd(e,ø(n))=1
*i.e. reject any p or q not relatively prime to e


Efficient Decryption
•decryption uses exponentiation to power d
~this is likely large, insecure if not
•can use the Chinese Remainder Theorem (CRT) to compute mod p & q separately. then
combine to get desired answer
~approx 4 times faster than doing directly
•only owner of private key who knows values of p & q can use this technique


RSA Key Generation
•users of RSA must:
~determine two primes at random - p, q
~select either e or d and compute the other
•primes p,q must not be easily derived from modulus n=p*q
~means must be sufficiently large
~typically guess and use probabilistic test
•exponents e, d are inverses, so use Inverse algorithm to compute the other


RSA Security
~possible approaches to attacking RSA are:
•brute force key search (infeasible given size of numbers)
•mathematical attacks (based on difficulty of computing ø(n), by factoring modulus
n)
•timing attacks (on running of decryption)
•chosen ciphertext attacks (given properties of RSA)


Methods of Attack
~Four general attacks can be perform against encrypted information:
•Ciphertext-only attack guessing the plaintext or using frequency analysis
•Known Plaintext guess using known pliantext.
•Chosen-plaintext
•Chosen-ciphertext attack
~There are also specific attacks that can be launched against encryption systems.
•Brute-Force attack
*Exhaustive key search - trying every possible combination.
•Replay attacks
*Taking encrypted information and playing it back at a later point in time.
~Man-in-the-middle attacks
~Fault in Cryptosytem


yuhuuu... walaupun ia memeningkan... kepuasan n keseronokan itu penting!.. hehehehee...


alhamdulilllah...


"It is easier to be wise for others than for ourselves.."




Read More......

Lab 2 ~The Goals of Information Technology~

Assalamualaikumm w.b.t..

Lam Lab 2 nie encek ckp blajar sndiri... so kiteorg x msk lab la time tue.... godek2 sndiri la saper yg rajin tue... ermm.. aku bacer jer la lab sheet nie.. dop tau nk kater la... Lab nie menerangkan tentang The Goals of Information Technology..
Antare objektif yang perlu dicapai adalah :-

• Understand What is Information Technology Security goals
• Determine if partition is NTFS or FAT32
• Implementing confidentiality in Windows Server 2003
• Implementing integrity in Windows Server 2003
• Implementing availibility in Windows Server 2003


Introduction The goals of Information Technology Security
In general the term “Security” is use to describe the quality or state of being secure that is to be free from danger or to be protected from those who would do harm, intentionally or otherwise. In Information Security it is refer to the protection of information and the systems and hardware that use, store, and transmit that information. Information security involves the security in an organization
regarding the application security, policies involves and Information Technology infrastructure to create a secure and protected computing environment for an organization. The goals of an Information security are confidentiality, integrity and availability.

Confidentiality
-Provides protection to computer related assets from being used by unauthorized user. Its mean only the right person who has the authority can read, view, print or even knowing the existing of the object. It also called as privacy or secrecy.

Integrity
-Ensures data can be modified by authorized parties and by authorized mechanism only. Information can be added, updated or deleted; hence it must be done in a correct ways and by the right person to ensure the correctness and validity of the information. Encryption is one of them mechanism used in providing data integrity.

Availability
-Makes sure authorized user can access information at any time without any failure. Information that is not available to the authorized user is useless, imagine if we went to the ATM machine and we cannot access to our account particular, how frustrated is that?

Using NTFS to Secure Local Resources.
Local computer security, especially at the file level, is often ignored. Most people are familiar with the Windows 9x version of Microsoft Windows, which uses FAT and does not offer local file security. NTFS, the file system for Windows server 2003, is designed with local file security in mind. To take advantage of these capabilities, we must have Windows NT, 2000, 2003, or XP with the NTFS file
system installed. It is important to note that although all of these operating systems are compatible with FAT; local file security will be enabled only if we have NTFS installed.

1. Open the winserv03 virtual machine
2. Log on to the Windows 2003 server as Administrator.
3. Click [Start].
4. Click [Run].
5. Type cmd to invoke the command line. (The FAT partition in this lab will be designated as drive letter D.)
6. At the command line type chkntfs d: to verify that the drive is not using NTFS. We will see the message, “D: is not dirty”. This means that there is no corruption on the drive.

7. To convert a FAT disk to NTFS you need to type at the command line convert d: /fs:ntfs
8. If the drive has a volume label, enter it when prompted. Windows will then convert the drive to NTFS. Note: If we convert the system partition you will have to reboot for the conversion to take place.
9. At the command line type chkntfs d: to verify that the drive is now NTFS.

10. Close all Windows and log off.

Data Confidentiality
Once a secure file system is installed, we can begin to think about data
confidentiality. Data confidentiality refers to making sure that only those intended to have access to certain data actually have that access. With the FAT file system, this is not possible at the local level, but with NTFS we can lock down both folders and files locally. NTFS can be used to protect data from intruders who may
have physical access to the computer containing the data. In this lab, we will create a folder and files, assign NTFS permissions, then verify whether or not the data is confidential.

Creating user account
1. Two user-level accounts: User1 and User2
a. To create user account go to [Start] |[Administrative Tools] | [Computer Management].
b. Choose [Local User and Groups] and double click on the [user] folder.
c. To create new user right click on the pane and from the pop-up menu choose [New User] and fill up the necessary information such as username and password (use easy to remember password e.g. abc123)

Creating data Confidentiality between 2 user accounts.
1. Log on to the Windows 2003 server as Administrator.
2. Open My Computer, and then double-click on the D: drive.This should be the drive that was converted from FAT to NTFS in task 1
3. Create a new folder called Confidentiality.
4. Double-click the Confidentiality folder and create a new folder called User1Folder.
5. To secure this folder from other users, right-click User1Folder.
6. Click [Properties] to open the User1Folder Properties window.
7. Click the [Security] tab, as seen in Figure 2.3. Note: if the drive was not formatted with NTFS the Security tab will be unavailable

8. Click on the Advanced Button, you will receive a windows

9. Uncheck the box “Allow inheritable permissions from
parent to propagate to this object”.
10. You will receive the message shown below

11. Click [Copy] to retain the permissions.
12. Click [Add] and the Select Users, Computers, or Groups window will pop up.
13. Type User1 and then click [Checks Names].

14. Click [OK].
15. In the Permission Entry windows, click the Allow Full Control box and then click [OK].
16. Remove the other username except Administrator, System and User1 by clicking the username and click the [Remove] button.

17. Click OK.
18. Double-click User1Folder.and you should see the content of the folder
19. Close all windows and log off.
20. Log on as User2 and navigate to the User1Folder, can we open it?
21. Close all windows and log off.


Data Availibility
Although it is important that data remains secure and confidential, it is just as important that the data is available when needed. Secured data that is inaccessible is considered downtime and detrimental to a business and its ability to serve customers. Technologies such as clustering and load balancing can help, but if NTFS permissions are assigned inappropriately, these features will not help.
Log on to the Windows 2003 server as Administrator.
1. Open My Computer and then double-click on the D drive.
2. Create a new folder called Availability.
3. Double-click the Availability folder and create the folder User2Folder.
4. Right-click on User2Folder.
5. Follow step 6 to 20 in the previous task to secure the folder so that only User2 can access it.
6. Log on as User2 and verify that you have access to d:\Availability\User2Folder.
7. Close all windows and log off.
8. Log on as Administrator and delete the User2 account from the local security database.
9. Create a new user, also named User2, then log off.
10. Logon as User2 and try to access the d:\Availability\User2Folder. Access should be denied.
11. Log off User2.
12. Log on as Administrator.
13. Check the Security properties of the d:\Availability\User2Folder. Notice the account is no longer listed, but the old SID is.

14. We should be denied access. The data is no longer available to User2.
15. To verify this, log on as User2 and try to open the User2Folder.We will be denied access.
16. Close all windows and log off.


Data Integrity
Once data is secured properly and available to the appropriate people, it is important to make sure that the contents of the data have not been altered accidentally or intentionally. Malicious corruption is a problem, and can be done by a virus, worm, or hacker. Accidental changes, however, can also damage data
integrity. For example, Windows 2003 file synchronization capabilities could easily lead to accidental corruption. Changes made to data that conflict with other changes to the same data can damage data integrity just as much as a hacker can.
1. Log on to the Windows 2003 server as User1.
2. Open My Computer, and then double-click the D drive.
3. Create a new folder called Integrity.
4. Double-click the Integrity folder and create a new folder called User1Folder.
5. Double-click the User1Folder folder.
6. Create a new Text document and edit the contents to say:“This document has not been modified accidentally or intentionally”.
7. Save the file as New Text Document and close the document.
8. Log off User1.
9. Log on as User2.
10. Navigate to the d:\integrity\User1Folder and remove the word “not” from the New Text Document. Because we did not assign permissions to d:\integrity\User1Folder, we can modify the contents of the file.
11. Close the file and save the changes.
12. Log off User2.

Hmmm... then lepas nie kene la wat review question cam biaser... uhuksss...

alhamdulillah

"Always put yourself in others' shoes. If you feel that it hurts you, it probably hurts the person too.."

Read More......
Related Posts with Thumbnails