Information protection Lecture 2

Cryptographic systems We have a source of information and one for keys. The last one sent using a very safe communication channel the keys for source and destinations The ciphering is a reversible transformation f (bijection) usually unique for a key K over the message. Function f can be composed to increase the security od criptosystem. Figure 1. Cryptographic system

Requirements for good cryptosystems (Sir Francis R. Bacon ( )) 1. Given e k and a plaintext w, it should be easy to compute c = e k (w). 2. Given d k and a cryptotext c, it should be easy to compute w = d k (c). 4. It should be unfeasible to determine w from e k (w) without knowing d k. 5. The so called avalanche effect should hold: A small change in the plaintext, or in the key, should lead to a big change in the cryptotext (i.e. a change of one bit of the plaintext should result in a change of all bits of the cryptotext, each with the probability close to 0.5). 6. The cryptosystem should not be closed under composition, i.e. not for every two keys k 1, k 2 there is a key k such that e k (w) = e k1 (e k2 (w)). 7. The set of keys should be very large. 3. A cryptotext e k (w) should not be much longer than the plaintext w.

Malicious Software

Digital Immune System

Previous figure illustrates the typical steps in digital immune system operation: 1. A monitoring program on each PC uses a variety of heuristics based on system behavior, suspicious changes to programs, or family signature to infer that a virus may be present, & forwards infected programs to an administrative machine 2.The administrative machine encrypts the sample and sends it to a central virus analysis machine 3.This machine creates an environment in which the infected program can be safely run for analysis to produces a prescription for identifying and removing the virus 4.The resulting prescription is sent back to the administrative machine 5.The administrative machine forwards the prescription to the infected client 6.The prescription is also forwarded to other clients in the organization 7.Subscribers around the world receive regular antivirus updates that protect them from the new virus.

Behavior-Blocking Software integrated with host O/S monitors program behavior in real-time –eg file access, disk format, executable mods, system settings changes, network access for possibly malicious actions –if detected can block, terminate, or seek ok has advantage over scanners but malicious code runs before detection

References 1.William Stallings, “Cryptography and Network Security”, 4/e. 2.Davies D.W., Price W.L., “Security for Computer Networks”, John W&Sons, USA, Angheloiu I, ş.a., “Securitatea şi protecţia informaţiei în sistemele electronice de calcul”, Ed. Militară, 1986, Bucureşti 4.Menzenes A., et all, “Handbook of applied cryptography”, CRC Press,

Bad vs Good Guys