1. Lecture 1 Overview

2. Computer-Based System
Hardware
Software
Data
Vulnerability
Weakness (to be exploited)
Threat
Circumstances (Potential to cause harm)
Attack
Exploits vulnerabilities
CS 450/650 Fundamentals of Integrated Computer Security

3. Threats Interception Interruption Modification Fabrication
Unauthorized party has gained access to an asset
Interruption
An asset becomes lost, unavailable, or unusable
Modification
Unauthorized party tampers with an asset
Fabrication
Unauthorized party may create objects
CS 450/650 Fundamentals of Integrated Computer Security

4. Security Goals Assets are accessed only by authorized people
Confidentiality
Integrity
Availability
Assets are accessible to
authorized people
Assets can be modified
only by authorized people
CS 450/650 Fundamentals of Integrated Computer Security

5. Lecture 2 Elementary Cryptography
CS 450/650
Fundamentals of
Integrated Computer Security
Slides are modified from Hesham El-Rewini

6. Objectives Learn how cryptography works
Learn how encryption systems are broken
Understand basic ciphers:
substitution and transposition codes
CS 450/650 Fundamentals of Integrated Computer Security

7. Goal of Cryptography
Ensure security of communication over insecure medium
Privacy (secrecy, confidentiality)
Integrity
Communicate even with possibility of adversaries
CS 450/650 Fundamentals of Integrated Computer Security

8. Main Components in Sending Messages
sender
Medium
receiver
Intruder
Interrupt
Intercept
Modify
Fabricate
Availability
Confidentiality
Integrity
CS 450/650 Fundamentals of Integrated Computer Security

9. Approaches to Secure Communication
Steganography
Hide message existence
Cryptography
Hide message meaning
CS 450/650 Fundamentals of Integrated Computer Security

10. Cryptography Secret writing Encryption : encoding (encipher)
Disguised data cannot be read, modified, or fabricated easily
Encryption : encoding (encipher)
plaintext  cipher text
P = <p1, p2, p3, .., pn>  C = <c1, c2, c3, .., cm>
C = E(c) (E = encryption rule)
Decryption : decoding (decipher)
Cipher text  plaintext
C = <c1, c2, c3, .., cm>  P = <p1, p2, p3, .., pn>
P = D(c) (D = decryption rule)
CS 450/650 Fundamentals of Integrated Computer Security

11. Cryptosystem How does this help us accomplish our goals? Privacy
Integrity
CS 450/650 Fundamentals of Integrated Computer Security

12. Encryption Encryption Decryption Encryption Decryption Encryption
plaintext
Original
ciphertext
Keyless
Encryption
Decryption
plaintext
Original
ciphertext
Symmetric key
Encryption
Decryption
plaintext
Original
ciphertext
Asymmetric key
CS 450/650 Fundamentals of Integrated Computer Security

13. Cryptanalysis How to break an encryption! Cryptanalyst
Deduce the original meaning of the ciphertext
Determine the decryption algorithm that matches the encryption one used
Breakable Encryption!
CS 450/650 Fundamentals of Integrated Computer Security

14. wklv phvvdjh lv qrw wrr kdug wr euhdn
Exercise
wklv phvvdjh lv qrw wrr kdug wr euhdn
CS 450/650 Fundamentals of Integrated Computer Security

15. Ciphers Substitution Ciphers Transposition Ciphers Notation
Substitute a character or a symbol for each character of the original message
Transposition Ciphers
The order of letters is rearranged
Notation
UPPERCASE PLAINTEXT
lowercase ciphertext
CS 450/650 Fundamentals of Integrated Computer Security

16. The Caesar Cipher -- Substitution
Ci = pi + 3
A  d
B  e
C  f …
X  a
Y  b
Z  c
CS 450/650 Fundamentals of Integrated Computer Security

17. Cryptanalysis of the Caesar Cipher
TREATY IMPOSSIBLE  wuhdwb lpsrvvleoh
Break is preserved
Double letters are preserved
Repeated letters
CS 450/650 Fundamentals of Integrated Computer Security

18. Other Substitutions: Permutation
Alphabet is scrambled, each plaintext letter maps to a unique ciphertext letter
For example
1, 2, 3, 4, 5, 6, 7, 8, 9
p1 = 1, 3, 5, 7, 9, 8, 6, 4, 2
p1(1) = 1, p1(2) = 3, p1(3) = 5, p1(4) = 7, etc.
Key can be used to control the permutation used to
CS 450/650 Fundamentals of Integrated Computer Security

19. Substitution Cipher Example
ABCDEFGHIJKLMNOPQRSTUVWXYZ
wordabcefghijklmnpqstuvxyz
profesinalbcdghjkmqtuvwxyz
CS 450/650 Fundamentals of Integrated Computer Security

20. Cryptanalysis of substitution ciphers
Brute force attack
26! possibilities
Clues
Short words,
Words with repeated patterns,
Common initial and final letters, …
Knowledge of language may simplify it
English E, T, O, A occur far more than J, Q, X, Z
Context
CS 450/650 Fundamentals of Integrated Computer Security

21. Cryptanalysis Example: wklv phvvdjh lv qrw wrr kdug wr euhdn
wrr --> see, too, add, odd, off...
wr --> to, of
Best guess: w = T, r = O
CS 450/650 Fundamentals of Integrated Computer Security

22. Cryptanalysis wklv phvvdjh lv qrw wrr kdug wr euhdn
wrr --> see, too, add, odd, off...
wr --> to, of
Best guess: w = T, r = O
lv --> so, is, in, ...
T_SO very unlikely...
T_IS likely
Best guess: l = I, v = S
CS 450/650 Fundamentals of Integrated Computer Security

23. Cryptanalysis wklv phvvdjh lv qrw wrr kdug wr euhdn
wrr --> see, too, add, odd, off...
wr --> to, of
Best guess: w = T, r = O
lv --> so, is, in, ...
Best guess: l = I, v = S
T-IS --SS--- IS -OT TOO ---- TO -----
CS 450/650 Fundamentals of Integrated Computer Security

24. Avoid Regularity Non-repeating series of numbers Encryption Decryption
ciphertext
plaintext
Original
plaintext
CS 450/650 Fundamentals of Integrated Computer Security

25. One-Time Pads
Name  set of sheets of paper with keys, glued into a pad
The sender would tear off enough number of pages
The receiver needs a pad identical to the one used by the sender
CS 450/650 Fundamentals of Integrated Computer Security

26. One-Time Pads (cont.)
The sender would write the keys one at a time above the letters of the plaintext.
K1 k2 k3 k4 ... Kn
p1 p2 p3 p4 ... pn
The plaintext is enciphered using a pre-arranged chart
Vignere Tableau
all 26 letters in each column in some scrambled order
select the substitution in row pi, column Ki
Problems:
Unlimited number of keys & Absolute synchronization between sender and receiver
CS 450/650 Fundamentals of Integrated Computer Security

27. Vernam Cipher Example Plaintext Random numbers Sum Sum mod 26
Random numbers
Sum
Sum mod 26
Ciphertext
t a h r s p i t x m a b
CS 450/650 Fundamentals of Integrated Computer Security

28. Book Ciphers Both sender and receiver need access to identical objects
Example: telephone book – xxx-xxx-xxxx
use xx mod 26 as a key
Problem
High frequency letters
A, E, O, T  40% of all letters used in Standard English text
A, E, O, T, N, I  50% of all letters used in Standard English text
The probability that the key letter and plain text letter is in these 6 letters is 0.25
CS 450/650 Fundamentals of Integrated Computer Security

29. Transposition The letters of the message are rearranged
Columnar transposition
Example:
THIS IS A MESSAGE TO SHOW HOW A
COLMUNAR TRANSPOSITION WORKS
CS 450/650 Fundamentals of Integrated Computer Security

30. Transposition Example
T H I S I
S A M E S
S A G E T
O S H O W
H O W A C
O L M U N
A R T R A
N S P O S
I T I O N
W O R K S
tssoh oaniw haaso lrsto imghw utpir seeoa mrook istwc nasna
CS 450/650 Fundamentals of Integrated Computer Security

31. Summary Maintain privacy and integrity despite adversaries
Cryptanalysis
Cryptosystems
Substitution
Transposition
CS 450/650 Fundamentals of Integrated Computer Security

32. Review Questions
What is the process for going from plaintext to ciphertext back to plaintext? 
What is a substitution code? 
Why are there 26! possible substitution codes for simple English messages? 
What is a frequency distribution analysis? 
What is a transposition code? 
How do secret key and public key cryptography differ? 
CS 450/650 Fundamentals of Integrated Computer Security

33. Much More To Discuss... What makes a "good" encryption algorithm
Data Encryption Standard (DES)
Double and Triple DES
Advanced Encryption Standard (AES)
Public Key Encryption
Rivest-Shamir-Adelman (RSA)
CS 450/650 Fundamentals of Integrated Computer Security