Systems Approach to Computer Networks Unit 18 ReviewNetwork Security: Crypto & Secure Comms

Key Concepts and Terminology

• Cryptography involves techniques for secure communication, including encryption, decryption, and key management
• Confidentiality ensures that information is not disclosed to unauthorized parties (privacy)
• Integrity verifies that data has not been altered or tampered with during transmission or storage
• Authentication confirms the identity of the communicating parties and the origin of the data
• Non-repudiation prevents an entity from denying their involvement in a communication or transaction
• Plaintext refers to the original, unencrypted message or data
• Ciphertext is the encrypted version of the plaintext, transformed using an encryption algorithm and key
• Cryptographic keys are secret values used in conjunction with encryption algorithms to secure data

Cryptography Fundamentals

• Cryptography relies on mathematical algorithms and protocols to protect information and ensure secure communication
• Encryption is the process of converting plaintext into ciphertext using a cryptographic algorithm and key
• Decryption reverses the encryption process, transforming ciphertext back into the original plaintext
• Cryptographic algorithms can be classified as symmetric (single key) or asymmetric (public-private key pair)
• Cryptographic hash functions generate fixed-size digests of input data, useful for integrity checks and digital signatures
  • Examples of hash functions include SHA-256 and MD5
• Key exchange protocols (Diffie-Hellman) enable secure establishment of shared secret keys over insecure channels
• Cryptanalysis studies techniques for breaking or circumventing cryptographic systems to assess their strength and vulnerabilities

Symmetric Encryption Techniques

• Symmetric encryption uses a single secret key for both encryption and decryption processes
• The same key must be securely shared between the communicating parties before any encrypted communication can occur
• Examples of symmetric encryption algorithms include AES (Advanced Encryption Standard) and DES (Data Encryption Standard)
• Block ciphers operate on fixed-size blocks of plaintext, applying a series of substitution and permutation operations
  • Modes of operation (ECB, CBC, CTR) define how block ciphers handle multiple blocks and ensure confidentiality and integrity
• Stream ciphers encrypt plaintext one bit or byte at a time, generating a pseudorandom keystream for each message
• Symmetric encryption is generally faster and more efficient than asymmetric encryption for bulk data encryption
• Key management is crucial in symmetric encryption to ensure the secure generation, distribution, and storage of secret keys

Public Key Cryptography

• Public key cryptography, or asymmetric encryption, uses a pair of keys: a public key and a private key
• The public key is freely distributed and used for encryption, while the private key is kept secret and used for decryption
• RSA (Rivest-Shamir-Adleman) is a widely used public key cryptosystem based on the difficulty of factoring large prime numbers
• Elliptic Curve Cryptography (ECC) offers similar security to RSA with shorter key sizes, making it suitable for resource-constrained devices
• Public key encryption enables secure communication without the need for prior key exchange, as the public key can be openly shared
• Digital signatures rely on public key cryptography to provide authentication, integrity, and non-repudiation
• Key management in public key cryptography involves the secure generation, distribution, and revocation of key pairs

Digital Signatures and Certificates

• Digital signatures provide a means to verify the authenticity and integrity of digital documents or messages
• The signer uses their private key to generate a signature, which can be verified by anyone using the corresponding public key
• Digital signatures are created by hashing the message and encrypting the hash with the signer's private key
• Verification involves decrypting the signature using the public key and comparing the resulting hash with the hash of the original message
• Digital certificates bind a public key to an identity, providing trust and facilitating secure communication
• Certificate Authorities (CAs) issue and manage digital certificates, acting as trusted third parties
• X.509 is a standard format for digital certificates, widely used in various network security protocols (SSL/TLS, S/MIME)
• Certificate revocation mechanisms (CRLs, OCSP) allow for the invalidation of compromised or expired certificates

Secure Communication Protocols

• Secure communication protocols establish encrypted and authenticated channels for data exchange over networks
• SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) provide secure communication for web traffic (HTTPS)
  • SSL/TLS uses a combination of symmetric and asymmetric encryption, along with digital certificates for authentication
• IPsec (Internet Protocol Security) is a framework for securing IP-based networks, operating at the network layer
  • IPsec supports two main protocols: Authentication Header (AH) for integrity and Encapsulating Security Payload (ESP) for confidentiality
• SSH (Secure Shell) enables secure remote access and command execution, commonly used for remote server administration
• PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) provide email encryption and digital signatures
• VPNs (Virtual Private Networks) use secure protocols to create encrypted tunnels for remote access and site-to-site connectivity

Network Security Threats and Attacks

• Eavesdropping involves intercepting and monitoring network traffic to gain unauthorized access to sensitive information
• Man-in-the-middle attacks occur when an attacker intercepts and potentially alters communication between two parties
• Replay attacks involve capturing and retransmitting valid network traffic to gain unauthorized access or disrupt services
• Denial-of-service (DoS) attacks aim to overwhelm network resources, making them unavailable to legitimate users
  • Distributed DoS (DDoS) attacks leverage multiple compromised systems to amplify the impact
• Malware, such as viruses, worms, and Trojans, can infect systems and compromise network security
• Social engineering techniques, like phishing, manipulate users into disclosing sensitive information or granting unauthorized access
• Cryptographic attacks, such as brute-force and dictionary attacks, attempt to crack encryption keys or exploit weaknesses in algorithms
• Zero-day vulnerabilities are previously unknown flaws in software or systems that can be exploited by attackers before patches are available

Practical Applications and Case Studies

• E-commerce platforms rely on secure communication protocols (SSL/TLS) to protect sensitive customer information and transactions
• Online banking and financial services employ strong encryption and multi-factor authentication to safeguard user accounts and prevent fraud
• Secure messaging applications (Signal, WhatsApp) use end-to-end encryption to ensure the privacy and confidentiality of user communications
• Virtual Private Networks (VPNs) are used by remote workers and organizations to securely access corporate resources over untrusted networks
• Blockchain technology, which relies on cryptographic principles, enables secure and decentralized applications (cryptocurrencies, smart contracts)
• Government and military communications often employ high-grade encryption and secure protocols to protect classified information
• Internet of Things (IoT) devices and industrial control systems require robust security measures to prevent unauthorized access and tampering
• Case studies, such as the Equifax data breach and the WannaCry ransomware attack, highlight the importance of strong network security practices