Week 16 - InfoSec and CIA

InfoSec is about protecting all information against unauthorized access that could result in undesired data modification or theft.

Cybersecurity refers to the practice of protecting data, its related technologies, and storage sources from threats.

• Confidentiality: The property that information is only made available or disclosed to authorised individuals, entities or processes

• Integrity: The Property of safeguarding the accuracy and completeness of assets against unauthorised access or modification.

• Availability: The property of being accessible and useable on demand by an authorised entity

• Plaintext - Original message to be transmitted
• Ciphertext - encrypted version of the plaintext
• Encryption algorithm - specific recipe for going from plaintext to ciphertext
• Key - additional input controlling encryption/ decryption algorithms.
  • In many cases the key is secret, and without it decryption is impossible.

1. Plaintext
2. Encryption
3. Ciphertext
4. Decryption
5. Plaintext

• Algorithm - A detailed set of instructions which results in a predictable end-state

• Can be used with both Stream and Block Encryption methods.

• Vernam Cipher:
  • XORs the plaintext with a key to create ciphertext.
• RC4
  • Designed by RSA in 1987
  • Used in WEP and WPA
  • Generally regarded as insecure but still used as a backup due to its speed and simplicity
  • Makes use of XOR with a key
  • the key was generated using a pseudo-random number generator
  • but it turned out to be not as random as it was presumed to be.
• ChaCha20
  • Used by google for HTTPS

• Encrypts the information a byte or letter at a time.

• The letters of the plain text are substituted with another letter a set distance down the alphabet.
• An example of a stream cipher.

• Encrypts information as a single block.
• Generally requires a computer to handle the transformation.
• Generally more efficient.
• The Plaintext is broken into blocks of a specific size
• each block is then encrypted separately(a round)
  • each round is a series of simple steps
• In each round half of the block is altered with a function and a subkey
• Then it is XOR’d with the other half
• These rounds are then repeated
• More rounds = More security but also with more processing load
• Each round has a separate set of keys

• Data Encryption Standard
• Old and generally insecure
• Makes use of the Feistel Cipher
• Short key length of 56 bits - Makes it vulnerable to brute force attacks
• Triple-DES is DES but done 3 times

Steps:

1. Expansion

   • 32-bit half block expanded to 48-bits

2. Key Mixing

   • Expanded half block is XOR’d with subkey

3. Substitution

   • Resulting block is broken up into 8 6-bit blocks
   • the S-boxes transform the 6 bits into 4 bits (this part makes it non-trivial)

4. Permutation

   • The P-Box then mixes up the S-Box output so that the outputs are spread out over the next sequence of S-Boxes

   

• Advanced Encryption Standard
• Very common
• Can be expanded
• Uses a Substitution-Permutation network
  • S-Boxes = Substitute a small block of inputs with another small block
  • P-Box = Permutates the S-Box outputs and feeds them into the next round of S-Boxes
    • Permutation = Rearrangement
    • {1,2,3}, has 6 versions (2,1,3), (2,3,1), etc

• Can be cracked
• Can get lost
• Can be stolen
• Needs to be transmitted

• Create long keys to slow cracking of the key

• They always give the same output meaning easy to work out how it works and easy to backtrack to the plain text from the cipher text.

• Add a key which makes every encryption unique.

• Uses 2 Different keys
• One to encrypt the plaintext (Public key)
  • This is sent to anyone to encrypt data to send.
• One to decrypt the ciphertext (Private key)
  • This is kept private and used to decrypt the sent data.

• RSA
  • Same people created RC4
  • A bit slow but still widely used
• El-Gamal
  • More Advanced
  • Suffered from excessive complexity
• Elliptic Curve Cryptography (ECC)
  • Good for when resources are constrained

• Password guessing:

  • Brute force
    • Methodical Process of trying every possible password combination
    • Very time consuming
    • Generally defeated by the inclusion of a ‘Salt’
  • Dictionary attack
    • Makes use of word lists
      • Leaked passwords which are compiled together
      • just a list of words
    • Much quicker but needs to be tailored
    • Salting will again make it a lot harder

• Poor key Generation Procedures

  • WEP was cracked using this method.
  • If using the same key then capturing a lot of data encrypted with the same key it can be used to crack the encryption.

• Side Channel Attacks

  • Timing Attacks
    • Noticeable difference in how long the system processes correct/incorrect guesses
  • Power Monitoring
    • Noticeable difference in power consumption when guesses are incorrect vs correct.