Lecture Data security and encryption - Chapter 2: Classical encryption techniques

This chapter presents the following content: Security concepts: confidentiality, integrity, availability; security attacks, services, mechanisms; models for network (access) security; classical encryption techniques; symmetric cipher model.

(CSE348)

1

2

Key Security Concepts

5

• FIPS PUB 199 provides a useful 

characterization of these three objectives in 

terms of requirements and the definition of a loss of security in each category

• A loss of confidentiality is the unauthorized 

disclosure of information

• Two of the most commonly mentioned are:

CIA Triad

10

• Authenticity: The property of being genuine and being able to be verified and trusted; 

confidence in the validity of a transmission, a message, or message originator

Levels of Impact

• can define 3 levels of impact from a security breach

– Low

– Moderate

– High

12

Levels of Impact

• degradation in mission capability to an extent and duration that the organization is able to 

Levels of Impact

• a significant degradation in mission capability and effectiveness of the functions is 

significantly reduced; 

• result in significant damage to oganizational assets; 

17

• Student enrollment information may have a 

moderate confidentiality rating. 

21

Confidentiality Example

• While still covered by FERPA, this 

information is seen by more people on a daily basis, is less likely to be targeted than grade 

cause harm to the hospital. 

23

Integrity Example

• The database needs to be restored to a trusted basis quickly, and it should be possible to trace the error back to the person responsible

• Patient allergy information is an example of an asset with a high requirement for integrity

• Inaccurate information could result in serious harm or death to a patient and expose the 

hospital to massive liability

24

Availability Example

• The more critical a component or service, the higher is the level of availability required. 

• Consider a system that provides authentication services

• An interruption of service results in the 

inability for customers to access computing 

resources. 

• loss of service translates into a large financial loss productivity and potential customer loss

25

Computer Security Challenges

1 not simple

2 must consider potential attacks

3 procedures used counter-intuitive

4 involve algorithms and secret info

5 must decide where to deploy mechanisms

6 battle of wits between attacker / admin

7 not perceived on benefit until fails

8 requires regular monitoring

9 too often an after-thought

10 regarded as impediment to using system

26

Aspects of Security

• Security attack: Any action that compromises the security of information owned by an 

organization. 

28

Aspects of Security

• Security mechanism: A process (or a device incorporating such a process) that is designed 

to detect, prevent, or recover from a security attack. 

29

Aspects of Security

• Security service: A processing or 

communication service that enhances the 

security of the data processing systems and the information transfers of an organization. 

30

Passive Attacks

31

Active Attacks

34

Active Attacks

35

• Active attacks involve some modification of the  data stream or the creation of a false stream

• Instead, the goal is to detect active attacks and to  recover from any disruption/or delays caused by  them.

Security Service

– enhance security of data processing systems and  information transfers of an organization

– intended to counter security attacks

– using one or more security mechanisms 

– often replicates functions normally associated with  physical documents

• which, for example, have signatures, dates; need 

protection from disclosure, tampering, or destruction; 

be notarized or witnessed; be recorded or licensed

37

Security Mechanism

• feature designed to detect, prevent, or recover from a security attack

Security Mechanisms (X.800)

• specific security mechanisms:

– encipherment, digital signatures, access controls,  data integrity, authentication exchange, traffic 

Model for Network Security

42

Model for Network Security

43

Model for Network Access Security

44

Model for Network Access Security

Chapter 2 – Classical Encryption

Techniques

• "I am fairly familiar with all the forms of secret 

writings, and am myself the author of a trifling 

monograph upon the subject, in which I analyze one  hundred and sixty separate ciphers," said Holmes  

—The Adventure of the Dancing Men, Sir Arthur 

Conan Doyle

46

Symmetric Encryption

• or conventional / private­key  / single­key

• sender and recipient share a common key

• all classical encryption algorithms are private­key

• was only type prior to invention of public­key 

in 1970’s

• and by far most widely used

47

Some Basic Terminology

Symmetric Cipher Model

49

Symmetric Cipher Model

Ingredients of the symmetric cipher model

• plaintext - original message

• encryption algorithm – performs

substitutions/transformations on plaintext

• secret key – control exact

substitutions/transformations used in encryption

algorithm

• ciphertext - scrambled message

• decryption algorithm – inverse of encryption

algorithm

50

• two requirements for secure use of symmetric encryption:

• Transposition (elements in the plaintext are rearranged)

• Product  (involve multiple stages of substitutions and transpositions)

Cryptanalytic Attacks

ciphertext only 

 only know algorithm & ciphertext, is statistical,  know or can identify plaintext 

More Definitions

unconditional security 

 no matter how much computer power or time is  available, the cipher cannot be broken since the