diff options
Diffstat (limited to 'main.tex')
| -rw-r--r-- | main.tex | 199 |
1 files changed, 199 insertions, 0 deletions
diff --git a/main.tex b/main.tex new file mode 100644 index 0000000..282d924 --- /dev/null +++ b/main.tex @@ -0,0 +1,199 @@ +\documentclass[a4paper]{article} + +% Imports +\usepackage{amssymb} +\usepackage{amsmath} +\usepackage{multicol} +\usepackage{ragged2e} +\usepackage{blindtext} +\usepackage[english]{babel} %this is the dictionary you will use +\usepackage{graphicx,mathdots,chemarr,fancyvrb,comment} %some more packages +\usepackage{tikz} %some more packages +%the packages from here on will help with creating a graph +%tikzpicture +\usepackage[many]{tcolorbox} +\usepackage{wrapfig} +\usepackage{scalerel} +\usepackage{pict2e} +\usepackage{tkz-euclide} +\usepackage{scalerel} +\usepackage{pict2e} +\usepackage{tkz-euclide} +\usepackage{listings} +\usepackage{color} +\usepackage{xifthen} +\usepackage{hyperref} +\graphicspath{ {/home/butterdog/Documents/texassets/} } +\definecolor{dkgreen}{rgb}{0,0.6,0} +%\definecolor{gray}{rgb}{0.5,0.5,0.5} +\definecolor{red}{HTML}{ffb3b3} +\definecolor{redbar}{HTML}{ff0000} +\definecolor{mauve}{rgb}{0.58,0,0.82} +\definecolor{cyanbar}{HTML}{00bfff} +\definecolor{cyan}{HTML}{b3f0ff} +\definecolor{greenbar}{HTML}{00ff00} +\definecolor{green}{HTML}{8cd98c} +\definecolor{main}{HTML}{5989cf} % setting main color to be used +\definecolor{sub}{HTML}{cde4ff} % setting sub color to be used +\tcbset{ + sharp corners, + colback = white, + before skip = 0.2cm, % add extra space before the box + after skip = 0.5cm % add extra space after the box +} % setting global options for tcolorbox +\makeatletter + + +%My Custom Commands +\newcommand{\mnewline}{\newline\newline\newline} +\newcommand{\mline}{\rule{0.5cm}{0.5pt}} +\newcommand{\proj}[1]{\text{Proj}_{#1}} +\newcommand{\st}{\ni:} +\newcommand{\evaline}[2]{\Big|^{#1}_{#2}} +\newcommand{\nulli}[1]{\text{Null }{#1}} +\newcommand{\ran}[1]{\text{ran }{#1}} +\newcommand{\col}[1]{\text{Col }({#1})} +\newcommand{\re}[1]{\text{Re}({#1})} +\newcommand{\im}[1]{\text{Im}({#1})} +\newcommand{\spa}[1]{\text{span}\{{#1}\}} +%\newcommand{\neproof}[3]{$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N > {#3}$}}} +\newcommand{\neproof}[3]{ %The first one is without the 3rd argument and the second one is + \ifthenelse{\isempty{#3}}{$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N$}}} + {$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N > {#3}$}}} +} +\newcommand{\infobox}[2]{\begin{InfoBox} + \smash{\raisebox{-5pt}{\includegraphics[width=0.77cm,height=0.68cm]{information}}}{\bf #1}\newline\newline + {#2} +\end{InfoBox}} +\newcommand{\warningbox}[2]{\begin{WarningBox} + \smash{\raisebox{-6pt}{\includegraphics[width=0.70cm,height=0.70cm]{warning}}} + {\bf #1}\newline\newline + {#2} +\end{WarningBox}} +\newcommand{\theorybox}[2]{\begin{TheoryBox} + \smash{\raisebox{-6pt}{\includegraphics[width=0.70cm,height=0.70cm]{theorem}}} + {\bf #1}\newline\newline + {#2} +\end{TheoryBox}} +\newcommand{\notebox}[2]{\begin{NoteBox} + \smash{\raisebox{-6pt}{\includegraphics[width=0.55cm,height=0.70cm]{reminder}}} + {\bf #1}\newline\newline + {#2} +\end{NoteBox}} +\renewcommand*\env@matrix[1][*\c@MaxMatrixCols c]{% + \hskip -\arraycolsep + \let\@ifnextchar\new@ifnextchar + \array{#1}} +\newtcolorbox{InfoBox}{ + colback = sub, + colframe = main, + boxrule = 0pt, + leftrule = 6pt % left rule weight +} +\newtcolorbox{WarningBox}{ + colback = red, + colframe = redbar, + boxrule = 0pt, + leftrule = 6pt % left rule weight +} +\newtcolorbox{TheoryBox}{ + colback = cyan, + colframe = cyanbar, + boxrule = 0pt, + leftrule = 6pt % left rule weight +} +\newtcolorbox{NoteBox}{ + colback = green, + colframe = greenbar, + boxrule = 0pt, + leftrule = 6pt % left rule weight +} +\newtcolorbox{TitleBox}{ + boxrule = 2pt, + rounded corners +} +\makeatother +\usepackage[letterpaper,left=6mm,includemp=true,marginparwidth=12mm,marginparsep=1mm,reversemarginpar,right=19mm, +includefoot=true,top=19mm,nohead,footskip=12mm,bottom=6mm]{geometry} +% Here are the custom commands I have created. They are increadibly retarded +% mnewline: creates 3 newlines +% mline: Creates a horizontal line +% proj: Creates a Proj with a suitable subscript - Takes an argument +% st: creates a ni and a : as the 'such that' +% evaline: creates a vertical line for evaluated definite integrals. First argument is upper limit, second is lower. - Takes two arguments +% nulli: creates a Null (with a whitespace) - Takes an argument +% col: creates a Col (with a whitespace) - Takes an argument +% ran: creates a ran (with a whitespace) - Takes an argument +% re: creates a Re() - Takes an argument +% im: creates a Im() - Takes an argument +% sp: creates a span{} - Takes an argument +% neproof: Creates a cookie cutter N-epsilon proof. First argument set's N's value and second argument sets epsilon greater than value and the third (optional) argument sets the n > N > value. IF YOU DO NOT WANT THE THIRD ARGUMENT YOU NEED AN EMPTY CURLY BRACKET +\begin{document} + \setlength{\parindent}{1cm} + \begin{center} + {\bf \Large CSCD27 -- Computer and Network Security} + \end{center} + \begin{TitleBox} + \begin{center} + \section{Main Notes} + \end{center} + \end{TitleBox} + \tableofcontents + \pagebreak + \section{Cryptography} + \theorybox{What is Cryptography}{Cryptography is the subject that introduces tools that we use to secure communications. Often times the channel we use to send messages is insecure, whether over a road or over the Internet. We use cryptography to secure these channels primarily by obfuscating data to ensure confidentiality (CIA). Because we are just obfuscating the message, cryptography cannot address integrity or availability.} + \notebox{Kinds of Cryptography Work}{There are two kinds of cryptography fields, one is the pure mathematical side building the individual tools. Then there is a computer science/technical side that utilizes these tools to build crypto protocols.} + \subsection{Classical Cryptography} + \theorybox{Plaintext}{Original message intended for author and recipient. This is the message that we want to secure.} + \theorybox{Ciphertext}{Encrypted message.} + \theorybox{Encryption}{The process of turning plaintext into ciphertext.} + \theorybox{Decryption}{The process of turning cipertext into plaintext.} + \theorybox{Cryptographic algorithm}{The algorithm that is used to do encryption and decryption.} + \theorybox{Cryptographic key}{Input used by algorithm to perform the actions of encryption and decryption.} + \theorybox{Shift Cipher} {A {\bf shift cipher} is one where you shift the characters in the alphabet by a fixed offset.} + The shift cipher is the oldest kind of cipher known to have been created. It was first implemented in the Caesar Cipher. With the Caesar cipher, the key is the shift offset. That is all fine and dandy, but we know that this is obviously trivial to crack. But how can we measure this? This is where we introduce key entropy. + \theorybox{N-Bit security entropy}{A measure in which we measure the strength of the algorithm. It is the number of bits to encode the number of possible keys.} + So for example in the Caesar cipher, with 25 possible rotations (not counting a full rotation which is dumb) you need 5 bits. This doesn't seem like a lot, and it isn't. While we will see that entropy is not exactly the be-all-end-all of measuring how good a cipher is, it is a useful benchmark as it directly impacts how easily a cipher is brute forced. + \infobox{What is considered good entropy?}{100 bits is the minimum threshold to not be considered a weak key.} + In the example big picture, an integrity attack can be where Mallory takes the message and sends it to someone else other than Bob, or resends it to Bob later.\\ + \theorybox{Kerckhoffs' Principle}{Kerckhoffs' Principle can be summed up as: ``The enemy knows the system'', or in other words, there is no security by obscurity. A cryptography algorithm should not rely on the fact the algorithm itself is secret. This only doesn't apply to the key.} + \theorybox{Types of ciphersystem attacks}{ + Listed are some of the main ways that ciphersystems are attacked. Note that they can be mixed together to form a more effective attack.\\ + Brute force: for $n$ keys it takes on average $n/2$ attempts to crack.\\ + Ciphertext Known: (you are given) One or more random ciphertexts are known.\\ + Known Plaintext: (you are given) You know a plaintext with it's associated ciphertext.\\ + Chosen Plaintext: (you get to interact with the system) You feed the cipher a plaintext and get the associated plain text.\\ + Chosen Ciphertext: (you get to interact with the system) You have the ciphertext and you can decode to get the plaintext. + } + So how can we apply these attacks to the Caesar Cipher? Brute forcing is very easy, you don't even need a computer. You just need to recognize what cipher is at play. Ciphertext Known for Caeser Cipher, you can try can try to reverse engineer the cipher by analysis, as opposed to brute forcing. So if you know something about the nature of the plaintext, you can do this.\\ + Chosen Plaintext and Ciphertext are really just mirrors. So for Caesar cipher for chosen plaintext, you input a plaintext character and count the offset. For Chosen Ciphertext you do the same but with the ciphertext character (so basically in this case it looks identical).\\\\\\ + So obviously it isn't great. Aside from the weak key permitting brute force, one can also analyze the structural weakness of the cipher. For example, with `e' being one of the most common letters in the alphabet, you can easily sniff out or guess which character is meant to substitute `e'. + \theorybox{Monoalphabetic Cipher}{A cipher that does not change the frequency of letters in a message. This is generally a bad idea. They are vulnerable to statistical analysis. The Caesar Cipher is one of them.} + Substitution is another example of a monoalphabetic ciper (along with Caesar). + \theorybox{Substitution Cipher}{Substitution cipher is one where you create a random permutation of the alphabet and use that. So if our alphabet was (a, b, c), then we could have (b, c, a) and we would subtitute b for a, c for b, etc.\\ + The key for this cipher is the permutation. The key entropy is $26!$.} + As we can see, it is far more resilient against brute force. However, as hinted earlier, higher entropy does not necessarily guarantee more security. A substitution cipher is vulnerable still to the other four attacks. In fact, you can combine known plaintext with bruteforce, it is common to mix them.\\\\ + So the opposite of a monoalphabetic cipher is a polyalphabetic cipher.\\ + \theorybox{Polyalphabetic Cipher}{A polyalphabetic cipher is one where we do change the fequency of letters in a message. This makes the cipher more resilient against analysis based attacks.} + One example for a polyalphabetic cipher is a Vigenere cipher. Instead of a fixed permutation, we have a phrase or word as our key instead of a number or set of permutations.\\ + A big enough $n$ makes brute force not possible for Vigenere. Statistical analysis is also dependent on length and the quality of the key. In an attack what you could do is try to reduce the search area to make brute force more viable. The other attacks are still possible if not easy.\\ + OTP is the best cipher eva. The key is an infinite random string. The reason why its called One Time Pad, you can only use the key once. In this case we use XOR to compute the ciphertext. Using the random string, we eliminate statistical analysis. And since we use the key only once, known plaintext is no good. Problem with this is that we have to constantly exchange keys. Many ciphersystems base themselves on OTP.\\ + Transposition Cipher is where we have a message of a fixed size, and each message we shuffle around characters in the messages. The key is the set of permutations. Brute force again depends on the entropy. You can still do some analysis if you have a known ciphertext. Known Plaintext you can reduce size, Chosen you send the alphabet and match the letters.\\\\ + \theorybox{Pillars of Modern Cryptography}{The pillars of modern cryptography are: Diffusion, Confusion and Randomization. Confusion and Randomization are good enough by themselves and are used to build a stream cipher. Diffusion and Confusion can be mixed together to build a block cipher.} + \notebox{Random Keys with high entropy are best.}{Big} + \pagebreak + \section{Core Concepts} + \theorybox{Definition - CIA}{An acronym for the three pillars of security, confidentiality, integrity and availability. For example, confidentiality means only the student can see their own grade, integrity is only the professor can enter a grade, availability just refers to keeping important systems online like 2FA. There are sub properties, see slides for Venn diagram.} + \section{Glossary} + {\bf Safety} -- Concept of a program where reasonable input for reasonable output, or correctness, or the program does what is intended.\\ + {\bf Security} -- Concept of a program where unreasonable inputs get reasonable outputs.\\ + {\bf Threat} -- Possibility of damage, can be tangible, possible, whatever. A threat can be accepted or not accepted. Rejected threats are ones that are not cost-effective or low possibility.\\ + {\bf Vulnerability} -- A weakness in the system, but not necessarily something that can be exploited or no exploit has been discovered yet.\\ + \indent A vulnerability enables a threat, and an attack/exploit takes advantage of a vulnerability. There is a clear differentiation between an attack and a vulnerability. An attack realizes a threat.\\ + {\bf Countermeasure} -- something done to disable an attack, limit the possibility or consequences of damage. So this can be like a patch or workaround. It mitigates a thread or removes/reduces a vulnerability\\ + Interception -- A kind of attack where an attacker obtains and reads the message. (Confidentiality)\\ + Modification -- A kind of attack where an attacker changes the message (Integrity)\\ + Fabrication -- A kind of attack where an attacker injects a message (Integrity)\\ + Interruption -- A kind of attack where an attacker disrupts communications (Availability)\\ + +\end{document} |