path: root/main.tex

\documentclass[a4paper]{article}

% Imports
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{multicol}
\usepackage{ragged2e}
\usepackage{blindtext}
\usepackage[english]{babel} %this is the dictionary you will use
\usepackage{graphicx,mathdots,chemarr,fancyvrb,comment} %some more packages
\usepackage{tikz} %some more packages
%the packages from here on will help with creating a graph
%tikzpicture
\usepackage[many]{tcolorbox}
\usepackage{wrapfig}
\usepackage{scalerel}
\usepackage{pict2e}
\usepackage{tkz-euclide}
\usepackage{scalerel}
\usepackage{pict2e}
\usepackage{tkz-euclide}
\usepackage{listings}
\usepackage{color}
\usepackage{xifthen}
\usepackage{hyperref}
\graphicspath{ {/home/butterdog/Documents/texassets/} }
\definecolor{dkgreen}{rgb}{0,0.6,0}
%\definecolor{gray}{rgb}{0.5,0.5,0.5}
\definecolor{red}{HTML}{ffb3b3}
\definecolor{redbar}{HTML}{ff0000}
\definecolor{mauve}{rgb}{0.58,0,0.82}
\definecolor{cyanbar}{HTML}{00bfff}
\definecolor{cyan}{HTML}{b3f0ff}
\definecolor{greenbar}{HTML}{00ff00}
\definecolor{green}{HTML}{8cd98c}
\definecolor{main}{HTML}{5989cf}    % setting main color to be used
\definecolor{sub}{HTML}{cde4ff}     % setting sub color to be used
\tcbset{
	sharp corners,
	colback = white,
	before skip = 0.2cm,    % add extra space before the box
	after skip = 0.5cm      % add extra space after the box
}                           % setting global options for tcolorbox
\makeatletter


%My Custom Commands
\newcommand{\mnewline}{\newline\newline\newline}
\newcommand{\mline}{\rule{0.5cm}{0.5pt}}
\newcommand{\proj}[1]{\text{Proj}_{#1}}
\newcommand{\st}{\ni:}
\newcommand{\evaline}[2]{\Big|^{#1}_{#2}}
\newcommand{\nulli}[1]{\text{Null }{#1}}
\newcommand{\ran}[1]{\text{ran }{#1}}
\newcommand{\col}[1]{\text{Col }({#1})}
\newcommand{\re}[1]{\text{Re}({#1})}
\newcommand{\im}[1]{\text{Im}({#1})}
\newcommand{\spa}[1]{\text{span}\{{#1}\}}
%\newcommand{\neproof}[3]{$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N  > {#3}$}}}
\newcommand{\neproof}[3]{ %The first one is without the 3rd argument and the second one is
	\ifthenelse{\isempty{#3}}{$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N$}}}
	{$\text{Let } \epsilon > {#2} \text{ be given}$\\\text{Choose $N = {#1}$\text{ Suppose $n > N  > {#3}$}}} 
}
\newcommand{\infobox}[2]{\begin{InfoBox}
		\smash{\raisebox{-5pt}{\includegraphics[width=0.77cm,height=0.68cm]{information}}}{\bf #1}\newline\newline
		{#2}
\end{InfoBox}}
\newcommand{\warningbox}[2]{\begin{WarningBox}
		\smash{\raisebox{-6pt}{\includegraphics[width=0.70cm,height=0.70cm]{warning}}}
		{\bf #1}\newline\newline
		{#2}
\end{WarningBox}}
\newcommand{\theorybox}[2]{\begin{TheoryBox}
		\smash{\raisebox{-6pt}{\includegraphics[width=0.70cm,height=0.70cm]{theorem}}}
		{\bf #1}\newline\newline
		{#2}
\end{TheoryBox}}
\newcommand{\notebox}[2]{\begin{NoteBox}
		\smash{\raisebox{-6pt}{\includegraphics[width=0.55cm,height=0.70cm]{reminder}}}
		{\bf #1}\newline\newline
		{#2}
\end{NoteBox}}
\renewcommand*\env@matrix[1][*\c@MaxMatrixCols c]{%
	\hskip -\arraycolsep
	\let\@ifnextchar\new@ifnextchar
	\array{#1}}
\newtcolorbox{InfoBox}{
	colback = sub, 
	colframe = main, 
	boxrule = 0pt, 
	leftrule = 6pt % left rule weight
}
\newtcolorbox{WarningBox}{
	colback = red, 
	colframe = redbar, 
	boxrule = 0pt, 
	leftrule = 6pt % left rule weight
}
\newtcolorbox{TheoryBox}{
	colback = cyan, 
	colframe = cyanbar, 
	boxrule = 0pt, 
	leftrule = 6pt % left rule weight
}
\newtcolorbox{NoteBox}{
	colback = green, 
	colframe = greenbar, 
	boxrule = 0pt, 
	leftrule = 6pt % left rule weight
}
\newtcolorbox{TitleBox}{
	boxrule = 2pt,
	rounded corners
}
\makeatother
\usepackage[letterpaper,left=6mm,includemp=true,marginparwidth=12mm,marginparsep=1mm,reversemarginpar,right=19mm,
includefoot=true,top=19mm,nohead,footskip=12mm,bottom=6mm]{geometry}
% Here are the custom commands I have created. They are increadibly retarded
% mnewline: creates 3 newlines
% mline: Creates a horizontal line
% proj: Creates a Proj with a suitable subscript - Takes an argument
% st: creates a ni and a : as the 'such that'
% evaline: creates a vertical line for evaluated definite integrals. First argument is upper limit, second is lower. - Takes two arguments
% nulli: creates a Null (with a whitespace) - Takes an argument
% col: creates a Col (with a whitespace) - Takes an argument
% ran: creates a ran (with a whitespace) - Takes an argument
% re: creates a Re() - Takes an argument
% im: creates a Im() - Takes an argument
% sp: creates a span{} - Takes an argument
% neproof: Creates a cookie cutter N-epsilon proof. First argument set's N's value and second argument sets epsilon greater than value and the third (optional) argument sets the n > N > value. IF YOU DO NOT WANT THE THIRD ARGUMENT YOU NEED AN EMPTY CURLY BRACKET
\begin{document}
	\setlength{\parindent}{1cm}
	\begin{center}
		{\bf \Large CSCD27 -- Computer and Network Security}
	\end{center}
	\begin{TitleBox}
		\begin{center}
			\section{Main Notes}
		\end{center}
	\end{TitleBox}
	\tableofcontents
	\pagebreak
	\section{Cryptography}
	\theorybox{What is Cryptography}{Cryptography is the subject that introduces tools that we use to secure communications. Often times the channel we use to send messages is insecure, whether over a road or over the Internet. We use cryptography to secure these channels primarily by obfuscating data to ensure confidentiality (CIA). Because we are just obfuscating the message, cryptography cannot address integrity or availability.}
	\notebox{Kinds of Cryptography Work}{There are two kinds of cryptography fields, one is the pure mathematical side building the individual tools. Then there is a computer science/technical side that utilizes these tools to build crypto protocols.}
	\subsection{Classical Cryptography}
	\theorybox{Plaintext}{Original message intended for author and recipient. This is the message that we want to secure.}
	\theorybox{Ciphertext}{Encrypted message.}
	\theorybox{Encryption}{The process of turning plaintext into ciphertext.}
	\theorybox{Decryption}{The process of turning cipertext into plaintext.}
	\theorybox{Cryptographic algorithm}{The algorithm that is used to do encryption and decryption.}
	\theorybox{Cryptographic key}{Input used by algorithm to perform the actions of encryption and decryption.}
	\theorybox{Shift Cipher} {A {\bf shift cipher} is one where you shift the characters in the alphabet by a fixed offset. Mathematically, shift ciphers can be expressed using $a + b \mod 26$ since if our shift offset goes past 26, we wrap back around.}
	The shift cipher is the oldest kind of cipher known to have been created. It was first implemented in the Caesar Cipher. With the Caesar cipher, the key is the shift offset. That is all fine and dandy, but we know that this is obviously trivial to crack. But how can we measure this? This is where we introduce key entropy.
	\theorybox{N-Bit security entropy}{A measure in which we measure the strength of the algorithm. It is the number of bits to encode the number of possible keys.}
	So for example in the Caesar cipher, with 25 possible rotations (not counting a full rotation which is dumb) you need 5 bits. This doesn't seem like a lot, and it isn't. While we will see that entropy is not exactly the be-all-end-all of measuring how good a cipher is, it is a useful benchmark as it directly impacts how easily a cipher is brute forced.
	\theorybox{Quick Facts -- Caesar Cipher}{
	Type: Monoalphabetic Shift Cipher\\
	Key: Shift offset\\
	N-bit security entropy: 5 bits}
	\infobox{What is considered good entropy?}{100 bits is the minimum threshold to not be considered a weak key.}
	In the example big picture, an integrity attack can be where Mallory takes the message and sends it to someone else other than Bob, or resends it to Bob later.\\
	\theorybox{Kerckhoffs' Principle}{Kerckhoffs' Principle can be summed up as: ``The enemy knows the system'', or in other words, there is no security by obscurity. A cryptography algorithm should not rely on the fact the algorithm itself is secret. This only doesn't apply to the key.}
	\theorybox{Types of ciphersystem attacks}{
	    Listed are some of the main ways that ciphersystems are attacked. Note that they can be mixed together to form a more effective attack.\\
	    {\bf Brute force}: for $n$ keys it takes on average $n/2$ attempts to crack.\\
	    {\bf Ciphertext Known}: (you are given) One or more random ciphertexts are known. Generally this attack occurs using something like statistical analysis.\\
	    {\bf Known Plaintext}: (you are given) You know one or several plaintext(s) with it's associated ciphertext.\\
	    {\bf Chosen Plaintext}: (you get to interact with the system) You feed the cipher a plaintext and get the associated ciphertext.\\
	    {\bf Chosen Ciphertext}: (you get to interact with the system) You feed the cipher a cipher text and get the associated plaintext.\\
    }
	So how can we apply these attacks to the Caesar Cipher? Brute forcing is very easy, you don't even need a computer. You just need to recognize what cipher is at play. Ciphertext Known for Caeser Cipher, you can try can try to reverse engineer the cipher by analysis, as opposed to brute forcing. So if you know something about the nature of the plaintext, you can do this.\\
	Chosen Plaintext and Ciphertext are really just mirrors. So for Caesar cipher for chosen plaintext, you input a plaintext character and count the offset. For Chosen Ciphertext you do the same but with the ciphertext character (so basically in this case it looks identical).\\\\\\
	So obviously it isn't great. Aside from the weak key permitting brute force, one can also analyze the structural weakness of the cipher. For example, with `e' being one of the most common letters in the alphabet, you can easily sniff out or guess which character is meant to substitute `e'.
	\theorybox{Monoalphabetic Cipher}{A cipher that does not change the frequency of letters in a message. This is generally a bad idea. They are vulnerable to statistical analysis. The Caesar Cipher is one of them.}
	Substitution is another example of a monoalphabetic ciper (along with Caesar).
	\theorybox{Quick Facts -- Substitution Cipher}{
	    Type: Monoalphabetic Cipher\\
	    Key: The permutation mapping\\
	    N-bit security entropy: $26!$ bits
	}
	Substitution cipher is one where you create a random permutation of the alphabet and use that. So if our alphabet was (a, b, c), then we could have (b, c, a) and we would subtitute b for a, c for b, etc.\\
	As we can see by the much larger entropy, it is far more resilient against brute force. However, as hinted earlier, higher entropy does not necessarily guarantee more security. A substitution cipher is vulnerable still to the other four attacks. In fact, you can combine known plaintext with bruteforce, it is common to mix them.\\\\
	So the opposite of a monoalphabetic cipher is a polyalphabetic cipher.\\
	\theorybox{Polyalphabetic Cipher}{A polyalphabetic cipher is one where we do change the fequency of letters in a message. This makes the cipher more resilient against analysis based attacks.}
	One example for a polyalphabetic cipher is a Vigenere cipher. Instead of a fixed permutation, we have a phrase or word as our key instead of a number or set of permutations. So for example, if our word is BUTTERDOG, the first letter would be offset by 2, the second would be offset by 20, so on and so forth. Once we have finished typing out BUTTERDOG, we restart again until we have exhausted the plaintext.\\
	\theorybox{Quick Facts -- Vigenere/Renaissance Cipher}{
	Type: Polyalphabetic Shift Cipher\\
	Key: A word (or a phrase with no spaces or whatever you want)\\
	N-bit security entropy: $26^n$}
	A big enough $n$ makes brute force impossible for Vigenere. Statistical analysis is also dependent on length and the quality of the key. In an attack what you could do is try to reduce the search area to make brute force more viable. The other attacks are still possible if not easy.\\
	So as we can see, if the key has an insufficient length, or has poor form, then Vigenere is unlikely to be very strong. But then what if we solved both of those in one shot, or in other words, in One Time Pad.
	\theorybox{Quick Facts -- Quick Pad}{
	    Type: Polyalphabetic Shift Cipher\\
	    Key: An infinite string containing randomly generated characters\\
	    N-bit security entropy: $\infty$
	}
	OTP is the best cipher eva. The reason why its called One Time Pad, you can only use the key once. This helps build resilience against attacks in where an attacker has access to the cipher, or has access to ciphertexts and plaintexts. In this case we use XOR the two strings together to compute the ciphertext, rather than using the key's characters as a shift offset. Using the random string, we eliminate statistical analysis. And since we use the key only once, known plaintext is no good. Problem with this is that we have to constantly exchange keys. For one our key has an infinite size. Second, our key is only valid for a single exchange, so every message sent must get a new key. However, there are ways to improve OTP and make them more viable for real world applications. Many ciphersystems base themselves on OTP.\\\\
	One suggestion given during lecture was to use the previous message as the encryption key. It is one time, mostly random, and we have to send a message either way. Only issue is that the chain has to be seeded from somewhere and requires that initial exchange of keys.
	\notebox{Random single-use keys with high entropy are best.}{Randomness makes statistical analysis extremely difficult/impossible, higher entropy keys make brute forcing unviable. The key being single-use makes known plaintext-ciphertext attacks impossible.}
	Transposition Cipher is where we have a message of a fixed size, and each message we shuffle around characters in the messages. The key is the set of permutations. Brute force again depends on the entropy. You can still do some analysis if you have a known ciphertext. Known Plaintext you can reduce size, Chosen you send the alphabet and match the letters.
	\theorybox{Quick Facts -- Transposition Cipher}{
	Type: Polyalphabetic Cipher\\
	Key: A permutation of the order of the characters\\
	N-Bit security entropy: $n!$ where $n$ is the length of the fixed length message.
    }
	\theorybox{Pillars of Modern Cryptography}{The pillars of modern cryptography are: Diffusion, Confusion and Randomization. Diffusion is like the game of guessing which cup has the ball, you want to mix up the characters in the string and make sure that changes are not local. An example is transposition. Confusion is replacing a symbol with another but keeping this relationship as opaque as possible. Randomization is not quite what you think it is, it is the feature where the same text encrypted multiple times does not generate the same ciphertext. Confusion and Randomization are good enough by themselves and are used to build a stream cipher. Diffusion and Confusion can be mixed together to build a block cipher.}
	\pagebreak
	\section{Core Concepts}
	\theorybox{Definition - CIA}{An acronym for the three pillars of security, confidentiality, integrity and availability. For example, confidentiality means only the student can see their own grade, integrity is only the professor can enter a grade, availability just refers to keeping important systems online like 2FA. There are sub properties, see slides for Venn diagram.}
	Something curious about the pillars of security is that sometimes some of them are undesirable. For example something like confidentiality and availability might be targets. Additionally, they can even conflict with each other. For example we have voting. For confidentiality, you want your vote to be secret so that you can express yourself freely. For integrity, you want to keep someone from voting twice, or having their vote changed, or pretending their vote never happened. And for availability, you want everyone who is able to vote to do so. Integrity and confidentiality in this case begin to clash a bit.\\
	\theorybox{Anonymity vs Pseudonymity}{Pseudonymity is the state of something like Discord or Reddit. You have a username (likely not your real name) that isn't directly named after you. However, as you show yourself through these platforms, people can begin to triangulate who this account likely belongs to, thus potentially revealing yourself.\\
	True anonymity means that it is impossible to trace something back to your person through any means.}
	\section{Glossary}
	{\bf Safety} -- Concept of a program where reasonable input for reasonable output, or correctness, or the program does what is intended.\\
	{\bf Security} -- Concept of a program where unreasonable inputs get reasonable outputs.\\
	{\bf Threat} -- Possibility of damage, can be tangible, possible, whatever. A threat can be accepted or not accepted. Rejected threats are ones that are not cost-effective or low possibility.\\
	{\bf Vulnerability} -- A weakness in the system, but not necessarily something that can be exploited or no exploit has been discovered yet.\\
	\indent A vulnerability enables a threat, and an attack/exploit takes advantage of a vulnerability. There is a clear differentiation between an attack and a vulnerability. An attack realizes a threat.\\
	{\bf Countermeasure} -- something done to disable an attack, limit the possibility or consequences of damage. So this can be like a patch or workaround. It mitigates a thread or removes/reduces a vulnerability\\
	{\bf Interception} -- A kind of attack where an attacker obtains and reads the message. (Confidentiality)\\
	{\bf Modification} -- A kind of attack where an attacker changes the message (Integrity)\\
	{\bf Fabrication} -- A kind of attack where an attacker injects a message (Integrity)\\
	{\bf Interruption} -- A kind of attack where an attacker disrupts communications (Availability)\\
\end{document}