Network Security

A network built only for speed and reach is a network built for attackers: every layer you met in this book was designed when the users were trusted colleagues.

This unit gives the vocabulary of network security, the cryptographic tools (symmetric, public-key, hashes, signatures), the protocols that use them (TLS, IPsec, WPA2) and the defensive devices (firewalls, IDS, VPN).

The RSA and hash examples are small enough to do by hand and are also executed by the program at the end.

7.1 Security goals and threats

The CIA triad: confidentiality (only authorised parties can read), integrity (data is not altered unnoticed), availability (the service works when needed).

Added goals are authentication (who are you?), authorisation (what may you do?) and non-repudiation (the sender cannot deny sending).

Attack	Goal attacked	How it works	Typical defence
Eavesdropping / sniffing	confidentiality	capture frames on a shared or compromised link	encryption (TLS, WPA2)
Spoofing	authentication	forged source address, MAC or e-mail sender	ingress filtering, authentication, SPF
Man-in-the-middle	confidentiality, integrity	attacker relays and alters traffic (ARP spoofing, rogue access point)	TLS with certificate validation, dynamic ARP inspection
Replay	integrity	resend a captured valid message	nonces, timestamps, sequence numbers
Denial of service (DoS, DDoS)	availability	flood a victim (SYN flood, amplification via DNS) with traffic	rate limiting, SYN cookies, scrubbing services
Phishing, social engineering	authentication	trick users into giving credentials	training, multi-factor authentication
Malware: virus, worm, ransomware	all	self-spreading or extortion code	patching, backups, endpoint protection

A passive attack only observes; an active attack modifies or injects. Passive attacks are hard to detect and are defeated by encryption; active attacks are detected by integrity checks.

7.2 Cryptography basics

Plaintext is encrypted with a key by an algorithm to give ciphertext; decryption reverses it. Kerckhoffs' principle: the algorithm is public, only the key is secret.

Classical ciphers

A Caesar cipher shifts each letter by k (k = 3 turns "NEB" into "QHE"); only 25 keys, broken at once by trying all. A monoalphabetic substitution has 26! ≈ 4 × 10²⁶ keys but falls to letter-frequency analysis.

Vigenère uses a repeating key to defeat simple frequency counts. Transposition rearranges letters. Modern ciphers combine substitution and transposition in many rounds (confusion and diffusion).

Symmetric-key cryptography

The same secret key encrypts and decrypts. DES (56-bit key, now breakable in hours), 3DES, and the standard AES (128-, 192- or 256-bit keys, block size 128 bits, 10, 12 or 14 rounds).

A block cipher needs a mode of operation: ECB (each block alone: identical plaintext blocks give identical ciphertext, leaking patterns), CBC (each block XORed with the previous ciphertext), CTR and GCM (counter mode, with authentication).

Strengths: fast. Weakness: the key distribution problem: n people who each need a private channel with every other need n(n − 1)/2 keys (45 keys for 10 people).

Public-key cryptography

Each party has a public key (published) and a private key (secret). What one key encrypts, only the other decrypts. To send a secret to Bob, encrypt with Bob's public key; only Bob's private key opens it.

Public-key operations are slow (about a thousand times slower than AES), so they are used to exchange a symmetric session key and to sign.

The RSA algorithm

1. Choose two primes p and q; n = p q.
2. φ(n) = (p − 1)(q − 1).
3. Choose e coprime to φ(n); compute d with e d ≡ 1 (mod φ(n)).
4. Public key (e, n); private key (d, n). Encrypt: c = mᵉ mod n. Decrypt: m = cᵈ mod n.

Diffie–Hellman lets two parties build a shared secret over a public channel: with public g and prime p, Alice picks a and sends gᵃ mod p, Bob picks b and sends gᵇ mod p, and both compute gᵃᵇ mod p. With p = 23, g = 5, a = 6 and b = 15: Alice sends 5⁶ mod 23 = 8, Bob sends 5¹⁵ mod 23 = 19, and the shared secret is 19⁶ mod 23 = 8¹⁵ mod 23 = 2.

An eavesdropper sees only p, g, 8 and 19. Without authentication it is open to a man-in-the-middle.

Hash functions

A cryptographic hash maps any input to a fixed-size digest and is one-way, collision-resistant and has the avalanche effect (one flipped input bit changes about half the output bits).

SHA-256 gives 256 bits; the digest of "abc" is ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad. MD5 and SHA-1 are broken for collisions and must not be used for security.

Hashes store passwords (with a per-user salt and a slow function such as bcrypt, scrypt or Argon2), check file integrity, and build blockchains. A MAC or HMAC is a hash keyed with a shared secret, giving integrity and authenticity.

Digital signatures and certificates

A digital signature is the hash of a message encrypted with the sender's private key; anyone can verify it with the public key, which gives integrity, authentication and non-repudiation. But how do you know a public key belongs to Bob?

A certificate authority (CA) signs an X.509 certificate that binds a name to a public key; browsers trust a list of root CAs, and a chain of certificates leads from the site's certificate up to a root.

In Nepal the Controller of Certification (Office of the Controller of Certification, under the Electronic Transactions Act) licenses certifying authorities for digital signatures.

7.3 Secure protocols

TLS (and HTTPS)

Transport Layer Security (successor to SSL) sits between TCP and the application and provides encryption, integrity and server authentication (optionally client authentication).

A simplified TLS 1.3 handshake: (1) ClientHello with supported cipher suites and a key share (Diffie–Hellman); (2) ServerHello with the chosen suite, its key share and its certificate and a signature proving possession of the private key; (3) both derive session keys; (4) Finished messages confirm; (5) application data is encrypted with a symmetric cipher (AES-GCM or ChaCha20).

TLS 1.3 needs one round trip (TLS 1.2 needed two), and the Diffie–Hellman exchange gives forward secrecy: stealing the server's long-term key later does not reveal old sessions.

HTTPS = HTTP over TLS on port 443; the browser's padlock means the certificate matched the host name and was signed by a trusted CA, not that the site is honest.

IPsec and VPNs

IPsec secures at the IP layer. The AH header gives integrity and authentication; ESP gives encryption plus integrity.

In transport mode only the payload is protected (host to host); in tunnel mode the whole original packet is encrypted and wrapped in a new IP packet (gateway to gateway), the basis of a site-to-site VPN. Keys are negotiated by IKE.

Remote-access VPNs use IPsec, TLS-based VPNs or WireGuard to give a traveller a private tunnel to the office network.

Wireless security

WEP's RC4 usage is broken in minutes. WPA2 uses AES-CCMP; with a pre-shared key (personal) all users share a passphrase, with 802.1X/EAP (enterprise) each user has credentials checked by a RADIUS server.

WPA3 adds SAE (a password-authenticated key exchange resisting offline guessing) and mandatory protected management frames. Hiding the SSID and MAC filtering are not real security.

E-mail and DNS security

PGP/S-MIME encrypt and sign mail end to end; STARTTLS protects the hop between servers; SPF, DKIM and DMARC authenticate sending domains; DNSSEC signs DNS records; DNS over HTTPS/TLS hides queries from eavesdroppers.

7.4 Firewalls and intrusion detection

A firewall enforces a policy between networks of different trust. Types:

• Packet filter (stateless): examines IP and port in each packet against an ordered rule list (an ACL); first match wins, with an implicit deny all at the end.
• Stateful inspection: remembers connections; return traffic of a connection initiated inside is allowed automatically; unsolicited inbound is dropped.
• Application gateway (proxy): terminates the connection and inspects content (HTTP, SMTP); also used for caching and URL filtering.
• Next-generation firewall: adds application identification, intrusion prevention and user identity.

A DMZ (demilitarised zone) is a separate network segment for public-facing servers, so that a compromised web server does not sit on the internal LAN.

An IDS monitors traffic or hosts and alerts; an IPS sits in line and blocks.

Signature-based detection matches known patterns (fast, misses new attacks); anomaly-based detection flags deviations from a baseline (finds new attacks, more false positives).

Honeypots are decoy systems that attract and study attackers.

7.5 Good practice

Use TLS everywhere, keep systems patched, give users least privilege, segment networks (VLANs, DMZ), enable multi-factor authentication, back up offline, change default passwords on routers and cameras, disable unused services (a closed port cannot be attacked), log and monitor, and teach users to recognise phishing.

Security is a process, not a product, and a chain is as strong as its weakest link, which is usually a person.

Practising the commands

This program checks every cryptographic example above: Caesar, the RSA key and message, Diffie–Hellman, the SHA-256 digest, the avalanche effect and an HMAC check.

import hashlib, hmac
print("Caesar +3:", "".join(chr((ord(ch) - 65 + 3) % 26 + 65) for ch in "NEB"))
p, q, e = 61, 53, 17; n = p * q; phi = (p - 1) * (q - 1); d = pow(e, -1, phi)
print("n", n, "phi", phi, "d", d, "check e*d mod phi =", e * d % phi)
c = pow(65, e, n); print("cipher", c, "plain", pow(c, d, n))
sig = pow(7, d, n); print("signature of h=7:", sig, "verifies:", pow(sig, e, n) == 7)
P, g, a, b = 23, 5, 6, 15; A, B = pow(g, a, P), pow(g, b, P)
print("DH:", A, B, pow(B, a, P), pow(A, b, P))
print(hashlib.sha256(b"abc").hexdigest())
x, y = hashlib.sha256(b"abc").digest(), hashlib.sha256(b"abd").digest()
print("avalanche bits changed:", sum(bin(i ^ j).count("1") for i, j in zip(x, y)), "of 256")
mac = hmac.new(b"key", b"message", hashlib.sha256).hexdigest(); print(mac[:16], hmac.compare_digest(mac, hmac.new(b"key", b"message", hashlib.sha256).hexdigest()))
print("keys for 10 people (symmetric):", 10 * 9 // 2)

Caesar +3: QHE
n 3233 phi 3120 d 2753 check e*d mod phi = 1
cipher 2790 plain 65
signature of h=7: 2667 verifies: True
DH: 8 19 2 2
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
avalanche bits changed: 122 of 256
6e9ef29b75fffc5b True
keys for 10 people (symmetric): 45

7.6 Seeing the ideas: ciphers, keys, hashes, handshakes and firewalls

Security is mostly arithmetic that can be checked, so this section computes the unit's examples instead of only describing them.

Plate 7.1 shows the history of secret writing in three objects: a bust of Julius Caesar (whose shift cipher gives the simplest example), an Enigma machine and a Lorenz cipher machine from the Second World War.

Plate 7.2 shows the people and the machine of modern cryptography: Diffie and Hellman (public-key exchange), Rivest, Shamir and Adleman (RSA) and the DES-cracking board that proved a 56-bit key was too short.

Plate 7.3 shows the inside of a real firewall appliance and a hardware security key.

The figures that follow compute the Caesar cipher and its key space, letter-frequency analysis, key counts, the RSA and Diffie-Hellman examples, the avalanche effect of a hash, digital signatures and certificates, the TLS handshake, IPsec modes, an access control list, two denial-of-service attacks and password strength.

(a) Caesar: shift cipher

(b) Enigma: rotor machine

(c) Lorenz SZ42: teleprinter cipher

(a) Diffie and Hellman: key exchange

(b) Rivest, Shamir, Adleman: RSA

(c) DES cracker board: 56 bits fell

(a) Firewall appliance: inside

(b) Hardware security key (FIDO2)

(c) Three kinds of evidence

7.6.1 Eight security practices that matter in Nepal

1. Encrypted web and payments. ConnectIPS, Fonepay, eSewa and mobile banking apps all run over TLS, so the handshake of Fig. 7.9 happens before any password or amount is sent. The padlock shows that the certificate matched the host name and was signed by a trusted authority (Fig. 7.8). It does not prove that the site is honest, so students should still check the address before typing a password.
2. Strong, salted passwords. Portals, e-mail and social accounts are protected first by passwords, and Fig. 7.13 shows that length matters most: twelve mixed characters last millions of years, an eight-letter lowercase word only seconds. A service should store only a salted, slow hash (Fig. 7.7) so a stolen database does not reveal passwords. A password manager lets each account have a different long password.
3. Multi-factor authentication. Banks send a one-time code to the registered phone, and a hardware key such as the one in Plate 7.3 is stronger still because its private key never leaves the device. Two different kinds of evidence (something you know and something you have) mean that a stolen password alone is useless. Turn it on for e-mail first, because e-mail can reset every other account.
4. Safe Wi-Fi at home, hostel and campus. Use WPA2 or WPA3 with a long passphrase, and enterprise 802.1X in a college so each student has a personal login. Hiding the network name and filtering MAC addresses give almost no protection. Public Wi-Fi without encryption lets anyone nearby sniff traffic, so use only HTTPS sites or a VPN there.
5. VPNs for remote work. Nepali software and outsourcing companies serve foreign clients and let staff work from home through VPN tunnels (Fig. 7.10). The tunnel hides the real addresses and encrypts everything between the laptop and the office gateway. This is the same mechanism that joins two branch offices of a bank across the public Internet.
6. Firewalls and a DMZ. A college or ISP puts public servers such as the website and mail gateway in a DMZ and the student records on the inside LAN, with rules like those in Fig. 7.11. The first matching rule decides and everything not permitted is denied. If the web server is hacked, the attacker still faces the firewall before reaching internal data.
7. Digital signatures and certificates. The Electronic Transactions Act and the Controller of Certification allow licensed authorities to issue digital signature certificates, which are used on electronic tenders and filings. A signature (Fig. 7.8) proves who signed and that the document was not changed, so it can replace a handwritten signature. The certificate chain tells the verifier that the public key really belongs to the named person.
8. Defence against attacks and fraud. A public portal on result day may face traffic floods, and SYN cookies and rate limits keep it alive (Fig. 7.12). Phishing messages that copy a bank or a telecom prize offer are the most common attack on ordinary users, so never type a password after clicking a link in a message. Regular offline backups are the best answer to ransomware, because the data can be restored without paying.

Formula and fact sheet

• RSA: n = pq, φ = (p − 1)(q − 1), e d ≡ 1 (mod φ), c = mᵉ mod n, m = cᵈ mod n.
• Diffie–Hellman: shared = gᵃᵇ mod p. Symmetric keys for n people: n(n − 1)/2.
• AES block 128 bits, keys 128/192/256. SHA-256 digest 256 bits. TLS port 443, SSH 22, IPsec ESP protocol 50, AH 51.
• Firewall: ordered rules, first match, implicit deny. Stateful tracks connections.
• Signature = private-key operation on the hash; verification with the public key.

Chapter summary

• Security aims at confidentiality, integrity, availability, authentication and non-repudiation; attacks are passive or active.
• Symmetric ciphers (AES) are fast but need key distribution; public-key systems (RSA, Diffie–Hellman) solve distribution and give signatures; hashes provide integrity.
• Certificates bind keys to names through CAs; TLS combines all of them to secure the web; IPsec and WPA2 do it at the IP and Wi-Fi layers.
• Firewalls filter by policy, IDS/IPS detect and block attacks, and good practice (patching, least privilege, segmentation, MFA) matters more than any single device.

Practice

1. Explain confidentiality, integrity and availability with an example attack on each.
2. Differentiate symmetric and public-key cryptography. How many keys do 10 people need for symmetric secrecy?
3. In RSA, p = 61, q = 53, e = 17. Find n, φ, d, and encrypt 65.
4. Do a Diffie–Hellman exchange with p = 23, g = 5, a = 6, b = 15.
5. What is a hash function? List three uses.
6. How does a digital signature give non-repudiation?
7. Describe the main steps of the TLS handshake and what the padlock does and does not mean.
8. Compare packet-filter, stateful and proxy firewalls.
9. What is a DMZ?
10. Compare IDS and IPS and signature-based and anomaly-based detection.
11. Why are SYN floods a threat to availability and how can they be mitigated?

Answers and worked solutions

1. Confidentiality: eavesdropping on unencrypted Wi-Fi. Integrity: a man-in-the-middle changing a bank transfer amount. Availability: a DDoS flood that takes a site down.

2. Symmetric: one shared secret key, fast, key distribution is hard. Public key: key pair, slow, solves distribution and enables signatures. 10 × 9 / 2 = 45 keys.

3. n = 3233, φ = 3120, d = 2753, c = 65¹⁷ mod 3233 = 2790.

4. A = 5⁶ mod 23 = 8, B = 5¹⁵ mod 23 = 19, shared = 19⁶ mod 23 = 2.

5. A function that maps data to a fixed-length digest, one-way and collision resistant. Uses: password storage (with salt), integrity checks of downloads, digital signatures, HMAC.

6. Only the holder of the private key can produce a signature that the public key verifies, so the signer cannot plausibly deny it (assuming the key was not stolen).

7. ClientHello, ServerHello with certificate and key share, key derivation, Finished, encrypted data. The padlock means the connection is encrypted and the certificate matches the domain; it does not prove the site is trustworthy or safe.

8. Packet filter: stateless rules on addresses and ports, fast. Stateful: tracks connections and allows replies. Proxy: terminates and inspects the application content, slowest but deepest.

9. A separate network segment for public servers, isolated from the internal network so a compromise stays contained.

10. IDS alerts only; IPS blocks in line. Signature-based finds known attacks quickly but misses new ones; anomaly-based finds unusual behaviour at the cost of false alarms.

11. They fill the server's half-open connection table so real clients cannot connect; mitigation: SYN cookies, shorter timeouts, rate limiting and upstream scrubbing.

Model answers for Unit 7

Q1. Explain symmetric and public-key cryptography, with the RSA algorithm and a worked example. (10 marks)

Introduction. Cryptography turns readable plaintext into unreadable ciphertext with an algorithm and a key; by Kerckhoffs' principle the algorithm is public and only the key is secret.

The two families are symmetric-key and public-key cryptography, and real systems use both.

Symmetric-key cryptography. One shared secret key encrypts and decrypts.

DES used a 56-bit key and was broken in 1998 by a machine built for the purpose (Plate 7.2); its successor AES uses 128-, 192- or 256-bit keys on 128-bit blocks with 10, 12 or 14 rounds, and a mode of operation (CBC, CTR or GCM) lets it encrypt long messages without leaking patterns.

It is fast, but n users need n(n - 1)/2 keys, which is 45 for 10 users and 499 500 for 1 000 (Fig. 7.4), and the key must first be delivered secretly.

Public-key cryptography. Each user has a public key, which is published, and a private key, which is kept secret. What one key encrypts only the other can decrypt, so n users need only 2n keys and no secret has to be shared beforehand.

It is about a thousand times slower than AES, so it is used to exchange a session key and to sign.

RSA. Choose primes p and q and compute n = p q and phi = (p - 1)(q - 1). Choose e coprime to phi and find d with e d = 1 (mod phi). The public key is (e, n) and the private key is (d, n).

Encryption is c = m^{e} mod n and decryption is m = c^{d} mod n. Its security rests on the difficulty of factorising n.

Example (Fig. 7.5). With p = 61 and q = 53: n = 3233 and phi = 3120. Take e = 17; then d = 2753 because 17 x 2753 = 46 801 = 15 x 3120 + 1. For m = 65, c = 65^{17} mod 3233 = 2790, and 2790^{2753} mod 3233 = 65 again.

Signing is the reverse: s = 65^{2753} mod 3233 = 588, which anyone checks with e since 588^{17} mod 3233 = 65.

Feature	Symmetric (AES)	Public key (RSA)
Keys	one shared secret	public and private pair
Speed	very fast	about 1 000 times slower
Keys for n users	n(n - 1)/2	2n
Main use	bulk data encryption	key exchange, signatures

Conclusion. Practical protocols such as TLS combine the two: public-key methods agree a session key and authenticate the server, and AES encrypts the data.

Q2. Explain how HTTPS works: the TLS handshake, certificates and the guarantees it gives. (10 marks)

Introduction. HTTPS is HTTP carried inside a Transport Layer Security (TLS) connection on TCP port 443. TLS sits between TCP and the application and gives encryption (confidentiality), integrity and authentication of the server, and optionally of the client.

Handshake (TLS 1.3, Fig. 7.9). After the TCP handshake the client sends a ClientHello listing the cipher suites it supports and a Diffie-Hellman key share.

The server replies with the chosen suite, its own key share, its certificate and a signature proving it owns the private key, then a Finished message.

Both sides derive the same session keys from the shared secret, the client sends Finished, and application data then flows encrypted with AES-GCM or ChaCha20.

TLS 1.3 needs only one round trip; with RTT = 50 ms the first request leaves after 100 ms, whereas TLS 1.2 needed 150 ms.

Certificates. A certificate is an X.509 document that binds a name to a public key and is signed by a certificate authority (CA).

The browser holds a list of trusted root CAs and checks the chain from the site's certificate through an intermediate CA to a root, as well as the validity dates and that the name matches (Fig. 7.8).

This stops a man-in-the-middle from posing as the server.

Guarantees. Confidentiality: data is encrypted with the session key. Integrity: every record carries an authentication tag, so any change is detected. Authentication: the certificate and the signature prove the server's identity.

Forward secrecy: because the key comes from Diffie-Hellman, stealing the server's long-term key later does not decrypt recorded sessions.

Layer	Protocol	Port	Protects
Application	HTTP	80	nothing (plain text)
Application + TLS	HTTPS	443	confidentiality, integrity, server identity

Limits. The padlock means only that the certificate matched the name and was signed by a trusted CA; a phishing site can have a valid certificate for its own name. Users must still check the address.

Conclusion. HTTPS combines public-key cryptography for the handshake, symmetric encryption for the data and certificates for trust, which is why ConnectIPS, Fonepay and internet banking rely on it.

Q3. Describe the types of firewall, the DMZ and an access control list. (10 marks)

Introduction. A firewall enforces a security policy between networks of different trust, usually the Internet and a private LAN. It may be a hardware appliance (Plate 7.3) or software on a router or host.

Types.

Type	How it works	Strength	Weakness
Packet filter (stateless)	checks IP addresses, protocol and ports of each packet against an ordered rule list	fast and simple	cannot tell a reply from an attack; no content check
Stateful inspection	keeps a table of connections; replies to connections opened inside are allowed automatically	blocks unsolicited inbound traffic	does not read the application data
Application gateway (proxy)	ends the connection and inspects HTTP, SMTP and so on; can cache and filter URLs	deep content control	slower, one proxy per protocol
Next-generation firewall	adds application identification, user identity and intrusion prevention	richest policy	costly and complex

ACL. An access control list is an ordered list of permit and deny rules. The first matching rule decides and an implicit deny ends the list.

In Fig. 7.11, rule 1 permits TCP 80 to the web server 203.0.113.10, rule 2 permits TCP 443, rule 3 lets the LAN 192.168.1.0/24 open outgoing HTTPS, and rule 4 denies everything.

Of six test packets, HTTPS to the web server and the LAN's own HTTPS are permitted, while SSH to the web server, a host outside the /24, an unsolicited packet to a LAN host and UDP to port 80 are all denied by the last rule.

Rule order matters: a broad deny placed first would block everything.

DMZ. A demilitarised zone is a separate segment for public servers (web, mail, DNS). The firewall allows the Internet to reach the DMZ only on the needed ports and allows almost nothing from the DMZ to the LAN, so a hacked web server cannot reach student records.

Related devices. An intrusion detection system (IDS) watches traffic and raises alarms; an intrusion prevention system (IPS) also blocks. A VPN gateway often runs on the same appliance.

Conclusion. Layering a stateful firewall, a DMZ, an IDS or IPS and patched hosts gives defence in depth: no single failure exposes the internal network.

Q4. Explain the CIA triad and the main network attacks with their defences. (5 marks)

The three goals of security are confidentiality (only authorised parties can read the data), integrity (the data is not altered unnoticed) and availability (the service works when needed).

Further goals are authentication (who are you?), authorisation (what may you do?) and non-repudiation (you cannot deny sending). Attacks are passive if they only observe, and active if they modify or inject traffic (Fig. 7.1).

Attack	Goal attacked	Defence
Eavesdropping, sniffing	confidentiality	encryption (TLS, WPA2)
Spoofing	authentication	ingress filtering, authentication, SPF
Man-in-the-middle	confidentiality and integrity	TLS with certificate checks
Replay	integrity	nonces, timestamps, sequence numbers
DoS, DDoS, SYN flood	availability	rate limits, SYN cookies, scrubbing
Phishing	authentication	training, multi-factor authentication

Passive attacks are hard to detect, so they are defeated by encryption; active attacks are detected by integrity checks such as hashes and MACs.

For example, a DNS amplification attack turns a 64-byte query into a 3 000-byte reply sent to the victim, an amplification of 46.9 times (Fig. 7.12).

Q5. Using p = 61, q = 53 and e = 17, find the RSA keys and encrypt the message 65. (5 marks)

First n = p x q = 61 x 53 = 3233, and phi = (p - 1)(q - 1) = 60 x 52 = 3120. The public exponent e = 17 has no common factor with 3120, so it is valid. The private exponent d must satisfy e x d = 1 (mod 3120).

Trying d = 2753 gives 17 x 2753 = 46 801, and 46 801 = 15 x 3120 + 1, so the remainder is 1 and d = 2753.

The public key is (e, n) = (17, 3233) and the private key is (d, n) = (2753, 3233).

Encryption of m = 65: c = 65^{17} mod 3233. Working with repeated squaring and reducing at every step gives c = 2790. Decryption: m = 2790^{2753} mod 3233 = 65, which is the original message (Fig. 7.5).

For a signature the keys are used the other way round: s = 65^{2753} mod 3233 = 588. The receiver computes 588^{17} mod 3233 = 65 and compares it with the message: they match, so the signature is genuine.

These small primes are only for practice; real keys use primes of 1 024 bits or more, a 2 048-bit modulus and padding schemes such as OAEP and PSS, because "textbook" RSA without padding is not secure.

Q6. Explain the Diffie-Hellman key exchange with an example. (5 marks)

Diffie-Hellman lets two parties create a shared secret over a public channel without ever sending it.

They first agree on a public prime p and a base g. Alice chooses a secret a and sends A = g^{a} mod p; Bob chooses a secret b and sends B = g^{b} mod p. Alice computes B^{a} mod p and Bob computes A^{b} mod p, and both equal g^{ab} mod p.

With p = 23 and g = 5 (Fig. 7.6): Alice picks a = 6 and sends A = 5^{6} mod 23 = 8. Bob picks b = 15 and sends B = 5^{15} mod 23 = 19. Alice computes 19^{6} mod 23 = 2, and Bob computes 8^{15} mod 23 = 2. The shared secret is 2 and it never crossed the network.

An eavesdropper sees p, g, 8 and 19. To find the secret she would have to solve the discrete logarithm problem, which is infeasible for primes of 2 048 bits.

The weakness is that the exchange is not authenticated: a man-in-the-middle can perform one exchange with Alice and another with Bob and read everything. TLS therefore signs the key shares with the server's certificate.

Because new random a and b are used for every session, the method also gives forward secrecy.

Q7. What is a cryptographic hash? Explain digital signatures and certificates. (5 marks)

A cryptographic hash maps any input to a fixed-size digest (SHA-256 gives 256 bits).

It is one-way (the input cannot be recovered), collision-resistant (no two inputs with the same digest can be found) and shows the avalanche effect: changing abc to abd changes 122 of the 256 bits and 58 of the 64 hexadecimal digits (Fig. 7.7).

Hashes check file integrity and store passwords, with a per-user salt and a slow function such as bcrypt or Argon2. MD5 and SHA-1 are broken and should not be used.

A digital signature is the hash of a message encrypted with the sender's private key. The receiver hashes the message, decrypts the signature with the sender's public key and compares the two digests (Fig. 7.8).

A match proves integrity, authentication of the sender and non-repudiation.

A certificate answers the question of whose public key it is. An X.509 certificate binds a name to a public key and is signed by a certificate authority.

The browser trusts a few root CAs, which sign intermediate CAs, which sign site certificates, and it verifies the whole chain.

In Nepal the Controller of Certification licenses certifying authorities under the Electronic Transactions Act.

Q8. Compare IPsec transport mode and tunnel mode and explain a VPN. (5 marks)

IPsec secures traffic at the IP layer. Its AH header gives integrity and authentication only, while ESP gives encryption plus integrity. Keys are agreed by the IKE protocol.

In transport mode the original IP header is kept and the ESP header is inserted after it, so only the payload (the TCP segment and data) is protected. The addresses stay visible, and the mode is used between two hosts.

In tunnel mode the whole original packet, including its IP header, is encrypted and wrapped in a new IP packet addressed from one gateway to the other, so the real source and destination are hidden (Fig. 7.10). It is the mode used by gateways.

Feature	Transport mode	Tunnel mode
Protected part	payload only	whole original packet
IP header	original kept	new outer header added
Typical use	host to host	gateway to gateway (site-to-site VPN)
Overhead	smaller	larger

A VPN (virtual private network) uses such a tunnel to give a remote user or a branch office a private, encrypted connection across the public Internet, as if it were on the office LAN. Remote-access VPNs may use IPsec, a TLS-based client or WireGuard.

Q9. How are Wi-Fi networks and passwords protected? (5 marks)

Wireless security. WEP used the RC4 cipher badly and is broken in minutes.

WPA2 uses AES-CCMP; in personal mode all users share one passphrase, and in enterprise mode 802.1X and EAP give each user a login checked by a RADIUS server, so a leaver can be removed without changing everyone's key.

WPA3 adds SAE, a password-based key exchange that resists offline guessing, and protected management frames. Hiding the SSID and filtering MAC addresses are not real security because both can be bypassed in seconds.

Password defence. At 10 billion guesses per second, a 4-digit PIN falls in a microsecond, 8 lowercase letters in 21 s, 8 characters from all 95 printable symbols in 7.7 days, and 12 mixed characters need 1.7 million years (Fig. 7.13).

Length therefore matters more than variety. A service should store a salted hash made with a slow function, which turns the 8-character case into about 21 000 years at 10 000 guesses per second.

Users should use a different long password for every account, a password manager, and multi-factor authentication such as a phone code or a hardware key.