Cryptography and Network Security
Semester VI · BCA 353 · 3 credits
0 / 7
chapters done
-
The syllabus asks for
- Security goals and attacks
- Caesar, affine and Vigenère ciphers
- Playfair
- The Hill cipher
- The programs
- Breaking classical ciphers
- The one-time pad
- Seeing the ciphers: machines, frequencies and keyspaces
Key points
- Security services are confidentiality, integrity, authentication, non-repudiation and availability; attacks are passive or active; security must rest on the key (Kerckhoffs).
- Substitution ciphers (Caesar, affine, Vigenère, Playfair, Hill) and transposition ciphers (rail fence) are all breakable by exploiting language structure or linearity.
- Hill encryption is C = K·P mod 26 and needs gcd(det K, 26) = 1; here det K = 441 ≡ 25 (mod 26), and ACT encrypts to POH.
- A one-time pad is perfectly secret but impractical; key reuse destroys it.
-
The syllabus asks for
- Modular arithmetic
- The Euclidean and extended Euclidean algorithms
- Euler's totient, Fermat and Euler
- Primality testing
- Primitive roots and the discrete logarithm
- Why the arithmetic is feasible and the inverse is hard
- Seeing the arithmetic: portraits, clocks, cycles and chains
Key points
- a mod n arithmetic is closed under + − ×; an inverse exists iff gcd(a, n) = 1; the extended Euclidean algorithm finds it (240·(−9) + 46·47 = 2; 7⁻¹ ≡ 15 mod 26).
- φ(p) = p − 1, φ(pq) = (p − 1)(q − 1); Fermat a^(p−1) ≡ 1; Euler a^φ(n) ≡ 1; CRT combines congruences (x ≡ 2, 3, 2 mod 3, 5, 7 gives 23).
- Square-and-multiply makes huge powers cheap; Miller–Rabin finds primes where the Fermat test is fooled by Carmichael numbers such as 561.
- Primitive roots and the hard discrete log underlie Diffie–Hellman and ElGamal.
-
The syllabus asks for
- Block and stream ciphers, confusion and diffusion
- The Feistel structure
- DES
- AES
- Modes of operation
- Comparison
- Seeing symmetric ciphers: hardware, rounds and chaining
Key points
- Confusion (substitution) and diffusion (permutation) are combined over many rounds; a Feistel network's rounds are invertible even if F is not.
- DES: 64-bit block, 56-bit key, 16 rounds, 8 S-boxes; exhaustive search takes 20.0 hours at 10¹² keys/s, so it is obsolete; 3DES is deprecated.
- AES: 128-bit block, 10/12/14 rounds of SubBytes, ShiftRows, MixColumns, AddRoundKey over GF(2⁸); {57}•{83} = {c1}; verified here against the FIPS-197 vector.
- ECB leaks patterns (equal blocks → equal ciphertext); CBC needs a random IV; CTR needs a unique nonce; GCM adds authentication and is the modern default.
-
The syllabus asks for
- The public-key idea
- RSA
- Diffie–Hellman key exchange
- Elliptic-curve cryptography
- Comparing key sizes and uses
- Seeing public-key cryptography: pioneers, keys and curves
Key points
- Public-key cryptography removes the shared-secret problem: n users need n key pairs instead of n(n − 1)/2, and it is used to exchange symmetric keys (hybrid encryption).
- RSA: n = pq, d = e⁻¹ mod φ(n), c = mᵉ mod n, m = cᵈ mod n; the example n = 3233, d = 2753 encrypts 65 to 2790; real RSA needs OAEP/PSS padding and ≥ 2048-bit keys.
- Diffie–Hellman agrees gᵃᵇ mod p and needs authentication against man-in-the-middle; ElGamal encrypts with a fresh k.
- Elliptic curves give the same security with far smaller keys; the example curve has a point of order 19.
-
The syllabus asks for
- Cryptographic hash functions
- Message authentication codes and HMAC
- Digital signatures
- Certificates and PKI
- Password hashing
- Seeing hashes, signatures and certificates
Key points
- A cryptographic hash is preimage-, second-preimage- and collision-resistant with avalanche; MD5 and SHA-1 are broken, SHA-256 and SHA-3 are secure.
- Birthday bound: collisions appear after about 1.1774·√N messages: 23 people give 0.5073 for N = 365; a 64-bit digest falls after about 5,056,894,494 messages.
- HMAC(K, m) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ m)) authenticates with a shared key; checked here against RFC 4231.
- Digital signatures (RSA-PSS, ECDSA, Ed25519) give authenticity, integrity and non-repudiation; reusing the ECDSA nonce reveals the key.
- X.509 certificates, CAs and chains of trust bind keys to identities; revocation by CRL/OCSP; Nepal's CCA licenses CAs under the ETA 2063.
-
The syllabus asks for
- Authentication and its attacks
- Kerberos
- TLS and HTTPS
- IPsec
- PGP, S/MIME and SSH
- Comparing the layers
- Seeing the protocols: tickets, handshakes and tunnels
Key points
- Authentication uses what you know, have or are; protocols need nonces or timestamps against replay and authenticated key exchange against man-in-the-middle; TOTP = HMAC over a time counter.
- Kerberos issues a TGT then service tickets; passwords never travel, but clocks and the KDC are critical.
- TLS 1.3 completes its handshake in one round trip with ephemeral DH (forward secrecy): time to first byte at 80 ms RTT is 240 ms against 320 ms for TLS 1.2.
- IPsec ESP in tunnel mode adds 64 bytes to a 1400-byte packet; AH is rarely used; IKEv2 sets up SAs.
- PGP uses a hybrid signed-and-encrypted design with a web of trust; SSH uses host and user keys.
-
The syllabus asks for
- Firewalls
- Intrusion detection and prevention
- VPNs
- Wireless security
- Common attacks and defences
- Key management and a security checklist
- Seeing network defences: walls, zones, sensors and radios
Key points
- Firewalls enforce ordered, first-match, default-deny rules; types range from packet filters to NGFWs and WAFs; DMZs isolate public servers.
- IDS/IPS use signatures or anomaly detection; with a rare attack (0.1%), a 99%-detecting, 1%-false-alarm IDS gives alerts that are about 91.0% false.
- VPNs tunnel traffic with IPsec, TLS or WireGuard; zero-trust assumes no trusted inside.
- WPA3 (SAE) replaces WPA2-PSK; WEP is broken; enterprise Wi-Fi uses 802.1X.
- Key management (secure generation, storage in HSMs/keystores, rotation, envelope encryption) decides whether the cryptography protects anything.
No chapter matches. Try another word.
The paper
TU assessment: 60% final examination set by the university, 40% internal (assignments, lab work, attendance). Confirm the split in your college's notice.
Where the hours go
Teaching hours are the board's guide to how much of the paper each part carries.
- Unit 3 · Symmetric Ciphers - Feistel, DES, AES and Modes of Operation9 h
- Unit 4 · Public-Key Cryptography - RSA, Diffie-Hellman, ElGamal and ECC8 h
- Unit 6 · Authentication and Secure Network Protocols8 h
- Unit 2 · Number Theory for Cryptography7 h
- Unit 5 · Hash Functions, MACs, Digital Signatures and PKI7 h
- Unit 1 · Security Goals and Classical Ciphers6 h
- Unit 7 · Network and System Security - Firewalls, IDS, VPN and Wireless5 h