Page 43 - DCAP516_COMPUTER_SECURITY

Unit 4: Cryptography

4.2 Two Fundamental Cryptographic Principles Notes

Principle 1: All encrypted message must contain some redundancy, that is, information not
needed to understand the message, to prevent active intruders from tricking the receiver into
acting on a false message.

Example: A mail-order company, The Couch Potato (TCP), with 60,000 products. Ordering
messages consist of a 16-byte customer name followed by a 3-byte data field (1 byte for the
quantity and 2 bytes for the product number).

Notes The last 3 bytes are to be encrypted using a very long key known only the customer
and TCP.
The following scenario shows how an active intruder—a recently-fired employee—can punish
TCP for firing her.
(a) Before leaving, she takes (part of) the customer list with her.
(b) She works through the night writing a program to generate fictitious orders using real
customer names.
(c) Since she does not have the list of keys, she just puts random numbers in the last 3 bytes,
and send hundreds of orders to TCP.
(d) When the messages arrive, TCP’s computer uses the customer’s name to locate the key and
decrypt the message.
(e) Unfortunately for TCP, almost every 3-byte message is valid!
This problem can be solved by adding redundancy to all messages: e.g., extend the encrypted
segment of an order from 3 bytes to 12 bytes, with the first 9 bytes being zeros (or a randomly
chosen string of English words). Then the ex-employee is no longer able to generate a large
stream of valid messages.

What’s the problem with adding redundancy ?
It makes it much easier for (passive) intruders to break messages (why ?)
Principle 2: some measures must be taken to prevent active intruders from playing back old
messages.
One such measure:
1. Include in every message a timestamp valid for 5 minutes,

2. The receiver keeps messages around for 5 minutes, to compare newly arrived messages to
previous ones to filter out duplicates.

Self Assessment

State whether the following statements are true or false:

1. The output of the encryption process, known as the ciphertext or …………………….
2. The art of breaking ciphers is called cryptanalysis …………………..
3. The art of devising ciphers and breaking them is collectively known as …………………...

LOVELY PROFESSIONAL UNIVERSITY 37