CSC8419 Cryptography and Security Assessment: CIA, AES & OpenSSL

This report provides a comprehensive assessment of cryptography and security concepts. It begins by detailing the CIA model (Confidentiality, Integrity, Availability) and its importance in managing information security issues within organizations, including threats and attacks. The report then discusses secure system design decisions, such as planning, security requirements, risk management, and defense in depth. It also includes practical applications, such as substitutions for decimal numbers and an explanation of the AES implementation with a focus on the Key Expansion algorithm. Finally, the report touches on generating digital certificates using OpenSSL, highlighting the steps to create a certificate authority and digital certificates for individuals. Desklib offers more resources like this to aid students in their studies.

CSC8419: Cryptography and Security
Assessment 1
Student Name:
Student ID:

Table of Contents
TASK 1 CIA in the computer security...........................................................................................................2
TASK 2..........................................................................................................................................................3
TASK 3..........................................................................................................................................................5
TASK 4..........................................................................................................................................................6
TASK 5..........................................................................................................................................................8
References...................................................................................................................................................9
1

TASK 1 CIA in the computer security
CIA is used to guide the industries for managing the information security issues. CIA is covering three
main domain that is given as confidentiality (C), Integrity (I) and Availability (A). These three main
domains of the CIA model are most important to manage the information security issues in the
organization. Now, discuss the role of these three components in the CIA model for organization
information security:
1. Confidentiality: The confidentiality component plays an important role in CIA to prevent the
critical information of the authorized user in the organization. Confidentiality could be used to
secure the data and also ensure the privacy of the data in the organization. It provides the
secure access to the data of the organization. The critical information of the authorised users is
important to make it confidential in the organization. When the multiple copies are stored at the
different-different location then it may be not secure. So, the organization should avoid storing
the information in different-different location. Other methods that are used to protect the
confidential data are given as Encryption, Biometric, Generate password to access data, Key
Fobs ad Provide security tokens.
2. Integrity: The Integrity components deal with data consistency, data accuracy, and trust on
stored data to move it. It measures the data that should be required protection at the time data
transferring with other employees or partners. The integrity main methods are assigning for
data integrity ensuring that is based on the file permissions. The version control is an effective
method that changes the track of the documents. The main role of data integrity is making it
trustworthy and corrects (Kelly, 2002).
3. Availability: To ensure the availability component, the hardware should be maintaining it
regularly. It provides reliable access to the users and it also provides the assured information
that is accessible to the authorised users. All the software that should be installed in the system,
they must be required to regularly updated. The bandwidth should be available to access the
data by authorised users (Bartino, 2005).
4. Threats and Attacks in the organization: The attacks are harmful to the organization, they are
performed by the hackers to hack the data and effect the system. The threats occur when
attacker harm to the organization. There are various attacks that are performed such as DoS
attacks, password sniffing by malware users.
2

TASK 2
The Secure system design decisions are given below:
1. Planning: To design the security first make a plan that includes the secure and safe cost and also
decide the approaches. In planning, the approach must decide to build the security system.
After that, make conceptual design and then implementable design to build the security system.
The two components are important for the security system development these are given as
security and safety. The security system should be secure and safe for the users and it must be
able to understand the concern and issues for both parties (Yu, 2011).
2. Security Requirements for the System: After completing the planning of designing and
constructing of the security system, start to analyse the security requirement for the system
according to the organization. The system major requirement is protection Zone. In protection
Zone numbers of components is a measure to provide security to the security system of the
organization (Faily, 2011). The protection zone includes
 CPTED (Crime prevention through environmental design) is used to mitigate and prevent
the system form the crime and attacks.
 Ensure the capability to decrease and increase the system security with detects the
threats and reducing the attacks.
 Use Multidisciplinary to improve the security of the system and it also involved
protection of users and visitors.
 After analysing the security requirement, manage the cost of the construction (Bertino,
2005).
3. Least Common Mechanism: This design decision declares the mechanism and components that
are used to design the security system. To access the resources, it should be authorised and not
be shared with others.
4. Risk management: The risk management decision is very important to design the security
system. Numbers of risk are arising during development, so it required managing these risks and
controlling them. The risk management is implementing to resolve the occurred risk and
manage them. This decision attempts the data change limit and it also prevents the damages
that are arises in the security system. This design decision also reduces the risk of make
interaction to the resources (Saltzer, 2011).
3

5. Defense in depth: This design principle or decision is the layering concept that is implemented
for authorising and verification of the users who access the data. It also helps to reduce the
attacks that re-arises in the system to hack the data. This approach is detecting the
unauthorised users who try to access the data (Barnum, 2005). When the security system is
designing, it must follow all the security mechanism and attributes that complete the security
requirements. The system is designed according to the security mechanism and attributes
because the quality attributes of the security system are based on the security qualities and
priorities (GSA, 2017).
4

TASK 3
Substitutions for the given decimal number 12, 7 and 2 and the given substitution box is
1. Substitution for 12 is given as 11 00
Where the first two binary digits represent Substitution box row and second two represent box
column. So, 11 refer to the third row and 00 refers to the first column. According to this, the
result is given as 0111 that is equal to decimal 7.
2. Substitution for 7 is given as 01 11
Now, the 01 refers to the second row of the substitution box and 11 refer to the third column.
So, the result is given 1011 that is equal to the decimal 11.
3. Substitution for 2 is given as 00 10
According to the substitution 00 refers to the first row of the substitution box and 10 refer to
the third column. So, the result is 1111 that is equal to the decimal 15.
5

TASK 4
Describe the implementation of AES and define the Key Expansion algorithm
When the given cipher key is: 2b7e151628aed2a6abf7158809cf4f3c
Take Nk is 4 and the given result as:
Now find the w [4], w [5], w [6], and w [7]:
Take I as an indivisible by (4)
W[i] = w [i-Nk] XOR sub bytes (Rotword (w [i-1])) XOR Rcon [i/Nk]
According to given scenario, the Nk is the 32-bit number that comprising with the cipher Key, according
to this case, Nk is 4 and I is the word number and it would be divisible by the 4.
 So, Rotword () is the permutation of cyclic with the 8 bytes. As taken an example to understand,
if any word is [a3 a2 a1 a0] then Rotword become [a2 a1 a0 a3].
 SubBytes () is the substitute of every given 8 bytes by the substitute box 8 byte that is equal to
it.
 Rcon is created according to the given rounds:
RC [1..10]= (01, 02, 04, 08, 10, 20, 40, 80, 1B, 36)
Rcon [i] is equal to (RC [i], 00, 00, 00)
Now, the round first for this case is Rcon [1] - 01 00 00 00
 Condition 1: If the Nk value is 4 then the value of I is also 4. For this condition the w [4] is given
as:
 W [4] = w [0 XOR z[1] = 2b 7e 15 16 XOR 8b 84 eb 01 = a0 fa fe 17
 Condition 2: When I value is not 4 or it is not divisible by 4:
 W[i] = w [i-Nk] XOR w [i-1]
Where the Nk is the number of 32 bit that compromising the cipher key and for this condition, the value
is 4. I is the value of the word and indivisible by the value 4.
6

So, for Nk = 4 and I, 5, 6, and 7 results given:
 W [5]= w [1] XOR w [4] = a0 fa fe 17 XOR 28 ae d2 a6 = 88 54 2c b1
 W [6] = W [2] XOR W [5] = ab f7 15 88 XOR 88 54 2c b1 = 23 a3 39 39
 W [7] = W [3] XOR W [6] = 09 cf 4f 3c XOR 23 a3 39 39 = 2a 6c 76 05
7

TASK 5
The selected topic for Assignment 3 is “using OpenSSL to generate the Digital certificates”
Using OpenSSL to generate the Digital certificates:
There are some reasons to generate the digital certificate by using OpenSSL with assign certificate
authority. If the digital certificate is generated by using OpenSSL the website is running on the internal
network with make interaction with the website. With this, the website may configure the web server to
the HTTPS. To create the digital certificate by using the OpenSSL follow these given steps:
1. First, create the certificate authority for digital signatures and it also used to recognize on the
internet. To create the certificate authority, create the CSR (certificate request) with entering
the dummy values. And also set the command for generating the password.
2. Now, generate the key file to store the private key and this point removes the functionality of
password so, there is no requirement to enter the password every time.
3. Generate the X.509 digital certificate after the certificate request by following command and the
private key of CA.
4. After completing this process now, generate the digital certificate for the persons with
generating the password and private key.
5. Now, required to generate the DER-encoded public key version that contains only public key not
private key and it has no requirement to protect the password (Figueiredo, 2017).
8

References
 Barnum, Sean. Gegick, Michael, 2005, Defense in Depth, Viewed 1 April 2018
<https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/principles/347-BSI.html> Bertini, E & Sandhu, R, 2005, ‘Database security- concepts, approaches, and challenges’, IEEE
Transactions on Dependable and secure computing, vol. 2, no. 1, pp. 2-19.
DOI: 10.1109/TDSC.2005.9
 Bertino, Elisa, 2005, Design Principles for Security, Viewed 1 April 2018
<http://homes.cerias.purdue.edu/~bhargav/cs526/security-9.pdf>
 Faily, S, 2011, ‘ A framework of usable and secure system design’, Ph. D. thesis.
 Figueiredo, R, 2017, Using OpenSSL to Create Certificates - The Blinking Caret, The Blinking Caret,
Viewed 1 April 2018 <https://www.blinkingcaret.com/2017/02/01/using-openssl-to-create-
certificates/#disqus_thread>
 GSA, 2018, 8 - Security Design, Gsa.gov. Viewed 1 April 2018
<https://www.gsa.gov/node/82203>
 Kelly, G. & McKenzie, B., 2002, ‘Security, Privacy, and Confidentiality issues on the internet’,
Journal of Medical Internet Research. Vol. 4, no. 2, pp. doi: 10.2196/jmir.4.2.e12
 Saltzer, Jerry, 2011, BASIC PRINCIPLES OF INFORMATION PROTECTION. Viewed 1 April
2018 <http://web.mit.edu/Saltzer/www/publications/protection/Basic.html>
 Yu, E. S. K, 2011, ‘Social modeling for requirements engineering’, Cooperative information
systems. Cambridge, Mass: MIT Press. OCLC: ocn459208266.
9