Information Security: Digital Signatures and Cloud Storage

This report delves into the realm of information security, exploring digital signatures, cloud storage, and PGP encryption. Part 1a defines digital signatures, explaining their role in verifying message integrity and sender identity, and details how open-source encryption like PGP utilizes cryptographic techniques for secure communication, including public key encryption, digital signatures, and symmetric key cryptography. The advantages and disadvantages of this technology are discussed, including email encryption, file encryption, and the importance of web of trust. Part 1b provides a technical installation guide for MEGA, a cloud storage service, detailing its features, data allowances, encryption methods using AES algorithm, and API. The guide is targeted towards users of Chrome browser and Windows operating system, providing step-by-step instructions for installation and highlighting the benefits and drawbacks of cloud storage, emphasizing security, accessibility, and collaboration features.

Running head: INFORMATION SECURITY
INFORMATION SECURITY
Name of the Student
Name of the university
Author note

1INFORMATION SECURITY
Part 1a
Digital Signature can be defined as mechanism of security which the certificate
authority issues and appends to digital certificate for allowing a receiver for verifying that
there has not been any alteration from the time of its creation by the sender. It is actually like
a code that has been digitalized and gets included in the digital message for sender
identification. Digital Signature guarantees the identity of the sender of the digital message; it
is used in a number of business transactions and cannot be forged. There are various
techniques for encryption which are used for ensuring that the security level is high. In 2000,
a law in the United States made it legitimate for the signing of legal documents by utilizing
digital signatures (Chen, Liu, Chen and Wang 2018). It is like there is a guarantee digitally
about the non-alteration of the information, acting like a seal that is tamper proof and is
broken if there happens to be any alteration in the content. The two important digital
signature applications are verification of file integrity and establishment of a secured website
connection. Digital Signature is a digest encryption of the file that is signed. Computation of
the digest is done from the file contents with the help of hash function that is one way, like
SHA-1 and MD5, after which encryption is done using the private part of the private/public
key pair (Shi et al. 2016). For proving that there was no tampering done to the file, public key
is used by the recipient for decrypting the signature to original digest, re-computation of new
digest from the file that was transmitted and comparing both to see if they are matching. If
both the digests match, it’s proved that there has not been any alteration by a hacker.
As per the information digital signature is the digest encryption of a file which was
created with hash function that is one-way from the contents of the file. Digital certificates
are the first important application for digital signatures and these are used for the verification
of the organization or an individual’s identity (Buldas et al. 2019). These are broadly used for
website authentication which establishes a connection encryption for confidential data and

2INFORMATION SECURITY
credit card purposes. The next important application is code signing which ensures the
verification of executable file integrity that is downloaded from website. This application also
utilizes digital certificates that are signed for identity verification.
PGP refers to Pretty Good Privacy and it is the type of encryption which has become
an important part in internet security and privacy for a reason and that is allowing users for
sending encoded message without sharing the code in advance. For example if user1 wants to
send a message to user2 and he does not want any other person to discover the message
content then the best solution is to alter the same with some secret code which only user1 and
user2 are aware of and as a result if anyone else intercepts the message, the contents will not
be readable to the third person (Pooja and Yadav 2018). However there is a flaw in such a
system. If a coded message is sent to someone without sharing the code to that person then
the recipient will not be able to decode that. Hence PGP comes into picture and has a solution
of public key encryption which helps users in sending encrypted and secured messages.
The core function of PGP is enabling the users for sending secure messages without
the requirement of any prior introduction and also the recipients are allowed for the message
verification that is whether the authenticity and contents are intact. This is done by the help of
digital signatures (Yin, Fu and Chen 2016). Apart from email encryption, PGP is also
involved in the encryption of files, hard drives, instant messages and more. Many people may
not be aware that email is not a secure method of communication. Once the email is sent from
an account it transition occurs through various networks that are beyond control of the user.
The emails can be easily tampered and intercepted without the sender’s or recipient’s
knowledge.
If user has to send sensitive or valuable information, normal email is not suitable
since it can be hacked and hackers may utilize it for committing identity frauds whereas
important messages of the government can be used by spies (Ahmad and Alam 2016). To

3INFORMATION SECURITY
avoid all such occurrences PGP was brought into picture which would protect the security in
email communication. The most important elements on which the PGP encryption depends
on are web of trust, symmetric key cryptography, digital signatures, and public key
cryptography.
In the cryptography of symmetric key the same key is used for encryption and decryption.
The asymmetric cryptography is also known as public key cryptography and in this type both
the private and public keys are used for encryption (Roh and Lee 2018). The various steps for
a PGP encryption are as follows:
1) Adding digital signature
2) Encrypting the data or information
3) Decryption of the message
4) Verification of Digital Signature
As long as security is concerned the recent PGP versions are very secure if used correctly.
Some vulnerability exists for the older version. With the development of PGP there has been
a significant addition to the encryption algorithms for tightening the security. Even for the
slightest vulnerabilities there has been quick patching done by the developers (Li, Zhong and
Takagi 2016). For those using PGP the settings in email client should be changed so that the
auto loading of images that are external can be prevented. HTML and JavaScript should also
be turned off while viewing the encrypted emails (Suprihanto and Priyambodo 2017). With
all these measures, this type of encryption is safer to use. With all the advantages PGP also
has some drawbacks and one of its major drawback is that it is not user friendly which means
it is challenging for those who are lacking technical literacy. Different versions of PGP are
available over the years with new features and algorithms and as a result the PGP with an
older version is unable to open messages encrypted by newer one.

4INFORMATION SECURITY
Part 1b
Cloud storage is the model of data storage of computer where digital data is kept
within logical pools. Several servers are spanned by physical storage and physical
environment typically is owned as well as managed by hosting company. Such providers of
cloud storage are responsible to keep data available as well as accessible, along with physical
environment running and protected. People as well as organizations lease or buy capacity for
storage from providers for storing user, application or organization data (Li et al. 2017). It is
model of cloud computing which stores data over internet by provider of cloud computing
who manages as well as operates storage of data as service.
Cloud storage is dependent on virtualized infrastructure having accessible interfaces,
metered, multi-tenancy and scalability resources. Data of cloud based is stored within pools
over disparate; the commodity servers are located over premises or within data center that are
managed by cloud provider of third party. By using RESTful API, a file is stored by object
storage protocol and the associated metadata as single object as well as assigns this ID
number (Xiao et al. 2017). Most services of cloud storage use several quantities of hard drive
storage systems within servers which are linked through mesh such as network architecture.
Advantages
Cloud services possess most appropriate option to store data digitally online. Best
thing of storing all data in cloud is this ensures affordability as well as data could be accessed
easily from any place. Users could drag easily as well as drop files within cloud storage. This
is easy in saving every data and file in cloud, there is no need of technical knowledge for the
purpose. Stored file in cloud could be accessed easily from any location. This is
recommended for all businesses in having backup plan for emergency. Cloud storage is
appropriate backup plan to the businesses.

5INFORMATION SECURITY
Business owner could be sure after storing data within cloud, this is safe. Best thing of
cloud storage’s use is that there is distribution of server data over redundant servers as well as
data stored within cloud service is safeguarded from any kind of failure of hardware. Cloud
storage is an appropriate platform for purposes of collaboration. Multiple people are enabled
by cloud environment for accessing, editing as well as collaborating on single document or
file (Yu et al. 2016). Cloud storage is beneficial to every kind of business. It is great platform
which doesn’t need huge investment as well as could be used actively to collect and
collaborate with employees and clients.
Disadvantages
Cloud storage has formidable setback as difficulties to migrate. After selecting
specific cloud vendor to store data, difficulties could be faced while migrating data into
another vendor. Businesses store huge amount of data generally with specific cloud vendor. If
there are problems in cloud vendor, data’s migration to other cloud vendor would not be
feasible (Yu, Ren and Wang 2016). Cloud storage consists of transfer control of the
confidential information into third party organization. Hence, complete trust is required in
cloud vendor. There could be issues in privacy and security of data which are stored within
cloud storage.
In this paper the installation guide of MEGA has been given. It is a secure cloud
storage service providing users with 50 GB free storage space. This is the 3.87.0 version
comprising of new download page video viewer, file versioning, MEGAchat and MEGAdrop
public upload folder. This provides video, text as well as audio chat capability. The source
code of the software can be found at https://mega.nz/sourcecode. This is the extension that
will allow any user to install MEGA into his or her browser (MEGA Help 2020). This will

6INFORMATION SECURITY
bring in reductions in the loading time thus improving the download performance as well as
strengthening security.
Background information of MEGA
It is a cloud storage as well as file hosting services that is offered by the Mega
Limited, company based at Auckland. The service is provided by the medium of web-based
applications. Mega mobile phone applications are also available for Windows, Android as
well as iOS. MEGA is better known for its 50GB storage allocation that to for the free
accounts. It was launched on 19th of January in the year 2013 by Kim Dotcom (MEGA Help
2020).
Data allowances
The free account users in MEGA are receiving:
1. 15GB base storage quota
2. An additional storage of 35 GB trail that is provided at the time of signup expires after a
time span of one month.
3. Maximum permanent storage is up to 50 GB.
The paid account users in MEGA are provided with four different tiers of options that
are:
 8 TB storage (8 TB bandwidth a month)
 400 GB storage (1 TB bandwidth a month)
 16 TB storage (16 TB bandwidth a month)
 2 TB storage (2 TB bandwidth a month)

7INFORMATION SECURITY
Data Encryption
Keeping the security of client’s data in mind, Mega service is encrypted on the client-
side and for this AES algorithm has been made use of. The encryption keys to the files that
are uploaded are not known to Mega and thus the content of the user cannot be decrypted and
viewed (MEGA, 2020). Thus, they cannot be held responsible for the contents in the
uploaded files.
API
MEGA has released some of the documentation of its API so that it can be made use
of by developers to write their own applications.

8INFORMATION SECURITY
Work Instruction template:
Applies to: Analysts who use the Chrome browser and Windows operating system.
Objective:
It will help a user to install Mega Cloud into its system guiding him at
every step.
Pre-Requisites
Prior to the installation it must be checked that which browser best
suits for the same and what can be the errors in the process
Date [17/04/2020]
Version of the cloud
storage Mega
3.87.0, available in 50 languages
Type: Cloud storage, File hosting service and remote backup service
Author [Name of Author]

9INFORMATION SECURITY
The steps that need to be followed to install the Mega cloud storage software are as follows:
Installation Guide
Step 1: Download Nextcloud from https://megasync.en.softonic.com/
Mega cloud is downloading:
Mega cloud can be downloaded from the link that is given above. Chrome browser is
recommended for this purpose.
Step 2: Choose language.
As the software is available in 50 languages, you can choose among these asyou’re your
requirement.

10INFORMATION SECURITY
Step 3: Start installation process by installing on Mega nz setup.

11INFORMATION SECURITY
Step 4: Click next the goto licence agreement.

12INFORMATION SECURITY
Step 5: Choose user.
This is an important step where you can make choice as to whether installation is to be made
only for your personal profile or anybody using the computer.

13INFORMATION SECURITY
Step 6: Choosing start menu folder.

14INFORMATION SECURITY
Step 7: Installation procedure started.

15INFORMATION SECURITY
Step 8: Installation started.

16INFORMATION SECURITY
Step 9: Login to the Mega cloud.
In order to get free 50 GBs of the storage you can log in with your valid e-mail address. Once
this is done, it will take a while and then you will receive a link to log onto the Mega. Any
web browser can be used to access your new storage but your browser should be supporting
JavaScript.

17INFORMATION SECURITY
Step 10: Choosing local folder and mega folder.

18INFORMATION SECURITY
Step 11: Uploading a folder to mega.
Files in the folder:

19INFORMATION SECURITY
Step 12: Choosing folder in mega.
Step 13: Click ok to upload.
Step 14: files are uploading.

20INFORMATION SECURITY
Checking in mega.nz that the files have been uploaded.
Expected results
By following the installation guide, one can install the software. It will be better if
Chrome is made use of for the purpose. Mega recommends the Chrome browser but it can be
used with Firefox and Internet Explorer as well. But the problem is in Internet Explorer 10,
Windows 8’s default browser it freezes up after 100Mb of files are uploaded. Once the user
gets into the software, he will be presented with a file-folder type display and both single as

21INFORMATION SECURITY
files as well as folders can be uploaded. Uploading as well as downloading files can be done
at the same time. This will not get integrated with the file system and a user can access his or
her files through a Web Browser only. At present a user can drag and drop his files into Mega
from the file manager or make use of the upload button at site. Using Chrome, a user can
even drag and drop directories. Once loaded, a file can be right clicked so that a link can be
obtained for the same or for various purposes such as downloading, renaming, moving,
copying, deleting as well as reloading it. Users can drag and drop their files into new Mega
Folders as well. Mega does not appear to provide 50GB of free storage and it can happen that
the files stored by the users, may not be actually stored on to the cloud. Quoting from the
terms of service of Mega, “Our service may automatically delete a piece of data you upload
or give someone else access to where it determines that that data is an exact duplicate of
original data already on our service. In that case, you will access that original data.” To
understand it better, the example given below will be of help. Suppose a user saves a copy of
Star Wars to Mega and another user as well had uploaded the same video then the former
user will unknowingly will be accessing the copy that has been saved by the latter. That is
when the former accesses his copy it is actually the latter persons copy that he is watching.
Exceptions and escalations
One common error that is encountered while installing the application is the
interference of the antivirus tool which causes “source file not found” error to appear. This
can be dealt with by disabling the antivirus temporarily and then restart the setup again. Even
if after this the problem does not get resolved, user can uninstall the antivirus and then check
if the problem gets solved. It was found while installing the software that even the Chrome
browser is found to freeze after uploading and downloading some files. Thus the browser
problem can be said to be as a common thing in Mega.

22INFORMATION SECURITY
It can thus be said that Mega might prove to be useful or be a free service someday
but for now it can be said that this is work in progress. It will be recommended that if a user
wants good, free as well as reliable cloud storage instead of Mega users can opt for Google
Drive, Microsoft SkyDrive or Dropbox.

23INFORMATION SECURITY
References
Ahmad, K. and Alam, M.S., 2016. E-commerce security through elliptic curve
cryptography. Procedia Computer Science, 78, pp.867-873.
Buldas, A., Firsov, D., Laanoja, R., Lakk, H. and Truu, A., 2019. A new approach to
constructing digital signature schemes (extended paper). Cryptology ePrint Archive, Report
2019/673.
Chen, F.L., Liu, W.F., Chen, S.G. and Wang, Z.H., 2018. Public-key quantum digital
signature scheme with one-time pad private-key. Quantum Information Processing, 17(1),
p.10.
Chrome.google.com. 2020. MEGA. [online] Available at:
<https://chrome.google.com/webstore/detail/mega/bigefpfhnfcobdlfbedofhhaibnlghod?
hl=en> [Accessed 17 April 2020].
Help.mega.nz. 2020. MEGA Help. [online] Available at:
<https://help.mega.nz/webclient/cloud-drive.html#how-do-i-upload-files-to-mega>
[Accessed 17 April 2020].
Li, F., Zhong, D. and Takagi, T., 2016. Efficient deniably authenticated encryption and its
application to e-mail. IEEE Transactions on Information Forensics and Security, 11(11),
pp.2477-2486.
Li, Y., Yu, Y., Min, G., Susilo, W., Ni, J. and Choo, K.K.R., 2017. Fuzzy identity-based data
integrity auditing for reliable cloud storage systems. IEEE Transactions on Dependable and
Secure Computing, 16(1), pp.72-83.

24INFORMATION SECURITY
Pooja, M.Y. and Yadav, M., 2018. Digital Signature. International Journal of Scientific
Research in Computer Science, Engineering and Information Technology (IJSRCSEIT), 3(6),
pp.71-75.
Roh, C.H. and Lee, I.Y., 2018. A Study on PGP (Pretty Good Privacy) Using Blockchain.
In Advances in Computer Science and Ubiquitous Computing (pp. 316-320). Springer,
Singapore.
Shi, Y., Lin, J., Xiong, G., Wang, X. and Fan, H., 2016. Key-insulated undetachable digital
signature scheme and solution for secure mobile agents in electronic commerce. Mobile
Information Systems, 2016.
Suprihanto, D. and Priyambodo, T.K., 2017. The Implementation of Pretty Good Privacy in
eGovernment Applications (Case Study on the Official Scripts Electronic Applications in
Bantul). International Journal of Information Engineering and Electronic Business, 9(4), p.1.
Xiao, L., Xu, D., Xie, C., Mandayam, N.B. and Poor, H.V., 2017. Cloud storage defense
against advanced persistent threats: A prospect theoretic study. IEEE Journal on Selected
Areas in Communications, 35(3), pp.534-544.
Yin, H.L., Fu, Y. and Chen, Z.B., 2016. Practical quantum digital signature. Physical Review
A, 93(3), p.032316.
Yu, J., Ren, K. and Wang, C., 2016. Enabling cloud storage auditing with verifiable
outsourcing of key updates. IEEE transactions on information forensics and security, 11(6),
pp.1362-1375.
Yu, Y., Au, M.H., Ateniese, G., Huang, X., Susilo, W., Dai, Y. and Min, G., 2016. Identity-
based remote data integrity checking with perfect data privacy preserving for cloud
storage. IEEE Transactions on Information Forensics and Security, 12(4), pp.767-778