Computer Security
Computer Security deals with the prevention and detection of unauthorised actions by users of a computer system.
Link to originalNetwork Security
Network Security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorised access and the effectiveness of these measures together.
Link to originalInformation security
Information Security means protecting information and information systems from unauthorised access, use, disclosure, disruption, modification, or destruction. Constitutes a basic right: protection of self.
Link to original
What is cryptography?
Cryptology
Cryptology: study of secret writing
Link to originalSteganography
Steganography: (science of) hiding messages in other messages
Link to originalCryptography
Cryptography is the study of techniques for secure communication.
‘Secure’ -> ‘in the presence of adversaries’
Link to originalCryptanalysis
Cryptanalysis: (science of) recovering the plaintext from ciphertext without the key Cryptanalysis attacks rely on the nature of the algorithm and in some cases knowledge of the general characteristics of the plaintext or even some sample plaintext-ciphertext pairs. We exploit characteristics of the algorithm to attempt to deduce a specific plaintext or to deduce the key being used.
Link to original
Agents (principals)
We’ll consider the following agents:
Honest agent
Honest agents: agents communicating with each other
Link to originalDishonest agent
Dishonest agents (attackers, intruders, etc): eavesdroppers or malicious, active attackers
Link to originalTrusted agent
Trusted and / or neutral: trusted servers, provers and verifiers
Link to original
Traditional security properties
Common security properties make up the CIA acronym:
Confidentiality
Confidentiality (Secrecy): no improper disclosure of information
Link to originalIntegrity
Integrity: no improper modification of information
Link to originalAvailability
Availability: no improper impairment of functionality/service
Link to original
Additional security properties include:
Accountability
Accountability means actions can be traced to responsible principals.
Link to originalNon-repudiation
Non-repudiation: parties cannot falsely deny their prior messages (‘only could have generated message ’)
Link to originalAuthentication
Authentication means principals or data origin can be identified accurately / verification of identity of a person or system.
Link to original
Privacy
Privacy: you choose what you let other people know
Link to original
Anonymity
Anonymity: condition in which your true identity is not known
Link to original
Attacks on anonymity
Passive traffic analysis
Passive traffic analysis: infer from network traffic who is talking to who
Link to originalActive traffic analysis
Active traffic analysis: inject packets or put a timing signature on a packet flow
Link to originalCompromise of network nodes
Compromise of network nodes / routers: not obvious which nodes have been compromised, best not to trust any individual node
Link to original
Properties of anonymity
Unlinkability (anonymity)
Unlinkability of action and identity: sender and e.g. their email are no more related after observing communication than they were before
Link to originalUnobservability (anonymity)
Unobservability (hard to achieve): observer cannot even tell whether a certain action took place or not
Link to original