Network Security | Computer Science

Symmetric encryption uses the same secret key for both encryption and decryption. Both parties Must share the key securely before communication.

Block cipher modes of operation:

Theorem 7.1. ECB mode is insecure for messages longer than one block because identical plaintext Blocks produce identical ciphertext blocks, revealing patterns.

Proof. If the plaintext contains repeated blocks $P_i = P_j$ Then under ECB, $C_i = E_K(P_i) = E_K(P_j) = C_j$. An attacker observing identical ciphertext blocks knows the corresponding Plaintext blocks are identical, regardless of the key. $\blacksquare$

Key distribution problem. Symmetric encryption requires a secure channel to exchange keys. For $n$ parties, $n(n-1)/2$ keys are needed. This motivates asymmetric encryption and key exchange Protocols.

Asymmetric encryption uses a key pair: a public key (for encryption/verification) and a private Key (for decryption/signing). The public key can be freely distributed.

RSA. Based on the difficulty of factoring large integers.

1. Choose two large primes $p$ and $q$. Compute $n = pq$ and $\phi(n) = (p-1)(q-1)$.
2. Choose $e$ such that $1 \lt e \lt \phi(n)$ and $\gcd(e, \phi(n)) = 1$.
3. Compute $d$ such that $e \cdot d \equiv 1 \pmod{\phi(n)}$.
4. Public key: $(n, e)$. Private key: $(n, d)$.
5. Encrypt: $c = m^e \bmod n$. Decrypt: $m = c^d \bmod n$.

Diffie-Hellman key exchange. Allows two parties to establish a shared secret over an insecure Channel without prior shared key.

1. Public parameters: prime $p$ and generator $g$.
2. Alice picks secret $a$Sends $A = g^a \bmod p$.
3. Bob picks secret $b$Sends $B = g^b \bmod p$.
4. Shared secret: $s = B^a \bmod p = g^{ab} \bmod p = A^b \bmod p$.

An eavesdropper who sees $g$, $p$, $A$, $B$ cannot compute $g^{ab}$ without solving the discrete Logarithm problem.

Digital signatures. The sender signs a message hash with their private key. Anyone can verify Using the sender”s public key. Provides authentication, integrity, and non-repudiation.

TLS 1.3 (RFC 8446) provides a clean, secure design:

• 1-RTT handshake: Client and server exchange key shares in the first round trip, enabling immediate encrypted communication.
• 0-RTT resumption: On subsequent connections, the client can send application data immediately using a pre-shared key from a previous session. Vulnerable to replay attacks.
• Forward secrecy: Every session uses ephemeral ECDHE keys, so compromise of the long-term private key does not allow decryption of past sessions.
• Cipher suites: Only AEAD ciphers are supported (AES-GCM, ChaCha20-Poly1305). No CBC or RC4.

Certificate chain validation:

1. Server presents its certificate (signed by intermediate CA).
2. Client verifies the signature chain up to a trusted root CA.
3. Client checks: validity dates, hostname match (SAN), revocation (CRL/OCSP).
4. Client verifies the server’s …/1-number-and-algebra/3_proof-and-logic-of-possession for the private key.

A firewall controls network traffic based on security rules.

Types:

Stateful inspection. Unlike simple packet filtering, a stateful firewall maintains a connection Table. It can distinguish between a new TCP SYN (allowed) and an unsolicited SYN+ACK (blocked), And it tracks UDP “connections” by observing request-response patterns.

DMZ (Demilitarised Zone). A separate network segment for publicly accessible services (web Servers, mail servers). The firewall allows external access to the DMZ but restricts DMZ-to-internal Access.

A Virtual Private Network creates an encrypted tunnel over a public network.

IPsec architecture (RFC 4301):

• Security Association (SA): A one-way logical connection with parameters: SPI (Security Parameters Index), destination IP, protocol (AH or ESP), encryption algorithm, key, lifetime.
• IKE (Internet Key Exchange): Protocol for establishing SAs. IKEv2 is the current standard. Uses Diffie-Hellman for key exchange and digital signatures for authentication.
• AH (Authentication Header): Provides integrity and authentication but NOT confidentiality. Protects the entire IP packet (immutable fields). Protocol number 51.
• ESP (Encapsulating Security Payload): Provides confidentiality, integrity, and authentication. Protocol number 50.

WireGuard. A modern VPN protocol (Linux kernel 5.6+):

• Uses ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange.
• No static keys: each peer has a public/private key pair.
• Under 4000 lines of code (vs ~100,000 for OpenVPN + OpenSSL).
• Roaming: peers can change IP without reconfiguration.

Rule syntax (generic):

Key principles:

• Rules are evaluated top-to-bottom; first match wins.
• Default deny policy: the last rule should deny everything not explicitly allowed.
• Specific rules must precede general rules.
• Stateful firewalls automatically allow return traffic for established connections.

flowchart TD
    A[7_Network Security] --> B[Key Concepts]
    A --> C[Core Principles]
    A --> D[Practical Applications]
    B --> E[Fundamental definitions]
    C --> F[Design patterns]
    D --> G[Real-world usage]

Network security is a layered defense strategy: encryption hides the message, authentication proves who sent it, and integrity checks verify nothing was tampered with in transit. TLS is the locked envelope that ensures your credit card number arrives intact and unreadable to anyone who intercepts it. The key insight is that security is not a single feature but a chain of mechanisms, and the chain is only as strong as its weakest link, like a fence with a gate that anyone can walk through.

Confusing symmetric with asymmetric encryption: Symmetric uses one key (fast, used for data). Asymmetric uses key pairs (slower, used for key exchange). Don’t assume they’re interchangeable.

Assuming encryption provides authentication: Encryption protects confidentiality. Digital certificates and signatures provide authentication. They’re different security properties.

Forgetting that security is about trade-offs: Stronger security often means slower performance or worse usability. Find the right balance for your use case.

• Transport Layer: TLS handshake and encryption.

• Network Layer: IPsec and network security.

• Application Layer: HTTPS and certificate management.

• Discrete Mathematics

• Algorithm Implementation