Network Security Unit-2 topic Part-2.pptx

Message Digest
A message digest is a fixed-length numerical representation (hash) of a piece
of data, typically created by applying a cryptographic hash function to the
data.
It serves as a unique digital fingerprint of the original data, ensuring its
integrity.
Even a small change in the input data produces a significantly different digest,
which is useful for verifying data integrity and authentication.

Characteristics of Good Message Digest
Fixed Size: The output is always of a fixed size, irrespective of the size of
the input data.
Deterministic: The same input always generates the same output.
Collision-Resistant: It is computationally infeasible for two different inputs
to produce the same digest.
Irreversibility: It is practically impossible to reconstruct the input data
from the digest.
Avalanche Effect: A small change in the input data causes a dramatic
change in the output.

How to create a Message Digest?
1. Choose a Hash Algorithm: Select an appropriate cryptographic
hash function (e.g., MD5, SHA-256).
2. Prepare Input Data: Gather the data (message, file, etc.) you want
to hash.
3. Apply the Algorithm: Use the selected hash algorithm to compute
the digest.
4. Obtain the Digest: The output is the message digest, represented
as a string of hexadecimal values.

Popular Message Digest Algorithms
MD5 (Message-Digest Algorithm 5):
Produces a 128-bit hash value.
Widely used in the past but is no longer considered secure due to vulnerabilities to collision
attacks.
SHA Family (Secure Hash Algorithm):
SHA-1: Produces a 160-bit hash; deprecated due to vulnerabilities.
SHA-2: Includes SHA-224, SHA-256, SHA-384, and SHA-512, offering increased security.
SHA-3: A newer standard using a different construction (Keccak).
BLAKE2:
Faster than MD5, SHA-1, and SHA-2 while providing strong security.
Supports BLAKE2b (for 64-bit platforms) and BLAKE2s (for 32-bit platforms).
RIPEMD (RACE Integrity Primitives Evaluation Message Digest):
Includes RIPEMD-160, which is more secure than MD5 but less commonly used than SHA-2.

Uses of Message Digests
1.Data Integrity Verification: Ensures that data has not been tampered with during
transmission or storage.
2.Digital Signatures: Hashes are used to sign messages, ensuring authenticity and integrity.
3.Password Storage: Securely store hashed versions of passwords rather than plaintext
passwords.
4.File Verification: Compare the hash of a downloaded file with the published hash to
ensure file integrity.
5.Blockchain: Hashes are fundamental in maintaining the integrity and immutability of
blockchain transactions.
6.Tokenization and API Security: Message digests are used in creating secure tokens and
API keys.

Real life use case of Message Digest
Checksum Generation: Verify file integrity after a download (e.g., using
SHA-256 for Linux ISO files).
Password Hashing: Protect user passwords in databases using bcrypt,
PBKDF2, or Argon2 (not direct message digests like MD5 or SHA).
Digital Certificates: Verify the authenticity of a certificate in SSL/TLS
communication.

MD5
MD5 is one of the most widely known cryptographic hash functions,
designed by Ronald Rivest in 1991.
It produces a 128-bit (16-byte) hash value, typically represented as a 32-
character hexadecimal number.
MD5 was commonly used for integrity checks, digital signatures, and
password hashing, but it has since become insecure due to vulnerabilities
that allow for collision attacks.

MD5 Algorithm
MD5 processes input data in blocks of 512 bits and produces a fixed-size 128-bit
hash (16 bytes). The steps involved in creating an MD5 digest are:
1. Padding: The input message is padded so that its length is congruent to 448
modulo 512. Padding involves adding a 1 bit followed by a series of 0 bits, and
then appending the length of the original message (in bits) as a 64-bit integer.
2. Initialize Variables: MD5 uses four 32-bit registers initialized to certain
constants.
3. Processing in Blocks: The padded message is divided into blocks of 512 bits.
Each block is processed iteratively, updating the state with each block.
4. Finalization: After all blocks are processed, the final output is a 128-bit digest,
which is typically represented in hexadecimal format.

MD5 algorithm
https://www.md5hashgenerator.com/

Drawbacks of MD5
Collision Vulnerability: MD5 is susceptible to collision attacks, where two
different inputs produce the same hash. This undermines the security of
applications that rely on MD5 for integrity verification or digital signatures.
Pre-image Attack: While not as prominent as collision attacks, MD5 also
shows vulnerabilities to pre-image attacks (finding the original message
from the hash).
Speed: The speed of MD5, while initially considered a strength, is now seen
as a liability in password hashing and other security applications. Attackers
can compute vast numbers of hash values quickly, enabling brute-force
attacks.

SHA-256
SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that produces
a fixed-size 256-bit (32-byte) hash value.
It is part of the SHA-2 family, designed by the National Security Agency (NSA).
SHA-256 is widely used in various security applications and protocols, including TLS and
SSL, PGP, SSH, and Bitcoin blockchain, due to its strong resistance against hash collisions
(where two different inputs produce the same hash).
SHA-2 256

Key features of SHA-256
Input size: Can process messages of arbitrary length.
Output size: Always produces a 256-bit hash, regardless of input size.
Deterministic: The same input always results in the same hash.
Pre-image resistance: It's computationally infeasible to reverse the hash
and obtain the original input.
Collision resistance: It's extremely unlikely for two different inputs to
produce the same hash value.
Avalanche effect: A small change in the input will result in a completely
different hash value.

Applications of SHA-256
Digital Signatures: Ensures message authenticity by hashing the message and signing it.
Blockchain Technology: Secures transactions and links blocks in cryptocurrency systems like Bitcoin.
Password Hashing: Protects passwords by storing their hashed versions instead of plaintext.
Data Integrity: Verifies that data has not been altered during transmission or storage.
Cryptographic Applications: Used in protocols like TLS/SSL, PGP, and SSH to secure communications.
Software Integrity: Verifies that software or firmware has not been tampered with.
File Fingerprinting and Deduplication: Identifies unique files and avoids storing duplicates.
Time-stamping: Provides verifiable proof of when data was created or modified.
SSL/TLS Certificates: Ensures the authenticity of websites by generating digital certificates.
Cloud Storage: Detects duplicate files and optimizes storage.
Smart Contracts: Verifies the integrity of data in blockchain-based contracts.
Secure Data Sharing: Confirms that shared data has not been altered.

Step3 Initialize chaining variables

Network Security Unit-2 topic Part-2.pptx

1. Message Padding : The input message is padded to ensure its length is a multiple of 512 bits.
Padding involves adding a 1 bit followed by enough 0 bits, and then appending the original
message length as a 64-bit number.
2. Initialization of Hash Values SHA-256 initializes eight 32-bit hash values (A, B, C, D, E, F, G, H)
using specific constants derived from prime numbers.
3. Processing in 512-bit Blocks: The padded message is divided into 512-bit blocks, which are
processed one by one.
4. Message Schedule Creation : Each 512-bit block is divided into 16 32-bit words. Then, 48
additional words are generated using specific mathematical operations to form a total of 64
words.
5. Compression Function : For each block, a series of logical operations (AND, OR, XOR), modular
additions, and shifts/rotations are applied to the data, using the message schedule, hash values,
and constants (K). This step mixes the data and generates temporary values.
6. Final Hash Calculation : After processing all blocks, the hash values are updated, and the final
256-bit hash value is obtained by combining the results of all the blocks.
SHA-256 Algorithm

Authentication Service
An authentication service is a system or process that verifies the identity
of a user, device, or system.
It ensures that the entity trying to access a resource is who they claim to
be.
Authentication is a crucial step in the security process, ensuring that only
authorized individuals or systems can access sensitive data or services.

Purpose of Authentication Services
•Security: Protects systems and data from unauthorized access by
verifying identity.
•User Management: Ensures that the correct individuals or systems
are accessing resources.
•Compliance: Many regulations require proper authentication
mechanisms to secure sensitive information.

Key Aspects of an Authentication Service
Verification of Identity:
 The primary role of an authentication service is to confirm the identity
of the user or system. This is typically done through one or more of the
following methods:
o Something you know (e.g., a password or PIN)
o Something you have (e.g., a smart card, security token, or phone)
o Something you are (e.g., biometric data like fingerprints or facial
recognition)

Authentication Methods:
1. Single-Factor Authentication (SFA): Uses one method, usually
something the user knows (e.g., a password).
2. Two-Factor Authentication (2FA): Requires two separate forms of
authentication, usually combining something the user knows (e.g.,
password) with something they have (e.g., a code sent via SMS or
generated by an app).
3. Multi-Factor Authentication (MFA): Involves two or more forms of
authentication, enhancing security.

Session Management:
 After the authentication process, the system typically issues a
session token or cookie to maintain the authenticated state
of the user for the duration of their session, avoiding the
need to re-authenticate repeatedly.

Examples of Authentication Services:
 Username and Password Authentication: A common method where the
system verifies the user's identity based on their credentials.
 OAuth (Open Authorization): A protocol that allows users to grant third-
party applications access to their data without sharing their credentials.
 Single Sign-On (SSO): A service that allows users to authenticate once and
gain access to multiple systems or services without needing to log in again.

Network Security Unit-2 topic Part-2.pptx

More Related Content

Similar to Network Security Unit-2 topic Part-2.pptx (20)

Recently uploaded (20)

Network Security Unit-2 topic Part-2.pptx

Editor's Notes