Network Security: Cryptography, RSA Math, Diffie-Hellman & Firewalls

Network security encompasses four fundamental pillars (the CIA+N model):

• Confidentiality: Only authorized sender and receiver understand message content (achieved via encryption).

• Integrity: Ensuring the message was not altered in transit (achieved via cryptographic hashes and MACs).

• Authentication: Confirming the true identity of the communicating peer.

• Non-Repudiation: Proving that the sender genuinely sent the message (achieved via digital signatures).

Symmetric vs Asymmetric Cryptographic Paradigms:

1. Symmetric Key Cryptography: Sender and receiver share the identical secret key K. Very fast, computationally light, used for bulk data encryption. Examples: DES (56-bit key, obsolete), Triple-DES (3DES, 168-bit key), AES (Advanced Encryption Standard, Rijndael with 128, 192, or 256-bit keys). Key distribution problem: How do sender and receiver agree on K over an untrusted internet?

2. Asymmetric (Public-Key) Cryptography: Each entity owns an asymmetric key pair: a publicly published Public Key (K_pub) and a strictly guarded Private Key (K_priv). A message encrypted with K_pub can only be decrypted by the matching K_priv. Solves the key distribution problem. Examples: RSA, Diffie-Hellman, ECC (Elliptic Curve Cryptography).

Invented in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman, RSA is the most widely deployed public-key algorithm. Its security rests on the computational intractability of factoring large composite integers into their prime components.

RSA Algorithm Step-by-Step:

1. Choose two large, distinct prime numbers p and q.

2. Compute modulus n = p * q. The bit length of n is the key length (e.g. 2048 bits).

3. Compute Euler's Totient function: phi(n) = (p - 1) * (q - 1).

4. Select public exponent e such that 1 < e < phi(n) and gcd(e, phi(n)) = 1 (e is coprime to phi(n)). Commonly chosen values in practice are 3, 17, or 65537 (2^16 + 1).

5. Compute private decryption exponent d such that: d = e^(-1) mod phi(n), meaning: (e * d) mod phi(n) = 1.

This is solved efficiently using the Extended Euclidean Algorithm.

6. Key Pairs: Public Key = (e, n); Private Key = (d, n).

7. Encryption (by Sender using Public Key):

$c = m^e \bmod n \quad (where plaintext integer 0 ≤ m < n)$

8. Decryption (by Recipient using Private Key):

$m = c^d \bmod n$

Correctness Proof (Euler's Totient Theorem):

Since e d = 1 (mod phi(n)), there exists an integer k such that e d = k * phi(n) + 1.

Then c^d = (m^e)^d = m^(ed) = m^(k phi(n) + 1) = (m^phi(n))^k * m.

By Euler's Theorem, if gcd(m, n) = 1, then m^phi(n) = 1 (mod n). Hence, 1^k * m = m (mod n).

Diffie-Hellman Key Exchange Protocol:

Allows two parties (Alice and Bob) who have never met to establish a shared symmetric secret key over a public eavesdropped channel without transmitting the key itself.

1. Public parameters: A large prime p and a primitive root modulo p, denoted g.

2. Alice picks a secret random private number a (1 <= a < p) and sends public value A = g^a mod p.

3. Bob picks a secret random private number b (1 <= b < p) and sends public value B = g^b mod p.

4. Alice computes shared key: K = B^a mod p = (g^b)^a mod p = g^(ab) mod p.

5. Bob computes shared key: K = A^b mod p = (g^a)^b mod p = g^(ab) mod p.

Eavesdropper Eve sees p, g, A, B, but computing a or b requires solving the Discrete Logarithm Problem, which is computationally infeasible for large p (e.g. 2048-bit primes).

Digital Signatures & Secure Hash Functions (SHA-256):

A digital signature provides non-repudiation and authentication.

1. Sender computes fixed-size digest H = Hash(M) using a cryptographic hash function (SHA-256: one-way, collision-resistant).

2. Sender encrypts H using their own PRIVATE key: S = (H)^d_sender mod n_sender.

3. Receiver decrypts signature using sender's PUBLIC key: H' = (S)^e_sender mod n_sender.

4. If H' == Hash(M), the receiver has mathematical proof that the message originated from the sender and was not modified.

A firewall is a network security appliance that monitors and filters incoming and outgoing traffic based on configured security policies.

1. Stateless Packet-Filtering Firewalls (Layer 3 & 4): Inspects individual IP datagrams in isolation. Evaluates rules based on: Source/Destination IP address, Source/Destination Port numbers, IP Protocol type (TCP, UDP, ICMP), and TCP control flags (SYN, ACK). High performance, but vulnerable to IP spoofing and cannot detect connection context.

2. Stateful Inspection Firewalls (Layer 4): Maintains an active state connection table. Verifies whether incoming packets belong to an existing, legitimately initiated TCP session (e.g. allows incoming ACK packets only if a matching outgoing SYN was previously observed).

3. Application-Level Gateways / Proxy Firewalls (Layer 7): Intercepts application traffic (HTTP, FTP, DNS) at the application layer. Can inspect message payloads, detect malicious SQL injection or cross-site scripting strings, and filter specific URLs.