GTU 3170720 Information security (IS) Summer 2026 Solved Paper & Solutions

An active attack changes the data stream or creates a false one. Three active attacks are:

• Masquerade: one entity pretends to be another. For example, an attacker uses a stolen login to act as a bank customer.
• Replay: the attacker captures a valid message and sends it again later to get an unauthorised effect, for example to repeat a payment.
• Modification of messages: the attacker changes a part of a real message, or delays or reorders it. For example, "pay Rs 100 to A" becomes "pay Rs 900 to B".

A fourth active attack is denial of service, which stops the normal use of a service.

The Hill cipher encrypts $m$ letters at a time with an $m \times m$ key matrix $K$: $C = KP \bmod 26$. The key matrix must be invertible modulo 26.

Strengths

• It hides single-letter frequencies. With $m = 2$, the same letter can be encrypted to different letters, so simple frequency counting fails.
• A larger $m$ hides more of the structure of the language, and it is hard to break with ciphertext alone.

Weaknesses

• It is linear. If an attacker knows $m$ pairs of plaintext and ciphertext blocks, the key can be found by $K = C P^{-1} \bmod 26$. So it falls to a known-plaintext attack.
• The same plaintext block always gives the same ciphertext block, so patterns remain.

So the Hill cipher is secure against ciphertext-only attack, but it is weak against known-plaintext attack.

Both are modes of operation of a block cipher $E$ with key $K$.

CBC (Cipher Block Chaining): each plaintext block is XORed with the previous ciphertext block before encryption. The first block uses a random initialisation vector (IV). Because of the chaining, two equal plaintext blocks give different ciphertext blocks, so patterns are hidden. The message must be padded to a whole number of blocks.

CTR (Counter): a counter value is encrypted, and the result is XORed with the plaintext block. The counter is different for every block, for example it is increased by 1. So the block cipher works like a stream cipher, and the plaintext may be of any length.

Comparison

CTR is faster and simpler. CBC is older and widely supported.

• Confusion: making the relation between the key and the ciphertext as complex as possible, so that the key cannot be found from the ciphertext. It is done by substitution.
• Diffusion: spreading the effect of each plaintext bit over many ciphertext bits, so the statistics of the plaintext are hidden. It is done by permutation.

These two ideas were proposed by Claude Shannon.

One round of DES is a Feistel round. The 64-bit block is split into a left half $L$ and a right half $R$, 32 bits each.

• The 32-bit right half is expanded to 48 bits by the expansion table E, which repeats some bits, and it is XORed with the 48-bit round key $K_i$. The round key is made from the 56-bit key by the key schedule.
• Eight S-boxes change each 6-bit group to 4 bits, which gives 32 bits.
• The permutation P mixes the bits, so that the output of each S-box affects many S-boxes of the next round.
• The result is XORed with $L_{i-1}$ to give the new right half.
• The old right half becomes the new left half without any change. DES repeats this round 16 times.

DES decryption uses the same algorithm as encryption, with the 16 round keys used in reverse order: $K_{16}$ in round 1 down to $K_1$ in round 16.

Why it works

In one round of encryption:

From these two equations we can recover the earlier values.

The second pair is again a Feistel round, using the same function $F$ and the same key $K_i$. So the round with key $K_i$ undoes the encryption round with $K_i$.

Steps

1. The 64-bit ciphertext goes through the initial permutation IP. This undoes the final inverse permutation of encryption.
2. The 16 rounds are run with the keys $K_{16}, K_{15}, \dots, K_1$.
3. The two halves are swapped.
4. The inverse permutation $IP^{-1}$ gives the plaintext.

The function $F$ does not need to be reversible, because it is never inverted. This is the main advantage of the Feistel design.

Key points

• The key schedule makes 16 round keys of 48 bits from the 56-bit key. In decryption the same keys are used, but in the order $K_{16}$ to $K_1$.
• The initial permutation IP and the final permutation $IP^{-1}$ are inverse of each other, and they have no security value. They only rearrange the bits.
• The swap of the halves after round 16 is needed so that the same circuit can do both encryption and decryption.
• So one device or one program does both jobs, and only the order of the round keys is changed.

A symmetric cipher uses the same secret key for encryption and decryption. It has five parts: plaintext, encryption algorithm, secret key, ciphertext and decryption algorithm.

Requirements

1. A strong encryption algorithm. An attacker who knows the algorithm and has some ciphertext must still be unable to find the plaintext or the key.
2. The sender and the receiver must get the secret key in a secure way and keep it secret. If someone finds the key, all the messages are open.

Given $p = 7$, $q = 11$, $e = 13$.

Check: $\gcd(13, 60) = 1$, so $e$ is valid.

Going back: $1 = 5 \times 60 - 23 \times 13$. So $13^{-1} \equiv -23 \equiv 37 \pmod{60}$.

Check: $13 \times 37 = 481 = 8 \times 60 + 1$.

In RSA, each user has a public key $PU$ (known to all) and a private key $PR$ (kept secret). Encryption with one key is undone by the other.

Confidentiality

The aim is that only the receiver can read the message. The sender encrypts with the receiver's public key. Only the receiver, who has the private key, can decrypt.

Authentication

The aim is to prove who sent the message. The sender encrypts with the sender's own private key. Anyone can decrypt with the sender's public key. If it decrypts correctly, the message came from that sender. This is a digital signature.

This gives authentication and integrity but not confidentiality, since anyone has $PU_a$. Only the owner of $PR_a$ could have made the message, so the sender cannot deny it later.

Both together

The two uses are joined when a message must be both secret and signed. The sender first signs with $PR_a$ and then encrypts with $PU_b$.

The receiver first decrypts with $PR_b$ and then verifies with $PU_a$. In practice a hash of the message is signed, and the message is encrypted with a symmetric key, since RSA is slow for long data. The order matters: the signature is made on the plain message, so the receiver can check it after decryption.

Example: Alice sends a secret contract to Bob. She signs it with her private key, and then locks it with Bob's public key. Bob unlocks it with his private key, and then checks the signature with Alice's public key.

A hash function $H$ takes a message of any length and gives a fixed-length output called the hash value or message digest. It is a one-way function, and a small change in the message changes the digest completely.

Protecting integrity

1. The sender computes $H(M)$ and sends it with the message, in a way the attacker cannot change, for example inside a digital signature, or encrypted, or sent by a secure channel.
2. The receiver computes the hash of the message received.
3. If both hashes are equal, the message is not changed. If not, it was altered.

Hash functions are classed by the properties they have.

• A weak hash function has weak collision resistance: given a message $x$, it is infeasible to find another message $y$ with $H(y) = H(x)$. This is also called second preimage resistance.
• A strong hash function has strong collision resistance: it is infeasible to find any two different messages $x$ and $y$ with $H(x) = H(y)$.

A strong hash function also has the weak property. It is needed for digital signatures, where the attacker can prepare both messages.

SHA-512 processes a message in blocks of 1024 bits and gives a 512-bit digest. Each block goes through 80 rounds.

Overview

The message is padded so that its length is 896 modulo 1024, and the 128-bit length of the message is added. Each block of 1024 bits gives 16 words of 64 bits, $W_0$ to $W_{15}$. The message schedule extends them to 80 words $W_0$ to $W_{79}$. Each word is used in one round. The constant $K_t$ comes from the cube roots of the first 80 prime numbers.

Working variables

Eight 64-bit registers $a, b, c, d, e, f, g, h$ start with the value of the previous hash. In round $t$, a 64-bit word $W_t$ taken from the message block and a constant $K_t$ are used. All additions are modulo $2^{64}$.

Round function

The functions are:

Here $ROTR^n$ is a right rotation by $n$ bits.

New values of the registers

So the registers shift by one place, and the new $a$ is computed from $T_1$ and $T_2$. The new $a$ and the new $e$ are the only registers that get fresh values.

The functions $\text{Ch}$ and $\text{Maj}$ are non-linear, and the rotations spread the bits, which gives the diffusion and confusion that a hash needs.

After the last block, the final registers are the 512-bit digest. After the 80 rounds of a block, the registers are added to the earlier hash value (modulo $2^{64}$), which is the input of the next block.

The Digital Signature Algorithm (DSA) uses the global public values $p$, $q$ and $g$, where $q$ is a prime divisor of $p - 1$. The signer has a private key $x$ with $0 < x < q$ and a public key $y = g^x \bmod p$.

Signing a message $M$

1. Choose a random secret number $k$ with $0 < k < q$.
2. Compute $r = (g^k \bmod p) \bmod q$.
3. Compute $s = \big[k^{-1}\,(H(M) + xr)\big] \bmod q$.

The signature is the pair $(r, s)$. The number $k$ must be new for each message.

Setup: a prime $q$ and a primitive root $\alpha$ of $q$ are public. The signer has a private key $X_A$ and a public key $Y_A = \alpha^{X_A} \bmod q$.

Signature: the signer takes the hash $m$ of the message, chooses a random $K$ with $\gcd(K, q-1) = 1$, and computes $S_1 = \alpha^K \bmod q$ and $S_2 = K^{-1}(m - X_A S_1) \bmod (q-1)$. The signature is the pair $(S_1, S_2)$.

Verification: the receiver computes

The signature is valid if $V_1 = V_2$.

Why it works: $S_2 = K^{-1}(m - X_A S_1) \bmod (q-1)$, so $m = X_A S_1 + K S_2$. Then $\alpha^m = (\alpha^{X_A})^{S_1}(\alpha^K)^{S_2} = Y_A^{S_1} S_1^{S_2}$.

Example: $q = 19$, $\alpha = 10$, $X_A = 16$, $m = 14$, $K = 5$. The public key is $Y_A = 10^{16} \bmod 19 = 4$. The signature is $S_1 = 10^5 \bmod 19 = 3$. Since $K^{-1} = 11 \bmod 18$, $S_2 = 11(14 - 16 \times 3) \bmod 18 = 4$. Then $V_1 = 10^{14} \bmod 19 = 16$ and $V_2 = 4^3 \cdot 3^4 \bmod 19 = 16$. They are equal, so the signature is valid.

The security rests on the discrete logarithm problem: an attacker who knows $Y_A$ cannot find $X_A$ for a large $q$. The random number $K$ must be secret and must be new for every message. If $K$ is used twice, the private key can be found.

In symmetric key cryptography the two parties must share a secret key, and nobody else must know it. The key must also be changed often. The problem is how to distribute the key.

Alternatives for key distribution

For two parties A and B, there are four options:

1. A selects a key and delivers it physically to B.
2. A third party selects a key and delivers it physically to A and B.
3. If A and B have used a key recently, one of them can send the new key to the other, encrypted with the old key.
4. If A and B each have an encrypted connection to a third party C, then C can send a key to A and B over those links. C is a Key Distribution Centre (KDC).

Options 1 and 2 are used for a master key between the user and the KDC. Option 4 is the one used in practice.

Key hierarchy

• A session key encrypts the data for one connection, and is destroyed afterwards.
• A master key is shared between a user and the KDC, and it encrypts the session keys.

Issues in key distribution

• Number of keys: for $n$ parties, $\dfrac{n(n-1)}{2}$ keys are needed, which is too many for a large network.
• Physical delivery is slow and impossible for a large or distant network.
• Trust in the KDC: the KDC knows all keys, so it is a single point of attack and of failure. It must be secure, and it must be available.
• Old key compromise: with option 3, if one key is found, all the later keys are open.
• Key storage and change: keys must be stored safely and renewed often.

Public key cryptography is used to solve the problem.