1 of 68

Session # 5: Cybersecurity Issues Debate & Cryptography

Justin Pineda CISSP, CISM

March 29, 2025

Technological Institute of the Philippines

2 of 68

Agenda for today

Part 1: Debate on Cybersecurity Issues
Part 2: Lecture on Cryptography
Part 3: Wireshark Exercise

3 of 68

Cybersecurity Topics

Issue # 1:

Topic: Piracy
Motion: Software piracy for educational purposes should be illegal.

Issue # 2

Topic: Privacy
Motion: It is necessary for the US Government to conduct tap and trace surveillance to maintain
the nation’s safety. (See Patriot Act)

Issue # 3

Topic: Internet Censorship

Motion: The Philippines should adapt the Internet Censorship being enforced by China.

Issue # 4

Topic: Cybersex

Motion: Cybersex with consent should be legal.

4 of 68

After presentation…

Please submit materials to Canvas.

5 of 68

15-minute break

6 of 68

Current Issue now:�Do AI-generated ‘artworks’ violate copyright? �Ex: Studio Ghibli

7 of 68

Cryptographic concepts

1 of 3

8 of 68

Important Terms

Plaintext—an unencrypted message
Ciphertext—an encrypted message
Cryptology—the science of secure communications
Symmetric Encryption—encryption that uses one key to encrypt and decrypt
Asymmetric Encryption—encryption that uses two keys: if you encrypt with one you may decrypt with the other
Hash Function—one-way encryption using an algorithm and no key

(CISSP Guide by Eric Conrad et al, 2010)

9 of 68

Cryptography provides…

Confidentiality – protection from information disclosure
Integrity – protection from modification
Identification – determines origin of message
Authentication – verifies the sender
Non-repudiation – sender cannot refute message came from him/her

10 of 68

More important terms…

From Claude Shannon:

Diffusion - the order of the plaintext should be “diffused” (or dispersed) in the ciphertext.
Confusion - relationship between the plaintext and ciphertext should be as confused (or random) as possible
Cryptographic substitution - replaces one character for another; this provides diffusion.
Permutation (also called transposition) provides confusion by rearranging the characters of the plaintext, anagram-style.

(CISSP Guide by Eric Conrad et al, 2010)

11 of 68

Cryptographic Strength

Strong encryption destroys patterns.
Work Factor - describes how long it will take to break a cryptosystem (decrypt a ciphertext without the key).
Modular Math – remainder in division
Exclusive OR (XOR) – “secret sauce” in modern encryption

12 of 68

History of Cryptography

Egyptian – Hieroglyphics
Spartan Scytale
Caesar Cipher
Vigenere Cipher
Jefferson Disks
Vernam Cipher
Project VENONA
ENIGMA

13 of 68

Cryptography Laws

Coordinating Committee for Multilateral Export Controls – expired; agreement during the cold war.
Wassenaar Arrangement – relaxed restrictions on exporting cryptography.

14 of 68

Encryption algorithms

2 of 3

15 of 68

Questions

Is there an unbreakable encryption algorithm?

Which encryption algorithm is more secured, a publicly known algorithm or an in-house/private algorithm?

16 of 68

Questions

Is there an unbreakable encryption algorithm?

It is possible that the algorithms may be cracked due as supported by Moore’s Law.

Which encryption algorithm is more secured, a publicly known algorithm or an in-house/private algorithm?

Kerckhoff’s Principle states that algorithms must be publicly known to ensure it is strong and secured.

17 of 68

Symmetric Encryption

Symmetric encryption uses one key to encrypt and decrypt.

(The Basics of Information Security A Practical Handbook, 2010)

18 of 68

Stream vs. Block Ciphers

Stream mode - Each bit is independently encrypted in a “stream.”
Block mode - Encrypts blocks of data each round

19 of 68

Initialization Vector and Chaining

Initialization Vector (IV) - Used in some symmetric ciphers to ensure that the first encrypted block of data is random. This ensures that identical plaintexts encrypt to different ciphertexts.
Chaining (called feedback in stream modes) - Seeds the previous encrypted block into the next block to be encrypted. This destroys patterns in the resulting ciphertext.

(CISSP Guide by Eric Conrad et al, 2010)

20 of 68

Data Encryption Standard

DES was made a United States federal standard symmetric cipher in 1976.
DES was designed by IBM, based on their older Lucifer symmetric cipher. It uses a 64-bit block size (meaning it encrypts 64 bits each round) and a 56-bit key.

(CISSP Guide by Eric Conrad et al, 2010)

21 of 68

Bitmap encrypted using DES

(CISSP Guide by Eric Conrad et al, 2010)

22 of 68

Other Symmetric Algorithms…

3DES
International Data Encryption Algorithm (IDEA)
Advanced Encryption Standard (AES)
Blowfish and Twofish
RC5 and RC6

23 of 68

Asymmetric Encryption

Asymmetric encryption uses two keys: if you encrypt with one key, you may decrypt with the other. One key may be made public (called the public key); asymmetric encryption is also called public key encryption for this reason.

(The Basics of Information Security A Practical Handbook, 2010)

24 of 68

Questions

What are the factors that will yield to the product 49,418,527?

35,184,372,088,832 is 8 to power what?

25 of 68

Asymmetric Methods

Methods use “one way function” - easy to compute one way and difficult to reverse back
Factoring Prime Numbers – factoring a composite number to its primes

Ex. 7,883 (prime) x 6,269 (prime) = 49,418,527 (composite)
Easy to multiply but hard to get the factors!

Discrete logarithms – opposite of exponentiation

Ex. 8¹⁵ = 35,184,372,088,832
But what is 35,184,372,088,832 is 8 to power what?

26 of 68

RSA (Ron Rivest, AdiShamir, and Leonard Adleman)

n	product of two prime numbers, p and q published together with the public key
e	public key (Kpu) less than and relatively prime to (p -1)(q -1)
d	private key (Kpr) equal to (e-1) mod ((p -1) (q -1))

(Pantola, 2015)

27 of 68

RSA Example

p = 3
q = 11
n = (3)(11) = 33
Compute φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20

n	product of two prime numbers, p and q published together with the public key
e	public key (Kpu) less than and relatively prime to (p -1)(q -1)
d	private key (Kpr) equal to (e-1) mod ((p -1) (q -1))

28 of 68

RSA Example

p = 3
q = 11
n = (3)(11) = 33
Compute φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20
Choose e such that 1 < e < φ(n) and e and n are coprime. Let e = 7

n	product of two prime numbers, p and q published together with the public key
e	public key (Kpu) less than and relatively prime to (p -1)(q -1)
d	private key (Kpr) equal to (e-1) mod ((p -1) (q -1))

(Mitra, 2016)

29 of 68

RSA Example

p = 3
q = 11
n = (3)(11) = 33
Compute φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20
Choose e such that 1 < e < φ(n) and e and n are coprime. Let e = 7
Compute a value for d such that (d * e) % φ(n) = 1. One solution is d = 3 [(3 * 7) % 20 = 1]

n	product of two prime numbers, p and q published together with the public key
e	public key (Kpu) less than and relatively prime to (p -1)(q -1)
d	private key (Kpr) equal to (e-1) mod ((p -1) (q -1))

(Mitra, 2016)

30 of 68

RSA Example

p = 3
q = 11
n = (3)(11) = 33
Compute φ(n) = (p - 1) * (q - 1) = 2 * 10 = 20
Choose e such that 1 < e < φ(n) and e and n are coprime. Let e = 7
Compute a value for d such that (d * e) % φ(n) = 1. One solution is d = 3 [(3 * 7) % 20 = 1]
Public key is (e, n) => (7, 33)
Private key is (d, n) => (3, 33)

n	product of two prime numbers, p and q published together with the public key
e	public key (Kpu) less than and relatively prime to (p -1)(q -1)
d	private key (Kpr) equal to (e-1) mod ((p -1) (q -1))

(Mitra, 2016)

31 of 68

RSA Example

The encryption of m = 2 is c = 2⁷ % 33 = 29
The decryption of c = 29 is m = 29³ % 33 = 2

(Mitra, 2016)

For more info on RSA, visit: https://www.cs.utexas.edu/~mitra/honors/soln.html

32 of 68

Asymmetric Encryption

Name	Private Key	Public Key
Arnel	AK_pr	AK_pu
Benjie	BK_pr	BK_pu

If Arnel wants to send an encrypted message that only Benjie can open, what should he do?

33 of 68

Asymmetric Encryption

Name	Private Key	Public Key
Arnel	AK_pr	AK_pu
Benjie	BK_pr	BK_pu

If Arnel wants to send an encrypted message that only Benjie can open, what should he do?

Use BK_puto encrypt the message and Benjamin can decrypt it using BK_pr.

34 of 68

Asymmetric Encryption

Name	Private Key	Public Key
Arnel	AK_pr	AK_pu
Benjie	BK_pr	BK_pu

What is the purpose if Arnel encrypts his message using his private key (AK_pr)?

35 of 68

Asymmetric Encryption

Name	Private Key	Public Key
Arnel	AK_pr	AK_pu
Benjie	BK_pr	BK_pu

What is the purpose if Arnel encrypts his message using his private key (AK_pr)?

For Authentication purposes.

36 of 68

What should we use? �Symmetric or Asymmetric?

Things to consider:

Speed
Security
Scalability

37 of 68

Hash Functions

A hash function provides encryption using an algorithm and no key.
They are called “one-way hash functions” because there is no way to reverse the encryption.

(The Basics of Information Security A Practical Handbook, 2010)

38 of 68

Hash Algorithms

Message Digest algorithm 5 (MD5)

created by Ronald Rivest.
creates a 128-bit hash value based on any input length
popular over the years, but weaknesses have been discovered due to collisions

Secure Hash Algorithm (SHA-1)

creates a 160-bit hash value
found to have weak collision avoidance

Hash of Variable Length (HAVAL)

similar to MD family of hash algorithms and faster than MD5

39 of 68

Diffie-Hellman Algorithm

Can 2 people generate a same key even if a hacker can hear their conversation?

40 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g, p	g, p	g, p
a		b
A = g^a mod p		B = g^b mod p
B	B, A	A
Y = B^a mod p		Z = A^b mod p

Y and Z are the same.

(Pantola, 2015)

41 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g = 2; p = 3	g = 2; p = 3	g = 2; p = 3

42 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g = 2; p = 3	g = 2; p = 3	g = 2; p = 3
a = 5		b = 4

43 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g = 2; p = 3	g = 2; p = 3	g = 2; p = 3
a = 5		b = 4
A = g^a mod p A= 2⁵ mod 3 A = 2		B = g^b mod p B = 2⁴ mod 3 B = 1

44 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g = 2; p = 3	g = 2; p = 3	g = 2; p = 3
a = 5		b = 4
A = g^a mod p A= 2⁵ mod 3 A = 2		B = g^b mod p B = 2⁴ mod 3 B = 1
B = 1	B = 1, A = 2	A = 2

45 of 68

Diffie-Hellman Algorithm

Rody	Mar (Eavesdropper)	Miriam
g = 2; p = 3	g = 2; p = 3	g = 2; p = 3
a = 5		b = 4
A = g^a mod p A= 2⁵ mod 3 A = 2		B = g^b mod p B = 2⁴ mod 3 B = 1
B = 1	B = 1, A = 2	A = 2
Y = B^a mod p Y =1⁵ mod 3 Y = 1		Z = A^b mod p Z = 2⁴ mod 3 Z = 1

46 of 68

Cryptographic Attacks

Cryptographic attacks will be discussed in COMSEC1.

47 of 68

Exercise: simulating rsa and diffie hellman

48 of 68

About the exercise

This Exercise is divided into 2 parts:

Algorithm Simulation

Simulate known cryptographic algorithms.

Algorithm Formulation

Code a simplified version of a known algorithm.

49 of 68

Part 1: RSA (30 points)

Objective: Simulate generation of a public key and private key using chosen given.
Tasks:

Group chooses 2 prime numbers to be used for the construction of the private and public keys.
Follow the formula in RSA.
Show solution and provide the keys

n	Product of two prime numbers, p and q published together with the public key
e	Public key (K_pu) Less than and relatively prime to (p-1)(q-1)
d	Private key (K_pr) Equal to (e^-1) mode ((p-1)(q-1))

50 of 68

Solution

p
q
n
e

51 of 68

Part 2: Diffie-Hellman

Objective: Generate a common key from 2 people with knowledge only of g, p, A and B.
Tasks:

Group chooses 2 members, each will have to disclose g, p, A and B.
Each member must not disclose “a” and “b.”
Members must be able to come up with the same Y and Z.
Show your solutions.

52 of 68

Solution

g
p
A
B
a
b
Y
Z

53 of 68

Implementing cryptography

3 of 3

54 of 68

Digital Signatures

Used to cryptographically sign documents.
Provides non-repudiation.

(The Basics of Information Security A Practical Handbook, 2010)

55 of 68

Hashed Message Authentication Code (HMAC)

Combines symmetric encryption with hashing.
Requires 2 parties with pre-shared secret key.
Sender hashes the message and encrypt has wit pre-shared key via symmetric cipher.
Receiver hashes plaintext locally and also decrypts HMAC with his/her copy of private key, recovering sender’s hash.

56 of 68

Public Key Infrastructure (PKI)

Uses all three forms of encryption to provide and manage digital certificates.

(The Basics of Information Security A Practical Handbook, 2010)

Terms to remember:

Registration Authority (RA)

Certification Authority (CA)

Validation Authority (VA)

Certificate Revocation List (CRL)

Key Escrow

57 of 68

Public Key Infrastructure (PKI)

Uses all three forms of encryption to provide and manage digital certificates.

Remember, the web browser does not

believe the website but the CA!!!

(The Basics of Information Security A Practical Handbook, 2010)

58 of 68

Other encryption protocols that will be discussed in later lessons:

IPsec – Internet Protocol Security
ISAKMP – Internet Security Association & Key Management Protocol
IKE – Internet Key Exchange (IKE)
SSL – Security Sockets Layer (SSL)
TLS – Transport Layer Security (TLS)
PGP – Pretty Good Privacy (PGP)
S/MIME – Multipurpose Internet Mail Extensions

59 of 68

Other concepts

Steganography – science of hidden communication
Digital Watermarks – encode data into a file

60 of 68

Exercise: Wireshark (Cryptography)

61 of 68

Introduction

Objective/s

To be able to utilize a packet sniffer tool.
To study the different features, functionalities and limitations of a packet sniffer tool.

Expected Output

Soft copy version of this lab exercise with answers to the theoretical and application parts.

Prerequisite/s

Wireshark
PC running Windows
Internet
MS Office

62 of 68

Instructions�

For the theoretical part, you may research the answers as long as you can defend it in class. Don’t forget to cite sources. Explain your answers in your own words.
For the application part, use the actual tool when doing the tasks and show it to your teacher. Screenshot the answers afterwards as evidence in your report.
Two groups will present in class: one group will present the theoretical part answers and the other one will present the application answers.
Answer all the tasks and place in in Powerpoint with the following slides:

Slide 1: Title: Exercise #, Members, Date
Slide 2: Part 1- Theoretical (This can be more than 1 slide)
Slide 3: Part 2 – Application and Proving (This can be more than 1 slide)

Save your work in a PDF format: <Subject>_<Exercise#>. pdf.
Upload your Exercise (Written Report) in Canvas at the end of class time.

63 of 68

Part 1: Theoretical (30 points/ 6 points each)

By default, in what network device can you sniff all packets from all connected devices by default? How and why?
Is packet sniffing considered a passive or active activity? Why?
If you are connected to a Wireless LAN, whose packets will your packet sniffer be able to sniff? How and why?
What will you enable in a switch so that you can sniff the packets on all devices connected to it?
If you are trying to sniff the traffic of a device in the same network in a WLAN environment, what will you be able to sniff if the device is using HTTPS (encrypted web traffic)? Will you be able to sniff anything? If yes, what? If no, why not?

64 of 68

Part 2: Application and Proving (70 points)

Open the Wireshark application.
Choose the working interface. This may vary on the network connection you have.
Start a new session.
Open a browser on go to the TIP Website
After the website has loaded, stop the session.
Find the 3-way handshake connection in the packet capture results. Screenshot the results

65 of 68

66 of 68

Sniffing traffic in clear text (10 points)

Go to http://testphp.vulnweb.com/login.php
Input the following and click login Username: test123 and Password: schooliscool.
Start Wireshark and click “Sign in” afterwards.
Stop the capture.
In the filter field, type HTTP.REQUEST.METHOD == POST
Right-click on the entry and then choose Follow, then TCP stream. Look for the user name and password you have entered. Screenshot the results

67 of 68

Filtering 1 (15 points)�

Open Command Prompt and ping: google.com.
Use Wireshark to show ping request and reply to and from and google server. Screenshot the results

68 of 68

Filtering 2 (20 points)

Use Wireshark to filter all http traffic from your IP address. (Use Wireshark Cheat Sheet if necessary) Screenshot the results