Credit:Eli TamangEli Tamang

Tribhuwan University

Institute of Science and Technology

2082

Bachelor Level / Third Year / Fifth Semester / Science

Bachelors in Information Technology (BIT303)

(Information Security)

Full Marks: 60

Pass Marks: 24

Time: 3 Hours

Candidates are required to give their answers in their own words as for as practicable.

The figures in the margin indicate full marks.

Section A

Long Answers Questions

Attempt any TWO questions.
[2*10=20]
1.
Distinguish between substitution and transposition cipher. How 16 sub keys are generated in DES? Describe in brief. Define finite field with its implications.[10]

Distinction between Substitution and Transposition Cipher, DES Sub-Key Generation, and Finite Fields

Part A: Substitution vs Transposition Cipher

Substitution Cipher replaces each plaintext character with a different character, while Transposition Cipher rearranges the positions of plaintext characters without changing them.

Feature Substitution Cipher Transposition Cipher
Basic Operation Replaces characters with other characters Rearranges the order of characters
Identity of characters Characters change their identity Characters retain identity but change position
Technique Mapping of plaintext to ciphertext symbols Permutation of plaintext characters
Example Caesar Cipher, Vigenère Cipher Rail Fence, Columnar Transposition
Key concept Confusion (obscures relationship) Diffusion (spreads plaintext over ciphertext)
Vulnerability Frequency analysis can break it Pattern analysis of positions can break it

Part B: Generation of 16 Sub-Keys in DES

In DES (Data Encryption Standard), 16 round sub-keys of 48 bits each are generated from the original 64-bit key using a key schedule algorithm.

Steps for Sub-Key Generation:

  • Step a — Initial Key: Start with a 64-bit key (8 bits are parity bits, so effective key = 56 bits)

  • Step b — PC-1 (Permuted Choice 1): The 64-bit key is passed through PC-1 permutation table, which discards the 8 parity bits and permutes the remaining 56 bits

  • Step c — Split into halves: The 56-bit key is divided into two halves:

    • C₀ = Left 28 bits
    • D₀ = Right 28 bits
  • Step d — Left Circular Shift: For each round ii (1 to 16), both Ci1C_{i-1} and Di1D_{i-1} are left circular shifted by 1 or 2 positions:

    • 1-bit shift for rounds: 1, 2, 9, 16
    • 2-bit shift for all other rounds
  • Step e — PC-2 (Permuted Choice 2): After shifting, CiC_i and DiD_i are combined (56 bits) and passed through PC-2 permutation table, which selects and permutes 48 bits out of 56 to produce the sub-key KiK_i

  • Step f — Repeat: Steps d and e are repeated 16 times to generate K1,K2,K3,,K16K_1, K_2, K_3, \ldots, K_{16}


Part C: Finite Field and Its Implications

A Finite Field (also called Galois Field, denoted $GF(p^n)$) is a field that contains a finite number of elements where all arithmetic operations (addition, subtraction, multiplication, division) are defined and closed.

Properties of a Finite Field:

  • It must satisfy all field axioms: closure, associativity, commutativity, distributivity, identity elements, and inverse elements
  • The number of elements in a finite field is always pnp^n, where pp is a prime and nn is a positive integer
  • The most common finite fields in cryptography are GF(2n)GF(2^n)

Implications in Cryptography:

  • AES operates over the finite field GF(28)GF(2^8), where each byte is treated as a polynomial
  • Arithmetic in finite fields ensures results always stay within a fixed range (no overflow)
  • Modular arithmetic in GF(p)GF(p) is the foundation of RSA and Diffie-Hellman algorithms
  • Provides mathematical structure that guarantees invertibility — essential for decryption
  • Enables efficient hardware and software implementation of encryption algorithms

Conclusion: Substitution and transposition are fundamental classical cipher techniques that form the basis of modern ciphers. DES uses a systematic key schedule to derive 16 sub-keys for its Feistel rounds. Finite fields provide the algebraic framework that ensures correctness and security in modern encryption algorithms like AES and RSA.

2.
What are the purposes of message authentication? Explain the working mechanism of MD5.[10]
3.
Define malicious software. Explain the different types of malicious softwares.[10]
Section B

Short Answers Questions

Attempt any Eight questions.
[8*5=40]
4.
Perform polynomial addition, subtraction and multiplication of 2x2+4x+22x^2 + 4x + 2 and 5x+65x + 6 over GF(7)GF(7). [5]
5.
Explain about threats, attacks and assets. [5]
6.
Why do we need two factor authentication? Discuss about security issues for user authentication. [5]
7.
Differentiate between role based and attribute based access controls. [5]
8.
Explain the security auditing architecture. [5]
9.
Define cybercrime and computer crime. Discuss about intellectual property. [5]
10.
What is attack tree? Describe about password based authentication. [5]
11.
What do you mean by subjects, objects and access rights? Discuss about ethical issues in cyber security. [2.5+2.5]
12.
Define security policy. How do you implement logging function? [5]