Network security
Introduced
Vocabulary
| English | Meaning |
|---|---|
| MAC/mæk/ | Message authentication code: a keyed value used to check message integrity and authenticity. |
| TLS/ˌtiː el ˈes/ | A protocol that protects data in transit using encryption, integrity checks and peer authentication. |
| symmetric/sɪˈmetrɪk/ | Describing encryption in which communicating parties share a secret key for encryption and decryption. |
| asymmetric/ˌeɪsɪˈmetrɪk/ | In cryptography, describing methods that use a related public key and private key rather than one shared secret key. |
The three properties
- Confidentiality needs encryption; integrity needs a MAC; authentication needs a certificate chain to a root the client already trusts. Drop any one and the protocol fails differently: no encryption is a wiretap, no MAC is alteration, no certificate is an impostor.
- TLS layers them: symmetric for the data (fast), asymmetric for the key agreement (one expensive operation), certificates for identity.
{exercise:uni-cs0906-props}
Practice
Integrity without confidentiality still —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
A MAC catches alteration; encryption catches reading - separate defenses.
The handshake, numbered
- ClientHello (suites + fresh random), ServerHello (chosen suite + random) with certificate, key exchange (premaster under the public key), both derive session keys from the three values, Finished messages verify — then data flows symmetric-encrypted.
- One RSA-style operation, then stream-speed cryptography: the asymmetry is used only to agree on the symmetric key.
{exercise:uni-cs0906-handshake}
Practice
TLS uses asymmetric cryptography —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
One expensive operation exchanges the key; symmetric encrypts the stream.
The attacker menu
- Passive sniffing: defeated by encryption. Modification: defeated by the MAC (Finished catches handshake tampering). Impersonation: defeated by certificates. Handshake replay: defeated by the fresh randoms.
- Encrypting without authenticating gives you a secure channel to the wrong machine; HTTPS makes the channel private and the server identified — the content can still lie.
{exercise:uni-cs0906-attacks}
Practice
Handshake replay is defeated by —
Difficulty 1/5 · 100 coins + a small bonus on first completion today
Each handshake carries new randoms; a replayed one derives different keys.