Performance analysis of des and rsa suitability for different system applications

Thesis Overview

<p> </p><p><strong>INTRODUCTION</strong></p><p><strong>1.1 background of<br>study &nbsp; &nbsp;</strong></p><p>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; In our society today, we depend on<br>Information Technology (IT) and this dependency is continuously growing. Further<br>existence and successful development of society without computerized<br>infrastructure is not feasible. On the other hand, due to the use of advanced<br>information technologies, the society has become more and more vulnerable. The<br>failure or misuse of information technology can negatively influence not only a<br>single organization, but can afflict a large number of people too. Therefore,<br>information security has emerged as one of the most important requirements or preconditions<br>of the information age. When a message is sent across an insecure network, it<br>is most likely to pass through a number of machines on the way [1]. Any of<br>these machines is capable of reading and recording the message for further use,<br>and this do not portray privacy [2]. In reality, people would prefer to have<br>their message(s) concealed, so that they will be able to send a message that<br>should be read only by the intended recipient.</p><p>The quest for<br>privacy has motivated researchers and system developers to adopt the techniques<br>of cryptography and intensive study of these two mostly used cryptographic<br>algorithms: Data Encryption Standard (DES) and Rivest-Shamir-Adleman (RSA),<br>nevertheless, these algorithms have their strength and weakness which them<br>suitable or not to a particular information exchange.</p><p>For every<br>system, there are basic priorities or requirements that the developer wants the<br>system to satisfy; it might be speed of processing, security of the data, small<br>memory consumption or others. And these priorities will affect the choice of<br>the cryptographic algorithm. Exchange of information like real-time<br>communication requires high speed of data transfer, the user of the encryption<br>algorithm therefore need very good knowledge of the performance of DES and RSA<br>under different circumstances of large volume of data, attacks, system<br>resource, etc in order to achieve the objective of the system.</p><p>&nbsp;According to [3], cryptography is<br>the art and science of protecting information from undesirable individuals by<br>converting it into a form not understood by un-authorized persons while it is<br>stored and transmitted. The main goal of cryptography is keeping data secure<br>from unauthorized persons. This work examines the two most commonly used<br>cryptographic techniques: Data Encryption Standard (DES) and<br>Rivest-Shamir-Adleman (RSA), discusses their similarities, differences,<br>advantages and disadvantages as well as<br>evaluating the performance of each of the algorithm and also showing which one<br>of the algorithm out-performs the other.</p><p><strong>1.2 Statement of Problem</strong></p><p>&nbsp; &nbsp; &nbsp; An<br>attempt to answer the following questions and many others constitutes the<br>problem statements for this study:</p><p>1. How can one determine which of the two<br>security techniques: DES and RSA is better for a particular information<br>exchange?</p><p>2. &nbsp; How can one differentiate between DES and<br>RSA?</p><p>3. &nbsp; How can one develop a piece of software for<br>implementing security technique?</p><p>4. &nbsp; How can one assess the performance of a<br>security technique?</p><p>5. How can one<br>compare the performances of DES and RSA based on EET and DET metrics?</p><p><strong>1.3<br>Objectives of the Study</strong></p><p>The main aim of<br>the project work is comparative analysis of two cryptographic algorithms; DES<br>and RSA. The specific objectives include to:</p><ul><li>Examine each of the most commonly used security<br>techniques: DES and RSA;</li><li>Develop software for encrypting and decrypting DES and<br>RSA.</li><li>&nbsp;Assess the performance of each based on some<br>metrics.</li><li>&nbsp;Compare their performances using Microsoft<br>Excel.</li></ul><p><strong>1.4 Scope of the Study</strong></p><p>The<br>scope of this study covers implementation of DES and RSA in java programming<br>language and majorly checking the speed at which DES and RSA encrypt and<br>decrypt different file sizes.</p><p><strong>&nbsp;1.5 &nbsp;<br>Significance of the Study</strong></p><p>Cryptographic<br>algorithms and protocols are necessary to keep a system secured, particularly<br>when communicating through an open network like the Internet. This has been of<br>much concern to the society. The society at large needs security and those that<br>are into e-business are not left out, for instance, the banking sector are<br>involved in various transactions and their private files that contain these<br>transactions ought to be secured in order to avoid unauthorized attackers<br>invading other peoples’ accounts and hacking into the bank’s system. Also the<br>telecommunication firms operating in Nigeria namely, MTN, Glo, Etisalat, etc.<br>have need of high security in order to keep their networks safe. The society is<br>not complete if the government is not mentioned, the government agencies<br>require security to protect their confidential information/data from<br>unauthorized attackers. This research shall aid the system analyst or the<br>system developer to be able to make a decision on the cryptographic algorithm<br>to use when designing a particular system and this decision will be base on the<br>particular function the system will be performing.</p><p><strong>1.6 Definition of Terms</strong></p><p><strong>Security: </strong>Security<br>is a system of safeguards designed to protect something from deliberate or<br>accidental damage or access by unauthorized persons [4].</p><p><strong>Computer Security: </strong>According to [5],<br>Computer Security is the process of preventing and detecting unauthorized use<br>of your computer.</p><p><strong>&nbsp;Computer Network: </strong>A network is a group of<br>interconnected systems sharing services and interacting by means of a shared<br>communications link [6].</p><p><strong>&nbsp;Internet: </strong>Internet is a network of<br>thousands of computer networks that allow computers to communicate with each<br>other [7]. Internet is also known as the information superhighway. The<br>information superhighway or the internet is one of the most important<br>developments in the history of information systems [8].</p><p><strong>&nbsp;Network Security: </strong>Internet security<br>involves securing data transmissions as well as protecting the site from<br>intrusions [9]. A system is secure if it adequately protects information that<br>it processes against unauthorized disclosure, unauthorized modification, and<br>authorized withholding (also called denial of service) [10].</p><p><strong>&nbsp;System Security: </strong>System Security involves<br>the security of the operating system of a computer.</p><p><strong>Communication Security: </strong>Communication<br>security involves the preserving of data/information as they are being sent<br>across networks to guarantee privacy. How secure are the communications<br>channels to transmit our data? Some form of encryption mechanism to keep the<br>information private may be necessary.</p><p><strong>&nbsp;Data<br>Security: </strong>Having established a secure communication channel to transmit<br>data, the next issue is how secure are the data on the other end on the<br>network? The operating system should be able to provide protective mechanisms<br>to secure the data, but for sensitive data, some form of encryption mechanisms<br>may be necessary mostly when the data is stored on a disk.</p><p><strong>&nbsp;Authentication and authorization: </strong>Authentication<br>is a way of asking “who are you?” The use of passwords has become popular<br>methods of authenticating users to computer systems. Authorization is a way of<br>asking “what are you allowed to do?”</p><p><strong>&nbsp;Threats: </strong>Threats are attacks that may<br>occur as a result of communications over open insecure network. The client and<br>application may be attacked. Possible attacks include: Content Alteration, Data<br>Contamination, Substitution Attack, Authentication Attack, Eavesdropping, Theft<br>and Fraud, Service Interruption, Cryptanalysis and Masquerading.</p><p><strong>Cryptosystems: </strong>Cryptosystems is<br>considered to be the collection of encryption and decryption systems, the key<br>generator, as well as the protocols for key transmission [11]. The term<br>cryptosystems is used to describe cryptographic algorithms and their<br>characteristics.</p><p><strong>Cryptographic Protocols: </strong>The term<br>cryptographic protocols, is used to describe the composition and application of<br>cryptographic algorithms with regards to securing of a communication’s channel<br>or information in a database. A protocol is a series of steps taken to accomplish<br>a task. In fact that is also the definition of an algorithm but we use<br>algorithm to refer to the attainment of internal, mathematical results like<br>encrypting a block, and protocol to refer to the attainment of user-visible<br>results such as secret communication and digital signatures [12].</p><p><strong>&nbsp;Key<br>Management: </strong>The term key management is used to refer to the fundamental<br>problems of creating, distributing, and storing keys.</p><p><strong>Cipher: </strong>A cipher is a<br>character-for-character or bit-for-bit manipulation irrespective of the<br>language structure of the message/data. In other words, a cipher is an<br>algorithm for executing encryption and decryption.</p><p><strong>Encryption: </strong>Encryption or enciphering<br>is the scrambling of data/messages in some way to make it unreadable.</p><p><strong>&nbsp;Decryption: </strong>Decryption or deciphering is<br>the unscrambling of data/messages in some way to make it readable. Decryption<br>or deciphering is possible with keys that are related. A message read/sent across<br>a network or communication channel is referred to as the plaintext whereas the<br>encrypted message is the ciphertext.</p><p><strong>&nbsp;Cryptographic Algorithms: </strong>A cryptographic<br>algorithm is defined to be the mathematical description of the enciphering and<br>deciphering processes together with the interrelation between their keys.<br>Cryptographic algorithm is more software oriented [11].</p><p><strong>Symmetric Cryptosystems: </strong>In a symmetric<br>cryptosystem the message or plaintext is encrypted using a key. The resulting<br>ciphertext is sent to the recipient, who decrypts the message using the same<br>key. Note: that the same key must be known to both parties.</p><p>&nbsp;<strong>Asymmetric<br>Cryptosystems: </strong>Asymmetric cryptosystems involves two keys – a private key<br>and a public key that are mathematically related. A message encrypted with one<br>key can be decrypted only with the other. It is extremely difficult to<br>determine the value of one key by examining the other. In an asymmetric<br>cryptosystem, the encryption key is different from the decryption key. The<br>public key is often called the encryption key.</p><p><strong>&nbsp;Privacy: </strong>Privacy is a secret message whose<br>contents are known only by the sender and receiver. The recipient public key is<br>used to encrypt the message and with the secret key in his possession, he can<br>decrypt the message.</p><p><strong>&nbsp;Authentication: </strong>Authentication arises when<br>the receiver knows who sent the message and its genuineness and the sender<br>knows that the message shall get to the intended recipient. The recipient has<br>the ability to authenticate the sender of the message by simply verifying a<br>digital signature.</p><p><strong>Secret Communication: </strong>Secret<br>communication is a situation whereby a message is made secret and only the<br>sender and intended recipient knows the content of the message.</p><p><strong>Digital Signatures: </strong>A digital signature scheme is a public key algorithm that allows one to authenticate a message by means of a piece of information called the signature. The generation of the signature requires the knowledge of the signer’s private key, while for the verification of the signature, only the knowledge of the corresponding public key is necessary. If the public key is publicly accessible, then everybody can verify the signature, while only the signer, who knows the private key, is able to sign.</p> <br><p></p>