Past Exam Questions

Playfair Cipher (Solved Question)Neso Academy · a full Playfair question solved, like mid-sem M2, 12 minMix Column Transformation in AES | Solved ExampleSK Page · MixColumns on one column, solved by hand, 10 minThe RSA Encryption Algorithm (1 of 2: Computing an Example)Eddie Woo · a small RSA example: n, phi(n), e, d, 9 minRSA Digital Signature Explained | Step-by-Step Numerical Example & VerificationSatish C J · RSA signature numeric example, like end-sem E4, 9 minKey Management in Cryptography | Symmetric Key Distribution | Needham Schroeder Protocol | KDCT V Nagaraju Technical · symmetric key distribution, KDC and Needham-Schroeder, 16 min

Question indexSearch on YouTubeBookmarkSaved

The two papers come from the file SEM VII - Batch 2022.pdf. Both papers allow a calculator. Every question is compulsory.

Mid-semester (October 2025)Search on YouTubeBookmarkSaved

M1. RSA key and messageSearch on YouTubeBookmarkSaved

Exam: Mid-sem. Marks: 5.

Question. A server uses RSA with $p=19$, $q=29$, $e=11$. The message is $m=25$. Find the private key and do encryption and decryption.

Answer.

1. Calculate the modulus: $n = pq = 19 \times 29 = 551$.
2. Calculate Euler's totient: $\phi(n) = (p-1)(q-1) = 18 \times 28 = 504$.
3. Make sure that $\gcd(11, 504) = 1$. This is true, so $e = 11$ is valid.
4. Find $d = e^{-1} \bmod 504$ with the extended Euclidean algorithm:

Work back: $1 = 9 - 4 \times 2 = 5 \times 9 - 4 \times 11 = 5 \times 504 - 229 \times 11$. Thus $d = -229 \bmod 504 = 275$.

Check: $11 \times 275 = 3025 = 6 \times 504 + 1$. The result is correct.

5. Encrypt with square-and-multiply. Use $11 = 8 + 2 + 1$:

6. Decrypt: $M = 169^{275} \bmod 551 = 25$. The result is the original message.

M2. Playfair decryptionSearch on YouTubeBookmarkSaved

Exam: Mid-sem. Marks: 10 (key square 5, decryption 5).

Question. Decrypt with Playfair. Key phrase: SECURITY LAB (I/J combined). Ciphertext: VTTDVTIYADUDIYUV. (a) Build the 5x5 key square. (b) Split into digraphs and apply the inverse rules: same row, move left; same column, move up; rectangle, swap columns. Remove the padding X only when it is clearly a filler.

Answer (a): the key square. Write the key letters without repeats (S E C U R I T Y L A B). Then add the remaining letters in alphabetical order. I and J share one cell.

Answer (b): decryption.

Result: MEETMEATTHEGATEX. The last X is a filler that makes the length even. Remove it.

Plaintext: MEET ME AT THE GATE.

M3. AES MixColumnsSearch on YouTubeBookmarkSaved

Exam: Mid-sem. Marks: 15.

Question. Do the MixColumns operation on one column. The input column is $[s_0, s_1, s_2, s_3] = [63, FC, AC, 16]$ (hex). Use the AES MixColumns matrix. Do all arithmetic in $GF(2^8)$. Use bitwise XOR for addition. For multiplication, multiply the polynomials modulo the irreducible polynomial 0x11B.

The printed paper shows 1 in row 3, column 1 of the matrix. Read it as 01, the standard AES value.

Answer.

Step 1. Multiply by 02 with xtime. Shift left by one bit. If the high bit was 1, XOR the result with 1B.

Step 2. Multiply by 03 with $03 \cdot x = (02 \cdot x) \oplus x$.

Step 3. XOR the four products of each row.

Output column: $[63, 79, E6, D9]$.

M4. CFB and OFB modesSearch on YouTubeBookmarkSaved

Exam: Mid-sem. Marks: 10.

Question. Show how encryption and decryption with 128 input bits work in cipher feedback (CFB) mode and output feedback (OFB) mode. Give the advantages and limitations.

Answer. Use a 128-bit block cipher $E$ (for example, AES) with key $K$. Both modes treat the message as a stream of bits. Both modes use only the encryption function of the block cipher, also for decryption.

CFB (full 128-bit feedback, CFB-128).

1. Load the 128-bit IV into the shift register.
2. Encrypt the register. XOR the output with the 128-bit plaintext segment. The result is the ciphertext segment.
3. Feed the ciphertext segment back into the register for the next stage.
4. To decrypt, encrypt the same register values and XOR them with the ciphertext.

In CFB-$s$, only $s$ bits (1, 8 or 64) go out each step. The register shifts left by $s$ bits and takes in the $s$ ciphertext bits.

OFB.

1. Encrypt the IV. The output is the first keystream block $O_1$.
2. XOR $O_1$ with the 128-bit plaintext block to get $C_1$.
3. Feed $O_1$ (not the ciphertext) back as the next input.
4. To decrypt, make the same keystream and XOR it with the ciphertext.

M5. Cipher for a mobile bank appSearch on YouTubeBookmarkSaved

Exam: Mid-sem. Marks: 10.

Question. A bank wants to secure real-time transactions on its mobile app. The app runs on modern smartphones with sufficient CPU and memory. Which algorithm do you recommend: DES, AES, or a lightweight version? Give reasons. Think about security strength, resistance to brute force attacks, and device resources.

Answer. Recommend AES (AES-128, or AES-256 for long-term protection).

Reasons:

1. Security strength. AES has a large key and a 128-bit block. No practical attack is known against full AES.
2. Brute force. A 56-bit DES key is too short. A 128-bit AES key space is far too large to search.
3. Device resources. A modern smartphone has enough CPU and memory. Thus a lightweight cipher gives no real advantage. Lightweight ciphers are for constrained devices.
4. Real-time use. AES in a fast mode (CTR, or GCM in TLS) adds very little delay to each transaction.

End-semester (November 2025)Search on YouTubeBookmarkSaved

E1. Active and passive attacksSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 15.

Question. Describe the active and passive security attacks that occur on the Internet. Explain how each attack works. Give one real-world example for each category.

Answer.

Passive attacks read or monitor the transmission. They do not change the data, so detection is very difficult. The defence is prevention, usually by encryption.

Real-world example: an attacker on a public Wi-Fi network captures unencrypted (HTTP) traffic with a packet sniffer and reads passwords.

Active attacks change the data stream or create a false stream. They are difficult to prevent. The aim is to detect them and recover.

Real-world example: the 2016 Mirai botnet attack on the DNS provider Dyn. It was a distributed denial-of-service attack that made many large websites unavailable.

E2. Diffie-Hellman shared keySearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 10.

Question. Parties A and B set up a common secret key with Diffie-Hellman. They agree on the modulus $q = 7$ and the primitive root $\alpha = 3$. A chooses the secret $X_A = 2$. B chooses the secret $X_B = 5$. Calculate the common secret key on both ends.

Answer.

1. A calculates its public key: $Y_A = \alpha^{X_A} \bmod q = 3^2 \bmod 7 = 9 \bmod 7 = 2$.
2. B calculates its public key: $Y_B = \alpha^{X_B} \bmod q = 3^5 \bmod 7 = 243 \bmod 7 = 5$.
3. A and B exchange $Y_A$ and $Y_B$.
4. A calculates $K = Y_B^{X_A} \bmod q = 5^2 \bmod 7 = 25 \bmod 7 = 4$.
5. B calculates $K = Y_A^{X_B} \bmod q = 2^5 \bmod 7 = 32 \bmod 7 = 4$.

The common secret key is $K = 4$. Both values are equal because $K = \alpha^{X_A X_B} \bmod q = 3^{10} \bmod 7 = 4$.

E3. Needham-Schroeder protocolSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 10.

Question. How is the session key shared between two parties with the Needham-Schroeder protocol? Explain in detail with an example.

Answer. A key distribution center (KDC) shares a master key with each user: $K_a$ with A and $K_b$ with B. A wants a one-time session key $K_s$ to talk to B. $N_1$ and $N_2$ are nonces. $f$ is a known function, for example $f(N) = N + 1$.

Example. Alice (A) wants to send a file to Bob (B).

1. Alice sends "Alice, Bob, $N_1 = 7341$" to the KDC.
2. The KDC makes $K_s$. It sends Alice $K_s$, "Bob" and $7341$, and a ticket for Bob. All of it is encrypted with $K_a$.
3. Alice decrypts the message, checks $7341$, and sends the ticket $E(K_b, [K_s \Vert \text{Alice}])$ to Bob.
4. Bob decrypts the ticket and sends $E(K_s, 5120)$.
5. Alice returns $E(K_s, 5121)$. Now both know $K_s$ and encrypt the file with it.

E4. RSA and DSA signaturesSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 10.

Question. Explain how RSA-based signatures and DSA-based signatures differ in their approach to building digital signature algorithms.

Answer.

RSA approach. Hash the message: $h = H(M)$. Encrypt the hash with the sender's private key: $S = h^d \bmod n$. Send $M$ and $S$. The receiver calculates $S^e \bmod n$ with the public key and compares it with $H(M)$.

DSA (DSS) approach. DSA is a signature-only algorithm. It does not encrypt.

• Global public values: a 160-bit prime $q$, a large prime $p$ where $q$ divides $p-1$, and $g = h^{(p-1)/q} \bmod p$.
• Keys: private $x < q$, public $y = g^x \bmod p$.
• Sign with a new random $k < q$ for each message:

• Verify:

The signature is valid if $v = r$.

E5. Elliptic curve 3PSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 15 (check 5, find 3P 10).

Question. The elliptic curve is $y^2 = x^3 + 5x + 1 \pmod{71}$. The point is $P = (7, 11)$. (a) Check whether $P$ is on the curve. (b) Find $3P$.

Answer (a).

$50 \ne 24$. Thus $P$ is not on the curve. (The points on the curve with $x = 7$ are $(7, 33)$ and $(7, 38)$.)

Answer (b). Write that $P$ is not on the curve. Then apply the group formulas as the question asks. Use $a = 5$ and $p = 71$.

Step 1. Calculate $2P$ (point doubling):

$22^{-1} \bmod 71 = 42$, because $22 \times 42 = 924 = 13 \times 71 + 1$. Thus $\lambda = 10 \times 42 = 420 \equiv 65$.

$2P = (22, 8)$.

Step 2. Calculate $3P = 2P + P$ (point addition):

$56^{-1} \bmod 71 = 52$, because $56 \times 52 = 2912 = 41 \times 71 + 1$. Thus $\lambda = 3 \times 52 = 156 \equiv 14$.

The formulas give $3P = (25, 21)$.

E6. SHA-1 padding and blocksSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 10.

Question. A message has a size of 10,456 bytes. SHA-1 calculates its hash value. (a) Draw the message generation diagram. (b) Find the number of blocks, the number of message bits in the last block, and the size of the padding for the last block.

Answer (a). The message digest generation:

1. Append padding bits: a single 1, then 0s, so that the length is $448 \bmod 512$.
2. Append the original length as a 64-bit value.
3. Split the result into 512-bit blocks $M_1, M_2, \dots, M_N$.
4. Set the 160-bit buffer $(A, B, C, D, E)$ to the initial value $IV$.
5. Process each block with the compression function $F$ (80 steps). Add the input chaining value to the output: $CV_{i} = CV_{i-1} + F(CV_{i-1}, M_i)$, with addition modulo $2^{32}$ on each word.
6. The last chaining value $CV_N$ is the 160-bit message digest.

M1 (512)    M2 (512)          MN (512, has padding + length)
   |           |                  |
IV-+->[ F ]-(+)-+->[ F ]-(+)- ... -+->[ F ]-(+)--> 160-bit digest
 160-bit chaining values CV1, CV2, ..., CVN

Answer (b).

1. Message length: $10456 \times 8 = 83648$ bits.
2. Full blocks: $83648 = 163 \times 512 + 192$. Thus there are 163 full blocks, and 192 message bits stay for the last block.
3. The last block has room for $192 + 1 + 64 = 257 \le 512$ bits. Thus no extra block is necessary.
4. Padding: $448 - 192 = 256$ bits. This is one 1 bit followed by 255 zero bits.
5. Length field: 64 bits, with the value 83648.

E7. DES complementation propertySearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 10.

Question. Let $y = DES(x, K)$ and $y' = DES(c(x), c(K))$. Here $c(\cdot)$ is the bitwise complement. Prove that $y' = c(y)$. That is, if you complement the plaintext and the key, the ciphertext is also complemented. (Use only the high-level structure of DES. The S-box contents are not relevant.)

Answer. Write $\bar{a}$ for $c(a)$. Two facts are true for any bit strings $a$ and $b$:

Also, a permutation, a selection or an expansion only moves or copies bits. Thus it commutes with the complement: $\pi(\bar{a}) = \overline{\pi(a)}$.

Step 1: subkeys. The key schedule uses only PC-1, left circular shifts and PC-2. These move or select bits. Thus the key $\bar{K}$ gives the subkeys $\bar{K}_1, \dots, \bar{K}_{16}$.

Step 2: the round function. $F(R, K_i) = P(S(E(R) \oplus K_i))$. The expansion $E$ copies bits, so $E(\bar{R}) = \overline{E(R)}$. Then:

The S-boxes get the same input. Thus $F(\bar{R}, \bar{K}_i) = F(R, K_i)$.

Step 3: initial permutation. $IP(\bar{x}) = \overline{IP(x)}$. Thus the second run starts with $\bar{L}_0$ and $\bar{R}_0$.

Step 4: induction over the rounds. Assume the second run has $\bar{L}_{i-1}$ and $\bar{R}_{i-1}$ after round $i-1$. Then:

Thus every round keeps the complement relation, up to round 16.

Step 5: output. The 32-bit swap and $IP^{-1}$ are permutations. Thus $y' = IP^{-1}(\bar{R}_{16} \Vert \bar{L}_{16}) = \overline{y}$. $\blacksquare$

E8. TLS or IPSec for e-commerceSearch on YouTubeBookmarkSaved

Exam: End-sem. Marks: 20 (4 parts x 5).

Question. An e-commerce company launches a new online payment system. It must protect customer login, credit card transactions, session cookies, and API requests between the mobile app and the server. The developer asks: is HTTPS (TLS 1.3) enough, or is an additional IPSec configuration necessary? (a) How does SSL/TLS protect each component? (b) Why is TLS preferred over IPSec for e-commerce? (c) Give a situation where IPSec is still necessary in the same company. (d) What can go wrong if SSL certificates are misconfigured (self-signed certificate, weak ciphers, expired certificates)?

Answer (a). TLS first runs the handshake. The server proves its identity with its X.509 certificate. Then the two sides agree on session keys. After that, the record protocol encrypts each record and adds a MAC (in TLS 1.3, an AEAD cipher such as AES-GCM).

Answer (b). TLS is preferred for these reasons:

1. TLS works at the transport layer, inside the application. It needs no change to the operating system or the network.
2. Every browser and phone already supports TLS. Customers need no setup. IPSec needs a configured client on each device.
3. TLS authenticates the server to the user with a certificate. IPSec authenticates hosts or networks, not a web site.
4. TLS protects one application session end to end. This is exactly the client-to-web-server traffic of e-commerce.
5. TLS 1.3 has a fast handshake (one round trip) and passes easily through NAT and firewalls.

Answer (c). IPSec works at the IP layer and protects all traffic between two hosts or networks. Examples in the same company:

• A site-to-site VPN in tunnel mode between the head office, the data center and the payment processor or bank.
• Remote access VPN for employees and administrators who manage the servers.
• Protection of internal traffic between the web servers and the database servers, also for protocols that do not use TLS.
• PCI-DSS requirements for encrypted links between internal networks.

Answer (d).

Conclusion. TLS 1.3, correctly configured, is enough for the customer-facing parts. Use IPSec in addition for the internal and partner network links.