Physical Security and Cryptography Basics: Controls, Ciphers and Worked Examples

Physical and cryptographic controls solve different parts of one security problem. A locked room cannot protect plaintext sent under stolen credentials; disk encryption cannot prevent power loss or equipment theft. Start with the asset and security goal, follow the threat-vulnerability-control chain, then test the residual risk and primitive choice. Place the topic within a wider GATE CS preparation plan only if the current syllabus names the relevant security area.

1. The security goals that connect physical and cryptographic controls

A protected system includes people, facilities, hardware, media, credentials, software and data. For a Lab L-07 record, unauthorised reading breaks confidentiality, changing a result breaks integrity, and an unreachable server breaks availability.

Follow one exact chain: threat, tailgating; vulnerability, a person holding the door; risk, an unauthorised visitor reaching Lab L-07; prevention, card plus PIN; detection, compare the event log with camera timestamps. Risk remains.

Defence in depth combines deter, prevent, detect, respond and recover. Physical and logical measures reinforce each other: disk encryption cannot stop equipment damage, and a locked room cannot protect plaintext sent with stolen credentials.

2. Physical security: assets, threats and layered controls

Match each threat to its asset and security goal:

• Environmental: fire or water can damage hardware and availability.

• Utility: power or cooling failure can interrupt service.

• Accidental: human error can alter, disconnect or expose an asset.

• Deliberate: theft, tampering or tailgating can affect all three goals.

Lab L-07 has four layers: a building visitor register; card plus PIN at lab entry; a locked rack for one server and one network switch; and a 30-minute UPS, smoke detection and tested recovery copy. Together they deter, prevent, detect, correct and recover. One measure can have multiple roles.

Add access owners, periodic review, visitor escort, media inventory, environmental checks and recovery exercises. Without revocation and review, a card reader is not complete access management.

3. Worked physical-risk example: decide what to treat first

This illustrative model is not an official standard. Rate likelihood and impact from 1, low, to 5, high:

risk score = likelihood x impact

Initially, 16 > 15 > 12. A 30-minute UPS plus generator procedure lowers power-loss likelihood to 2: 2 x 4 = 8. Smoke detection and suppression lower fire likelihood to 1: 1 x 5 = 5. Card plus PIN and visitor escort lower tailgating likelihood to 2: 2 x 3 = 6. Impact stays fixed for transparency. Residual order: power loss 8, tailgating 6, fire 5.

No score becomes zero. The highest residual risk needs an owner and treatment, with recovery retained.

4. Cryptography basics: goals, components and primitive choice

Encryption uses an algorithm and key to turn plaintext into ciphertext; the appropriate key reverses it. Assume the algorithm is known and protect the key. Encoding only changes representation. Revise Number Systems and Base Conversions Explained if needed.

A hash is not encryption and is not decrypted. Encryption alone does not identify a ciphertext's creator, so add authenticated encryption or authentication when needed.

5. Worked cryptographic traces: toy XOR and keyed HMAC verification

This teaching-only 8-bit XOR is not production security. Let P = 10110110 and shared key K = 01101100.

P              1 0 1 1 0 1 1 0
K              0 1 1 0 1 1 0 0
C = P XOR K    1 1 0 1 1 0 1 0

Thus C = 11011010. Decrypt: C XOR K = 11011010 XOR 01101100 = 10110110 = P. XOR reverses itself because K XOR K = 00000000 and XOR with zero leaves P.

Now authenticate two door-event records with HMAC-SHA-256. Both use the shared key L07-log-key:

• door=closed produces fae1bf78e5c284e5abf22a8baec49f8d8c0852f8b24bfbd2c764e61b7645a66f.

• door=open produces 9cecb1dd9981967e97b9e13dccb7ea920114350aac701a1fdeb70d52932176ff.

The changed message produces a different tag. A verifier who knows the shared key recomputes the HMAC and compares it with the received tag. A bare hash has no secret, while an HMAC provides shared-key authenticity; it cannot prove which of two key holders created the tag.

For a confidential Lab L-07 backup, use encryption. Use a hash for unkeyed change detection, an HMAC for shared-key authenticity, and a signature for public-key origin verification. Neither a bare hash nor an HMAC supplies confidentiality.

6. Common traps and the exact correction for each

For confidentiality, encrypt with R's public key; R decrypts with R's private key. Verify S's signature with S's public key; S protects the private key.

After the UPS lowers power-loss risk from 16 to 8, residual availability risk and the recovery plan remain.

7. How exams and interviews test control and key decisions

Questions may match threats to controls, classify control types, calculate risk, trace XOR, choose a primitive or test key roles. The earlier Physical Security and Cryptography Basics: Controls, Keys and Worked Examples provides the broad four-asset server-room model and toy RSA trace. Lab L-07 instead tests a residual-risk grid, XOR and keyed-HMAC decisions.

The official GATE 2026 CS syllabus names application-layer protocols, but not physical security or cryptography. For a later cycle, use that cycle's official syllabus before assigning study time. Security-focused exams and interviews may name these controls directly.

Check your recall against these five anchors:

1. Power-loss risk: 4 x 4 = 16.

2. XOR: 10110110 XOR 01101100 = 11011010.

3. A hash is one-way, not decrypted.

4. A MAC uses a shared secret.

5. The recipient's private key decrypts in this confidentiality case.

The GATE Test Series offers general timed practice.

8. Physical security and cryptography: the short version and next step

Identify the asset and security goal. Separate the threat from the vulnerability. Layer controls and rank the residual risk. Choose encryption, hashing, HMAC or signatures by the property required, and keep every key role explicit.

Reproduce 16 -> 8 for power-loss risk and 10110110 -> 11011010 -> 10110110 for XOR. Then explain why a bare hash cannot replace encryption or keyed authentication. For structured wider-CS study, continue with GATE Guidance by Sanchit Sir.