Formula sheet

Password combinatorics

$N$

total number of possible passwords

$C$

size of the character set

$L$

password length in characters

Password strength and generation

Password entropy

$H$

entropy in bits

$N$

total combinations, C^L

$L$

password length

$C$

character-set size

H, not N, is what the lecture and this site mean by "strength" - bits of uncertainty, not a raw count of passwords.

Password strength and generation

Passphrase entropy (dice method)

$H$

entropy in bits

$n$

number of words chosen

$W$

wordlist size, 7,776 for the EFF long list, since 6^5 = 7,776

The same formula as password entropy, with a word standing in for a character and the wordlist standing in for the character set.

Password strength and generation

Octal permission digit

$r, w, x$

Each is 1 if that permission is granted, 0 if not.

$d$

The resulting octal digit, 0 to 7.

The same formula gives the leading special-bits digit, with r -> SUID (4), w -> SGID (2), x -> sticky (1).

Unix and Linux permissions

Divisibility

$b \mid a$

"b divides a" — b is a divisor of a

$a, b, m$

integers, b nonzero

There is no remainder when a is divided by b.

Divisibility and the greatest common divisor

Linear combination property

$g, h$

two integers b divides

$m, n$

any integers

Divisibility and the greatest common divisor

Division algorithm

$a$

the dividend, a non-negative integer

$n$

the divisor, a positive integer

$q$

the quotient, found by flooring a/n

$r$

the remainder, always in [0, n)

Divisibility and the greatest common divisor

Greatest common divisor

$a, b$

the two integers

$k$

a common divisor of a and b

gcd(a, 0) = |a|, and gcd(0, 0) is defined to be 0.

Divisibility and the greatest common divisor

The mod operator

$a$

any integer, positive or negative

$n$

the modulus, a positive integer

$q$

the quotient, floor(a/n)

$r$

the remainder, always in [0, n)

For negative a, q rounds toward negative infinity, not toward zero — that is what keeps r non-negative.

Modular arithmetic and residue classes

Congruence modulo n

$a \equiv b \pmod{n}$

"a is congruent to b modulo n"

$a, b, n$

integers; n is the modulus

a ≡ 0 (mod n) if and only if n | a.

Modular arithmetic and residue classes

Modular arithmetic properties

$\circ$

any of +, -, x

$a, b$

any integers

$n$

the modulus

Reduce before combining or after — addition, subtraction and multiplication all give the same answer either way.

Modular arithmetic and residue classes

Residue class [r]

$[r]$

the residue class of r modulo n

$a$

any integer congruent to r mod n

The smallest non-negative member of a class is the one normally used to name it.

Modular arithmetic and residue classes

The set Zn

$\mathbb{Z}_n$

the set of residues modulo n

$n$

the modulus

Modular arithmetic and residue classes

Bezout identity

$a, b$

the two input integers

$d$

gcd(a, b)

$x, y$

the Bezout coefficients — the extended Euclidean algorithm finds both

x and y are not unique, but the algorithm always produces one valid pair.

The extended Euclidean algorithm and modular inverses

Modular inverse

$a$

the integer being inverted

$n$

the modulus

$x$

the inverse, written a^{-1} mod n

A solution for x exists if and only if gcd(a, n) = 1.

The extended Euclidean algorithm and modular inverses

Fundamental theorem of arithmetic

$a$

any integer greater than 1

$p_1 < p_2 < \ldots < p_t$

the distinct prime factors of a, in increasing order

$a_i$

the positive integer power of p_i in the factorisation

This factorisation is unique: there is exactly one way to write a as a product of prime powers.

Primes, Fermat, Euler and fast modular exponentiation

Fermat's little theorem

$p$

a prime number

$a$

any integer not divisible by p

A special case of Euler's theorem below, with n = p and phi(p) = p - 1.

Primes, Fermat, Euler and fast modular exponentiation

Euler's totient function

$\varphi(n)$

the count of positive integers below n that are coprime to n

$n$

any positive integer

phi(p) = p - 1 for prime p, since every integer from 1 to p-1 is coprime to p.

Primes, Fermat, Euler and fast modular exponentiation

Totient of a product of two primes

$p, q$

two distinct prime numbers

$n = pq$

their product

This is the identity RSA key generation runs directly: n = pq, phi(n) = (p-1)(q-1).

Primes, Fermat, Euler and fast modular exponentiation

Euler's theorem

$a, n$

any two relatively prime integers, n positive

$\varphi(n)$

the Euler totient of n

Alternative form: a^{phi(n)+1} = a (mod n). Setting n = p prime recovers Fermat's little theorem.

Primes, Fermat, Euler and fast modular exponentiation

Order of an element

$\mathrm{ord}_p(a)$

the order of a modulo p

$p$

a prime modulus

$a$

an integer not divisible by p

The order always divides phi(p) = p - 1.

Discrete logarithms and primitive roots

Primitive root condition

$g$

a primitive root of p

$p$

a prime

A primitive root's powers g^1, g^2, ..., g^{p-1} run through every nonzero residue mod p exactly once before repeating.

Discrete logarithms and primitive roots

Discrete logarithm problem (DLP)

$p$

a prime

$g$

a primitive root of p

$x$

the discrete logarithm of y to base g: the unknown the problem asks for

$y$

the given result of the exponentiation

Computing y from g, x, p is fast (square-and-multiply); recovering x from g, y, p has no known fast general method.

Discrete logarithms and primitive roots

Group axioms

$G$

the set, with a binary operation written + here

$0$

the identity element

$-a$

the inverse of a

Closure, associativity, identity, inverse. Add commutativity (a+b=b+a) and the group is abelian.

Groups, rings and fields

Ring axioms

$R$

the set, with addition and multiplication

$(R, +) \text{ abelian}$

R is an abelian group under addition

Multiplication must be closed and associative, and distribute over addition. Neither a multiplicative identity nor multiplicative commutativity is required.

Groups, rings and fields

Commutative ring

$R$

a ring

A ring where multiplication is also commutative.

Groups, rings and fields

Field axioms

$F$

a commutative ring with a multiplicative identity 1

$a^{-1}$

the multiplicative inverse of a

A field is a commutative ring where every nonzero element has a multiplicative inverse. Z is not a field; Q is.

Groups, rings and fields

Prime field GF(p)

$p$

a prime number

Also written F_p. Characteristic p is the smallest number of copies of any element that sum to 0.

Finite fields, GF(p) and GF(2^n)

Extension field GF(p^n)

$p$

a prime (2 for every field on this page)

$n$

the extension degree

Built from GF(p) by adjoining the roots of a degree-n irreducible polynomial over GF(p).

Finite fields, GF(p) and GF(2^n)

GF(2^3) irreducible polynomial

$p(x)$

the modulus every multiplication in GF(2^3) reduces by

Cannot be factored into lower-degree polynomials with coefficients in GF(2), which is what makes it irreducible over GF(2).

Finite fields, GF(p) and GF(2^n)

AES irreducible polynomial

$m(x)$

the modulus every GF(2^8) multiplication in AES reduces by

In binary: 100011011, or 0x11B.

Finite fields, GF(p) and GF(2^n)

Encryption and decryption

$p$

plaintext, drawn from an alphabet R

$c$

ciphertext, drawn from an alphabet S that need not match R, in size or content

$k_e$

the encryption key

$k_d$

the decryption key

In symmetric cryptography k_e = k_d, or k_d is trivially derivable from k_e. In asymmetric cryptography neither holds.

Cryptography basics and Kerckhoffs's principle

Caesar cipher

$P_i, C_i$

the numeric value (A=0 .. Z=25) of the i-th plaintext and ciphertext letter

$n$

the shift, a fixed integer from 0 to 25

Every letter uses the same shift n: one fixed rule for the whole message, which is exactly what frequency analysis exploits.

Substitution, transposition and frequency analysis

Caesar cipher keyspace

$|K|$

the number of distinct keys

A 26-letter alphabet gives 26 possible shifts, of which the shift of 0 does nothing to the plaintext, so 25 keys actually change the message.

Substitution, transposition and frequency analysis

Vigenère encryption and decryption

$P_i, C_i$

the numeric value of the i-th plaintext and ciphertext letter

$K_j$

the numeric value of the j-th letter of the key

$L$

the length of the key

i mod L cycles the key to match however long the plaintext is; +26 before the mod in decryption keeps the result non-negative.

The Vigenère cipher and the Kasiski examination

Vigenère keyspace

$|K|$

the number of distinct keys of length L

$L$

the key length in letters

Grows exponentially with key length: a 3-letter key already gives 26^3 = 17,576 possible keys, far more than Caesar's 26, but still small enough that a short key is worth attacking directly, which is exactly what the Kasiski examination does.

The Vigenère cipher and the Kasiski examination

One-time pad encryption and decryption

$p$

plaintext bits

$c$

ciphertext bits

$k$

the one-time key (the pad), the same length as p

XOR is its own inverse, so encryption and decryption are the same operation.

Stream ciphers and the one-time pad

Many-time pad key-reuse relationship

$C_1, C_2$

two ciphertexts produced under the same reused key K

$P_1, P_2$

the plaintexts behind them

$P$

C_1 XOR C_2, independent of the key entirely

The key cancels out completely, because K XOR K is all zeros.

Stream ciphers and the one-time pad

DES S-box addressing

$b_0, b_5$

the outer two bits of the 6-bit S-box input — together they give a row from 0 to 3

$b_1 b_2 b_3 b_4$

the inner four bits, read as a 4-bit number — a column from 0 to 15

DES has eight S-boxes addressed this way. S[0] is worked in full below.

Block ciphers, S-boxes, P-boxes and Feistel

Feistel round

$L_n, R_n$

the left and right halves entering round n

$F$

the round function, keyed by the round subkey

$K_n$

the subkey used in round n

$\oplus$

bitwise XOR

Block ciphers, S-boxes, P-boxes and Feistel

DES keyspace

$K$

the set of all possible DES keys

$56$

the DES key length in bits

DES and 3DES

Average-case brute-force time

$T$

expected time to find the key, in seconds

$2^{55}$

half the keyspace — the average number of keys tried before a hit

$R$

attack rate, in keys tried per second

Worst case tries the full 2^56; on average a hit comes after trying half the keyspace.

DES and 3DES

3DES effective key sizes

$56$

one DES key length

$2, 3$

the number of independent DES keys, for two-key and three-key 3DES

The unit teaches these as the effective strengths. See the discrepancy noted below for what NIST rates instead.

DES and 3DES

AES round count by key size

$N_k$

key length in 32-bit words — 4, 6 or 8 for AES-128, AES-192, AES-256

$N_r$

number of rounds for that key size

AES

Key expansion size

$N_b$

block size in 32-bit words — fixed at 4 for every AES key size, since the block is always 128 bits

$N_r$

number of rounds for the chosen key size

$w$

total 32-bit words produced by key expansion, one round key of N_b words per round plus one extra for the initial AddRoundKey

The lecture works the AES-128 case only: w = 4(10+1) = 44 words, 176 bytes. The same formula gives 52 words for AES-192 and 60 for AES-256.

AES

AES finite field

$m(x)$

the irreducible polynomial AES reduces modulo, defining GF(2^8)

Every AES byte operation — SubBytes and MixColumns — is arithmetic in this field.

AES

ECB

$P_i$

plaintext block i

$C_i$

ciphertext block i

$E_k$

the block cipher's encryption function under key k

No chain-in at all. Every block is encrypted exactly as if it were the only block in the message.

Modes of operation

CBC encrypt

$P_i, C_i$

plaintext and ciphertext block i

$C_{i-1}$

the previous ciphertext block, or the IV when i = 0

$E_k$

the block cipher's encryption function under key k

The first block has no previous ciphertext, so C_{-1} is replaced by the IV.

Modes of operation

CBC decrypt

$D_k$

the block cipher's decryption function under key k

$C_i, C_{i-1}$

the current and previous ciphertext blocks

Every block of ciphertext is already available before decryption starts, unlike encryption, which must run in order.

Modes of operation

CTR keystream

$i$

the per-block counter value, incremented once per block

$\text{nonce}$

a value combined with the counter, never reused under the same key

$E_k(\text{nonce}\Vert i)$

the keystream block for position i

Every block's keystream depends only on the nonce and its own counter value, never on another block's ciphertext. This is what lets CTR parallelise.

Modes of operation

One-way function

$X$

the input, from the function's domain

$Y$

the output, from the function's range

$f$

the one-way function itself

Every output has a unique inverse; computing it just is not feasible without extra information.

Public-key cryptography and trapdoor functions

Trapdoor one-way function

$X, Y$

input and output, as above

$k$

the trapdoor — a piece of extra information

$f_k$

the function, parameterised by the trapdoor

Every public-key cryptosystem in this module is one instance of this idea.

Public-key cryptography and trapdoor functions

Discrete Logarithm Problem (DLP)

$p$

a prime number

$g$

a primitive root of p

$x$

the value to find — the discrete logarithm of y

$y$

the given result of raising g to the power x

Finding x given p, g and y is believed infeasible for a large enough p.

Public-key cryptography and trapdoor functions

RSA problem

$n$

the modulus

$e$

the public exponent

$m$

the value to find — the e-th root of c

$c$

the given result of raising m to the power e

Finding m given c, e and n is believed infeasible for certain n.

Public-key cryptography and trapdoor functions

RSA key generation

$p, q$

two distinct primes, chosen and then discarded

$n$

the modulus, published as part of both keys

$\varphi(n)$

Euler's totient of n — kept secret, discarded after key generation

$e$

the public exponent, 1 < e < \varphi(n)

$d$

the private exponent, the modular inverse of e mod \varphi(n)

Public key PU = {e, n}. Private key PR = {d, n}.

RSA

Euler's totient of a semiprime

$n$

the RSA modulus, a product of two distinct primes

$p, q$

the two prime factors of n

The shortcut used throughout RSA key generation — see 04-04 for the general definition of phi.

RSA

RSA encryption

$M$

the plaintext, an integer with 0 \le M < n

$e, n$

the public key

$C$

the ciphertext

RSA

RSA decryption

$C$

the ciphertext

$d, n$

the private key

$M$

the recovered plaintext

RSA

RSA malleability

$c$

the intercepted ciphertext, c = m^e mod n

$r$

any value the attacker chooses

$e, n$

the victim's public key

$c'$

the modified ciphertext the attacker submits for decryption

$d$

the victim's private exponent, never seen by the attacker

$m$

the original plaintext, still unknown to the attacker at this point

The attacker never learns d and never sees m directly, but recovers m from the decrypted (c')^d by dividing out r.

RSA security, attacks, padding and hybrid encryption

Diffie-Hellman shared secret

$p$

a public prime modulus

$g$

a public primitive root (generator) of p

$a, b$

Alice's and Bob's private exponents, never sent

$X, Y$

the public values X = g^a mod p and Y = g^b mod p, exchanged in the open

$K$

the shared secret both sides compute independently

K = g^(ab) mod p either way the exponents are applied, which is why the two sides agree without ever sending a or b.

Diffie-Hellman key exchange

Elliptic curve over a prime field

$p$

a prime defining the field the curve is drawn over

$a, b$

the curve's two coefficients

$x, y$

coordinates of a point on the curve, both reduced mod p

Over the reals (no modulus) this is the same equation and gives the familiar smooth curve used for the geometric picture of point addition.

Elliptic curve cryptography

Elliptic curve over a binary field

$GF(2^m)$

the binary field the curve is defined over, see finite fields for the general construction

$a, b$

the curve's coefficients, themselves elements of GF(2^m)

$x, y$

coordinates, also elements of GF(2^m)

A different equation from the prime-field case, not the same one with a different modulus. Addition and subtraction in GF(2^m) both reduce to XOR.

Elliptic curve cryptography

Elliptic curve discrete logarithm problem

$P$

a known point on the curve, often the agreed base point G

$k$

the value to find: a scalar less than the order of P

$Q$

the given result of adding P to itself k times

Finding k given only P and Q is believed harder, bit for bit, than the classical discrete logarithm problem, which is why ECC keys are shorter than RSA or Diffie-Hellman keys for the same security level.

Elliptic curve cryptography

ECDH shared secret

$G$

the public base point, with public order n

$n_A, n_B$

Alice's and Bob's private scalars

$P_A, P_B$

the public points P_A = n_A G and P_B = n_B G

$K$

the shared point both sides compute independently

The same commutativity trick as classical Diffie-Hellman, with scalar point multiplication standing in for modular exponentiation.

Elliptic curve cryptography

Grover's algorithm: effective symmetric key strength

$b$

the nominal length of a symmetric key, in bits

$b_{\text{eff}}$

the effective security level against a quantum adversary running Grover's algorithm

A 256-bit key offers security comparable to a 128-bit key against a quantum adversary, per the lecture. Doubling key sizes is the stated mitigation.

Post-quantum cryptography

Hash function

$M$

the input message, of variable length

$H$

the hash function

$h$

the hash value, digest or checksum: fixed-size regardless of the length of M

The input space is far larger than the fixed output space, so collisions, two different messages with the same hash, always exist. A good hash function still spreads its outputs evenly enough that finding one is infeasible.

Hash functions and what they are for

Preimage resistance

$y$

a hash value, chosen at random from H's range of possible outputs

$x$

the preimage being searched for

$H$

the hash function

Not impossible, brute force always works in principle, just infeasible in practice.

Preimage, second preimage and collision resistance

Second preimage resistance

$x$

a given, already-known input

$x'$

a different input the attacker searches for

The attacker is handed x and must match it exactly, unlike collision resistance below.

Preimage, second preimage and collision resistance

Collision resistance

$x, x'$

any two distinct inputs, neither fixed in advance

Collision resistance implies second preimage resistance: a successful second-preimage attack is itself a valid collision. The reverse implication does not hold.

Preimage, second preimage and collision resistance

Birthday attack, general form

$N$

the size of the uniform range the values are drawn from

Applies to any uniformly-distributed random variable, not only hash outputs, the classic case being 365 possible birthdays.

The birthday attack and output length

Birthday attack on an n-bit hash

$n$

the hash function's output length, in bits

$2^n$

the total number of possible hash values

$2^{n/2}$

the number of attempts needed for a better-than-50% chance of finding some collision

For n = 160, the currently accepted minimum, this is 2^80 attempts.

The birthday attack and output length

SHA-512 padding

$L$

the original message length, in bits

$1$

a single appended 1 bit

$k$

the number of 0 bits appended after it, chosen to satisfy the congruence

After this padding, a 128-bit encoding of L is appended, bringing the total to an exact multiple of 1024 bits.

SHA-2 and SHA-3

SHA-3 state size

$b$

the total width of the permutation state, in bits

$r$

the rate: bits absorbed or squeezed per application of the permutation f

$c$

the capacity: bits held back from direct message input or output, the security margin

A larger r means faster hashing (more bits processed per round) at the cost of a smaller c, and therefore less security margin. Different SHA-3 variants just move this split.

SHA-2 and SHA-3

MAC

$M$

the input message

$K$

the secret key, shared between sender and receiver

$C$

the MAC function

Also called a cryptographic checksum. The MAC is sent alongside the original message, unlike encryption, which replaces it.

Message authentication codes and HMAC

HMAC

$H$

any cryptographic hash function, e.g. MD5, SHA-1, SHA-2

$K$

the shared secret key

$M$

the input message

$\text{ipad}, \text{opad}$

publicly known constant bit strings, required for HMAC's security proof to hold

ipad = 0x36 repeated for the block length; opad = 0x5c repeated for the block length. Their precise values matter little beyond that, per the slides.

Message authentication codes and HMAC

The four AE approaches

$M$

the plaintext message

$E_K$

encryption under key K

$H(M)$

the message's hash

$\text{MAC}_{K}(x)$

the MAC of x under key K

$K_1, K_2$

two independent keys, one for the MAC and one for encryption, used in every approach except H then E

A->E is used in SSL/TLS, E->A is used in IPSec and is considered the strongest, E+A is used in SSH.

Authenticated encryption, GCM and CCM

RSA signature generation

$M$

the message being signed

$H(M)$

the message's secure hash, e.g. under SHA

$PR_a$

the sender's (Alice's) private key

$E$

RSA encryption, here used to produce the signature rather than for confidentiality

Digital signatures, DSA and RSA

RSA signature verification

$PU_a$

the sender's public key

$D$

RSA decryption, applied here to the received signature

$H(M)$

the verifier's own hash of the received message

The signature is accepted only if decrypting it with the sender's public key reproduces the verifier's own computed hash exactly.

Digital signatures, DSA and RSA

Confidentiality and authentication of a secret key

$K_s$

the secret (session) key A wants to give B

$PR_a$

A's private key: encrypting with it is what only A could have produced

$PU_b$

B's public key: encrypting with it means only B can read the result

$M$

the message A actually sends, protected by both layers at once

B recovers K_s by undoing the layers in reverse: D(PU_a, D(PR_b, M)). Encrypting with A's own private key is what proves origin; encrypting again with B's public key is what hides it from anyone but B.

Distributing symmetric keys with public-key encryption

Certificate creation

$PR_{auth}$

the certificate authority's private key

$T$

a timestamp, used to judge whether the certificate is still valid

$ID_A, PU_a$

the holder's identifier and public key, the binding the certificate vouches for

The whole block is encrypted (signed) with the authority's private key, which is what makes the binding trustworthy to anyone who trusts that authority.

Public-key certificates and X.509

Certificate verification

$PU_{auth}$

the certificate authority's public key, known in advance by the verifier

$C_A$

the certificate as received from A or from a directory

A successful decryption under PU_auth is itself the proof the certificate came from the authority, since only the authority holds PR_auth.

Public-key certificates and X.509

Combined session key from a mutual hybrid exchange

$k_A$

the key half A contributes, sent as Enc_{k_e,B}(k_A), Sig_A(k_A)

$k_B$

the key half B contributes, sent as Enc_{k_e,A}(k_B), Sig_B(k_B)

$f$

a combining function applied to both halves

Both parties contribute to k, so one party accidentally picking a poor key half does not, by itself, make the scheme insecure.

Authenticated key establishment

Needham-Schroeder message 1: initiate

$ID_A, ID_B$

identifiers of A and B

$N_1$

a nonce identifying this session, chosen by A

Needham-Schroeder and Kerberos

Needham-Schroeder message 2: AS response

$K_s$

the fresh session key the AS generates for this exchange

$K_a, K_b$

the long-term master keys A and B each share with the AS

The first block, decryptable only by A, carries K_s and A's own request (including N_1) back, so A can confirm freshness. The second block is the ticket meant for B; A cannot read it.

Needham-Schroeder and Kerberos

Needham-Schroeder message 3: forward the ticket

$E(K_b, [K_s \Vert ID_A])$

the ticket A relays to B unopened, exactly as received from the AS

Needham-Schroeder and Kerberos

Needham-Schroeder message 4: B's challenge

$N_2$

a fresh nonce B generates, proving to itself that A's next reply is current

Needham-Schroeder and Kerberos

Needham-Schroeder message 5: A's response

$f(N_2)$

a generic transformation of N_2, e.g. incrementing it, proving A holds K_s and answered this specific challenge

Needham-Schroeder and Kerberos

Kerberos exchange 1: client requests a ticket-granting ticket

$ID_c$

the client's identity

$ID_{tgs}$

tells the AS the user requests access to the TGS

$TS_1$

lets the AS verify the client's clock is synchronised with its own

Needham-Schroeder and Kerberos

Kerberos exchange 2: AS returns the ticket-granting ticket

$K_c$

a key derived from the user's password, letting the AS and client verify the password and protecting the message contents

$K_{c,tgs}$

a session key the AS creates for the client and TGS to use, so they need no permanent shared key

$ID_{tgs}$

confirms this ticket is for the TGS

$TS_2$

tells the client when this ticket was issued

$\text{Lifetime}_2$

tells the client how long this ticket remains valid

$\text{Ticket}_{tgs}$

the ticket-granting ticket itself, used by the client to access the TGS

Needham-Schroeder and Kerberos

Kerberos exchange 3: client requests a service-granting ticket

$ID_v$

tells the TGS the user requests access to server V

$\text{Ticket}_{tgs}$

assures the TGS this user was already authenticated by the AS

$\text{Authenticator}_c$

generated by the client to let the TGS validate the ticket

Needham-Schroeder and Kerberos

Kerberos exchange 4: TGS returns the service-granting ticket

$K_{c,tgs}$

the key shared only by client and TGS, protecting this message's contents

$K_{c,v}$

the session key for the client and server V

$ID_v$

confirms this ticket is for server V

$\text{Ticket}_v$

the ticket used to access server V

TS_4 is not separately glossed in the notes; by the same pattern as TS_2, it records when this ticket was issued.

Needham-Schroeder and Kerberos

Kerberos exchange 5: client requests service

$\text{Ticket}_v$

assures server V this user was authenticated by the AS

Needham-Schroeder and Kerberos

Kerberos exchange 6: optional server authentication

$K_{c,v}$

assures the client this reply genuinely came from V

$TS_5 + 1$

assures the client this is not a replay of an earlier reply

Needham-Schroeder and Kerberos

Number of subnets from borrowed bits

$s$

number of bits borrowed from the host portion of the address for subnetting

For a Class C base network extended to a /26, s = 26 - 24 = 2, giving 4 subnets.

Network layer: IP addressing, subnets, NAT and IPv6

Usable hosts per subnet

$h$

number of bits remaining for the host portion of the address

The 2 subtracted are the subnet's network address and its broadcast address, neither of which can be assigned to a host.

Network layer: IP addressing, subnets, NAT and IPv6