2.3 Bitwise Operations & Two's Complement

Once you can read binary and hex, the next Cyber Test skill is operating on bits. Firewalls, permission flags, subnet masks, and many crypto constructions are bitmasks: they keep, clear, or flip selected bits. Signed integers add another layer — the same bit pattern can mean different magnitudes depending on whether the value is unsigned or two's complement signed.

Bitwise Operations

Operate column by column on equally wide bit strings. Write the operands stacked; compute each column independently.

AND (&)

Result bit is 1 only if both inputs are 1. Use AND to clear bits (mask with 0) or to extract fields (mask with 1s where you care).

Worked example: 10110110 AND 11110000 = 10110000. The lower nibble was cleared — the classic "keep high bits" mask pattern. Networking parallel: applying a subnet mask is conceptually AND between address and mask.

OR (|)

Result bit is 1 if either input is 1. Use OR to set bits.

Worked example: 10000000 OR 00001111 = 10001111. You turned on the low four bits without touching the high bit.

XOR (^)

Result bit is 1 if inputs differ. Use XOR to toggle bits where the mask is 1; XOR with all zeros leaves a value unchanged; XOR a value with itself yields zero.

Worked example: 11001100 XOR 00111100 = 11110000. Crypto cameo: XOR appears in stream-cipher-style constructions and in simple one-time-pad teaching examples — ciphertext bit = plaintext bit XOR key bit. Knowing XOR's truth table is enough at CT depth; you do not need full cipher design.

NOT (~)

Flips every bit: 0→1, 1→0. Width matters: NOT of an 8-bit 00001111 is 11110000, not an infinite string of leading ones unless the type is wider.

Worked example: NOT 10101010 (8-bit) = 01010101.

---

Shifts (Conceptual)

Left shift

Move every bit toward the MSB; vacate LSBs with zeros; bits shifted out of the high end are discarded (for fixed width). Each left shift by 1 multiplies by 2 (when no overflow out of the field).

• 00000101 (5) left shift 1 → 00001010 (10)
• Left shift 2 → 00010100 (20)

Right shift

Move bits toward the LSB; bits shifted out the low end are lost. For unsigned values, vacated MSBs fill with 0 — each step divides by 2 (floor).

• 00010100 (20) right shift 1 → 00001010 (10)

Signed arithmetic right shifts may sign-extend (fill with the old MSB). At Cyber Test depth, know the unsigned story and that signed shifts can preserve the sign bit — do not assume every right shift zeros the MSB.

---

Signed vs Unsigned

For an N-bit unsigned integer, values run from 0 to 2ᴺ − 1.

• 8-bit unsigned: 0 … 255
• 4-bit unsigned: 0 … 15

For two's complement signed N-bit integers, the MSB is the sign bit. The range is roughly −2ᴺ⁻¹ … 2ᴺ⁻¹ − 1.

• 8-bit signed: −128 … +127
• Same bit pattern 11111111: unsigned 255; signed −1
• Pattern 10000000: unsigned 128; signed −128

Exam trap: Interpreting a high bit as "just another 128" when the stem says signed negative encoding.

---

Two's Complement Negate Recipe

To negate a value in two's complement (fixed width):

1. Invert all bits (bitwise NOT).
2. Add 1 (with carry in the same bit width; discard overflow beyond the width).

Worked example: Negate +6 in 8-bit two's complement

• +6 = 00000110
• NOT → 11111001
• Add 1 → 11111010 → this represents −6

Worked example: Negate −6 back to +6

• Start 11111010
• NOT → 00000101
• Add 1 → 00000110 → +6

Worked example: Find the decimal of signed 11111100 (8-bit)

Option A — recipe: MSB is 1, so negative. Negate to find magnitude: NOT 11111100 → 00000011; add 1 → 00000100 = 4; therefore value = −4.

Option B — place values with sign: −128 + 64 + 32 + 16 + 8 + 4 = −128 + 124 = −4. Same answer.

Special case: −128 in 8-bit

10000000 negated: NOT → 01111111; add 1 → 10000000 again. There is no +128 in 8-bit signed; −128 is the asymmetric edge of the range.

---

Putting It Together for Cyber

• Subnet / ACL style thinking: address AND mask → network portion (clear host bits).
• Flag registers: OR to enable options; AND with inverted mask to disable; XOR to toggle a feature bit.
• ASCII case bit: difference of 32 between 'A' and 'a' is one bit — OR/AND/XOR with 0x20 can force case in ASCII-only contexts.
• Crypto intuition: XOR mixes keystream bits; understanding that XOR is its own inverse (apply twice → original) explains simple recovery demos without needing AES internals yet.

---

Exam Traps

• Confusing AND and OR: AND with 0 clears; OR with 1 sets. Mixing them reverses the intended mask effect.
• XOR vs OR: OR never turns a 1 into 0; XOR can. If both bits are 1, OR stays 1 and XOR becomes 0.
• Width after NOT: Always NOT within the stated bit width.
• Signed high bit: 1xxxxxxx is not automatically "128 + …" when signed — use two's complement interpretation.
• Shift multiply overflow: Left-shifting until bits fall off the MSB is not a pure ×2 in a fixed-width register.

Mini checklist

• Stack bits; compute AND/OR/XOR/NOT per column
• Left shift ≈ ×2; unsigned right shift ≈ ÷2
• Unsigned max = all 1s; signed uses MSB as sign
• Negate = NOT then +1
• Masking in networks is AND; toggles often XOR

Master these operations with 8-bit scratch work. The Cyber Test rewards clean bit hygiene more than memorizing tool names.