Introduction to Cryptography

Cryptography is the science of protecting information by using mathematical techniques to provide secure communication and data protection. It is widely used to protect confidentiality, integrity, authentication, and non-repudiation.

Historical Development of Cryptography

  • Classical Cryptography: Caesar cipher, substitution ciphers, transposition ciphers and Scytale.
  • World War Era: Enigma and other mechanical cryptographic systems.
  • Modern Cryptography: DES, AES, RSA, ECC, cryptographic hash functions and digital signatures.
  • Modern Security: TLS, public-key infrastructure and post-quantum cryptography.

Objectives of Cryptography

  • Confidentiality: Preventing unauthorized users from accessing information.
  • Integrity: Detecting unauthorized modification of data.
  • Authentication: Verifying the identity of a user, device or communicating party.
  • Non-repudiation: Providing evidence that can help prevent a sender from falsely denying a digitally signed action or message.

Basic Cryptography Concepts

Understanding basic cryptographic terminology is essential for studying encryption, decryption and information security.

Key Terminology

  • Plaintext: Original readable data before encryption.
  • Ciphertext: Data produced after encryption.
  • Encryption: The process of transforming plaintext into ciphertext.
  • Decryption: The process of recovering plaintext from ciphertext.
  • Cryptographic Key: A value used by a cryptographic algorithm to perform encryption, decryption or other cryptographic operations.
  • Algorithm: A defined mathematical procedure used to perform a cryptographic operation.
  • Cryptanalysis: The study of analyzing cryptographic systems and attempting to discover weaknesses or recover protected information.

Basic Encryption and Decryption Process

Plaintext → [Encryption Algorithm + Key] → Ciphertext

Ciphertext → [Decryption Algorithm + Key] → Plaintext

Note: Kerckhoffs's principle states that the security of a cryptographic system should depend on the secrecy of the key rather than the secrecy of the algorithm.

Symmetric Key Encryption

Symmetric encryption uses the same secret key, or keys derived from the same shared secret, for encryption and decryption.

Characteristics of Symmetric Encryption

  • Uses a shared secret key.
  • Generally faster than public-key cryptographic operations.
  • Suitable for encrypting large amounts of data.
  • Requires secure establishment or exchange of the secret key.

Types of Symmetric Ciphers

Stream Ciphers

Stream ciphers encrypt data as a sequence of bits or bytes using a generated keystream.

  • RC4: Historically important but no longer considered secure for modern use.
  • A5/1: A historical stream cipher used in GSM communications.

Block Ciphers

Block ciphers process data in fixed-size blocks.

  • DES: Uses a 64-bit block and an effective key length of 56 bits; considered insecure today.
  • 3DES: Applies the DES operation multiple times and is now considered obsolete for most modern applications.
  • AES: Uses a 128-bit block size with 128, 192 or 256-bit keys.
  • Blowfish: A legacy symmetric block cipher with a variable-length key.

Block Cipher Modes of Operation

  • ECB (Electronic Codebook): Encrypts each block independently and should generally be avoided for ordinary data because identical plaintext blocks produce identical ciphertext blocks.
  • CBC (Cipher Block Chaining): Combines each plaintext block with the previous ciphertext block.
  • CFB (Cipher Feedback): Uses feedback from ciphertext to produce a keystream-like operation.
  • OFB (Output Feedback): Generates a keystream independently of the plaintext and ciphertext.
  • CTR (Counter): Encrypts successive counter values to generate a keystream.
Note: Modern applications commonly prefer authenticated encryption modes such as AES-GCM because they provide confidentiality and integrity together.

Asymmetric Key Cryptography

Asymmetric cryptography, also called public-key cryptography, uses a pair of mathematically related keys: a public key and a private key.

Key Concepts

  • Public Key: Can be distributed publicly and is used according to the cryptographic algorithm and operation being performed.
  • Private Key: Must be kept secret by its owner.
  • Key Pair: The public and private keys are mathematically related.

Common Public-Key Algorithms

RSA (Rivest-Shamir-Adleman)

RSA is a public-key cryptographic algorithm whose security is associated with the computational difficulty of factoring large integers.

  • Can be used for encryption and digital signatures.
  • Modern RSA deployments commonly use 2048-bit or larger keys.
  • RSA operations are generally slower than symmetric encryption.

Diffie-Hellman

Diffie-Hellman is a key-agreement protocol rather than a direct data-encryption algorithm.

  • Allows two parties to establish a shared secret over an insecure channel.
  • Security is based on the difficulty of certain discrete logarithm problems.
  • Authentication is required separately to prevent man-in-the-middle attacks.

Elliptic Curve Cryptography (ECC)

ECC uses mathematical properties of elliptic curves to provide public-key cryptographic operations.

  • Provides strong security with relatively small key sizes.
  • Can reduce storage and communication requirements.
  • Widely used in modern security protocols and applications.
Exam Tip: Diffie-Hellman is primarily used for key agreement, while RSA and ECC can support different public-key operations such as encryption or digital signatures depending on the scheme used.

Symmetric vs Asymmetric Cryptography

Symmetric and asymmetric cryptography solve different security problems and are frequently used together in practical systems.

Parameter Symmetric Cryptography Asymmetric Cryptography
Keys Shared secret key Public and private key pair
Speed Generally faster Generally slower
Large Data Well suited Generally not used for bulk data encryption
Key Establishment Shared secret must be established securely Public key can be distributed openly
Common Uses Data encryption Key agreement, authentication and digital signatures
Examples AES RSA, ECC, Diffie-Hellman
Important: Modern systems commonly use hybrid cryptography. Public-key techniques establish or protect a symmetric session key, while symmetric encryption is used for efficient bulk-data protection.

Cryptographic Hash Functions

A cryptographic hash function converts input data of arbitrary length into a fixed-length value called a hash or digest.

Properties of Cryptographic Hash Functions

  • Deterministic: The same input produces the same hash value.
  • Pre-image Resistance: It should be computationally difficult to find an input that produces a given hash.
  • Second Pre-image Resistance: It should be difficult to find another input having the same hash as a specified input.
  • Collision Resistance: It should be difficult to find two different inputs producing the same hash.
  • Avalanche Effect: A small change in the input should produce a significantly different output.

Common Hash Algorithms

  • MD5: Produces a 128-bit digest and is not suitable for security-sensitive applications.
  • SHA-1: Produces a 160-bit digest and is deprecated for modern security use.
  • SHA-2: Includes SHA-224, SHA-256, SHA-384 and SHA-512.
  • SHA-3: A modern hash-function family standardized by NIST.

Applications of Hash Functions

  • Data integrity verification
  • Digital signatures
  • Message authentication mechanisms
  • File integrity checking
  • Blockchain systems
  • Password protection when used with appropriate password-hashing algorithms
Important: Passwords should not normally be stored using a plain SHA-256 or SHA-512 hash. Dedicated password-hashing algorithms such as Argon2, scrypt or bcrypt are designed for password storage.

Digital Signatures

A digital signature is a cryptographic mechanism used to provide authentication, integrity and evidence of who signed digital data.

Digital Signature Process

  1. The sender creates a cryptographic hash of the message.
  2. The sender creates a digital signature using their private key.
  3. The signature is sent along with the message.
  4. The receiver uses the sender's public key to verify the signature.
  5. The receiver calculates the hash of the received message.
  6. The signature verification confirms whether the message and signature are valid.

Digital Signature Creation

Message → Hash Function → Message Digest → Digital Signature Algorithm + Private Key → Digital Signature

Digital Signature Verification

Message + Digital Signature → Signature Verification + Public Key → Valid / Invalid

Note: A digital signature by itself does not provide confidentiality. Encryption is required when the content must also remain secret.

Major Cryptographic Algorithms

The following algorithms are important for understanding the development and practical use of cryptography.

DES (Data Encryption Standard)

  • Uses a 64-bit block size.
  • Has an effective key length of 56 bits.
  • Uses a 16-round Feistel structure.
  • Considered insecure because its key size is too small for modern security.

3DES (Triple DES)

  • Based on repeated DES operations.
  • Historically provided stronger protection than DES.
  • Much slower than modern algorithms such as AES.
  • Considered a legacy algorithm and should not be selected for new systems.

AES (Advanced Encryption Standard)

  • Standardized by NIST.
  • Uses a 128-bit block size.
  • Supports 128-bit, 192-bit and 256-bit keys.
  • Uses 10, 12 or 14 rounds depending on the key size.
  • Based on a substitution-permutation structure.

RSA

  • Uses a public and private key pair.
  • Based on mathematical properties related to integer factorization.
  • Can be used for encryption schemes and digital signatures.
  • Modern deployments commonly use RSA keys of at least 2048 bits.
Exam Tip: Remember the important AES facts: 128-bit block size, key sizes of 128/192/256 bits, and 10/12/14 rounds respectively.

Cryptographic Attacks

Cryptographic attacks attempt to recover protected information, discover secret keys, forge authentication data or exploit weaknesses in cryptographic implementations.

Types of Cryptographic Attacks

Attack Type Description General Protection
Brute Force Attempts possible keys until the correct key is found. Use sufficiently strong keys and modern algorithms.
Man-in-the-Middle An attacker attempts to intercept communication between parties. Use authenticated secure protocols and certificate validation.
Birthday Attack Attempts to exploit the probability of hash collisions. Use modern collision-resistant hash functions.
Side-Channel Attack Uses information leaked by an implementation, such as timing or power consumption. Use carefully designed and tested implementations.
Replay Attack Previously captured valid messages are transmitted again. Use nonces, timestamps, sequence numbers or equivalent mechanisms.
Password Guessing Attempts common, weak or previously leaked passwords. Use strong authentication and appropriate password-hashing methods.
Important: Cryptographic security depends on the algorithm, key management, implementation, configuration and the security of the surrounding system.

Public Key Infrastructure (PKI)

Public Key Infrastructure (PKI) is a framework used to create, manage, distribute, validate and revoke digital certificates and public keys.

PKI Components

  • Certificate Authority (CA): Issues and digitally signs certificates.
  • Registration Authority (RA): Performs identity-related registration or verification functions on behalf of a CA where applicable.
  • Digital Certificate: Binds a public key to an identity or subject according to the certificate's intended use.
  • Certificate Repository: A location where certificates and related information may be published.
  • Certificate Revocation List (CRL): A list of certificates that have been revoked before their normal expiry.

Common Digital Certificate Information

  • Version
  • Serial number
  • Signature algorithm
  • Issuer
  • Validity period
  • Subject
  • Subject public key information
  • Extensions
  • Certificate signature

X.509 Certificates

X.509 is a widely used standard for the structure and format of public-key certificates.

SSL and TLS

Transport Layer Security (TLS) is a cryptographic protocol used to provide secure communication over networks. SSL is the older predecessor and is deprecated.

Basic TLS Handshake Concept

  1. ClientHello: The client begins the connection and provides supported protocol options and cryptographic parameters.
  2. ServerHello: The server selects compatible parameters and provides information required to continue the handshake.
  3. Authentication: The server can provide a certificate that the client validates.
  4. Key Establishment: The protocol establishes shared secret material for the secure session.
  5. Session Protection: Symmetric keys are used to protect application data.

Important SSL/TLS Versions

Version Status
SSL 2.0 Deprecated and insecure
SSL 3.0 Deprecated and insecure
TLS 1.0 Deprecated
TLS 1.1 Deprecated
TLS 1.2 Widely deployed and supported
TLS 1.3 Modern TLS version with improved security and performance characteristics
Exam Tip: SSL is obsolete. TLS is its successor, and TLS 1.3 is the latest standardized TLS version.

Applications of Cryptography

Cryptography is used in many everyday technologies to protect information and establish trust between systems.

Common Applications

  • Secure Web Browsing: HTTPS uses TLS to protect web communication.
  • Email Security: Technologies such as S/MIME and OpenPGP can provide encryption and digital signatures.
  • Virtual Private Networks: VPN technologies can use cryptographic protocols to protect network traffic.
  • Digital Payments: Cryptographic mechanisms help protect payment transactions and authentication.
  • Password Protection: Passwords can be protected using dedicated password-hashing algorithms with salts.
  • Digital Signatures: Used to verify the authenticity and integrity of digitally signed information.
  • Secure File Transfer: Protocols such as SFTP use secure communication mechanisms.

Emerging Areas

  • Homomorphic Encryption: Allows certain computations to be performed on encrypted data.
  • Quantum Cryptography: Includes approaches such as quantum key distribution.
  • Post-Quantum Cryptography: Cryptographic algorithms designed to resist attacks from sufficiently powerful quantum computers.
  • Zero-Knowledge Proofs: Allow one party to demonstrate knowledge of information without necessarily revealing the information itself.

Cryptography Quick Revision

Topic Key Point
Encryption Converts plaintext into ciphertext.
Decryption Recovers plaintext from ciphertext.
Symmetric Encryption Uses a shared secret key and is generally fast.
Asymmetric Cryptography Uses public and private keys.
Hash Function Produces a fixed-length digest from input data.
Digital Signature Provides integrity and authentication-related assurances.
PKI Manages public-key certificates and related trust infrastructure.
TLS Protects communication over networks.
AES Modern symmetric block cipher with 128-bit block size.
RSA Public-key cryptographic algorithm.
Exam Tip: For objective questions, focus on the differences between symmetric and asymmetric cryptography, encryption and hashing, digital signatures and encryption, RSA and Diffie-Hellman, and SSL/TLS.