Encryption and Decryption: Complete Cryptography Notes

1. Introduction to Cryptography

Cryptography is the science of protecting information using mathematical techniques. It is used in secure websites, online banking, digital payments, messaging applications, electronic signatures, virtual private networks, and many other digital services.

Objectives of Cryptography

• Confidentiality: Preventing unauthorised users from reading information.
• Integrity: Detecting unauthorised modification of information.
• Authentication: Verifying the identity of a user, device, or communicating party.
• Non-repudiation: Providing evidence that can help prevent a signer from falsely denying a digitally signed action or message.

Historical Development

• Classical Cryptography: Caesar cipher, substitution ciphers, transposition ciphers, and Scytale.
• Mechanical Cryptography: Systems such as Enigma used during the World War era.
• Modern Cryptography: AES, RSA, elliptic-curve cryptography, cryptographic hashes, digital signatures, and TLS.
• Post-Quantum Cryptography: Cryptographic techniques designed to resist attacks from sufficiently capable quantum computers.

2. Basic Cryptography Concepts

3. Symmetric Key Encryption

Symmetric encryption uses the same shared secret key, or keys derived from the same shared secret, for encryption and decryption.

Characteristics

• Uses a shared secret key.
• Usually faster than public-key cryptography.
• Suitable for protecting large amounts of data.
• Requires a secure method for establishing or exchanging the secret key.

Important Symmetric Algorithms

Block Cipher Modes

• ECB: Encrypts each block independently. It should generally be avoided because identical plaintext blocks produce identical ciphertext blocks.
• CBC: Chains blocks together, but does not provide integrity protection by itself.
• CTR: Generates a keystream by encrypting counter values. It requires careful nonce management.
• GCM: An authenticated-encryption mode commonly used with AES. It provides confidentiality and integrity when used correctly.

4. Asymmetric Key Cryptography

Asymmetric cryptography, also called public-key cryptography, uses a pair of mathematically related keys: a public key and a private key.

• Public Key: Can be distributed openly and is used according to the cryptographic scheme.
• Private Key: Must remain secret and under the control of its owner.
• Key Pair: The public key and private key are mathematically related.

Common Public-Key Techniques

Asymmetric cryptography is usually slower than symmetric cryptography. Modern systems often use public-key techniques to establish a session key and then use symmetric encryption to protect the actual data transfer.

5. Symmetric vs Asymmetric Cryptography

6. Cryptographic Hash Functions

A cryptographic hash function converts input data of arbitrary length into a fixed-length value called a hash or message digest.

Important Properties

• Deterministic: The same input produces the same hash value.
• Pre-image Resistance: It should be computationally difficult to find an input that produces a given hash.
• Second Pre-image Resistance: It should be difficult to find another input with the same hash as a specified input.
• Collision Resistance: It should be difficult to find two different inputs that produce the same hash.
• Avalanche Effect: A small change in input should produce a significantly different output.

Common Hash Algorithms

• MD5: Produces a 128-bit digest but is insecure for security-sensitive use.
• SHA-1: Produces a 160-bit digest but is deprecated for modern security use.
• SHA-2: Includes SHA-224, SHA-256, SHA-384, and SHA-512.
• SHA-3: A modern hash-function family standardised by NIST.

Hashing, Passwords, and HMAC

• Password Hashing: Passwords should use dedicated password-hashing algorithms, such as Argon2, scrypt, or bcrypt, with unique salts.
• HMAC: A keyed mechanism that can help verify message integrity and authenticity.
• File Integrity: A known hash can be used to check whether a downloaded file has changed.

7. Digital Signatures

A digital signature provides cryptographic evidence about the origin and integrity of digital data. It commonly uses the signer's private key and the corresponding public key.

Digital Signature Process

1. The sender creates a cryptographic hash of the message.
2. The sender uses a signature algorithm and private key to create a signature.
3. The message and signature are sent to the receiver.
4. The receiver uses the sender's public key to verify the signature.
5. The receiver confirms whether the signature is valid for the received message.

A valid signature can support integrity, authentication, and non-repudiation-related assurances. However, a digital signature does not make the content secret. Encryption is needed when confidentiality is also required.

8. Major Cryptographic Algorithms

AES

• Advanced Encryption Standard, standardised by NIST.
• Uses a 128-bit block size.
• Supports 128-bit, 192-bit, and 256-bit keys.
• Uses 10, 12, or 14 rounds depending on key size.
• Widely used in modern systems when implemented and configured correctly.

RSA

• Uses a public and private key pair.
• Its security is associated with integer factorisation difficulty.
• Can be used by properly designed encryption and signature schemes.
• Modern deployments commonly use keys of at least 2048 bits, depending on security requirements and policy.

DES and 3DES

• DES has a 56-bit effective key length and is insecure.
• 3DES was a stronger historical replacement for DES, but it is legacy technology.
• Neither DES nor 3DES should be selected for new systems.

9. Common Cryptographic Attacks

Cryptographic attacks attempt to recover protected information, discover keys, forge authentication data, or exploit implementation weaknesses.

10. Public Key Infrastructure (PKI)

Public Key Infrastructure is a framework used to create, manage, distribute, validate, and revoke public-key certificates.

• Certificate Authority (CA): Issues and digitally signs certificates.
• Registration Authority (RA): Performs identity-related registration or verification functions where applicable.
• Digital Certificate: Binds a public key to an identity or subject for a defined purpose.
• Certificate Repository: A location where certificates and related information may be published.
• Certificate Revocation List (CRL): A list of certificates revoked before their normal expiry date.
• OCSP: Online Certificate Status Protocol, which can provide certificate-status information.

X.509 Certificates

X.509 is a widely used standard for public-key certificates. A certificate normally includes details such as issuer, subject, validity period, public-key information, extensions, and a certificate signature.

11. SSL and TLS

Transport Layer Security, or TLS, is a cryptographic protocol that protects communication over networks. HTTPS uses TLS to protect communication between a browser and a web server.

SSL is the older predecessor of TLS and is obsolete. Modern systems should use supported TLS versions and secure configurations.

Basic TLS Handshake Concept

1. The client begins the connection and provides supported protocol options.
2. The server selects compatible parameters and provides a certificate where appropriate.
3. The client validates the server certificate and identity.
4. The parties establish shared secret material for the session.
5. Symmetric keys protect the application data exchanged during the session.

12. Applications of Cryptography

• Secure Web Browsing: HTTPS uses TLS to protect web communication.
• Email Security: S/MIME and OpenPGP can provide encryption and digital signatures.
• Virtual Private Networks: VPN technologies can use cryptographic protocols to protect network traffic.
• Digital Payments: Cryptographic mechanisms help protect transactions and authentication.
• Password Protection: Dedicated password-hashing algorithms protect stored passwords.
• Digital Signatures: Used to verify authenticity and integrity of digital documents and software.
• Secure File Transfer: Protocols such as SFTP use secure communication mechanisms.

13. Post-Quantum Cryptography

Post-quantum cryptography refers to cryptographic algorithms designed to remain secure against attacks from sufficiently capable quantum computers.

In 2024, NIST published initial post-quantum cryptography standards for key establishment and digital signatures. These include ML-KEM, ML-DSA, and SLH-DSA.

• ML-KEM: A key-encapsulation mechanism used to help establish shared secrets.
• ML-DSA: A post-quantum digital-signature standard.
• SLH-DSA: A stateless hash-based digital-signature standard.

Post-quantum cryptography is different from quantum key distribution. Post-quantum cryptography uses mathematical algorithms that can run on conventional computers.

14. Quick Revision

15. Practice Questions

1. What is the difference between encryption and hashing?
2. What are the four major objectives of cryptography?
3. Differentiate between symmetric and asymmetric cryptography.
4. Why is AES preferred over DES for modern systems?
5. What is the purpose of a cryptographic hash function?
6. Why should passwords not be stored using plain SHA-256 hashes?
7. What is a digital signature, and what security properties does it provide?
8. What is the role of a Certificate Authority in PKI?
9. Why is TLS used in HTTPS?
10. Why is Diffie-Hellman used for key agreement rather than direct encryption?
11. What are the common cryptographic attacks discussed above?
12. What is post-quantum cryptography?