An Introduction to Cryptography: The Basics and Principles
By Paramesh Vaidyanathan, Skytop Contributor / March 6th, 2023
Paramesh Vaidyanathan is a software technologist with over three decades of experience. Based out of the Seattle area, Paramesh spent 23 years building software and leading teams at Microsoft Corporation. His experience spans platform and infrastructure software (Microsoft Windows family of products), and developer tools (Microsoft Visual Studio). With an initial focus on local area networking performance and quality, Paramesh went on to lead large engineering teams there. His stint included a five year stint as one of the key leaders of Microsoft’s India Development Center in Hyderabad, India. Since “retiring” from Microsoft in 2012, Paramesh has spent his time, efforts and money working with, advising, and investing in software startups in the fields of Healthcare, Education, and Cybersecurity. He consults through his company, Yenodu LLC, that he co-founded with his wife in 2012. His current focus is on helping companies large and small, particularly in Healthcare, become more Cybersecurity aware and ready.
Paramesh has a Master’s Degree in Electrical (Computer) Engineering from Virginia Tech, and a Bachelor’s Degree in Electrical and Electronics Engineering from Anna University, Chennai, India. In his spare time, Paramesh dabbles in gardening, reading and playing bridge.
Cryptography is an essential tool for ensuring the confidentiality, integrity, and authenticity of communication in the modern business world. Cryptographic algorithms and advancements are designed to protect sensitive information from unauthorized access and tampering, and are critical for maintaining the trust of customers, partners, and stakeholders. This article aims to provide the basics and principles of symmetric and asymmetric cryptography, as well as the emerging field of post-quantum cryptography and quantum key distribution.
The Basics
Cryptography is the study of methods for secure communication that involve the use of codes to conceal the original meaning of a message. Cryptography is used to protect information from unauthorized access, and confidentiality is a key priority in this process. This means that only individuals with the proper permission can access the transmitted information, and it is protected from unauthorized access at all stages of its lifecycle. Confidentiality is important in maintaining the privacy of personal information stored in enterprise systems, and encryption is the only way to ensure the security of this information while it is being stored or transmitted. Even if the transmission or storage medium is compromised, encrypted information is difficult for unauthorized individuals to access without the proper decryption keys.
Cryptography involves the use of algorithms, keys, libraries, and certificates to protect sensitive information. Cryptographic keys serve to encrypt and decrypt information. They must be of an appropriate length and kept secret and are used in conjunction with cryptographic algorithms. Digital certificates, when properly managed and employed, maintain trust between digital components. Cryptographic libraries contain implementations of cryptographic algorithms that can be used by developers. Cryptographic algorithms, which must be standardized and mathematically secure, provide the foundation for maintaining the integrity, confidentiality, and authenticity of sensitive information. It is important to carefully manage these elements to prevent vulnerabilities and ensure the security of sensitive information. Cryptography has become increasingly important in recent years due to the risks posed by poor management and the emergence of quantum computing and new cryptographic regulations. Weak or non-compliant cryptographic mechanisms can pose a significant threat to businesses and their security, risk, and compliance teams.
Types of Cryptography
Cryptography has a long history, with early examples dating back to ancient Egypt around 2000 B.C., when secret hieroglyphics were used. There are three main branches of cryptography: symmetric algorithms, asymmetric algorithms (also known as public-key algorithms), and cryptographic protocols.
Symmetric algorithms involve the use of a shared secret key for both encryption and decryption. These were the only type of cryptographic methods used until 1976. Asymmetric algorithms, on the other hand, involve the use of a public key for encryption and a secret key for decryption. These algorithms
can be used for a variety of applications, such as digital signatures and key establishment. Cryptographic protocols are concerned with the application of cryptographic algorithms to secure communication. An example of a cryptographic protocol is Transport Layer Security (TLS), which is used to secure communication in web browsers. This article aims to provide a fundamental understanding of Symmetric and Asymmetric Cryptography.
Cryptanalysis is the study of methods for breaking cryptosystems and decrypting messages without the proper key.
Cryptography and Cryptanalysis combine to form the field of Cryptology.
Symmetric Cryptography
Symmetric algorithms, also known as symmetric-key, secret-key, or single-key schemes, are used in cryptography to allow for secure communication between two parties, Alice, and Bob, over an insecure channel. This could be the internet, a wireless communication link, or any other type of communication media. The issue arises when an unauthorized party, Oscar, has access to the channel and can listen in on the communication, a process called eavesdropping. To prevent Oscar from intercepting important information, such as business strategy documents, Alice can use symmetric cryptography to encrypt the message using a symmetric algorithm and a key, creating the encrypted text, also known as ciphertext. The term cipher denotes the process or steps (sometimes known as code) in the encryption. Bob can then decrypt the ciphertext using the same key to return the message to its original form. The key is a crucial element in symmetric cryptography and must be kept secret, while the encryption and decryption algorithms can be made public. This is because, while keeping the algorithms secret may seem to make the system more secure, it also means that they have not been analyzed and tested by other cryptographers.
Bob receives the ciphertext and decrypts it by reversing the encryption process. If the encryption algorithm is strong, the ciphertext will appear as random bits to Oscar and will not contain any useful information. To securely distribute the key between Alice and Bob, a secure channel must be used. This could involve a trusted intermediary physically transporting the key or using a pre-shared key system such as Wi-Fi Protected Access (WPA) in wireless LANs. It is important to note that both the encryption and decryption algorithms can be made public, as this allows for their analysis and testing by other cryptographers. The key, on the other hand, should be kept secret to maintain the security of the cryptosystem.
The secret key used by the sender and recipient for symmetric cryptography can either be a specific password or code, or it can be a randomly generated string of letters or numbers created by a secure random number generator (RNG).
Classification of Symmetric Algorithms
Symmetric algorithms can be classified into one of two types:
Block algorithms, which encrypt blocks of electronic data with a specific secret key in fixed lengths of bits (64 or 128). These algorithms temporarily store the data in memory as it waits for complete blocks to be encrypted, one block at a time.
Stream algorithms, which encrypt data as it is streaming, one bit at a time, rather than being stored in memory.
While there are several symmetric algorithms, some prominent examples of these include:
DES (Data Encryption Standard) – a block cipher, which divides the plain text into 64-bit blocks and encrypts each block. Eventually, DES was replaced with AES. In the interim, a stronger variant of DES, called Triple-DES, was used for a while. As the name suggests, this algorithm applied the DES mechanism three times with three different keys.
AES (Advanced Encryption Standard) – a block cipher that works on 128-bit blocks, AES uses keys of 128, 192 or 256-bits in length. The implementations of AES are referred to as AES 128, AES 192, and AES 256, consequently. AES continues to be the mostly widely used symmetric encryption mechanism.
Blowfish – a free-of-charge block cipher, Blowfish uses key lengths that range from 32 to 448 bits.
RC4 (Rivest 4) – a stream cipher that uses a 64 or a 128-bit key and operates at a byte level.
Symmetric encryption, though an older method, is faster and more efficient than asymmetric encryption, which can cause performance issues due to the large data size and heavy CPU usage it requires. Because of its superior performance and faster speed, symmetric cryptography is often used for bulk encryption and encrypting large amounts of data, such as for database encryption. In these cases, the secret key may only be accessible to the database for encryption and decryption purposes. Additionally, symmetric encryption is less vulnerable to advances in quantum computing compared to current standards for asymmetric algorithms.
Some applications of symmetric cryptography include:
Protecting personally identifiable information (PII) in payment applications, such as credit card transactions, to prevent identity theft or fraudulent charges
Verifying the identity of the sender of a message
Generating random numbers or hashing data.
Shortcomings of Symmetric Encryption:
Key Overuse: Symmetric encryption can be vulnerable to attacks in which an attacker can reconstruct the key by analyzing the information leaked with each use of the key. To prevent this, organizations can implement a key hierarchy to prevent overuse of master or key-encryption keys and regularly rotate keys that do encrypt large amounts of data. However, these measures require effective key management strategies, as the loss of a retired encryption key can result in the loss of the encrypted data.
Repudiation: Symmetric cryptography, where both parties have the same key, is not suitable for situations where it is important to prevent one of the parties from cheating or denying their actions. For example, in e-commerce, it is important to be able to prove that a particular message was indeed sent by Alice and not falsely generated by Bob. To prevent this kind of denial, or nonrepudiation, asymmetric cryptography, which uses a public key and a private key, can be used. This allows Alice to prove that she was the one who sent the message, as only she would have access to the private key needed to decrypt the message.
Key management at scale: For small-scale schemes with only a few keys (tens to low hundreds), key management can be handled manually. However, as the number of keys increases (such as in credit card companies with millions of cards and several keys per card), manual tracking of expiration and key rotation becomes impractical and a dedicated provisioning and key-management system is required.
Asymmetric Cryptography
Asymmetric cryptography, also known as public-key cryptography, is a relatively new development in the field of cryptography. It was first described publicly in 1976 by Diffie, Hellman, and Merkle, but it was later revealed that the principle had been discovered earlier by researchers at the GCHQ in the UK. Public-key cryptography involves the use of two different keys for encryption and decryption, a public key and a private key. The public key is used to encrypt a message and can be shared with anyone, while the private key is used to decrypt the message and is kept secret by the owner. This allows for secure communication even if the public key is known to an attacker, as they would not have the private key needed to decrypt the message.
Public-key or asymmetric algorithms are different from symmetric algorithms in how they work. Symmetric algorithms, like AES and DES, use math to directly change the information being encrypted into a secret code. Public-key algorithms, on the other hand, use a different kind of math that doesn’t have a simple relationship between the input and output. While some symmetric algorithms use math in parts of the process, they don’t use it in the same way as public-key algorithms do.
Diffie, Hellman, and Merkle proposed a solution to the limitations of symmetric cryptography by suggesting that the key used to encrypt a message does not have to be kept secret. The key used to decrypt the message, on the other hand, should be kept secret. To implement this system, the recipient of the message, Bob, can publish a public encryption key that is known to everyone. Bob also has a matching private key that is used to decrypt the message. This private key is kept secret. This system works similarly to a mailbox on the street: anyone can put a letter in the mailbox (encrypt the message), but only someone with the private key (decryption key) can retrieve the letters (decrypt the message). Key features of Asymmetric Encryption:
Having looked at some of the shortcomings of symmetric encryption, it is worthwhile to examine key features offered by employing asymmetric encryption. These include:
Key establishment protocols, such as Diffie-Hellman key exchange (DHKE) and RSA (Rivest–Shamir–Adleman) key transport, allow for the establishment of secret keys over an insecure channel.
Nonrepudiation and message integrity can be achieved using digital signature algorithms, such as RSA or digital signature algorithms (DSA).
Identification of entities can be performed by employing challenge-response protocols in conjunction with digital signatures, for example in applications like smart cards for banking or mobile phones.
Encryption of messages is possible with algorithms such as RSA.
Asymmetric encryption can be used in modern security protocols, but they are often too slow for practical use in encrypting data. Instead, they are often used in hybrid protocols that combine both symmetric and public key algorithms. Examples of these hybrid protocols include SSL/TLS, which is commonly used for secure Web connections, and IPsec, which is a security protocol for Internet communication. While public key algorithms are not as fast as block and stream ciphers, they are effective at providing nonrepudiation and key establishment functionality. To confirm that a particular public key belongs to a specific individual, the public key must be authenticated. One way to do this is to use certificates, which associate a public key with a specific identity. Major Asymmetric Algorithms:
Integer-Factorization: There are several public-key schemes that are based on the difficulty of factoring large integers, such as RSA (Rivest-Shamir-Adleman).
Example – RSA: Although the Rivest-Shamir-Adleman (RSA) algorithms are currently the most widely used asymmetric cryptographic scheme, others such as elliptic curves and discrete logarithm schemes are gaining popularity. RSA has a wide range of applications, but it is most often used for small data encryption, and for digital signatures on digital certificates on the Internet. RSA involves a lot of computation which makes it much slower than symmetric ciphers like AES. Consequently RSA is not used in place of symmetric algorithms but is often used in conjunction with a symmetric cipher like AES, with the latter performing the actual data encryption. The underlying one-way function (a function that is easy to compute on every input, but hard to invert given the image of a random input) of RSA is based on the difficulty of factoring large integers. Multiplying two large primes is quite easy but factoring a really large number into its base primes is extremely hard. Mathematical concepts like Euler’s theorem and Euler’s phi function are critical in RSA.
Discrete Logarithms: Other public-key schemes are based on the discrete logarithm problem in finite fields, including the Diffie-Hellman key exchange (Diffie-Hellman Key Exchange), Elgamal encryption, and the Digital Signature Algorithm (DSA).
Example – DHKE: The Diffie-Hellman Key Exchange (DHKE) is a practical solution to the problem of distributing keys, allowing two parties to generate a shared secret key through communication over an insecure channel. Diffie-Hellman uses the discrete logarithm problem to enable encryption, password-authenticated key agreement, and forward security. In password-authenticated key agreement, Diffie-Hellman helps prevent man-in-the-middle attacks by allowing parties to securely establish a shared key. With forward security, Diffie-Hellman generates new key pairs for each session, which protects against the compromise of keys from past sessions. Several cryptographic protocols such as Secure Shell (SSH), Transport Layer Security (TLS), and Internet Protocol Security (IPSec) use DHKE.
Elliptical Curves: Another type of public-key scheme is based on elliptic curves, including the Elliptic Curve Diffie-Hellman key exchange (ECDH) and the Elliptic Curve Digital Signature Algorithm (ECDSA).
Example – ECDH – The Elliptical Curve Diffie-Helman (ECDH) algorithm is a method of exchanging keys securely that is based on elliptic curve cryptography. It is similar to the classical Diffie-Hellman algorithm, but instead of using exponentiation to calculate the keys, it uses multiplication on elliptic curves. ECDH is a variant of the Diffie-Hellman algorithm. Elliptic curve cryptography is used in many applications including protecting government communications, ensuring anonymity in the Tor project, verifying ownership of bitcoins, providing signatures in iMessage, and securing web browsing through SSL/TLS. While Elliptic curve cryptography is becoming a popular choice for privacy and security online, algorithms like RSA and Diffie-Helman are still the standards employed.
An elliptic curve is a set of points that can be described by a specific mathematical equation involving two variables. The equation has a degree of two in one variable and a degree of three in the other. Elliptic curves have certain properties that make them useful in cryptography, such as horizontal symmetry (the ability to be reflected over the x-axis without changing the curve) and the fact that any non-vertical line will intersect the curve at most three times. The elliptic curve discrete logarithm problem has not yet been solved by faster algorithms. It is currently harder to solve than factoring, which makes elliptic curve cryptosystems more secure than RSA and Diffie-Hellman.
This group of established public-key schemes are generally recommended for most applications. In addition to the three main sets of public-key schemes, others like multivariate quadratic and lattice-based schemes, and hyperelliptic curve cryptosystems have been in use. Of late, lattice-based schemes have been gaining prominence in a post-quantum cryptography world.
Digital Signatures
Digital signatures are a crucial cryptographic tool that are used in a variety of applications including secure e-commerce transactions with digital certificates, legal signing of contracts, and secure software updates. Digital signatures use asymmetric cryptography to authenticate and verify the integrity of software, documents, messages, and other content. They provide message authentication, data integrity, and non-repudiation, which means that the sender cannot later deny sending the information.
A digital signature requires a hash function. Hash functions are a type of cryptographic tool that are used in many different protocols. They take in a message and produce a fixed-length string of bits, called a hash value or message digest, which serves as a unique representation of the original message. These message digests are often referred to as fingerprints of the message. In contrast to other cryptographic algorithms, hash functions do not use a key. They have many uses in cryptography, including being an essential part of digital signature schemes and message authentication codes, and for storing password hashes and deriving keys.
To create a digital signature, a message digest is created from the message or document to be signed. The signer’s private key is then used to encrypt the hash. The resulting encrypted hash, along with information about the hashing algorithm used, constitutes the digital signature. This signature can be verified by the recipient or any third party using the signer’s public key. Digital signatures provide a way to send/receive digitally signed and secure email that ensures the authenticity of a message. In addition, digital signatures enable carrying out of secure online transactions, validating participants in online transactions, carrying out transactions like online tax filing, and validating documents of various formats (Microsoft Office, Adobe PDFs, etc.)
Certificates
A man-in-the-middle attack is a type of cyberattack that involves an attacker intercepting and altering communication between two parties. This is done by replacing the legitimate public keys of the participants with the attacker’s own keys, and eventually enables the attacker to steal and alter communications between the original sender and receiver. This attack is particularly effective against public-key algorithms, which are used to encrypt and decrypt messages, unless the public keys are protected through methods such as certificates. Certificates are digital signatures that authenticate the identity of a user and their public key and are issued by a mutually trusted third party called a Certification Authority (CA). The CA’s role is to generate and issue certificates for all users in the system, helping to prevent man-in-the-middle attacks by detecting any attempts to replace a public key.
Threat to Modern-Day Cryptography- Quantum Computing
The brute-force method of cracking a symmetric key is to try all possible combinations until the correct one is found. While this can be done with a conventional computer, it can be very time-consuming. It would take millions of years for the fastest supercomputer to find the right combination for a 128-bit key. Asymmetric algorithms are tougher to break because of the prime factorization math that it deploys. This math makes it possible to mathematically compute the private key from the public key, rather than trying all possible keys. Currently, public key encryption is considered secure because it uses very long key pairs, such as 2,048 bits, which corresponds to a number with over 600 digits. However, it is possible that future quantum computers could potentially crack even longer key pairs, such as 4,096 bits, using a method called Shor’s algorithm. While quantum computers, based on quantum physics rather than standard electronics, currently available do not have sufficient processing power or low enough error rates to break strong codes, it is uncertain how long it will take for these advances to be achieved. But this problem will be ideal for quantum computers of the future to solve. If public key encryption is broken, it could compromise the security and trustworthiness of data transmitted over the internet, including digital identities. In advance preparation for asymmetric encryption algorithms being broken with quantum computers, researchers, and government entities (NIST – National Institute of Standards and Technology) have been actively working on post-quantum or quantum-resistant cryptographic solutions. Most of these involve very hard math problems that even quantum computers cannot solve easily.
Post-Quantum (a.k.a. Quantum-Resistant) Cryptography
Researchers in mathematics and computer science have been exploring various ways to improve upon integer factorization and discrete logarithmic problems, existing asymmetric cryptographic systems. One of the most promising approaches is lattice-based cryptography, which is simple to implement and can be easily parallelized. Another option is code-based cryptography, which involves constructing cryptographic systems based on difficult problems in error-correction code theory. With the anticipated advancement of quantum computing, experts predict that RSA and other asymmetric algorithms will no longer be able to secure sensitive data within the next decade. As a result, the National Institute of Standards and Technology (NIST) is actively working to establish a standard for post-quantum encryption.
Quantum Key Distribution
Post-quantum cryptography is sometimes confused with the use of quantum physics to create mechanisms to offer secure communication. The use of quantum physics in cryptography is known as quantum key distribution, a secure means to exchange encryption keys between parties. Those shared keys are used to encrypt and decrypt messages. Quantum Key Distribution uses a quantum system unlike public key cryptography which relies on hard problems in mathematics. Fundamental laws on quantum physics are used to protect data – e.g. in quantum systems, a fundamental principle is that it is impossible to make exact copies of an unknown quantum state. As a result, hackers cannot copy data in the same way that they can copy network traffic using classical computers. Further, any attempt to disturb or observe the system will cause it to change in a detectable way, which means that any attempt to eavesdrop will be easily detected by the actual sender or receiver. Quantum Key Distribution uses photons (light particles) over fiber optic cables as the basic medium of communication.
Cryptography plays a vital role in protecting sensitive information and maintaining the trust of customers and stakeholders in business and government. Understanding the basics and principles of symmetric and asymmetric cryptography is essential for any leader or stakeholder looking to secure their communication and data. The field of post-quantum cryptography and quantum key distribution is still developing, but it is important to be aware of these emerging technologies and their potential impact on the security landscape. As the use of quantum computers becomes more widespread, it is likely that these post-quantum cryptographic methods will become increasingly important for protecting against potential attacks. Keeping up to date with the latest developments in cryptography is essential for any individual, entity or government looking to ensure the security and confidentiality of their communication and data.