Cryptography

Key Takeaways

Not all information is meant to be shared. In fact, many types of interaction need privacy in order to take place. For example, would you want a third party intercepting your emails? Or a stranger seeing your bank details when you make an online purchase? If the answer is no, keep reading.

Now, more than ever, we need robust cryptographic techniques to protect our data, including credit card and banking info, our identity and our private interactions. According to IBM, data breaches cost $4.45 million in 2023, a 15% increase over three years. In this article, we’ll simplify cryptography for beginners, from its definition to its use cases, discussing its various types, their risks, and how to mitigate cryptographic hazards.

Cryptography Definition

Cryptography is a sophisticated word for keeping secrets safe. It’s about using special methods to protect information from people who shouldn’t see it. Cryptography will transform messages into an unreadable format, known as cipher text, ensuring its integrity, confidentiality, and authenticity.

Algorithms and keys encrypt and decrypt data, with the most trusted algorithms adopted by the National Institute of Standards as an industry standard. Cryptography secures communications, shields sensitive information in transit and at rest, and underpins secure transactions in all industries. This is why nearly everything you do online undergoes some form of encryption process either before or during transmission.

Origins of cryptography

While modern cryptology is firmly rooted in computer science, mathematics and engineering principles, the practice of encoding information is ancient.

Ancient Greeks used scytale devices

As far back as 600BC, Greek leaders used scytale devices (early encryption tools) to send private messages during battle.

The Roman Empire used ciphers

Around 50 BC, Julius Caesar developed his own cipher, in which each letter of the Alphabet advanced by three places. In other words, A became D, B became E and so on. This proved to be an effective method of encryption for the times.

The middle ages saw encryption keys developed

By the 1500s, Italian academic Giovan Battista Bellaso had conceptualized the first “encryption key”. The idea was that a predefined “key” shared by the two communicating parties would enable both to have exclusive access to the underlying message.

WW11 saw the first secure electronic communication

During WW11, actress Hedy Lamarr co-developed a type of radio communication that evaded enemy detection, technology that became the precursor for Wifi and Bluetooth.

1970s saw mass adoption of cryptography

By the 1970’s, the digital sector was booming and cryptography was being taken seriously by big industry. IBM formed a “crypto group” tasked with developing a block cipher to protect IBM customer data. The solution, the Data Encryption Standard (DES) was adopted as a national data security standard.

Meanwhile, researchers Whitfield Diffie and Martin Hellman developed a secure method for cryptographic key exchange. This would allow the key for decrypting encoded messages to be shared safely between parties, without being intercepted.

Present day encryption standards

Today, the prevailing cryptographic standard is AES, or advanced encryption standard. This relies on each party having both a public and private key, which are linked. This enables data to be decoded without either party sharing their own encryption key, preventing man in the middle attacks. To date, this is considered the gold standard of encryption.

Why do we use Cryptography?

With advancements in technology, it became easier to create convenient tools. For instance, our communication is primarily remote thanks to the infrastructure around simplifying communication. Our entire system works around online communication, from ordering food to working and making payments. As a result, implementing cryptography is vital for protecting our communication, transactions, and other online interactions from malicious actors.

Privacy and Confidentiality

People and businesses protect their privacy and keep conversations and data secret through cryptographic techniques. Cryptography scrambles messages with an algorithm and a key only the sender and receiver know, making it nearly impossible for outsiders to read the information. 

Cryptography also secures web browsing through virtual private networks (VPNs). VPNs use encrypted tunnels, complex math, and shared secret keys to keep online activity private and safe from hackers.

Authentication

Cryptography confirms identities. It verifies who sends and receives information. Cryptography helps verify a user’s identity and authenticates their access privileges where identity authentication is necessary, such as logging into an online bank account or accessing a secure network.

Integrity

Integrity is the certainty that information remained unchanged during transit between the sender and the intended recipient, or while in storage. 

Cryptography maintains information integrity by using hashing algorithms and message digests to protect data privacy. For example, digital signatures can detect forgery or tampering in software distribution and financial transactions. Cryptographic methods allow recipients to verify data integrity by providing a unique digital fingerprint for data.

Non-repudiation

Nonrepudiation is a principle in information security and cryptography that ensures the origin and integrity of data. It prevents the sender or receiver from denying actions or transactions they have performed. Nonrepudiation uses digital signatures, mathematical constructs that verify the authenticity of a message or document, to achieve its function.

Key Exchange

The key exchange involves two parties trading cryptographic keys to enable secure communication. In the key exchange scheme, each party generates a public/private key pair and distributes the public key. After obtaining an authentic copy of each other’s public keys, the parties can compute a shared secret offline. This shared secret secures subsequent communications with a symmetric key cipher. Key exchange ensures that both parties can communicate securely.

Cryptography in network security

Cryptography, the art and science of securing communication, has become indispensable in everyday transactions. Its applications span various industries, ensuring data confidentiality, integrity, and authenticity. Let’s explore the industries that benefit from cryptography.

Banking 

Every online transaction, from balance checks to fund transfers, relies on cryptography to protect account numbers, passwords, and transaction details. Digital signatures authenticate these transactions, stopping fraudsters in their tracks. Cryptographic hash functions maintain the integrity of financial records, ensuring no one tampers with them.

Ecommerce

When you enter your credit card number on an e-commerce site, cryptography scrambles your sensitive information into an indecipherable code. The data then moves across the internet through a secure tunnel protected by protocols like SSL or TLS.

Digital signatures act as electronic gatekeepers to ensure you’re shopping at the right place. They verify the website’s identity, preventing hackers from stealing your information.

Beyond these foundational protections, e-commerce platforms use advanced technologies and algorithms to scrutinize patterns and user behaviors, ensuring a secure shopping environment.

Emails

Secure/Multipurpose Internet Mail Extensions (S/MIME) provide a way to digitally sign and encrypt emails, ensuring message integrity and confidentiality. Email encryption conceals the message contents, making them unreadable as they travel from one inbox to another. Even if a hacker intercepts the messages, they won’t be able to understand the content. Email encryption is generallly acheieved via an algorithm called Pretty Good Privacy (PGP).

Cryptocurrency

Blockchain technology, the underlying infrastructure of cryptocurrencies, relies on cryptographic techniques. 

• Public and private key cryptography enables secure data transactions and ownership verification. 
• Cryptographic hash functions create unique identifiers for each block in the blockchain, ensuring data immutability in blockchain systems. 
• Consensus mechanisms like Proof-of-Work (PoW) employ cryptographic puzzles to secure blockchain networks. 

Cryptography keeps transactions safe, controls new coin creation, and confirms asset transfers to ensure only rightful owners make transactions and prevent double-spending.

Types of Cryptographic Algorithms

Cryptographic algorithms are mathematical formulas that scramble and unscramble data. People break them down into three main types:

• Secret key cryptography uses a single key to both lock and unlock data. Both the sender and receiver need the same secret key to encrypt and decrypt data.
• Public-key cryptography uses two keys: a public key for locking data and a private key for unlocking it. Anyone can use the public key, but only the owner has the private key. This means it requires a different key to encrypt and decrypt data.
• Hash functions are algorithms that turn data into a fixed-size string of characters. This output, called a hash, is unique to the input data. You can use a secure hash algorithm to verify data integrity.

Secret Key Cryptography

Secret Key Cryptography employs a single key for both encrypting and decrypting data. The key remains confidential and is shared exclusively between communicating parties. Two primary types of Secret Key Cryptography exist: Stream Ciphers and Block Ciphers.

1. Stream Ciphers

Stream Ciphers encrypt data digit by digit, often bit by bit, in a continuous flow. They excel in high-speed encryption applications. These ciphers encrypt data in real time, suit hardware implementations, and demand a unique keystream for each encryption to maintain security. Examples include RC4, once widely used but now considered insecure, and Salsa20/ChaCha, known for performance and security.

You can learn more about stream ciphers in GeeksforGeeks’ elaborate article. 

2. Block ciphers

Block Ciphers encrypt data in fixed-sized chunks. They simultaneously apply the encryption algorithm to entire plaintext blocks, making them suitable for bulk data encryption. Block Ciphers process data in chunks, operate in various modes to enhance security and efficiency and require padding for messages that don’t align with block size. Examples of block ciphers include:

• AES (Advanced Encryption Standard), the modern standard, offers robust security and efficiency.
• DES (Data Encryption Standard), an older cipher, is now considered insecure due to its short key length.
• 3DES is an enhanced version of DES for increased security.

 

Public Key Cryptography

Public key cryptography secures key exchanges, digital signatures, and encryption without a shared secret key. Both the sender and the receiver use different keys to encrypt and decrypt transmitted data. Popular public key algorithms include:

• RSA
• Elliptic Curve Cryptography (ECC)
• Digital Signature Algorithm (DSA)
• Identity-Based Encryption (IBE)
• Public Key Cryptography Standards (PKCS)
• Diffie-Hellman Key Exchange (DHKE)

1. RSA

RSA (Rivest-Shamir-Adleman) is one of the earliest public-key cryptosystems. Its strength lies in the mathematical difficulty of factoring large integers, which makes it suitable for encryption and digital signatures.

Although it’s relatively slow compared to modern encryption algorithms, RSA is primarily used for key exchange and digital signatures rather than bulk data encryption. RSA applications include secure email (such as PGP), SSL/TLS for secure web communications, and digital signatures in software distribution.

The RSA algorithm operates through three main steps: key generation, encryption, and decryption. The encryption key is public, while the decryption key remains private. RSA’s security relies on the factoring problem, which refers to the challenging task of factoring large integers. 

In recent years, there have been talks at different cryptography conferences about the future of RSA, specifically concerning quantum computing developments. During theRSA Conference 2024, specialists highlighted the importance of transitioning to post-quantum cryptography to tackle the threat of “steal now, decrypt later.” 

2. Elliptic Curve Cryptography (ECC)

At its core, ECC relies on the unique properties of elliptic curves to create secure cryptographic systems. The combination of strong security and compact key sizes has propelled ECC into a leading position in modern cryptography. Its adoption across various technologies highlights its effectiveness in safeguarding digital information.

Dedicated events like the annualWorkshop on Elliptic Curve Cryptography underscore the importance of ECC. These workshops serve as a platform for collaboration between experts and students, leading to breakthroughs in the field.

3. Digital Signature Algorithm (DSA)

The Digital Signature Algorithm (DSA) is a cryptographic tool that validates digital message authenticity. It operates on a public-key model where senders use private keys to generate digital signatures. These signatures are then attached to the message and transmitted to the recipient.

To validate the signature, the recipient utilizes the sender’s public key. DSA’s security depends on the mathematical complexity of the discrete logarithm problem, making it computationally difficult to forge signatures. DSA’s algorithm guarantees non-repudiation, preventing senders from denying message origination. Despite DSA’s prominence, key size limitations led to DSA’s replacement with more efficient algorithms like ECDSA.

DSA was once a Federal Information Processing Standard primarily used to authenticate and verify message integrity. However, according to theComputer Security Resource Center (CSRC), as of February 2023, DSA is no longer approved for digital signature generation.

4. Identity-based Encryption (IBE)

Instead of traditional certificates, Identity-Based Encryption (IBE) uses a public key derived directly from an identity, such as an email address.

The core of IBE involves four key algorithms.

• The setup algorithm generates system parameters and a master key.
• The key generation algorithm produces a private key for a specific identity.
• Encryption uses the identity as a public key to secure a message, while decryption requires the corresponding private key.

IBE’s ability to use any unique identifier as a public key simplifies data encryption and decryption. However, its reliance on a central authority to generate private keys introduces a single point of failure and trust issues.

Recent discussions at the National Institute of Standards and Technology (NIST) Workshop onPrivacy-Enhancing Cryptography (PEC) highlight the growing interest in IBE. The workshop promoted the development of reference material that can contribute to a better understanding of PEC.

5. Public Key Cryptography Standards (PKCS)

Public Key Cryptography Standards (PKCS) are guidelines developed by RSA Security to standardize public-key cryptography implementations. PKCS standards ensure interoperability and security by outlining specific procedures for cryptographic algorithms and formats.

PKCS include a broad spectrum of public-key cryptography operations. They provide detailed instructions for:

• Generating public and private key pairs
• Encrypting data with public keys
• Decrypting data with corresponding private keys
• Verifying data authenticity
• Integrity through digital signatures
• Securely managing public and private keys

The widespread adoption of PKCS has made them foundational for many cryptographic applications.

6. Diffie-Hellman and Key Exchange Algorithm (KEA)

Diffie-Hellman Key Exchange (DHKE) is a cryptographic protocol that allows two parties to establish a shared secret key over an insecure public channel. DHKE involves a series of steps.

• First, both parties agree on a large prime number and a generator. These values are public knowledge.
• Next, each party independently selects a random private number. Based on their private numbers and the agreed-upon parameters, they calculate public values, which both parties exchange openly.
• Finally, both parties use their private numbers and the exchanged public value to compute the shared secret. Symmetric encryption relies on a shared secret to establish a secure line of communication between the parties involved.

DHKE is a key exchange protocol, not an encryption algorithm. Its security relies on the impracticality of determining the private numbers from public information. While effective against passive eavesdropping, DHKE is susceptible to man-in-the-middle attacks. Therefore, additional security measures, such as authentication, are essential.

Harvard University hosts a dedicated center probing the deep connections between technology and society. The Center for Research on Computation and Society (CRCS) is exploring how cryptography, among other digital advancements, shapes our world, both positively and negatively.

Hash Function

A hash function is a cryptographic algorithm that converts data of any size into a fixed-size output, known as a hash value or digest. It takes any amount of data, like a document, photo, or password, and turns it into a short, scrambled string of characters, the hash.

The unique hash value is the digital fingerprint for the input data, enabling efficient data integrity verification and authentication. Notably, hashing is the only form of cryptography that is not encryption.

While encryption is a two-way process in which data is transformed into an unreadable format and can be reverted to its original form using a key, hashing is a one-way process in which data cannot be recovered in its initial form once it has been hashed. 

Why Are Hash Functions Used in Cybersecurity?

Hash functions are critical in cybersecurity for several reasons, and are a key element of cryptography in network security. 

When data travels, a hash function creates a unique identifier. Even the slightest change to the data completely alters this fingerprint, resulting in a change in the hash value, signaling potential tampering.

In password security, hashing algorithms convert passwords into fixed-length values stored in databases. If a hacker steals these scrambled passwords, they’re useless without the original key – the actual password. And let’s not forget digital signatures, which use hash functions to guarantee message authenticity and integrity.

Hash Function Use Cases

Hash functions find applications in various areas beyond cybersecurity. 

Data Structures

Hash tables are a popular way to store and find data quickly. They use hash functions to turn data into a number, which helps them find the right spot to store it. Data structures enhance the speed of information retrieval.

Recent advancements in machine learning have allowed researchers to develop faster and more efficient hash functions. For example, in 2023,MIT researchers created improved hash functions that significantly speed up searches in large databases, demonstrating the ongoing innovation in this field.

Blockchain Technology

Blockchain is all about trust and security. Hash functions create a unique fingerprint for each data block. This fingerprint links to the previous block’s fingerprint, making it impossible to change data without everyone knowing.

Content Addressing

Instead of using a file name to find data, you can use its hash, like finding a book by its unique barcode. It’s handy for systems that need to find data quickly and accurately.

Random Number Generation

Hash functions create pseudo numbers, which appear random but are not, which is necessary for many security tools and apps.

Types of Cryptographic Key Attacks and Risks

As with any technology, cryptography comes with its own foibles and risks. Let’s unpack those in more detail.

1. Weak Keys

Weak keys are a danger in cryptography. They expose data to attackers by providing insufficient protection. Poor algorithms can lead to weak keys by failing to generate sufficient randomness during the key generation process. The result is keys that are easier to guess or crack.

Hackers may exploit weak keys through brute force attacks, trying many combinations until they find the correct one. For example, attackers can quickly crack a 56-bit key in the Data Encryption Standard (DES) with modern computing power. Modern computers can try billions and billions of different codes every second. With a code that’s only 56 digits long, a powerful computer could guess the right one rapidly.

2. Poor Key Storage

Secure storage of cryptographic keys helps maintain the integrity and confidentiality of sensitive data. Poor key storage practices can lead to unauthorized access and potential data breaches. For instance, consider a company that stores cryptographic keys in plaintext on a server. If an attacker gains access to this server, they can easily access these keys. With these keys, the attacker can decrypt sensitive data, leading to a loss of confidentiality and potential data breaches.

3. Reuse of Keys

Usually, you have a different key for the house, the car, the office, and the lockbox. What if you had one key to access all these? If someone were to steal the key, they’d have access to all your information. The same principle applies to cryptographic keys. Reusing the same key across multiple systems amplifies vulnerabilities to compromise. A breach in one system potentially exposes all systems sharing the same key.

4. Insecure Movement of Keys

Transferring cryptographic keys through insecure channels creates vulnerabilities. Attackers can intercept these keys through man-in-the-middle attacks, compromising their integrity and enabling unauthorized access to protected data.

5. Insider Threats (User Authentication, Dual Control, and Segregation of Roles)

Insider threats originate from individuals with authorized access who intentionally or unintentionally misuse their privileges. Malicious insiders can exploit their positions to steal sensitive data, disrupt operations, or compromise key management processes.

6. Lack of Resilience

A resilient cryptographic system can withstand attacks without compromising its functionality. Inadequate response mechanisms or poorly designed systems can frequently hinder resilience. Systems lacking key revocation processes or backup keys suffer severe consequences during attacks. A resilient system takes swift action to revoke compromised or lost keys and issue new ones. Without this capability, a single compromised key prolongs system vulnerability.

7. Lack of Audit Logging

Audit logging captures all key-related activity for risk identification and response. Without audit logging, it’s tough to keep track of who’s using the keys, making it easy for attackers to go unnoticed.

8. Manual Key Management Processes

Manual key management processes introduce significant risks. Humans make mistakes that can lead to incorrect key entry or mishandling. Additionally, manually rotating and revoking keys is time-consuming, allowing attackers more opportunities to exploit vulnerabilities. Manually managing many keys is also more work, hindering scalability and increasing error probability.

How to Minimize the Risks Associated with Cryptography

Key management, storage, and transfer missteps can expose organizations to severe vulnerabilities. Below are strategies to mitigate these risks:

 

Closing Thoughts

Cryptography is a powerful tool for protecting sensitive data, and is an essential tool for nearly all businesses as the prevalence of digital data and remote work skyrocket. However, cryptography alone is not a panacea: its effectiveness relies on proper implementation by users and organizations. With cryptographers constantly developing new cryptographic solutions –  and attempting to find weaknesses in existing ones – this promises to be an exciting space in the years and decades ahead.