Security Technology

Cryptography

Large amount of private information are stored on computers and transmitted between computers
today, including account passwords, trade secrets, and personal financial information. In order to
hide information from third parties who wants illegal access to it by reason of stealing, sabotage,
and other malicious intent cryptographic techniques must be applied, making it difficult or
impossible to recover the original data for anyone but the intended recipient.

Objective
- To provide students basics on cryptography, what its purpose, how it works, and some
basic examples on how it is applied
- To show some basic cryptographic techniques such as the Caesar cipher and alike.

Cryptography
Cryptography is the study of encryption and decryption of messages. The principle of encoding
message is to ensure that only the intended receiver understands the message. Thus, when
encoding a message, it is important to define a consistent “cipher”, which is known by the
recipient beforehand. A “cipher” determines how the message is encrypted.

 Comes from Greek

 Kryptos meaning “hidden”
 Grahein meaning “to write”
 Process of making and using codes to secure the transmission of information

Cryptanalysis
 Process of obtaining the original message form encrypted message

Encryption
 Process of converting an original message into a form that is unreadable to unauthorized
individuals
Decryption
 Process of converting the encrypted message (cipertext) into an easily read message
(plain text

* Cipher text is usually transmitted without spacing or punctuation to avoid errors and hide word
boundaries or grouping.
* Encryption is a two-way function. You encrypt information with the intention of decrypting it
later. So, correspondence with someone online, protecting your cloud data or transmitting
financial data are all examples of times when encryption is appropriate.

Key terms
Algorithm
- Programmatic steps to encrypt message
Cipher
- Encryption method or process
Ciphertext or cryptogram-
- Encrypted message
Code
 - Process of converting unencrypted components into encrypted components
Decipher
- Convert to plaintext
Encipher
- To encrypt
Key or crypto-variable
- Information used with the algorithm to encrypt
Key-space
- Entire range of values that can possibly be used to construct an individual key
Link encryption
- Series of encryptions /decryptions between a number of systems
Plaintext or clear text
- The original message
Steganography
- Process of hiding messages
Work factor
- Amount - effort required to perform cryptanalysis

Cipher Methods
Bit stream method
- Each bit in the plaintext is transformed bit by bit
- Most common use XOR
Block cipher method
- Messaged divided into blocks
- Each block is encoded
- Substitution, transposition, XOR or combination
o Substitution Cipher
- Substitute one value for another
- 3 character substitution to the right
 Original alphabet:

ABCDEFGHIJKLMNOPQRSTUVWXYZ

Encrypted alphabet:

DEFGHIJKLMNOPQRSTUVWXYZABC

- Simple by itself – powerful when combined with other operations

https://www.youtube.com/watch?v=o6TPx1Co_wg&ab_channel=LaceyWright
Examples: polyalphbetic cipher

o Transposition Cipher
- Simply rearranges the values within a block
- Can be done at the bit level or the byte level
- Julius Caesar was associated with the early version of this cipher also
- Larger blocks or keys makes cipher stronger
- Transposition Ciphers can be words written backwards for example (you are
cool)=(uoy era looc). It could also be every pair or every 3 letters a pair of
letters are swapped. An example of that would be (you are cool)=(oya uer oclo)
 https://www.youtube.com/watch?v=sHsnH1u03e4&ab_channel=Mathispower4u

o Exclusive OR (XOR)
- Function of Boolean algebra
- Two bits are compared
- If identical, result is binary 0
- If not identical, result is binary 1
- Very simple encryption
- Not very secure

https://www.youtube.com/watch?v=pvII6_O6KAc&ab_channel=ComputerScience
Different types of ciphers
 Shift Ciphers – Like the example we discussed above, two parties determine a number
between 1-25, and shift the letters that number of spaces in the alphabet. The shift
number serves as the key.
 Substitution Ciphers – These ciphers replace plaintext with cipher text using an algorithm
that is a fixed system. The key is the document that shows the fixed system, which can be
used to reverse engineer the encryption.
 Transposition Ciphers – This algorithm uses a set of rules, which serve as the key, to
change the order of the text into a different permutations that can then be encrypted.
Common examples are Rail Fence and Route ciphers.
 Polyalphabetic Ciphers – These are a type of substitution cipher that use multiple
alphabets to further complicate unauthorized decryption of the ciphertext.
 Nomenclator ciphers – A type of substitution cipher that replaces common plaintext
words with symbols to try and throw off a specific form of cryptanalysis.

* Cryptanalysis is the study of cryptosystems with intention of finding weaknesses in them. One
of the most common forms of cryptanalysis, that dates back to an Arab mathematician named Al-
Kindi who lived around 800 AD, is called frequency analysis. It examines the cipher text for
repetitive symbols or strings of characters and cross references them with words that would
appear with a high frequency in the message that’s being decrypted.
* Polyalphabetic ciphers and nomenclator ciphers were better suited to withstand frequency
analysis than their classical counterparts.
* Polyalphabetic ciphers continued to be used until World War II when the Enigma machine
was cracked.

Encryption forms
 Asymmetric Encryption – This is the Public Key example we just gave. One key
encrypts, the other key decrypts. The encryption only goes one way. This is the concept
that forms the foundation for PKI (public key infrastructure), which is the trust model
that undergirds SSL/TLS.

 Symmetric Encryption – This is closer to a form of private key encryption. Each party
has its own key that can both encrypt and decrypt. As we discussed in the example above,
 after the asymmetric encryption that occurs in the SSL handshake, the browser and server
communicate using the symmetric session key that is passed along

Modern Encryption Algorithm

- AES stands for Advanced Encryption Standard, originally called Rijndael, it’s the
specification for encryption published by the National Institute for Standards and
Technology (NIST) back in 2001. It puts plaintext through a number of
“transformation rounds” determined by key size, each round consists of several
processing steps. Let’s not stray too far into the weeds on this one. AES is a common
algorithm with SSL/TLS. It replaced the Data Encryption Standard (DES) that was
created in 1977.

- RSA stands for Rivest-Shamir-Adlemen, after its creators, it is a public key

encryption algorithm (asymmetric) that has been around since 1978 and is still widely
used today. It uses the factorization of prime numbers to encipher plaintext.

- [Fun Fact: The unfortunately named Clifford Cocks, a mathematician employed by

the GCHQ, a British intelligence agency, invented an equivalent system five years
earlier, in 1973, but it wasn’t declassified until 1997.]

- ECC stands for Elliptic Curve Cryptography, which relies on the algebraic
structure of elliptical curves over finite fields. Although ECC has been around since
1985, it’s only been in use since about 2004. ECC has distinct advantages over RSA
and is likely going to play a more prominent role in the future of SSL/TLS.

- PGP stands for Pretty Good Privacy, it was created in 1991 by Phil Zimmerman.
It’s really more of a collection of algorithms than a single one, all for hashing, data
compression and both public and private key cryptography. Each step uses a different
algorithm. PGP has been criticized for poor usability, a lack of ubiquity and for the
length of its keys.
SYMMETRIC ASYMMETRIC
said to be the simplest and best-known relatively new as compared to symmetric
encryption technique encryption, and is also referred to as public-
key cryptography
uses one key for both encryption and considered more secure since it uses two keys
decryption
When a message is encrypted using a public
key, it can only be decrypted using a private
key. However, when a message is encrypted
using a private key, it can be decrypted using
a public key.
use less complex algorithm which executes It’s used in smaller transactions, primarily to
faster, commonly used for data bulk authenticate and establish a secure
 transmission communication channel prior to the actual
data transfer
Widely used symmetric encryption algorithms Common asymmetric encryption techniques
include AES (Advanced Encryption include RSA (Rivest–Shamir–Adleman),
Standards) such as AES-128, AES-192, and DSA (Digital Signature Algorithm), and
AES-256 PKCS (Public Key Cryptography Standards)
The length of the keys used is typically 128 or The length of the keys is much larger, e.g., the
256 bits, based on the security requirement. recommended RSA key size is 2048 bits or
higher.
* Both of the cryptosystems have their own pros and cons, asymmetric encryption is a better
choice from the security perspective.