Principles of Cryptography
Last updated
Last updated
Security professionals must have an adequate understanding of cryptography and how to properly use it. The following definitions will aid you in understanding key concepts for this lesson:
We typically use encryption to ensure our files and communication channels are secure from eavesdroppers. An excellent example of using crypto in everyday life is navigating to a website using SSL/TLS encryption. For example, if we navigate to
https://www.cyberdefensetrainingacademy.org
in the Firefox web browser, we will notice the green lock showing that the website uses encryption between your computer and the webserver. You may also notice the use of
https://
instead of
http://
on the beginning of the URL. This denotes a secured HTTP connection. If we do a little more investigation by clicking on the green lock, we can check out the certificate information, expiration, etc. But this is for a later lesson.
Cryptographic hashing has been used for years by law enforcement. Hashing ensures digital evidence does not change as it moves through the chain of custody from the point of seizure to forensics labs for analysis. Without the verifcation of integrity provided by cryptographic hashing, digital evidence could be challenged and found inadmissible in a court of law. Coaches and participants in the CyberPatriot competition also use the MD5 or SHA1 hashing algorithm to verify downloaded competition images. File hashes are commonly referred to as file "fingerprints" due to their unique nature.
For example, we downloaded a file called CP_image.zip from a website on the Internet. On their website, they post the MD5 for this file as d577273ff885c3f84dadb8578bb41399. Using a Linux system, we can use the openssl application to generate the MD5 hash for this file. Take a look at the following command line output:
As you can see, our compiled MD5 hash matches what was posted on the website. This is how we can verify the integrity of our files.
Since ancient times, military commanders and heads of nations have used some sort of cryptography to secure their messages from their adversaries. The earliest accounts of cryptography used a method called a transposition cipher where letters were moved to different positions in the message. For example, our message is
A SIMPLE MESSAGE
Take a look at Crypto Corner's example of transposition ciphers. Toward the bottom of the page are examples of how to encipher plaintext of your choosing.
Using a transposition cipher, we would swap each letters position to scramble the message. The issue with this type of cipher is that single letter pieces of the message are left unchanged making this message easy to decrypt. Later, the substitution cipher was developed to ensure that all aspects of the message becomes enciphered. Earliest accounts of the substitution cipher were used during the times of Julius Caesar where he would shift the letters based on a key. For instance, looking at the English alphabet
If we used a shift key of 2, we would take a letter of our message, shift down two letters, then replace that letter with the new value. If the letter was A, after the shift the new enciphered letter would be C. Let's take our message from the last example and use a shift key of 2 to encipher the message. After the enciphering, we get the following result:
Take a look at Crypto Corner's example of substitution ciphers and encipher your own plaintext messages.
Steganography is the art of hiding messages in plain sight. It is not considered an implementation of cryptography; however, it can be a clever way to hide messages. As an example, in ancient times, some would tattoo messages on a person's head and have them regrow their hair before sending them to the message's recipient. Later, invisible ink, microdots, etc. were used to hide messages in plain sight.
During World War II, Germany realized the importance of encrypting messages before transmission. German engineer Arthur Scherbius developed a way to encipher these messages using a complex machine called the Enigma.
What the Germans quickly realized was that making the cipher [the Enigma] a secret and hoping it would never end up in enemy hands was a grave mistake. During the late 1930's, Allied Forces were able to acquire an Enigma device. The British scientist Alan Turing, known as the "father of modern computing," along with other scientists, were able to cryptanalyze the device and attack Enigma-encrypted messages.
Image courtesy of Wikipedia
Most modern cryptography relies on a key remaining the secret and the cipher a known algorithm. Standards like the Advanced Encryption Standard (AES), the replacement to the Digital Encryption Standard (DES), have been developed and published to the community for review. The two main classes of modern cryptography are symmetric and asymmetric cryptography.
Symmetric cryptography, also known as secret key cryptography, uses a pre-shared key for its operation. A user will generate their secret key and use a cipher to encrypt their message. It is important to remember that a new key must be generated for each communication channel. For example, the picture above shows Alice communicating with Bob using channel keyed with Key 1. She also attempts to communicate with Charlie, but instead of using the key she used with Bob, she generates a new one (Key 2). This is to ensure that her communication with Bob cannot be decrypted by Charlie or anyone else other than Bob.
As a common practice, the ciphertext will be transmitted to the recipient and the secret key shared outside of the original communications channel. For example, we would send the message over the Internet, then call the recipient on the telephone and tell them the key. Otherwise, if an eavesdropper were able to capture both, they could decrypt the message.
The following image is an example of symmetric key cryptography. Here we use the secret key for both the encryption and decryption operations.
Symmetric cryptography is designed for fast encryption and decryption operations on large sets of data. Typical uses for symmetric crypto include:
Full disk encryption (data at rest)
File encryption
Securing communication channels
Examples of symmetric cryptographic algorithms include:
DES (never use this!!!)
AES
RC4
Asymmetric cryptography, also known as public key cryptography, uses two keys for its encryption and decryption operations. A private key is generated and typically secured by the user. A public key is generated along with the private, but typically distributed to an individual or group of individuals.
Let's use Alice and Bob for another example. Both Alice and Bob generate their key pairs, secure their private keys, and publish their public key to a server on the Internet. Alice is looking to send an encrypted message to Bob and will do the following:
Retrieve Bob's public key from the Internet
Encrypt her message with Bob's public key
Send the encrypted message to Bob
From here Bob will do the following:
Find his private key
Decrypt Alice's message with his private key
Read the decrypted message
If Bob wanted to reply to Alice, he would: retrieve Alice's public key, encrypt the message with her key, and send his encrypted message. Alice would use her private key to decrypt and read the message. The following is an example of asymmetric key cryptography using public and private key pairs.
Asymmetric cryptography is typically used for smaller datasets like email or to secure symmetric cryptography keys for transmission across the Internet. You will learn more about this in later lessons.
Examples of asymmetric cryptographic algorithms include:
RSA
DSA
There comes a time when we might not want the overhead of encrypting and decrypting a message, but want to ensure its integrity during transmission. In some cases we may also need a way to validate the data's author. For this we can use asymmetric cryptography to digitally sign the data.
As mentioned in a previous section, we typically use cryptographic hashes to ensure the integrity of the file. The same applies to our messages. Using Alice as an example, she creates a program called alicerocks.exe. She generates the following MD5 hash:
We can download Alice's program and generate our own hash for verification. But how do we know that Alice was the one that wrote the program? To show ownership, Alice will use her private key to encrypt the cryptographic hash of her program. She then posts her program along with its digital signature
Bob downloads both the program and digital signature from the Internet. To verify that Alice was the original author, he:
Retrieves Alice's public key from the Internet
Decrypts the digital signature to retrieve the file hash
Generates a hash of alicerocks.exe
Compares the generated hash to the digital signatures hash
If the hashes match, Bob can verify that Alice was the author and continue to use the program...if he trusts her.
Term
Definition
Cryptography
is the practice and study of techniques for secure communication in the presence of third parties called adversaries. [Wikipedia]
Cryptanalysis
is the study of analyzing information systems in order to study the hidden aspects of the systems. Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages, even if the cryptographic key is unknown. [Wikipedia]
Cipher
an established technique to hide or disguise a message; a code
Key
a predetermined secret used to secure a message
Plaintext
a message in its original readable format
Ciphertext
a message in a coded form
Encrypt
the process of using a key and cipher to convert plaintext into ciphertext
Decrypt
the process of using a key and cipher to convert ciphertext into plaintext
