Cryptography

Cryptography protects information by transforming it so only intended parties can read or verify it. It provides confidentiality, integrity, authentication and non-repudiation.

Basic terms

• Plaintext: readable data before encryption.
• Ciphertext: encrypted, unreadable data.
• Cipher: the algorithm used to encrypt and decrypt.
• Key: the secret value that controls the cipher.
• Key space: the number of possible keys; larger key spaces resist brute force.

Symmetric encryption

One shared secret key encrypts and decrypts. Fast, so it is used for bulk data; the challenge is distributing the key securely.

• Block cipher: encrypts fixed-size blocks (AES uses 128-bit blocks).
• Stream cipher: encrypts data one bit or byte at a time.

Asymmetric encryption

A key pair: the public key can be shared, the private key is kept secret. Data encrypted with one key can only be decrypted with the other. Slower than symmetric encryption, so it is mainly used for key exchange and digital signatures.

• RSA: based on the difficulty of factoring large numbers; common key sizes 2048 and 4096 bits.
• ECC: elliptic curve cryptography; equal security with much shorter keys than RSA.
• Diffie-Hellman: lets two parties agree a shared secret over an untrusted channel.
• DSA / ECDSA: algorithms for digital signatures.

Hashing

A hash function turns input of any size into a fixed-size digest. It is one-way, and a tiny change in input changes the whole digest.

• Collision: two different inputs producing the same digest.
• Salt: random data added to a password before hashing, so identical passwords give different hashes and precomputed tables are useless.
• HMAC: a hash combined with a secret key, proving both integrity and authenticity.

Digital signatures

The sender hashes the message and encrypts the hash with their private key. Anyone can verify it with the sender's public key. A valid signature proves integrity, authenticity and non-repudiation.

Public key infrastructure (PKI)

• Certificate authority (CA): a trusted party that issues and signs digital certificates.
• Registration authority (RA): verifies identities before the CA issues a certificate.
• Digital certificate (X.509): binds a public key to an identity, signed by a CA.
• Certificate revocation list (CRL): a list of certificates revoked before expiry.
• OCSP: Online Certificate Status Protocol, a real-time check of a certificate's status.
• Chain of trust: a certificate is trusted because it was signed by an intermediate, signed in turn by a trusted root CA.

Encryption in practice

• TLS: secures web and other traffic; uses asymmetric cryptography to agree keys, then symmetric encryption for the data.
• Full disk encryption: protects data on lost or stolen devices (e.g. BitLocker, LUKS).
• Email encryption: S/MIME and PGP sign and encrypt messages.
• VPN protocols: IPsec and WireGuard encrypt traffic between networks or devices.

Cryptographic attacks to know

• Brute-force attack: trying every possible key; defeated by long keys.
• Birthday attack: exploits the probability of hash collisions; defeated by longer digests.
• Downgrade attack: forcing a connection to use weaker, older encryption; prevented by disabling old protocol versions.
• Known-plaintext attack: the attacker has some plaintext and its ciphertext and tries to deduce the key.
• Side-channel attack: learns keys from timing, power use or emissions rather than the algorithm itself.

Good practice

Use well-reviewed standard algorithms (AES, SHA-2, RSA 2048+ or ECC), never home-made ciphers. Protect and rotate keys, store them in hardware security modules or key vaults where possible, and disable obsolete protocols such as SSL and TLS 1.0/1.1.