Introduction
I recently gave a lunch-and-learn discussing cryptography, and I figured I could convert the talk into a series of blog posts. While cryptography is a topic I enjoy learning, it is certainly not a field I am an expert in by any means. However, I feel that discussing it (verbally or written) helps me reinforce the knowledge.
At depth, cryptography can be a complicated subject matter because it can get into the weeds of mathematics and understanding abstract concepts. So, these posts will be a gentle introduction to the topic that will discuss some concepts in cryptography at a high-level.
This post will start off with a definition of cryptography, introduce some vocabulary, and wrap up with a little note about encryption. The next post will take what has been discussed here and flesh it out more.
Let's get started!
What is Cryptography, Anyway?
Cryptography is the process of protecting information and communication by obscuring its contents so it can only be read by an intended party. If the contents are to be read, there should be a guarantee about who originated the information. The mechanisms by which the information is obscured should use strong, mathematically intensive functions.
In the open internet, we can't blindly trust that our communication is safe. There is always the chance that our communication could be intercepted or forged by a malicious actor. When information is stored, it should be protected by an unwanted person from reading its contents. Cryptography can help ensure information is protected when sent between parties (in-transit) or stored (at rest).
Information security aims to address three pillars: confidentiality, integrity, and availability. These make up the CIA triad of security. In cryptography, while confidentiality and integrity are relevant, availability is not a concern. However, we do care about verifying where information came from.
Therefore, cryptography should address the following CIA triad:
- Confidentiality: Information cannot be read by unauthorized parties.
- Integrity: Data is not tampered with during transmission. It is complete.
- Authenticity: Only the sender could have sent the message.
Introducing Some Vocabulary
Before diving in, let's introduce some vocabulary and provide some definitions.
- Encrypt: Converting something readable into an unreadable form.
- Decrypt: Converting something unreadable into a readable form
- Plaintext: Ordinary, readable text before encryption and after decryption
- Ciphertext: Unreadable text that is output of encryption and input to decryption
- Hashing: One-way conversion of a plaintext to a ciphertext. This should not be able to convert back to plaintext.
Cryptographic Cast of Characters
If you come across literature concerning cryptography, sometimes example scenarios are provided to explain a concept. These examples probably involve characters named Alice, Bob, Eve, Mallory, etc. Alice and Bob are innocent actors while Eve and Mallory are typically malicious actors. For more information on these characters, feel free to check out this Wikipedia article on Alice and Bob.
Encryption
Encryption is the act of converting something readable into an unreadable form. Decryption is the act of converting something unreadable into a readable form. Information is encrypted using a key and decrypted using a key. The keys do not need to be the same.
The main types of encryption include:
- Symmetric Encryption: The same key is used to encrypt and decrypt a message (secret key)
- Asymmetric Encryption: A public key is used to encrypt a message and a private key is used to decrypt a message. Also known as public key encryption
- Hybrid Encryption: A blend of symmetric and asymmetric encryption.
Initialization Vectors
So far, we've discussed a key and plaintext as input to encryption. If a plaintext is encrypted twice with the same key, is the resulting ciphertext the same? From what we have, the resulting ciphertext would be the same. This can be a bad thing. If an attacker knows the encryption of plaintext A produces ciphertext B, any time they see B they can infer that A was input. This would violate confidentiality.
Another component is needed to maintain confidentiality of encryption – an initialization vector (IV). The IV should be unpredictable / random and generated prior to any message encryption. Even if the plaintext and key are the same, a unique random IV will guarantee each resulting ciphertext will be different. The IV is usually appended at the start of the ciphertext and is used as input to decryption. It does not need to be secret.
Randomness is one of the most crucial parts of cryptography, especially for IVs. It is also near impossible to produce a truly random value – how do you produce a truly random number? I won't go into detail for this post about randomness (this post goes into good detail). IVs should be seeded using a secure random number generator.
Bits and Bytes
Nearly everything in cryptography is expressed in bits and bytes. Some encryption schemes (ciphers) work from fixed-length groups of bits called blocks. As you come across different algorithms, keys/blocks may require different bit sizes (256-bit / 512-bits).
While key length does not imply security, some encryption algorithms have been proven to be weak when key size is small (see here). A larger key size can decrease performance. When choosing an encryption algorithm, always research its implementation, what key sizes are recommended, and whether it's still considered secure. As computers get faster, encryption with smaller key sizes can be "broken" more quickly.
Summary & Up Next
A lot of material has been covered so far!
The next post in this series will take a look at symmetric and asymmetric encryption, understand what they are, how they could be applied, and what their limitations are. It will also dive into hashing and explain its usage. The post will conclude with how encryption and hashing could be used to fulfill the CIA triad of cryptography.
Thank you!
Part 2
Part 2 of this post is now available! Link to the next article: here
Latest comments (0)