Modern Cryptography

Why We Need Cryptography

The answer is in the CIA triad: confidentiality, integrity and availability. There's a direct correlation between cryptography and confidentiality, that is, we encrypt things to make them confidential. There is also a direct correlation between cryptography and integrity, that is, there are things that we can do from a cryptography standpoint, like using hashing algorithms, to make sure that we're maintaining integrity.

The correlation between cryptography and availability isn't quite as apparent and clear, but you could just open up your network and hackers will come in and make things unavailable. We need to secure things down, and one of the ways we do that is by securing our passwords with cryptography, and other things with cryptography. So there is definitely a correlation with that as well.

There's a couple of reasons why we should probably add to the list, and that is authenticity and non-repudiation. One thing to note is that all five of these are sometimes referred to as the pillars of cyber security, and there's a lot of references that go beyond just the security triad and include authenticity and non-repudiation on equal grounds with that, where others may group these into integrity. That's one of the reasons why they're off to the side here. We do need to make sure we address that, and it's part of the things that we consider when it comes to cryptography.

I will add actually one more, authentication. But authentication really plays into all of these elements here, because it's going to keep things confidential, keep integrity, keep availability. It really plays into all of these aspects.

Integrity, Authenticity and Non-Repudiation

So what is the difference between integrity, authenticity and non-repudiation?

Integrity means nothing has changed. So if Susan's sending a message to David, nothing has changed along the way, there's no one that has intercepted this, made an alteration to the message and then sent it off to David.

Authenticity is, is the sender valid? When David receives this message it says that it's from Susan. Is it authentic though? Is there authenticity there? Did it actually come from Susan?

And then non-repudiation, that's the idea that Susan can't deny sending this message, that there's some sort of record that she is the one that sent that message, and David can't deny receiving that message and accessing the data.

How Cryptography Works

It works through an algorithm. An algorithm is a process that plaintext goes through to create ciphertext. It's a process and a calculation to spit the ciphertext out on the other side. An example that I gave earlier was something like the Caesar cipher, in which we converted secret into another message.

Algorithms Versus Protocols

There can be some confusion between algorithms and protocols, so I want to address the differences.

An algorithm is a specific sequence of instructions or procedures, calculations, that something will go through, and it's really meant to solve a specific problem. So it's rules, procedures and standards that things will go through, and then you have some sort of input and it'll have an output on the other side.

Versus a protocol, which is more standardized sets of rules for communication. It defines rules, syntax, semantics, synchronization. It will even define physical characteristics like how the connections go together, the coding and signaling that happen on each side, what both sides of this communication should be expecting and what format that should be in. So it's standardizations for communication.

One important thing to note is a lot of times we'll use algorithms for protocols. Protocols will use different algorithms to carry out their function, to carry out this communication. As an example of this, maybe we have a protocol that is communicating between two devices and we want to do it securely. Within that protocol we're going to choose some sort of cipher or some sort of encryption algorithm that we're going to use to secure that communication. So we would choose an algorithm to use within that protocol to carry out its functions securely.

Some of these protocols we actually choose multiple algorithms for. For IPsec we actually have a lot of different ways we can assemble and choose different encryption algorithms, different ciphers, for different components. So this is an example of how we would assemble something together to meet our needs, or meet the needs of the current industry.

Types of Cryptography

We can break down cryptography into different types. Cryptography can be broken down at a high level into hashing and encryption. Hashing is when we create some sort of fingerprint of a program, a file, a password, something to that effect, but you can't reverse this process. It's not like encryption where you can then decrypt it.

Encryption works differently. Encryption can be broken down into two different types: symmetric keys and asymmetric keys. Symmetric keys mean that both the sender and the receiver are using the same key back and forth, versus asymmetric means that they both have different keys. And then from the symmetric key standpoint we can break that down into a stream cipher or block cipher.

Here's a couple of examples for each one of these categories:

• Hashing has MD5 and SHA.
• Symmetric key encryption has both DES and AES.
• Asymmetric keys has both Diffie-Hellman and RSA.

There are of course other examples, but these are some of the most prominent ones.