Making Sense Of Cryptography

Article Title | Article Author Voice of Information Security
ISSA The Global ISSA Journal | October 2006

Making Sense of
Cryptography
By Mark J. House

The very word cryptography can send shivers down the spines of technology folks, new and
experienced alike. My objective is to simplify the topic of cryptography in a way that makes
it easier for new IT junkies and experienced tech gurus alike to understand.

T he very word cryptography can send shivers down the
spines of technology folks, new and experienced alike. I
have had to spend more hours learning this subject than
any other technical domain in my career. So my hopeful objective in
writing this article is to simplify the topic of cryptography in a way
from unauthorized disclosure, or risk legal consequences. There are
specific information security requirements that come into play when
we need to protect data. As one of its most basic goals cryptography
must address these requirements, which include:
• Confidentiality – When we want to conceal personal or
that makes it easier for new IT junkies and experienced tech gurus private information
alike to understand.
• Integrity – When we want to assure that the message has
Let’s begin by saying that cryptography is the science of mathematics not been altered from its original format
and computers coming together to develop ways in which to scramble
• Authentication – When we want to prove the sender’s
computer data into secret code. Cryptography is an ancient art, and
identity
some experts have theorized that it dates back some 4000 years.
Uses for cryptography in earlier times included communicating • Non-repudiation – When we want to prove that the sender
diplomatic missives and wartime battle plans and strategies. really sent the message
Since the advent of computer communications in modern times,
cryptography has advanced to new levels and has become a common Cryptographic tools
tool for use in the private sector and government sector. In data The past few decades have seen the creation of cryptographic tools
and telecommunications, cryptography is used when you need to that apply cryptography to data in different ways. Combinations of
communicate or store data in such a way that no one else is able to these tools are used in some cases to achieve a particular desired result.
read it. When someone can make sense out of our data, the data Furthermore, the data we wish to protect may be in transit or may be
becomes information, and it is this information that has value. This stored. The cryptographic tool needs to be selected accordingly.
valuable information can then become the target of theft or other
Three basic cryptographic tools make up the heart of high-tech
malicious acts. For instance, the number 14378 by itself doesn’t
implementations of cryptography:
mean much. When this number is combined with other data,
such as a bank account number and bank routing number, it could • Encryption
reference the account balance. Having these pieces of data together • Digital signatures
as information makes the data much more susceptible to malicious
acts. For this reason, we need to find ways to protect our data so • Hash functions
others cannot read it without our permission. The tool selection for a particular use should be based on a number
But protecting our data is not only a good idea. In many parts of different factors. If high security is required, one rigorous tool
of the United States and around the world, it is becoming or has might be selected. However, if computing and processing power is
become law that businesses must protect consumer information limited, then one might have to trade off high security for a better-
performing cryptographic tool.

34

Making Sense of Cryptography | Mark J. House ISSA Journal | October 2006

1. Ciphers based on symmetric techniques
Encryption
Encryption is the process of making information unreadable, thus 2. Ciphers based on asymmetric techniques
providing confidentiality. In the 1970s encryption shifted from Symmetric ciphers, also known as symmetric algorithms, use the
primary use by the government to use as a public tool for scrambling same key for encrypting and decrypting information. Asymmetric
digital computer information. Not all information needs to be ciphers, on the other hand, normally use two different, but related
encrypted, however. Only sensitive information that should not be keys, one to encrypt and one to decrypt the information. Symmetric
read by others needs to be encrypted to preserve its confidentiality. key algorithms are sometimes called “private key
cryptography” while asymmetric key algorithms
Symmetric (Private) Key Exchange are called “public key cryptography.”
John Sends Message to Bob Bob Receives John’s Message Symmetric key ciphers
Symmetric key algorithms are a class of algorithm
Cum sociis natoque penatibus et Cum sociis natoque penatibus et
magnis dis parturient montes, magnis dis parturient montes,
nascetur ridiculus mus. Donec porta, PQrKK4kbNmqB+X/SHW PQrKK4kbNmqB+X/SHW nascetur ridiculus mus. Donec porta,
enim et pharetra lobortis, libero tellus enim et pharetra lobortis, libero tellus
Bi1peZwIDAQAB Bi1peZwIDAQAB
Internet/
that uses a key for encryption and decryption that
scelerisque ipsum, facilisis scelerisque ipsum, facilisis
ullamcorper ante sem venenatis leo. AoGBAKI1WhCgGHe1vK AoGBAKI1WhCgGHe1vK ullamcorper ante sem venenatis leo.
Curabitur eget nibh id tellus Encrypt using Decrypt Curabitur eget nibh id tellus
accumsan faucibus. Ut massa augue,
SYMMETRIC
ndOD9tZxYYFfd6bqW6D Intranet ndOD9tZxYYFfd6bqW6D
Using The
accumsan faucibus. Ut massa augue,
malesuada a, pharetrparturient GqcZtWKkDCzqwLstspT9 GqcZtWKkDCzqwLstspT9 malesuada a, pharetrparturient
montes, nascetur ridiculus mus.
Donec porta, enim et pharetra
lobortis, libero tellus scelerisque
ipsum, facilisis ullamcorper ante sem
KEY BUoskTI
jWjC5EVAeE4uyGQ9BZP1
BUoskTI
jWjC5EVAeE4uyGQ9BZP1
SAME KEY is trivially related, if not identical. Symmetric key
montes, nascetur ridiculus mus.
Donec porta, enim et pharetra
lobortis, libero tellus scelerisque
ipsum, facilisis ullamcorper ante sem

ciphers can be broken down into “stream ciphers”
venenatis leo. Curabitur eget nibh id H5xIKfFXc4YQ2jqjQI H5xIKfFXc4YQ2jqjQI venenatis leo. Curabitur eget nibh id
tellus accumsan faucibus. Ut massa tellus accumsan faucibus. Ut massa
augue, malesuada a, pharetr augue, malesuada a, pharetr

and “block ciphers.” Stream ciphers encrypt the bits
Figure 1. Symmetric (private) key exchange of a message one bit at a time in what can be called
a stream. Block ciphers take a particular number of
Encrypted information is called “ciphertext,” while unencrypted bits and encrypt them as a single unit. For instance, the Advanced
information is called “plaintext.” Encryption Standard (AES) encrypts data in 128-bit blocks.
So what is the underlying tool that makes encryption work? The Symmetric key ciphers are usually much less computationally
answer is the cipher. A cipher, or an algorithm, is a well-defined, intensive than asymmetric key ciphers. This means that in a real-
detailed sequence of actions which, when performed, accomplishes a world deployment, an asymmetric key cipher is much slower to
specific task – that task being either to encrypt or decrypt information. process than a symmetric key cipher. However, a disadvantage of the
Ciphers are usually very complex mathematical computations that symmetric key is that it uses the same shared key for encryption and
produce a predictable result. This predictable result cannot be read decryption, and over time that key can be cracked. For this reason,
or decoded by anyone not holding a decryption key. frequent forced key changes are recommended to keep the keys
secure. Some examples of symmetric key ciphers are DES, Triple
When a cipher, or algorithm, applies its complex mathematical DES, RC2, RC4, AES, Twofish, Blowfish, and IDEA.

Asymmetric (Public) Key Encryption
John Bob
When a signature needs to be verified, a public
PQrKK4kbNmqB+X/SHWB key is used that is mathematically related to,
Hey, Bob, how about
but not the same as, the private key.
i1peZwIDAQABAoGBAKI1
lunch at McDonalds? Encrypt with WhCgGHe1vKndOD9tZxY
I hear they have Public Key YFfd6bqW6DGqcZtWKkD
free refills. CzqwLstspT9BUoskTIjWjC
5EVAeE4uyGQ9BZP1H5xI

Symmetric cipher key lengths
PQrKK4kbNmqB+X/SHWB You can think of the cryptographic key as a character string similar
i1peZwIDAQABAoGBAKI1 Hey, Bob, how about
WhCgGHe1vKndOD9tZxY Decrypt with lunch at McDonalds? to a password, used to encrypt and decrypt data. The key controls
YFfd6bqW6DGqcZtWKkD Private Key I hear they have the transformation process of the data by the algorithm, and there
CzqwLstspT9BUoskTIjWjC
5EVAeE4uyGQ9BZP1H5xI
free refills. are a variety of key sizes from which to choose. For many years the
standard key size was 40 bits, but today this key length provides little,
Figure 2. Asymmetric (public) key encryption if any, protection. Some experts now recommend a minimum key
size of 80 bits for strong security, although others suggest a minimum
of 128 bits. The National Institute of Standards and Technology
equation to information, the results produced appear to be random
(NIST) has recommended the phase-out of 80-bit encryption by the
numbers and characters that make no sense. For instance, the
year 2010.
data “123 Main Street” might become “gw&%4dot96” after being
encrypted. To you and me, 123 Main Street makes much more sense One of the first widely deployed symmetric keys, Data Encryption
than the gw&%4dot96 outputted by the algorithm. The scrambled Standard (DES), was released in 1977. The DES key was a 56-bit
data by itself is essentially useless to anyone that does not hold a key key length and considered strong at that time. However, by the 1990s
capable of decrypting the data and putting it back into its initial the 56-bit key could be cracked easily in only a short time, due to
format. By making information unintelligible, encryption provides advances in computing processing power. Other encryption keys in
confidentiality. use today include the National Security Agency’s (NSA) Skipjack
algorithm, which uses an 80-bit key; and one of the most popular
Symmetric vs. asymmetric ciphers (algorithms) keys, Triple DES, which has 112 bits of security with 168-bit keys.
The Advanced Encryption Standard (AES) released in 2001 uses a
Ciphers belong to one of two main categories:
minimum key size of 128 bits, but is capable of using keys of up to

35


256 bits. The US Government requires the use of AES keys of 192 to Algorithm (DSA), developed by the NSA and used to generate and
256 bits for encrypting top-secret data. verify digital signatures. When a signature is generated, the private
The decision of which key size to use for a particular purpose is key is used. When a signature needs to be verified, a public key
usually based on both how much security you require and the is used that is mathematically related to, but not the same as, the
processing power of the device, or devices, performing the encryption private key.
process. To generate a digital signature on a message, the owner first
applies the Secure Hash Algorithm (SHA) to the original message.
Asymmetric key ciphers This results in a “message digest.” The owner then applies his or
Asymmetric key ciphers, also known as public-key exchange her private key to the message digest. The DSA’s mathematical
algorithms, were first developed conceptually by Martin Hellman techniques produce a digital signature. This digital signature is sent
and Whitfield Diffie in the mid-1970s, and then expanded upon by to the intended recipient.
Ron Rivest, Adi Shamir and Leonard Adleman (RSA). The receiver of the message then uses the message sender’s public
The Diffie-Hellman public-key exchange protocol proposed one key to decrypt the message and verify its integrity using the DSA
key to encrypt, and a mathematically related second key to decrypt. verify operation. If the signature verifies, the receiver can be sure the
One key was called “public” and the other “private.” Together they message is from who it’s supposed to be from, and that it has not
provided a way of encrypting and decrypting data between two users been changed. This same DSA can also be used to prove to a third
without the need for sharing the same key. This research resulted in party that the message was actually signed by the generator of the
what is known today as the Diffie-Hellman key-exchange protocol. message. This is called “non-repudiation.”
In this type of cryptographic system, essentially the first key locks the Digital Signatures
lock and the second key unlocks it.
Protocols that use asymmetric key ciphers are IKE (Internet key
Cum sociis natoque penatibus et magnis dis
parturient montes, nascetur ridiculus mus. Donec
porta, enim et pharetra lobortis, libero tellus
scelerisque ipsum, facilisis ullamcorper ante sem

exchange), SSL (Secure Socket Layer), PGP (Pretty Good Privacy),
venenatis leo. Curabitur eget nibh id tellus accumsan
faucibus. Ut massa augue, malesuada a,
pharetrparturient montes, nascetur ridiculus mus.
Donec porta, enim et pharetra lobortis, libero tellus

SSH (Secure Shell), GPG (GNU Privacy Guard) and SILC (Secure venenatis leo. Curabitur eget nibh id tellus accumsan
faucibus. Ut massa augue, malesuada a, pharetr Cum

HASH
Message
Step 1:
sociis natoque penatibus et magnis dis parturient
montes, nascetur ridiculus mus. Donec porta, enim et

Internet Live Conferencing protocol).
pharetra lobortis, libero tellus scelerisque ipsum,
facilisis ullamcorper ante sem venenatis leo. Curabitur
eget nibh id tellus accumsan faucibus. Ut massa
augue, malesuada a, pharetrparturient montes,
Digest
nascetur ridiculus mus. Donec porta, enim et pharetra
lobortis, libero tellus scelerisque ipsum, facilisis

This type of cryptographic system is known as a public/private key
system. The public key is distributed to others while the private key
is kept secret and closely guarded by its owner. The sender encrypts a The sender hashes the original document to be sent.
message with the receiver’s public key and forwards it to the intended
recipient. Only the intended recipient can decrypt the message using Message Encrypt with
Digest Signature
his or her private key. Step 2: Private Key

Asymmetric cipher key lengths The Message Digest is then encrypted using the sender’s
Private Key creating what we call the Digital Signature
The minimum asymmetric key length generally recommended for
secure use today is 1024 bits, which is said to be about as strong as

an 80-bit symmetric key. However, NIST has stated that keys of

Append

Signature

1024 bits will only be secure through the year 2010, when processing Step 3:

power should catch up and make it a reality to break the 1024-bit

code. A 2048-bit RSA key, which is about as secure as a 112-bit

The digital signature gets appended lobortis, libero tellus scelerisque ipsum, facilisis

Signature
symmetric key, would buy a little more time. It is thought that these to the original document.
keys will be good through 2030. If you are a futuristic thinker and
you require an asymmetric key that will last beyond 2030, you can
Message
HASH

always use a 3072-bit key.
Digest

NIST guidelines suggest that if you need the equivalent of 256-bit Step 4:

symmetric key encryption in an asymmetric key, you need to utilize

Message

Decrypt with
lobortis, libero tellus scelerisque ipsum, facilisis

the 15360-bit asymmetric key. Signature Public Key Digest

Digital signatures The receiver decrypts the message using the sender’s public key, changing it back
to a message digest. If message digest matches the original, then it proves the
A digital signature (not to be confused with a digital certificate) is sender signed the document because only the sender has the private key that the
document was orginally signed with. The receiver then hashes the document data
most often an electronic signature used to authenticate the identity of into a message digest. If the message digest is the same as the original, then the
the sender of a message, but it can also be used to verify the integrity receiver can be sure that the document has not been changed.
of a message and prove that the contents have not been altered from
the original. A digital signature is represented in a computer as a Figure 3. Digital signatures
string of binary digits. It is created by using a set of mathematical
rules and parameters that allow the receiver of a message to verify
the identity of the sender and the integrity of the data within the
Hash functions
message. A hash function is also known as a hash algorithm. Hash functions
can provide a number of services, including authentication, non-
The Digital Signature Standard (DSS) issued by NIST is the repudiation and error checking. The term “hash” comes from the
standard that defines the public key crypto-system for generating non-technical meaning “to chop” or “to mix.” A hash algorithm is
and verifying digital signatures. DSS specifies the Digital Signature

36


a mathematical algorithm that chops or mixes up the original data The hash function is often connected to the digital signature. Many of
into another fixed value. the most popular digital signature signing techniques (such as DSA,
A hash function H is a transformation that takes a variable-size mentioned earlier) involve first hashing the data and then digitally
input m and returns a fixed-size string output (h). That
is, h = H(m). This output is called a “hash value” (or a MD5
message digest). The hash value is commonly known as Input Hash Value
the digital fingerprint of the original data. Some common
hash technology families intended for cryptographic Hash Function PQrKK4kbNmqB+X/S
Dog HWBi1peZwIDAQABA
hashing include MD5, SHA-1 and SHA-2. There are Applied oGBAKI1WhCgGHx
other hash technologies for use in error correction and
audio identification.
YYFfd6bqW6DGqcZt
Some hash functions are said to be “one-way” since they can The dog ran Hash Function WKkDCzqwLstspT9B
be very hard to invert1. This means that given a hash value around the yard Applied UoskTIjWjC5EVAuyG
h, it is computationally infeasible to find some input x such
that H(x) = h. If, given the message x, it is computationally
infeasible to find a message y not equal to x such that H(x) Q9BZP18H5xIKfFXc4Y
The dog Hash Function
Q2jqjQI84KkDCzq68
= H(y), then H is said to be a “weakly collision-free” hash chased the cat Applied wLstspT9BU5o5skTI
function. A “strongly collision-free” hash function H is
one for which it is computationally infeasible to find any Figure 4. Hash functions
two messages x and y such that H(x) = H(y).
So the hash function, in simpler terms, is a mathematical formula
which, when applied against a larger set of data such as a document, signing the hash. Raw messages are usually not signed directly for
produces a value known as a hash value that can be used for message both performance and security reasons.
integrity checks and digital signatures. Hash functions are most
often used to verify that two documents are equal. If the same hash The future
function is applied against the same data, the resulting outputs
In the never-ending spiral of technology growth, we will need to
should be the same. If the two resulting hash values are different,
continue to perfect new and emerging cryptographic technologies. In
then the inputs are different. It’s that simple.
early 2006 at the SPIE Defense and Security Symposium in Orlando,
Some other common uses of hash functions include checksums Florida, NIST unveiled its quantum key distribution (QKD)
over a large amount of data (e.g., the cyclic redundancy check), and system. Quantum key distribution uses single photons, the smallest
finding an entry in a database by key value. particles of light, in different orientations to produce a continuous
As with other cryptographic techniques, some hash functions can be binary code, or “key,” for encrypting information. This is a critical
broken. We need to be aware of two types of attacks that can occur first step toward using conventional, high-speed backbones such as
with hash functions. These attacks are called the “preimage attack” broadband Internet to transmit ultra-secure video for applications
and the “collision attack.” A preimage attack enables someone to find such as surveillance. The rules of quantum mechanics ensure that
an input message that causes a hash function to produce a particular anyone intercepting the key is detected, thus providing a highly
output value. In contrast, a collision attack finds two messages that secure key exchange.
produce the same hash value, though the attacker cannot pick what Applications for high-speed QKD might include distribution of
those hash values will be. To exploit a collision attack, an adversary sensitive remote video, such as satellite imagery, or commercially
would need to determine that two messages produce the same hash valuable material such as intellectual property, or confidential
value. For example, the adversary might discover this similarity healthcare and financial data. One thing is for sure, it’s a very exciting
between the following two messages: time to be working with cryptography.
1. I, Bill, agree to pay Bob $500.00 on January 1, 2005.
2. I, Bill, agree to pay Bob $23917832.34 on July 2, 2006.
Conclusion
As you can see, cryptography is a field all its own. Cryptography
The adversary could then get the victim to digitally sign the first can be your lifelong pursuit if you desire. So while there is a lot of
message and then claim that the victim actually signed the second information provided here, many types of algorithms, cryptographic
message. The adversary could “prove” this assertion by showing that systems and uses for these techniques have gone unmentioned in this
the victim’s signature does indeed match the second message. article. I hope to have given you a bird’s-eye view of some of the more
Collisions can be a problem for crypto systems that involve digitally common cryptographic techniques in use today. Cryptography is used
signed code. In particular, a collision attack can enable adversaries to in information security to provide confidentiality, authentication,
develop an innocuous program and a malicious program with the integrity and non-repudiation for the information age.
same hash. For example, a trusted compiler/verifier might accept
and sign the innocuous program, which could then be substituted About the Author
for the malicious one. In the security world, we need to be aware of
these particular types of attacks to the hash function. Mark J. House, CCNA, CEH, CISSP, CNE and MCP, is principal
owner of Fast Track Solutions in Tampa, Florida, and an independent
Information Security Consultant. He has over 10 years experience in
network design and network security with Fortune 500 companies in
1 http://www.rsasecurity.com/rsalabs/node.asp?id=2164

37


the financial, medical, and educational arenas. He teaches courses in of Standards and Technology. May 6, 2006. http://www.itl.nist.gov/
IT Security and IT Security Awareness in addition to security solution fipspubs/fip46-2.htm
implementations. He can be reached at mark@markhouse.net. Ellison, Carl M. and Bill Frantz, et al. Simple Public Key Certificate.
July 26, 1999. Internet draft. May 9, 2006. http://theory.lcs.mit.edu/
References ~rivest/simple-public-key-certificate.txt
“Computer Security Resource Center.” April 25, 2006. National Ost, Laura. “Code for ‘Unbreakable’ Quantum Encryption
Institute of Standards and Technology. May 5, 2006. http://csrc.nist. Generated at Record Speed over Fiber.” April 18, 2006. National
gov/CryptoToolkit/tkhash.html Institute of Technology and Standards. May 10, 2006. http://www.
Cryptographic Tools. RSA Security. RSA Laboratories. May 9, 2006. nist.gov/public_affairs/releases/quantumfiber.htm
http://www.rsasecurity.com/rsalabs/node.asp?id=2164 Rivest, Ronald L. “The RC5 Encryption Algorithm.” 1994 Leuven
Dam, Kenneth W. and Herbert S. Lin, eds. Cryptography’s Workshop on Fast Software Encryption. May 9, 2006. http://theory.
Role in Securing the Information Society. Committee to Study lcs.mit.edu/~rivest/Rivest-rc5.pdf
National Cryptography Policy. Commission on Physical Sciences, Rivest, Ronald L. The MD5 Message Digest Algorithm. April 1992.
Mathematics, and Applications. Washington, D.C. 1996. May 6, Internet RFC 1321 May 2, 2006. http://theory.lcs.mit.edu/~rivest/
2006. http://fermat.nap.edu/books/0309054753/html/index.html publications.html
“Data Encryption Standard (DES).” Federal Information Processing
Standards Publication 46-2. December 30, 1993. National Institute

38

Making Sense Of Cryptography

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (15)

Similar to Making Sense Of Cryptography

Similar to Making Sense Of Cryptography (20)

Making Sense Of Cryptography