Introduction to Cryptography

Cryptography is the art of converting text into another form for secret transmission and reception. It works by converting plain text into cipher text using some encryption algorithm at the sender’s side and converting ciphertext into plain text at the receiver’s. Cryptography is used to provide confidentiality, integrity, authenticity and non-repudiation.

Key terms:

Plain text: Message to be encrypted

Ciphertext: Encrypted message

Encryption: Process of converting plain text into cipher text.

Decryption: Process of converting ciphertext into plain text.

Algorithm: The method used to encrypt/decrypt the plain text.

Key: The data used for encrypting/decrypting.

What is Cryptography?

Cryptography is the study of encrypting and decrypting data to prevent unauthorized access. The ciphertext should be known by both the sender and the recipient. With the advancement of modern data security, we can now change our data such that only the intended recipient can understand it.

Cryptography allows for the secure transmission of digital data between willing parties. It is used to safeguard company secrets, secure classified information, and sensitive information from fraudulent activity, among other things. Crypto means hidden and graph means writing.

Encryption is a fundamental component of cryptography, as it jumbles up data using various algorithms. Data encryption is the method of undoing the work done by encrypting data so that it can be read again. Cryptography is dependent on both of these methods.

In cryptography, a plaintext message is converted to ciphertext when using a technique, or a combination of numerical computations, that appear incomprehensible to the untrained eye.

Fundamentals of cryptography

Before diving into the details of how cryptography works, it’s important to understand the terminology. Technically, cryptography (creation of codes) is a subfield of cryptology (the study of codes), but both terms are often used interchangeably. The other subfield of cryptology, cryptanalysis, focuses on trying to break encryption algorithms.

Every good encryption algorithm has at least three main components: the plaintext, the ciphertext and the secret key.

The plaintext is the message that will be protected by the encryption algorithm. While this message is often the secret that a hacker is trying to steal, it may also be under the control of the hacker. Most encryption algorithms are protected against known plaintext attacks, where the attacker knows the plaintext and is trying to learn the secret key.

The ciphertext is the result of encrypting the plaintext with a secret key. A ciphertext should be essentially indistinguishable from a random number. This is accomplished by creating encryption algorithms with high confusion (making each bit of ciphertext dependent on several bits of the secret key) and diffusion (ensuring that flipping one bit of the plaintext flips an average of half of the bits of the ciphertext).

The secret key is a piece of data that should be known only to authorized users of the protected data. It is provided as an argument to the encryption algorithm (along with the plaintext) to create the ciphertext.

According to Kerckhoff’s Principle, the secret key should be the only secret component of an encryption algorithm. Relying on security by obscurity (e.g., keeping the encryption algorithm or parts of it secret) is poor cryptography. Relying on security by obscurity is one of the mistakes that made the Enigma cipher breakable.

Types of cryptography

There are a few different ways in which cryptographic algorithms can be classified. Some of the major ones include asymmetric versus symmetric and block versus stream. Knowledge of these classifications can be useful for ethical hacking since different types of cryptography, if misused, can be vulnerable to attack.

Symmetric and asymmetric

One of the main ways to differentiate between different encryption algorithms is based on whether they use symmetric or asymmetric encryption keys. A symmetric encryption algorithm uses the same secret key for both encryption and decryption, while an asymmetric algorithm uses two related keys: a private key and a public key.

Symmetric encryption algorithms are generally better for bulk data encryption, but they have one main shortcoming: both sides need to have a copy of the same shared secret key. A good cryptographic implementation will use asymmetric cryptography to set up a channel to share a symmetric encryption key for bulk encryption. However, if a symmetric key is sent in cleartext or embedded in software, intercepting it can allow an ethical hacker to decrypt and read all of the protected data.

Asymmetric encryption uses a related public and private key. With asymmetric cryptography (also called public key cryptography), the main vulnerability of the protocol is to quantum computers, which can break it easily.

However, public key cryptography can also face the authentication problem. A user’s public key can be used to encrypt a message to them or verify a digital signature generated using their associated private key. This assumes that the public key in possession of and in use by the software is the correct one. If public key authenticity is not checked appropriately, substituting an ethical hacker’s public key may allow them to decrypt messages and generate digital signatures accepted by the software.

Block and stream

The other main distinction between types of cryptographic algorithms is whether they are block or stream ciphers. As the name suggests, a block cipher performs encryption and decryption on fixed-size blocks of data. A stream cipher, on the other hand, generates a stream of pseudorandom output bits that are exclusive-ored (XORed) with the bits of the plaintext to produce the ciphertext.

The main issue with block encryption algorithms is that they don’t have a built-in mechanism for encrypting data longer than the size of a single block. To fix this, block cipher modes of operation were developed to define a protocol for encryption of multi-block plaintexts. However, some of these leak information about the encrypted data, which can be exploited by an ethical hacker.

Stream ciphers are designed to encrypt plaintexts of arbitrary length, since they encrypt a bit at a time. However, this bit-level encryption can also make the system vulnerable to bit flip errors. If an application doesn’t test for the integrity of the encrypted data (through a MAC or checksum), a hacker can flip bits without detection. Also, the most well-known stream cipher (RC4) has vulnerabilities that can leak data about the secret key if not used properly.

Cryptography for ethical hacking

The widespread use of modern cryptography is good for privacy and security but also complicates the work of an ethical hacker. Data encryption can conceal other flaws in a system if the hacker can’t properly analyze data at rest or in transit to identify them.

During an ethical hacking exercise, it’s important to inspect the use of cryptography for any mistakes that may allow a hacker to break the encryption. It may also be a good idea to request access to unencrypted data as well, in order to enable analysis of the system for other flaws hidden by encryption.

History of Cryptography

The history of cryptography finds its roots in Egypt around 4000 years ago. The Egyptians used hieroglyphics, the oldest cryptography technique, to communicate with each other. Later, in 500 BC, the technique was modified by replacing the characters with alphabets based on some secret rule known to only a few. This rule came to be known as the key to decipher hidden codes or messages.

Later, in the 15th century, more sophisticated techniques evolved such as Vigenere cipher and coding machines like the Enigma rotor machine. Years later, cryptography was born!

How does Cryptography work?

The functioning of cryptography revolves around cryptographic algorithms. Cryptographic algorithms or ciphers are mathematical functions that are combined with keys, such as phrase, digit, word, etc., to encrypt text. The effectiveness depends on the strength of the cryptographic algorithms and the secrecy level of the key.

Multiple complex combinations of algorithms and keys boost the effectiveness of a cryptosystem.

Cryptography Techniques

Some major techniques of Cryptography are listed below:

• Steganography: One of the oldest techniques of cryptography, steganography involves hiding secret information or messages with no confidential status files in order to avoid detection. Decades ago, steganography was not as sophisticated as it is now. Earlier, invisible ink, slight variations, etc., were used to hide messages. But with the advent of technology, steganography has evolved as one of the commonly used techniques in cryptography.
• Hashing: Hashing converts data to be hidden into a unique string. Irrespective of the type or form of data, hashing can be used to hide it. Once hashing is performed, it cannot be decrypted by using just keys.
• Simple codes: A language is used to hide the meaning of the sentences written in a different language. The message is written in such a way that it is hard to decipher. In a majority of cases, niche alphabets are used to make the message more complex to read.
• Symmetric encryption: It is mainly used for encrypting and decrypting electronic data through a secret key. Substitution ciphers form the base of symmetric encryption. However, nowadays, symmetric encryption is much more than just substitution ciphers. Symmetric encryption is largely used when the message to be encrypted is quite sizable.
• Asymmetric encryption: This type of encryption uses two keys, public key, and private key, to encrypt and decrypt plaintext. Anyone with the secret key can decrypt the message. Hence, asymmetric encryption uses two corresponding keys to ensure secrecy.