Cryptography and Secure Communication: An Introduction – netseed

We are living in a digital age. Various online threats exist that may compromise and steal your data, your money, and even your entire identity. Any systems that are connected to the Internet are exposed to a large number of potential cyber-attacks from different outside adversaries who are targeting the systems and open communication channels, either to steal the sensitive information or to disrupt the critical information system. It can be extremely difficult to create a system that is impregnable to outsiders unless you disconnect it from the Internet!

Modern cryptographic systems provide a robust set of techniques to ensure secure transactional sensitive data flows online, thus preventing hackers and cyber-criminals from accessing sensitive contents, even if they succeed in capturing the transmitted encrypted data. The mathematical formulas involved in today’s cryptographic standards are enough to prevent the majority of attackers from decrypting stolen data.

The future of cryptography is brighter than ever before. With more companies becoming increasingly vulnerable to cyber-attacks, it’s crucial that organizations strengthen their line of defence with strong encryption techniques and systems. Passwords, disk encryption, SSL certificates, electronic signatures, security access systems, simple end-user mobile solutions such as the InvizBox, and anything else that incorporates some form of security in the digital world must use some form of robust cryptographic techniques.

Individuals also need to use encryption to secure their personal data. Encryption is considered the last line of defence if an attacker successfully gains access to your confidential data. In other words, encryption will be your last hope to prevent the compromise, use, or disclosure of your sensitive information to the public or to your enemies.

In a world where everything is connected to everything else by the Internet, the demand to keep secrets has never been this hard. In this post, we will give you thoughtful insight about some of the terms and concepts behind basic cryptographic methods. You will also learn how to use different cryptographic tools to encrypt data at rest and possible attacks against full disk encryption. We will also cover protecting data in transit as well as steganography techniques (the science of hiding data in plain sight).

The Difference Between Encryption and Cryptography

The majority of computer users think the terms cryptography and encryption are interchangeable. This is not completely correct. Cryptography is the science of “secret writing.” It can be looked at as an ancient art that has taken many forms over the years. It includes steganography, which is the science of hiding a secret message inside another, seemingly legitimate message that acts as the carrier so the hidden, unseen message will not appear during transit.

Encryption is considered a component of cryptography, and it is concerned with concealing secret messages by obscuring them. In other terms, encryption converts plaintext data into another obscured form called ciphertext using a specific cryptographic algorithm. This ciphertext can’t be decrypted to its original state without owning or having access to the associated decryption key.

Encryption helps to ensure the confidentiality of the data stored on servers when at rest or when communicated through public networks such as the Internet.

Usefulness of Cryptography

Cryptography is an essential information security tool. It provides the four most basic services for information security.

Authentication

Authentication works by using a cryptographic system to ensure that a user (or system) is who they say they are. The process works technically by comparing the credentials provided by the remote entity against a list of authorized entities stored in a file system or database.

Authentication precedes authorization. Most people think both terms are interchangeable, but this is not completely correct. For example, when a user requests access to remote resources stored on a server, he or she needs to supply their credentials, for instance, a username and password. If the user credentials match, the system will grant the user access, or authorize, the access to the data or computing resources matching the associated access control tables; otherwise, access will be denied.

Non-repudiation

The concept of non-repudiation is important in the e-commerce world. To repudiate means to deny, and this concept is simple: when a user performs an action, he or she cannot later deny it.

As an example, think about when a bank client sends a money transfer from his or her account to another account using an electronic transfer. Later, this client may deny sending any transfer from his or her account and demand the money be returned. Here, there should be a technical mechanism in the bank to confirm that this client has legally authorized the transaction. Nonrepudiation can be technically guaranteed via digital signatures and/or encryption, as you are going to see later in this post.

Confidentiality

In simple terms, confidentiality ensures that data is not made available or disclosed to unauthorized parties. This has always been the main purpose of creating cryptographic systems. When the data is confidential, no one should be allowed access to it except the authorized people who possess the decryption key. Confidentiality can be achieved by using a strong encryption algorithm combined with a strong and complex passphrase.

Integrity

Integrity means that data is not viewed or manipulated by an unauthorized, or even an authorized, user during storage or transit. Technically, users can assure data integrity in transit by using hashing, which provides a mechanism to ensure that data has not been tempered with or changed during transmission. While the data is at rest, integrity can be achieved by physically controlling access to server/network device rooms, restricting access to data, and implementing strict authentication procedures in addition to storing sensitive data encrypted on company servers.

Cryptographic Types

There are different classifications of cryptographic algorithms. The most common one is classifying them according to the number of security keys used in the encryption/decryption process.

A cryptographic algorithm works in combination with a key (a number, word, or phrase) to encrypt and decrypt data. This key is composed of a string of bits. The larger the key (contains more bits), the greater the number of patterns that can be created, thus making it harder to break. A cryptographic key is the core part of modern cryptographic operations.

Symmetric Cryptography

Also known as Secret Key Cryptography ( SKC), in this type of encryption, both the sender and the receiver use the same key to encrypt and decrypt the data. The main disadvantage of this scheme is that the entire operation is dependent on the secrecy of the key. If the key is compromised by an unauthorized party, the whole system is breached.

Symmetric encryption algorithms are split into stream ciphers and block ciphers. Stream ciphers encrypt plaintext bits individually, whereas block ciphers encrypt an entire block of plaintext bits at a time as a single unit. The majority of modern block ciphers have a block length of 128 bits (16 bytes).

Some of the popular symmetric encryption algorithms are AES/Rijndael, Blowfish, CAST5, DES, IDEA, RC2, RC4, RC6, Serpent, Triple DES, and Twofish.

Assymetric Cryptography

Also known as Public Key Cryptography ( PKC), this cryptographic schema uses two different keys for encryption and decryption. The two keys are mathematically linked. However, no one can derive the decryption key (private key) from the encryption key (public key).

In asymmetrical cryptography, the public key can be distributed freely; however, the private key should be kept secret to avoid collapsing the whole system. The public key is used to encrypt the secret message or to verify the digital signature of the sender, while the private key is used to decrypt the scrambled message or to create a digital signature. A message encrypted using this technique can only be decrypted back using the corresponding private key pair.

Some of the popular asymmetric encryption algorithms are the RSA encryption algorithm, Diffie-Hellman, Digital Signature Algorithm, ElGamal, ECDSA, and XTR.

: Compared with symmetric cryptography, public-key encryption requires more computation power, which can make it inappropriate for encrypting large amounts of data (according to some studies, asymmetric encryption techniques are almost 1,000 times slower than symmetric techniques).
To counter this issue, some implementations suggest using public-key encryption to send a symmetric key, which can then be used to encrypt a large amount of data. this approach is used by the SSL protocol.

Cryptographic Hash

A cryptographic hash function (also called a digest) converts a digital file (input) and returns a fixed-size value, which is called the hash value. You find the hash of any digital file (or piece of data) by running the data through a hash generator. Every time you hash the same data, you should get the same hash value as a result. This effectively helps you to create a digital fingerprint for any digital file.

To ensure the integrity of a file (or any piece of data), a hash of a file can be sent to accompany the file. The receiver may then compute a hash of the data received and compare it with the hash received. If the two outputs match, then you can assert that a message has not been tampered with.

There are different hash functions, the most popular of which are MD5, SHA-1, and SHA-256. MD5 and SHA-1 are now obsolete, never use them. The best secure hash algorithm is the one that has the best speed and is collision resistant. (Collison means producing the same hash from two different inputs. This is rare, especially when using hashing algorithms that create a higher bit hash of 256 bits and more.)

Hash values are used extensively during digital forensics investigations to examine, identify, and authenticate digital evidence. Hashing is also used to store user credentials (password) in management information systems (MISs) so that even the administrator of the MIS does not know a user’s password. Hashing can also speed up the process of searching through a database because searching for hash values is faster than searching for long string names within databases.

Difference between Encryption and Hashing

Encryption is a two-way operation; it converts input data from cleartext into ciphertext, and vice versa (from cipher to cleartext). hashing is one-way encryption; it’s never meant to be reversed.

How to Calculate File Hash

There are many programs to calculate a digital file hash. Febooti Hash & CRC is one of them that can integrate natively into Microsoft Windows file properties. After installing the program, right-click any file for which you want to calculate its hash, select Properties, and go to the Hash/CRC tab.

You can also calculate the hash of any file in a modern Windows version without using a third-party tool. To do this, open Windows Powershell, and run the command below.

Get File-Hash [path-to-the-file]

Key Exchange Algorithms

A key exchange is any method in cryptography that allows a user to safely exchange encryption keys with an unknown party in order to use a cryptographic algorithm. For example, when two parties want to use symmetrical key cryptography to exchange secret data, they need first to share the “secret key.” Public key cryptography can be used to share the secret key securely between authorized communication parties through an untrusted network like the Internet. The following are two of the most common key exchange algorithms currently used:

• Diffie-Hellman key agreement algorithm
• RSA key exchange process

In general, the Diffie-Hellman key exchange algorithm (used for SSL connection) provides better performance than the RSA key exchange algorithm. The figure below shows the basic Diffie-Hellman key agreement process.

Digital Signature

A digital signature is a way to assure that an e-mail or digital file is authentic. Authentic means it is from the correct person who purports to be the authorized party and that the file content has not been tampered with after sending. A digital signature is considered the digital equivalent of a handwritten signature or a rubber stamp. The legal systems in most developed countries consider digital signatures to have the same legal significance as the more traditional forms of signed documents.

A digital signature is based on asymmetric cryptography (public key). For example, to have your e-mail signed, you need first to generate two keys (private and public keys). The signing software (such as an e-mail client like Thunderbird) creates a hash (also called a message digest) of the data that you are going to sign. The private key is used then to encrypt the hash. The result is the digital signature. Finally, the e-mail client appends the digital signature to the e-mail. Now all the data that was hashed has been signed.

As you saw previously, hashing algorithms produce a fixed-length hash value that is unique for the hashed data (unless a collision occurred, which is practically near impossible to happen, especially when using modern hashing algorithms). Any change in the hashed data (even a single character) will produce a new hashing value. So, when a recipient wants to validate the integrity of the received message, all he or she needs to do is to use the signer’s public key to decrypt the hash. If the decrypted hash matches the value of the hash generated by the recipient’s software for the same data set, this means the message is authentic and has not been tampered with after sending. If the two hashes do not match, this means either the message has been tampered with during transit or the signature was created using a private key that does not correspond to the public key pair used to decrypt it.

A digital signature can be used with any kind of message, whether it is encrypted or not, to authentic sending partners. today, the majority of modern e-mail clients support the use of digital signatures.

The Difference Between Digital Signatures and Electronic Signatures

You should not confuse the terms digital signature and electronic signature (e-signature) even though, again, both names are often used interchangeably. Both digital signatures and e-signature solutions allow you to sign documents and authenticate the signer. However, they differ in the purpose, technical implementation, and legal acceptance. For instance, most electronic signature solutions are easy to use; a user can just click to sign the document or can simply insert an image containing a handwritten signature on the document to sign it.

E-signatures are not regulated like digital signatures, and each vendor has its own standards and technical implementation that cannot compare with the strict security standards implemented by the digital signature algorithms currently deployed. However, some more secure e-signature solutions protect the signed document with a cryptographic digital signature, thus making it have the same strict security standards as a digital signature in term of linking the signer’s identity to his or her e-signature.

Cryptographic Systems Trust Models

Cryptographic systems are designed to form the basis of information security. However, despite their importance, you still need trust between communicating parties in order to securely exchange data online. For instance, in the Symmetric Key Cryptography, both the sender and the receiver must share the “secret key” in advance in order to encrypt/decrypt the data, but how can they assure safe transmission of this key in an untrusted channel (such as the Internet) if, for example, each one lives in a different country? The Public Key Cryptography tries to solve the problem of sharing the secret key securely by introducing two keys for each party. The public key of the receiver is used to encrypt the data and can publish publicly, and the private key pair (of the receiver) is used to decrypt the data and must remain private. Nevertheless, you still have additional problems in PKC. For instance how can you be assured that the sender of the encrypted data is actually the authorized party? For example, when User A receives an encrypted message from User B, how can User A be assured that this message really originated from User B? What if a malicious person (User C) is impersonating User B? How will User A know this? This section will answer these questions. In a cryptographic schema, there are a number of methods to assure that the person you are communicating with is really the authorized party. The following are the most popular trust model.

• The Web of Trust concept is used in Pretty Good Privacy (PGP) and other OpenPGP-compatible systems.
• Kerberos is a distributed authentication service designed to provide strong authentication for client-server applications by using secret key cryptography.
• A certification authority (CA) is a third-party entity that issues a digital certificate to authenticate a user’s ownership of a public key.

Web of Trust

The Web of Trust is used in Pretty Good Privacy and other compatible systems to establish a trust relationship between a public key and its owner. It is a decentralized security model in which participants authenticate the identities of other users. The Web of Trust is similar to social networking web sites. A user can add unknown people to his or her list of friends if they already have friends in common. You can see this clearly on Facebook and LinkedIn.

Kerberos

Kerberos is a network authentication protocol developed by MIT. It works through a client-server architecture by using secret key cryptography. Kerberos provides secure authentication between the user and server rather than a host-to-host approach. The main component of a Kerberos schema is a central server (or a trusted third-party server) used for authenticating requests.

In a Kerberos network, each connected host has its own secret key, and one of these hosts is the central Kerberos server, also known as a key distribution center (KDC). All host secret keys will be stored on the KDC server. (In some networks, not all host keys will be stored in the central KDC; the group of systems that are under the same master KDC is called a realm.) Kerberos provides secure communication by checking each connected host’s secret key with the one stored on it (the host can do the same with the Kerberos server). After a client and server have used Kerberos to assure their identities, they can begin to exchange encrypted data across an unsecured network such as the Internet.

The main component of Kerberos is also its main disadvantage. If a malicious hacker gains access to the central server, the entire Kerberos authentication system is at risk of being compromised.

Certificates and Certificate Authorities

Certificate authorities (CAs) issue digital certificates for web sites, online services, IoT devices, and individuals. These certificates contain their identity credential in order to be recognized and trusted online (trusted because CA has already verified the identity of each digital certificate holder). CAs play a critical role in today’s digital age. They build trust relationships between different business partners online, encrypt business transactions, and secure the communications between different parties conducting e-commerce transactions.

A digital certificate is like your passport; you can use it within your country to verify your identity. If you are in South Africa and your passport is issued from Johannesburg, you can safely use it in Cape Town. The local authorities in Cape Town will recognize and trust your personal information because your passport is issued by a government agency they trust (Johannesburg authorities). If you moved outside South Africa, foreign countries that accept South African passports will also verify and trust your details, because they trust in the government papers issued by South African authorities. This analogy represents the certificate trust chain where your “certificate” is accepted so as long as it is issued from a recognized trusted party (the CA).

For online transactions, digital certificates are small data files that contain identifying information (certificate issuer, public key, holder name, expiration date, serial number, version, certificate issuer digital signature, and other information according to each CA provider). A certificate enables its holder to bind (or prove ownership) of a public key to him or her (or an organization, web site, or any other entity currently holding this certificate). A digital certificate encrypts the connections between communication parties, ensuring the secure exchange of confidential information online. It also lists what actions its holder can do and what actions the holder cannot.

A popular type of digital certificate is the SSL certificate issued for web sites. SSL binds the ownership details of a web server (and consequently web sites) to their cryptographic keys. These keys are used to establish a secure session between the client’s browser and the web server (web site) hosting the SSL certificate. The figure below show a sample digital certificate for facebook.com issued by DigiCert Inc.

Let us now return to the role of digital certificate with regard to the trust relationship between a sender and a receiver. For example, when User A wants to send an encrypted e-mail to User B, he needs to get User B’s public key from User B’s CA issuer. If both User A and User B have their certificates from the same issuer, the process is clear, and the trust relationship is already established. However, if User B’s certificate is issued from a different CA other than the one that issued User A’s certificate, how can User A trust User B’s certificate? When people face such a challenge, they can simply trust the receiver’s public key certificate when it is issued by a global reputable CA company. CA providers like , , and are are known to be trusted on a global level (and, of course, there are others).

The most commonly used standard for issuing digital certificates for a public key schema is the X.509 format that is defined in International Telecommunication Union Telecommunication Standardization Sector (ITU-T) Recommendation X.509. The information in an X.509 certificate includes the following: version, serial number, algorithm information, issuer name, expire date, subject name, subject public key, and optional standard extensions. Many SSL certificates follow the X.509 standard format.

Cryptographic Algorithm Selection Criteria

Many types of cryptographic algorithms are already in use. Some are considered more secure than others. Their strength depends on mathematics and the size of the encryption key. To achieve the maximum security possible when using encryption tools to protect your sensitive information, it is advisable to check the following criteria before selecting the algorithm you are going to use:

• Do not use proprietary encryption algorithms if you are on a top-secret mission. No one can guarantee they don’t have a backdoor. The RSA encryption company has been accused of receiving $10 million to incorporate a weaker algorithm into an encryption product called BSafe, according to a Reuters report.
• For security-conscious people, do not trust algorithms developed or sponsored by official government agencies. For example, Advanced Encryption Standard (AES) was developed by the U.S. National Institute of Standards and Technology (NIST). SHA and its family (SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256) were developed by the U.S. National Security Agency (NSA), which makes it unfavorable choice.
• Do not use algorithms that have been previously broken or are considered relatively insecure in today’s computing standards. Examples include MD5, SHA-0, SHA-1, and DES.
• Open source cryptographic algorithms are considered safer than the closed alternatives; the public can audit them for trustworthiness, and their code can be rigorously tested and reviewed by global security experts and academics alike.

In cryptographic algorithms, the key length, which is the number of bits in a key used by a cryptographic algorithm, is an important parameter to measure the security of the encryption algorithm. Longer keys provide stronger encryption. The preferred key length differs between asymmetrical and symmetrical algorithms. For instance, to achieve the same level of encryption strength, a 1,024-bit RSA key (asymmetrical algorithm) is only considered equivalent to an 80-bit symmetric key. This site gives advice on the minimum key size requirement for your cryptography system.

For security-conscious people, it is advisable to use the Twofish algorithm. It is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits developed by Bruce Schneier and other scientists. Twofish is unpatented, and the source code is uncopyrighted and license-free. Currently, there is no successful cryptanalysis of Twofish.

As we already said, encrypting a large amount of data using asymmetrical key is not practical, so always exchange the symmetric encryption key using an asymmetrical algorithm and encrypt your data using a symmetrical algorithm like twofish.

And that will be it for this post. In the next post, we will commence practical work on using cryptographic systems to secure your sensitive data. I hope you found this introductory post useful.