Basic Concepts of Cryptography in Computer Networks

1. Network Security Goals: The CIA Triad

In modern interconnected computer networks, information security revolves around three fundamental security pillars (the CIA Triad), plus authentication and non-repudiation:

                            SECURITY PILLARS
                                   |
         +-------------------------+-------------------------+
         |                         |                         |
  CONFIDENTIALITY              INTEGRITY                AVAILABILITY
  (Encryption/Privacy)      (Hash Functions)          (Redundancy/Uptime)
         |                         |                         |
         +-------------------------+-------------------------+
                                   |
                     AUTHENTICATION & NON-REPUDIATION
                        (Digital Signatures & PKI)

Confidentiality: Ensuring that sensitive information is inaccessible to unauthorized eavesdroppers. Achieved via Encryption.
Integrity: Ensuring that data has not been secretly modified, injected, or altered during transit. Achieved via Cryptographic Hash Functions and MACs.
Availability: Ensuring authorized users have reliable, timely access to services without disruption from Denial of Service (DoS) attacks.
Authentication: Confirming the true identity of communicating entities before granting access.
Non-Repudiation: Preventing a sender from denying having sent a message. Achieved via Digital Signatures.

2. Cryptographic Terminology

Plaintext ( $P$ ): The original, unencrypted readable message.
Ciphertext ( $C$ ): The scrambled, unreadable message produced by encryption.
Cipher: The mathematical algorithm used to transform plaintext into ciphertext.
Key ( $K$ ): A mathematical secret parameter used by ciphers to control encryption and decryption.
Encryption ( $E$ ):

C = E_K(P)

Decryption ( $D$ ):

P = D_K(C)

Cryptanalysis: The science of breaking ciphers and decrypting data without knowledge of the secret key.
Kerckhoffs's Principle: A cryptosystem must remain secure even if everything about the system (the algorithm) is public knowledge, as long as the Key itself remains secret.

3. Symmetric Key Cryptography (Secret-Key)

In Symmetric Key Cryptography, the exact same secret key is used for both encryption and decryption:

  Alice (Sender)                                              Bob (Receiver)
 +-------------+                                             +-------------+
 | Plaintext P | ──> [ Encryption: Ek(P) ] ──> Ciphertext ──> [ Decryption: Dk(C) ] ──> Plaintext P
 +-------------+               ^                                           ^
                               |                                           |
                               +======== [ SHARED SECRET KEY K ] ==========+

Classification of Symmetric Ciphers:

Stream Ciphers: Encrypts plaintext bit-by-bit or byte-by-byte continuously (e.g., RC4, ChaCha20).
Block Ciphers: Divides plaintext into fixed-size blocks (typically 64 or 128 bits) and encrypts each block:
- DES (Data Encryption Standard): 56-bit key, 64-bit block size. Obsolete (cracked via brute-force in hours).
- 3DES (Triple DES): Applies DES three times ( $168$ -bit key). Phased out due to slow performance.
- AES (Advanced Encryption Standard - Rijndael): The global gold standard. Fixed 128-bit block size with key lengths of 128, 192, or 256 bits.

The Key Distribution Problem:

For a network with $N$ users, every pair of users requires a distinct shared key:

\text{Total Secret Keys Needed} = \frac{N(N - 1)}{2} = O(N^2)

In a network of $1{,}000$ users, nearly $500{,}000$ secret keys must be securely distributed and stored!

4. Asymmetric Key Cryptography (Public-Key)

To solve the key distribution nightmare, Whitfield Diffie and Martin Hellman introduced Public-Key Cryptography in 1976. Each user possesses a mathematically linked Key Pair:

Public Key ( $K_{\text{pub}}$ ): Freely published and known to the entire world.
Private Key ( $K_{\text{priv}}$ ): Kept strictly secret by the owner.

  Confidential Message to Bob:
  Alice encrypts using BOB'S PUBLIC KEY ──> Bob decrypts using BOB'S PRIVATE KEY
  (Only Bob possesses the private key capable of reversing the encryption!)

Mathematical Foundations:

Based on One-Way Trapdoor Functions—problems that are easy to compute in the forward direction but computationally infeasible to invert without special knowledge (the trapdoor):

RSA (Rivest-Shamir-Adleman): Security relies on the extreme computational difficulty of factoring large prime numbers ( $2048 - 4096\text{ bits}$ ).
Diffie-Hellman / ECC (Elliptic Curve Cryptography): Security relies on the Discrete Logarithm Problem. ECC provides the same security as RSA with vastly smaller keys (256-bit ECC $\approx$ 3072-bit RSA).

5. Digital Signatures and Message Digests

Asymmetric cryptography also provides Authentication and Non-Repudiation through Digital Signatures:

 SENDER (Alice):
 Message ──> [ Hash Function (SHA-256) ] ──> Message Digest (256b)
                                                    |
                                    Encrypt with ALICE'S PRIVATE KEY
                                                    |
                                                    v
                                             DIGITAL SIGNATURE

 RECEIVER (Bob):
 1. Decrypts signature using ALICE'S PUBLIC KEY ──> Extracts Original Digest
 2. Re-hashes received message with SHA-256 ───────> Computes Received Digest
 3. Compares Digests: If Identical ===> Authentic Sender & Unaltered Message!

Cryptographic Hash Functions (SHA-256): One-way, fixed-size output, collision-resistant (impossible to find two different inputs that produce the same hash output).
Digital Certificates & PKI (X.509): Trusted third-party Certificate Authorities (CAs) digitally sign and bind public keys to domain identities (e.g., Let's Encrypt, DigiCert) for HTTPS web browsing.

6. Hybrid Cryptography (The Real-World Solution)

Symmetric encryption is $1{,}000\times$ faster than asymmetric encryption.
Asymmetric encryption solves key distribution.
The Modern Standard (TLS / SSL / HTTPS) combines both:
1. Handshake Phase: Uses Asymmetric Cryptography (ECDH / RSA) to authenticate the server and securely exchange a temporary Symmetric Session Key.
2. Data Transfer Phase: Uses Symmetric Cryptography (AES-256-GCM) with the negotiated session key to encrypt bulk data at wire speed!

7. Comprehensive Comparison: Symmetric vs. Asymmetric

Parameter	Symmetric Encryption	Asymmetric Encryption
Number of Keys	1 shared secret key	2 mathematically linked keys (Public & Private)
Key Distribution	Difficult ( $O(N^2)$ secret channels)	Simple ( $O(N)$ public keys)
Computational Speed	Extremely Fast (Hardware accelerated)	Slow (Heavy modular exponentiation)
Cipher Text Size	Same as or slightly larger than plaintext	Significantly larger than plaintext
Primary Algorithms	AES, DES, 3DES, ChaCha20, Blowfish	RSA, ECC, Diffie-Hellman, DSA
Primary Use Cases	Bulk file encryption, database storage	Key exchange, Digital Signatures, TLS handshakes

8. Key Exam Questions & Takeaways

State Kerckhoffs's Principle.
- A cryptographic system must be designed to remain secure even if everything about the design and algorithms is publicly known, provided the specific key remains secret.
Why is Hybrid Cryptography used in HTTPS/TLS rather than pure asymmetric encryption?
- Asymmetric encryption involves heavy mathematical operations that are too slow for high-speed web traffic. HTTPS uses asymmetric cryptography only for initial key exchange and authentication, then switches to fast symmetric encryption (AES) for the actual webpage payload.
What two properties are guaranteed by a Digital Signature?
- Authentication / Non-Repudiation (proves the message was signed by the holder of the unique private key) and Integrity (proves the message was not modified in transit).

Basic Concepts of Cryptography