Introduction to Cryptography

#The Science of Secrets: Introduction to Cryptography#link

Cryptography is the mathematical foundation that makes modern cybersecurity possible. It protects data in transit over the internet, secures stored passwords, verifies digital identities, and ensures the integrity of software updates. Without cryptography, online banking, e-commerce, private messaging, and secure government communications would be impossible. In this lesson, you'll learn the core concepts of cryptography that every security professional must understand.

What Is Cryptography?

Cryptography is the practice and study of techniques for secure communication in the presence of adversarial behavior. It transforms readable data (plaintext) into an unreadable format (ciphertext) using mathematical algorithms and keys. Only those who possess the correct key can reverse the process and recover the original data. The strength of a cryptographic system lies not in keeping the algorithm secret, but in keeping the key secret — a principle known as Kerckhoffs's Principle.

Symmetric Encryption

Symmetric encryption uses a single shared key for both encryption and decryption. The sender encrypts the plaintext with the key, and the receiver decrypts the ciphertext with the same key. Symmetric algorithms are fast and efficient, making them ideal for encrypting large volumes of data. The challenge is securely sharing the key between parties.

# Example: AES symmetric encryption using Python's cryptography library
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
import os

# Generate a random 256-bit key and 128-bit initialization vector
key = os.urandom(32)  # 256-bit key for AES-256
iv = os.urandom(16)   # 128-bit IV

# Encrypt
cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
encryptor = cipher.encryptor()

# Pad the plaintext to be a multiple of block size (16 bytes)
plaintext = b"Secret message for authorized eyes only!"
padded_plaintext = plaintext + b"\x00" * (16 - len(plaintext) % 16)

ciphertext = encryptor.update(padded_plaintext) + encryptor.finalize()
print(f"Ciphertext (hex): {ciphertext.hex()}")

# Decrypt
decryptor = cipher.decryptor()
decrypted = decryptor.update(ciphertext) + decryptor.finalize()
print(f"Decrypted: {decrypted.rstrip(b'\x00').decode()}")

Asymmetric Encryption

Asymmetric encryption (public-key cryptography) uses a pair of mathematically related keys: a public key and a private key. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. This solves the key distribution problem of symmetric encryption — you can share your public key openly while keeping your private key secret.

• ▪RSA (Rivest-Shamir-Adleman) — The most widely used asymmetric algorithm. Based on the difficulty of factoring large prime numbers. Key sizes of 2048-bit or 4096-bit are recommended.
• ▪ECC (Elliptic Curve Cryptography) — Provides equivalent security to RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA). Preferred for mobile and IoT devices.
• ▪Diffie-Hellman Key Exchange — Allows two parties to establish a shared secret over an insecure channel. Used in TLS/SSL handshakes.
• ▪Digital Signatures — Using your private key to sign data proves it came from you and hasn't been tampered with. Anyone can verify with your public key.

Hashing: One-Way Functions

Hashing is a one-way function that converts input data of any size into a fixed-length output (hash/digest). Unlike encryption, hashing cannot be reversed — you cannot recover the original data from the hash. Hashing is used for password storage, data integrity verification, and digital signatures.

Digital Certificates and PKI

Public Key Infrastructure (PKI) is the framework that manages digital certificates and public-key encryption. A digital certificate binds a public key to an identity (person, organization, or device) and is issued by a trusted Certificate Authority (CA). When you visit an HTTPS website, your browser checks the site's certificate against its list of trusted CAs to verify the site's identity.

• ▪Certificate Authority (CA) — A trusted entity that issues and signs digital certificates (e.g., Let's Encrypt, DigiCert)
• ▪Certificate — Contains the public key, identity information, validity period, and the CA's digital signature
• ▪TLS Handshake — The process where a client and server establish a secure connection using certificates and key exchange
• ▪Certificate Revocation — The process of invalidating a compromised or expired certificate (via CRL or OCSP)