cmc/cleberg.net

  1#+date:        [2020-02-09 Sunday 00:00:00]
  2#+title:       Cryptography Basics
  3#+description: An introduction to cryptographic methods for encryption.
  4#+slug:        cryptography
  5#+filetags:    :security:
  6
  7* Similar Article Available
  8
  9If you haven't already, feel free to read my post on [[file:2018-11-28-aes-encryption.org][AES Encryption]].
 10
 11* What is Cryptography?
 12
 13In layman's terms, cryptography is a process that can change data from a
 14readable format into an unreadable format (and vice-versa) through a series of
 15processes and secrets. More technically, this is the Internet Security
 16Glossary's definition:
 17
 18#+begin_quote
 19[Cryptography is] the mathematical science that deals with transforming data to
 20render its meaning unintelligible (i.e., to hide its semantic content), prevent
 21its undetected alteration, or prevent its unauthorized use. If the
 22transformation is reversible, cryptography also deals with restoring encrypted
 23data to an intelligible form.
 24
 25- [[https://tools.ietf.org/html/rfc2828][Internet Security Glossary (2000)]]
 26#+end_quote
 27
 28Cryptography cannot offer protection against the loss of data; it simply offers
 29encryption methods to protect data at-rest and data in-traffic. At a high-level,
 30encrypted is when plain text data is encrypted to cipher text (a secure form of
 31text that cannot be understood unless decrypted back to plain text). The
 32encryption process is completed through the use of a mathematical function that
 33utilizes one or more values called keys to encrypt or decrypt the data.
 34
 35* Key Elements of Cryptographic Systems
 36
 37To create or evaluate a cryptographic system, you need to know the essential
 38pieces to the system:
 39
 40- *Encryption Algorithm (Primitive):* A mathematical process that encrypts and
 41  decrypts data.
 42- *Encryption Key:* A string of bits used within the encryption algorithm as the
 43  secret that allows successful encryption or decryption of data.
 44- *Key Length (Size):* The maximum number of bits within the encryption key.
 45  It's important to remember that key size is regulated in certain countries.
 46- *Message Digest:* A smaller, fixed-size bit string version of the original
 47  message. This is practically infeasible to reverse, which is why it's commonly
 48  used to verify integrity.
 49
 50* Symmetric Systems (Secret Key Cryptography)
 51
 52Symmetric cryptography utilizes a secret, bidirectional key to perform both
 53encryption and decryption of the data. The most common implementation of
 54symmetric cryptography is the Advanced Encryption Standard, which uses keys that
 55are 128 bits to 256 bits in size. This standard came after the National
 56Institute of Standards and Technology (NIST) decided to retire the Data
 57Encryption Standard (DES) in 2001.
 58
 59Since brute force attacks strongly correlate with key length, the 56-bit key
 60length of DES was considered insecure after it was publicly broken in under 24
 61hours. However, there is a modern implementation of DES called Triple DES where
 62the DES method is applied three times to each data block.
 63
 64The main advantages to symmetric systems are the ease of use, since only one key
 65is required for both encryption and decryption, and the simplicity of the
 66algorithms. This helps with bulk data encryption that may unnecessarily waste
 67time and power using asymmetric systems.
 68
 69However, symmetric systems have disadvantages to keep in mind. Since the key is
 70private, it can be difficult to safely distribute keys to communication
 71partners. Additionally, the key cannot be used to sign messages since it's
 72necessary to keep the key private.
 73
 74* Asymmetric Systems (Public Key Cryptography)
 75
 76Asymmetric cryptography utilizes two keys within the system: a secret key that
 77is privately-held and a public key that can be distributed freely. The
 78interesting aspect of asymmetric cryptography is that either key can be used to
 79encrypt the data, there's no rule that dictates which key must be used for
 80encryption. Once one key is used to encrypt the data, only the other key can be
 81used to decrypt the data. This means that if the private key encrypts the data,
 82only the public key can decrypt the data.
 83
 84An advantage of this system is that if you successfully decrypt data using one
 85of the keys, you can be sure of the sender since only the other key could have
 86encrypted the data.
 87
 88One of the major implementations of an asymmetric system is a digital signature.
 89A digital signature can be generated using the sender's private key, or a
 90one-way hash function and is used to provide assurance for the integrity and
 91authenticity of the message. A couple common message digest algorithms are
 92SHA-256 and SHA-512, which securely compress data and produce a 128-bit message
 93digest.
 94
 95It should be noted that man-in-the-middle attacks are one of the risks with
 96digital signatures and public keys. To combat this, applications often use a
 97public key infrastructure (PKI) to independently authenticate the validity of
 98signatures and keys.
 99
100Due to the large key size and [[https://crypto.stackexchange.com/a/591][inefficient mathematical functions]] of asymmetric
101encryption, elliptical curve cryptography (ECC) is often used to increase
102security while using fewer resources.
103
104* Applications of Cryptographic Systems
105
106There are numerous implementations of cryptographic systems around the world.
107Here are six popular examples:
108
109*Transport Layer Security (TLS):* One of the most famous cryptographic solutions
110created is TLS, a session-layered or connection-layered internet protocol that
111allows for secure communications between browsers and servers. Using handshakes,
112peer negotiation, and authentication allows TLS to prevent eavesdropping and
113malicious transformation of data. The major reason for TLS popularity is that a
114major vulnerability was found in the SSL protocol in 2014. Instead of SSL, TLS
115can be used with HTTP to form HTTPS and is the preferred method for modern web
116development due to its increased security.
117
118*Secure Hypertext Transfer Protocol (HTTPS):* An application layer protocol that
119allows for secure transport of data between servers and web clients. One of the
120unique parts of HTTPS is that it uses a secured port number instead of the
121default web port address.
122
123*Virtual Private Network (VPN):* VPNs are made to securely extend a private
124network across public networks by utilizing an encrypted layered tunneling
125protocol paired with an authentication method, such as usernames and passwords.
126This technology originally allowed remote employees to access their company's
127data but have evolved into one of the top choices for anyone who wishes to mask
128their sensitive personal data.
129
130*Internet Protocol Security (IPSec):* This protocol suite facilitates
131communication between two or more hosts or subnets by authenticating and
132encrypting the data packets. IPSec is used in a lot of VPNs to establish the VPN
133connection through the transport and tunnel mode encryption methods. IPSec
134encrypts just the data portion of packets in the transport methods, but it
135encrypts both the data and headers in the tunnel method (introducing an
136additional header for authentication).
137
138*Secure Shell (SSH):* SSH is another network protocol used to protect network
139services by authenticating users through a secure channel. This protocol is
140often used for command-line (shell) functions such as remote shell commands,
141logins, and file transfers.
142
143*Kerberos:* Developed by MIT, Kerberos is a computer-network authentication
144protocol that works on the basis of tickets to allow nodes communicating over a
145non-secure network to prove their identity to one another securely. This is most
146commonly used in business environments when used as the authentication and
147encryption method for Windows Active Directory (AD).
148
149* Cybersecurity Controls
150
151If you're someone who needs solutions on how to control risks associated with
152utilizing a cryptographic system, start with these basic controls:
153
154- *Policies:* A policy on the use of cryptographic controls for protection of
155  information is implemented and is in accordance with organizational
156  objectives.
157- *Key management:* A policy on the use, protection and lifetime of
158  cryptographic keys is implemented through the entire application lifecycle.
159- *Key size:* The organization has researched the optimal key size for their
160  purposes, considering national laws, required processing power, and longevity
161  of the solution.
162- *Algorithm selection:* Implemented algorithms are sufficiently appropriate for
163  the business of the organization, robust, and align with recommended
164  guidelines.
165- *Protocol configuration:* Protocols have been reviewed and configured suitable
166  to the purpose of the business.