Lecture-7-Intro To Cryptography, Lecture notes of Information Security and Markup Languages

Download Lecture-7-Intro To Cryptography and more Lecture notes Information Security and Markup Languages in PDF only on Docsity!

Cryptography

Chapter 7 CISSP

Cryptography

3.1.1 Definitions and

Concepts

When data is stored on a computer, it is usually protected by logical and physical access controls

When this same sensitive information is sent over a network, it can no longer take these controls for granted, and the information is in a much more vulnerable state

Without the right key, the captured

message is useless to an attacker.

Sender

Receiver

Cryptography

Definitions and Concepts

A system or product that provides encryption and decryption is referred to as a cryptosystem and can be created through hardware components or program code in an application

The cryptosystem uses an encryption algorithm

Most algorithms are complex mathematical formulas that are applied in a specific sequence to the plaintext

Cryptography

Definitions and Concepts

Most encryption methods use a secret value called a key (usually a long string of bits), which works with the algorithm to encrypt and decrypt the text

The algorithm, the set of rules also known as the cipher, dictates how enciphering and deciphering takes place

Many of the mathematical algorithms used in computer systems today are publicly known and are not the secret part of the encryption process

If the internal mechanisms of the algorithm are not a secret, then something must be

The secret piece of using a well-known encryption algorithm is the key

The larger the keyspace, the more available values can be used

to represent different keys—and the more random the keys

are, the harder it is for intruders to figure them out

Cryptography

Definitions and Concepts

When the algorithm needs to generate a new key, it uses random values from this keyspace

For example, if an algorithm allows a key

length of 2 bits, the keyspace for that

algorithm would be 4, which indicates the

total number of different keys that would be

possible. That would not be a very large

keyspace, and certainly it would not take an

attacker very long to find the correct key that

was used.

Key Length and Exhaustive Search Time

RAYMOND R.

PANKO

Key Length in Bits

Number of Possible Keys

112 5.1923E+

168 3.74144E+

256 1.15792E+

512 1.3408E+

Each extra bit doubles the number of keys

Shaded keys are

Strong symmetric keys

(>=100 bits)

Time Required For Decryption

Key Size (bits) Number of Alternative Keys

Time required at 1 decryption/μs

Time required at 10^6 decryptions/μs

32 232 = 4.3 × 10 9 231 μs = 35. minutes

2.15 milliseconds

56 256 = 7.2 × 10 16 255 μs = 1142 years 10.01 hours

128 2128 = 3.4 × 10 38 2127 μs = 5.4 × 10 24 years

5.4 × 10^18 years

168 2168 = 3.7 × 10 50 2167 μs = 5.9 × 10 36 years

5.9 × 10^30 years

26 characters (permutation)

26! = 4 × 10^26 2 × 10^26 μs = 6.4 × 1012 years

6.4 × 10^6 years

3.1.2 Kerckhoffs’ Principle

Auguste Kerckhoffs published a paper in 1883 stating that the only secrecy involved with a cryptography system should be the key. He claimed that the algorithm should be publicly known.

He asserted that if security were based on too many secrets, there would be more vulnerabilities to possibly exploit

Cryptographers in the private and academic sectors agree with Kerckhoffs’ principle, because making an algorithm publicly available means that many more people can view the source code, test it, and uncover any type of flaws or weaknesses

It is the attitude of “many heads are better than one.” Once someone uncovers some type of flaw, the developer can fix the issue, and provide society with a much stronger algorithm

3.1.3 The Strength of the

Cryptosystem

The strength of an encryption method comes from the algorithm, the secrecy of the key, the length of the key, the initialization vectors, and how they all work together within the cryptosystem.

When strength is discussed in encryption, it refers to how hard it is to figure out the algorithm or key, whichever is not made public.

The strength of an encryption method correlates to the amount of necessary processing power, resources, and time required to break the cryptosystem or to figure out the value of the key.

Breaking a cryptosystem can be accomplished by a brute force attack, which means trying every possible key value until the resulting plaintext is meaningful

Depending on the algorithm and length of the key, this can be an easy task or one that is close to impossible