Module 2

Symmetric & Asymmetric Key Cryptography and Key Management

1. Cryptography
● Cryptography is the science of protecting information by converting it into an unreadable format.
● Objectives / Goals: Confidentiality, Integrity, Availability, Authentication, Non-repudiation.

2. Symmetric Key Cryptography

● Definition: In symmetric key cryptography, the same key is used for encryption and decryption.
● Formulas: C = E_K(P), P = D_K(C)
● Advantages: Fast, suitable for bulk data encryption, less computation.
● Disadvantages: Key distribution problem, scalability issue, etc.
● Algorithms: Block ciphers (AES, DES, 3DES, Blowfish, IDEA), Stream ciphers (RC4, ChaCha20).
● Use case: Encrypting a file in a company server using AES.

3. Asymmetric Key Cryptography (Public Key Cryptography)

● Definition: Uses two keys – Public Key (PU) shared openly and Private Key (PR) kept secret.
● Formulas: C = E_PU(P), P = D_PR(C)
● Advantages: Solves key distribution, supports digital signatures, provides authentication and non-
repudiation.
● Disadvantages: Slow, not used for bulk encryption directly.
● Algorithms: RSA, Diffie-Hellman, ECC, DSA.
● Use cases: HTTPS/SSL/TLS, digital certificates, secure email (PGP: Pretty Good Privacy), digital
signatures.

4. Symmetric vs Asymmetric Cryptography

Sr.
Feature Symmetric Cryptography Asymmetric Cryptography
No
1 Uses one key (same key for Uses two keys (Public key + Private
Keys used
encryption & decryption) key)
2 Encryption/Decry Same secret key is shared Public key encrypts, private key
ption between sender & receiver decrypts (or vice-versa)
3 Speed Fast Slow (more computations)
4 Secure, but key sharing is a More secure for key exchange because
Security
challenge private key is never shared
5 Difficult (key must be shared Easy (public key can be shared
Key distribution
secretly) openly)
6 Encrypting large data / bulk Secure key exchange, digital
Best used for
messages signatures
7 Examples AES, DES, 3DES, Blowfish RSA, ECC, DSA
8 If key is leaked → all data is
Main disadvantage Slower and not efficient for large data
compromised
5. Hybrid Cryptosystem
● Modern systems use both: Asymmetric cryptography for key exchange and symmetric
cryptography for data encryption.
● Example: HTTPS uses RSA for session key exchange and AES for data encryption.

6. Key Management
● Meaning: Handling cryptographic keys securely throughout their lifecycle.
● Key lifecycle: Generation, distribution, storage, usage, rotation, revocation, destruction.
● Issues: Key distribution, storage, rotation, revocation.
● Techniques: Key Distribution Center (KDC), Public Key Infrastructure (PKI).

7. Block Cipher Principles

● Definition: Encrypts plaintext in fixed-size blocks (AES block size = 128 bits).
● Key concepts: Confusion, diffusion, avalanche effect.
● Structures: Feistel (DES), SPN (AES).

8. Block Cipher Modes of Operation

Encryption algorithms are divided into two categories based on the input type: block cipher and
stream cipher. A block cipher is an encryption algorithm that takes a fixed-size input (e.g., b bits) and
produces a ciphertext of b bits. If the input is larger than b bits, it can be divided further. There are
several modes of operation for a block cipher, each suited for different applications and uses.

What are Block Cipher Modes of Operation?

Block Cipher Modes of Operation define how to securely encrypt and decrypt large amounts of data
using a block cipher. A block cipher is an encryption algorithm that processes data in fixed-size blocks
(e.g., 128 bits) rather than one bit at a time. However, to encrypt data larger than a single block,
different modes of operation are used to ensure both security and efficiency. Here are a few common
modes. Here are a few common modes:

Electronic Code Book (ECB)

The electronic codebook is the easiest block cipher mode of functioning. It is easier because of the
direct encryption of each block of input plaintext and output is in the form of blocks of encrypted
ciphertext. Generally, if a message is larger than b bits in size, it can be broken down into a bunch of
blocks and the procedure is repeated.

The procedure of ECB is illustrated below:

Advantages of using ECB

 Parallel encryption of blocks of bits is possible, thus it is a faster way of encryption.

 Simple way of the block cipher.

Disadvantages of using ECB

 In ECB mode, each block of plaintext is encrypted separately.

 So if two plaintext blocks are the same, their ciphertext blocks will
also be the same.

 Because of this, patterns in the original message can still be seen in

the encrypted message.

 This makes ECB easy to attack (hackers can guess information by seeing
repeated patterns).

Cipher Block Chaining (CBC):

Cipher block chaining or CBC is an advancement made on ECB since ECB

compromises some security requirements. In CBC, the previous cipher block is
given as input to the next encryption algorithm after XOR with the original
plaintext block. A cipher block is produced by encrypting an XOR output of the
previous cipher block and present plaintext block.
IV is a random starting block used only for the first plaintext block so that
encryption becomes different every time. It is Random / unpredictable. Unique
(should not repeat with same key).Key used in CBC is same for all P1,P2,P3....Pn.

The process is illustrated here:

Advantages of CBC

1) Good for long messages

 CBC works well when the data/message is larger than one block size (b
bits).

2) Provides better security

 Each plaintext block is mixed with the previous ciphertext block.

 So even if plaintext blocks are same, ciphertext blocks become different.

3) Harder to break (better against cryptanalysis)

 Because blocks are linked (chained), attackers cannot easily find patterns.
 So CBC is more resistant to attacks than ECB.

4) Hides patterns

 Unlike ECB, CBC does not show repeated patterns.

 Hence it is more secure than ECB.
5) Useful for authentication

 Since every block depends on previous block, any change in data will
affect the ciphertext.
 This property helps in detecting tampering (authentication purpose).

Disadvantages of CBC

Not suitable for parallel processing

 For encrypting/decrypting a block, CBC needs the previous ciphertext

block.
 So blocks cannot be processed independently.
 That’s why parallel encryption/decryption is difficult in CBC.

Cipher Feedback Mode (CFB)

In this mode the cipher is given as feedback to the next block of encryption with
some new specifications:

Step 1: Use IV

 First, we start with an Initial Vector (IV).

 IV is encrypted using the encryption algorithm and key.

Step 2: Take only s bits

 The output of encryption is b bits (block size).

 From this output, we take leftmost s bits.
Step 3: XOR with plaintext

 These s bits are XORed with plaintext s bits.

 The result becomes ciphertext (s bits).

Step 4: Feedback (shift register)

 Now this ciphertext is fed back into a shift register:

o b–s bits shift left
o new s ciphertext bits go to the right side
 This new register value becomes the input for the next round.

Step 5: Repeat

 The same steps continue for all blocks.

Advantages of CFB

1) Harder to break (difficult cryptanalysis)

 CFB uses a shift register + feedback mechanism.

 Because of this, ciphertext depends on previous data.
 So attackers cannot easily find patterns → cryptanalysis becomes difficult.

2) Works for any size of data

 CFB can encrypt any amount of data (small or large).

 It is suitable for continuous data streams (like audio/video/network
data).

Disadvantages of using CFB

 The drawbacks of CFB are the same as those of CBC mode. Both block
losses and concurrent encryption of several blocks are not supported by
the encryption.

 Slightly more complex and can propagate errors.

Output Feedback (OFB) Mode :

The output feedback mode follows nearly the same process as the Cipher
Feedback mode except that it sends the encrypted output as feedback instead of
the actual cipher which is XOR output. In this output feedback mode, all bits of
the block are sent instead of sending selected s bits. The Output Feedback mode
of block cipher holds great resistance towards bit transmission errors. It also
decreases the dependency or relationship of the cipher on the plaintext.

1. Start with an Initial Vector (IV).

2. Encrypt IV using key K → this produces an output block.
3. This output block acts like a keystream.
4. Now do: Ciphertext = Plaintext XOR Keystream
5. The encrypted output (keystream) is again fed back for the next step.
6. This continues for all blocks.
Advantages of OFB

1. No error propagation

 In CFB, if 1 bit error occurs in ciphertext, it can affect many next blocks.
 But in OFB, this problem is solved.
 If a transmission error happens, it affects only that bit in plaintext.
 So errors do not spread to the next blocks.

2. OFB is very good when the communication channel is noisy.

Disadvantages of OFB

1. More vulnerable to message modification attacks (attacker can change

ciphertext bits and plaintext also changes).

2. Keystream reuse is dangerous → if same key + IV is reused, security is

compromised

Counter (CRT)Mode :

 CTR is a block cipher mode that uses a counter instead of feedback.

 Each block gets a unique counter value, which is then encrypted and
XORed with plaintext to produce ciphertext.
 The CTR mode is independent of feedback use and thus can be
implemented in parallel.
 1. Start with a counter

 Usually a number that increases for each block (e.g., 0, 1, 2…).

2. Encrypt the counter

 Use the block cipher and key to encrypt the counter → gives a keystream
block.

3. XOR with plaintext

 Ciphertext = Plaintext ⊕ Encrypted Counter (keystream)

4. Increment counter

 Counter is increased for the next block and process repeats.

Advantages of CTR Mode

1. Same plaintext → different ciphertext

 Each block uses a different counter value, so even if plaintext repeats, the
ciphertext will be different.
 This hides patterns better than ECB.

2. Parallel processing possible

 CTR does not depend on previous blocks like CBC.

 So encryption and decryption of multiple blocks can be done at the same
time, which is faster.

Disadvantages of CTR Mode

1. Requires synchronized counters

 Both sender and receiver must use exactly the same counter sequence.
 If synchronization is lost, decryption will be wrong.

2. CTR is fast and secure, but only if counters stay in sync.