Encryption

Symmetric vs. Asymmetric

 Definition of Encryption
• Encryption is a way of scrambling data so that only
authorized parties can understand the information.
• In technical terms, it is the process of converting
human-readable plaintext to incomprehensible text,
also known as ciphertext.
• In simpler terms, encryption takes readable data and
alters it so that it appears random.
• Encryption requires the use of a cryptographic key: a
set of mathematical values that both the sender and
the recipient of an encrypted message agree on.
 Encryption
• Data is encrypted using a key, and the decryption
is also done using the same key. There are a few
strategies used in cryptography algorithms.
• For encryption and decryption processes, some
algorithms employ a unique key. In such
operations, the unique key must be secured since
the system or person who knows the key has
complete authentication to decode the message
for reading.
 How does encryption work

• Encryption is a mathematical process that alters data using an encryption algorithm and
a key. Imagine if Alice sends the message "Hello" to Bob, but she replaces each letter in
her message with the letter that comes two places later in the alphabet. Instead of
"Hello," her message now reads "Jgnnq." Fortunately, Bob knows that the key is "2" and
can decrypt her message back to "Hello."
• Alice used an extremely simple encryption algorithm to encode her message to Bob.
More complicated encryption algorithms can further scramble the message.
• The receiving party needs the right key to decrypt the data.
• Data can be encrypted "at rest," when it is stored, or "in transit," while it is being
transmitted somewhere else.

• What is a key in cryptography?

• A cryptographic key is a string of characters used within an encryption algorithm for
altering data so that it appears random. Like a physical key, it locks (encrypts) data so
that only someone with the right key can unlock (decrypt) it.

•
 Types
• In symmetric encryption, there is only one key, and all
communicating parties use the same (secret) key for
both encryption and decryption.
• In asymmetric, or public key, encryption, there are
two keys: one key is used for encryption, and a
different key is used for decryption. The decryption
key is kept private (hence the "private key" name),
while the encryption key is shared publicly, for anyone
to use (hence the "public key" name). Asymmetric
encryption is a foundational technology for TLS (often
called SSL).
 Asymmetric Encryption
Asymmetric Cryptography is also known
as public-key cryptography. It uses public and
private keys for the encryption and decryption
of message. One key in the pair which can be
shared with everyone is called the public key.
The other key in the pair which is kept secret
and is only known by the owner is called the
private key.
How is encryption used to keep Internet
browsing secure?
• Encryption is foundational for a variety of technologies, but it is especially important for
keeping HTTP requests and responses secure.
• The protocol responsible for this is called HTTPS (Hypertext Transfer Protocol Secure). A website
served over HTTPS instead of HTTP will have a URL that begins with https:// instead of [Link]
usually represented by a secured lock in the address bar.
• HTTPS uses the encryption protocol called Transport Layer Security (TLS). In the past, an earlier
encryption protocol called Secure Sockets Layer (SSL) was the standard, but TLS has replaced SSL.
• A website that implements HTTPS will have a Transport Layer Security (TLS) certificate installed on
its origin server.
• TLS encryption can help protect web applications from data breaches and other attacks. Today,
TLS-protected HTTPS is a standard practice for websites. The Google Chrome browser
gradually cracked down on non-HTTPS sites, and other browsers have followed suit. Every day,
internet users are more wary of websites that do not feature the HTTPS padlock icon.

• What does TLS do?

• There are three main components to what the TLS protocol accomplishes: Encryption,
Authentication, and Integrity.
• Encryption: hides the data being transferred from third parties.
• Authentication: ensures that the parties exchanging information are who they claim to be.
• Integrity: verifies that the data has not been forged or tampered with.
• For a website or application to use TLS, it must have a TLS certificate installed on its origin
server. A TLS certificate is issued by a certificate authority to the person or business that owns a
domain. The certificate contains important information about who owns the domain, along with
the server's public key, both of which are important for validating the server's identity. .
 How does TLS work?
• A TLS connection is initiated using a sequence known as
the TLS handshake. When a user navigates to a website that
uses TLS, the TLS handshake begins between the user's
device (also known as the client device) and the web server.
• During the TLS handshake, the user's device and the web
server:
• Specify which version of TLS (TLS 1.0, 1.2, 1.3, etc.) they will
use
• Decide on which cipher suites (see below) they will use
• Authenticate the identity of the server using the server's
TLS certificate
• Generate session keys for encrypting messages between
them after the handshake is complete
 How does TLS work?

• The TLS handshake establishes a cipher suite for each communication session. The
cipher suite is a set of algorithms that specifies details such as which
shared encryption keys, or session keys, will be used for that particular session. TLS
is able to set the matching session keys over an unencrypted channel thanks to a
technology known as public key cryptography.

• The handshake also handles authentication, which usually consists of the server
proving its identity to the client. This is done using public keys. Public keys are
encryption keys that use one-way encryption, meaning that anyone with the public
key can unscramble the data encrypted with the server's private key to ensure its
authenticity, but only the original sender can encrypt data with the private key. The
server's public key is part of its TLS certificate.

• Once data is encrypted and authenticated, it is then signed with a message

authentication code (MAC). The recipient can then verify the MAC to ensure the
integrity of the data. This is kind of like the tamper-proof foil found on a bottle of
aspirin; the consumer knows no one has tampered with their medicine because the
foil is intact when they purchase it.
How does TLS work?
 Encryption Types
• The two main kinds of encryption are symmetric encryption
and asymmetric encryption. Asymmetric encryption is also
known as public key encryption.
• In symmetric encryption, there is only one key, and all
communicating parties use the same (secret) key for both
encryption and decryption.
• In asymmetric, or public key, encryption, there are two
keys: one key is used for encryption, and a different key is
used for decryption. The decryption key is kept private
(hence the "private key" name), while the encryption key is
shared publicly, for anyone to use (hence the "public key"
name). Asymmetric encryption is a foundational technology
for TLS (often called SSL).
 Why is encryption important?

• Privacy: Encryption ensures that no one can read communications or data at rest
except the intended recipient or the rightful data owner. This prevents attackers, ad
networks, Internet service providers, and in some cases governments from
intercepting and reading sensitive data, protecting user privacy.
• Security: Encryption helps prevent data breaches, whether the data is in transit or at
rest. If a corporate device is lost or stolen and its hard drive is properly encrypted,
the data on that device will still be secure. Similarly, encrypted communications
enable the communicating parties to exchange sensitive data without leaking the
data.
• Data integrity: Encryption also helps prevent malicious behavior such as on-path
attacks. When data is transmitted across the Internet, encryption ensures that what
the recipient receives has not been viewed or tampered with on the way.
• Regulations: For all these reasons, many industry and government regulations
require companies that handle user data to keep that data encrypted. Examples of
regulatory and compliance standards that require encryption include HIPAA,
PCI-DSS, and the GDPR.
• Commonly used symmetric encryption algorithms
include:
• AES
• 3-DES
• SNOW
• Commonly used asymmetric encryption
algorithms include:
• RSA
• Elliptic curve cryptography
 Encryption algorithms-Types
• Encryption algorithms are divided into two categories based on the input type: block
cipher and stream cipher.
• A block cipher is an encryption algorithm that takes a fixed-size input (e.g., b bits)
and produces a ciphertext of b bits. If the input is larger than b bits, it can be divided
further. There are several modes of operation for a block cipher, each suited for
different applications and uses.
• A block cipher is an encryption algorithm that processes data in fixed-size blocks
(e.g., 128 bits) rather than one bit at a time. However, to encrypt data larger than a
single block, different modes of operation are used to ensure both security and
efficiency.
• In stream cipher, one byte is encrypted at a time while in block cipher ~128 bits are
encrypted at a time. Initially, a key(k) will be supplied as input to pseudorandom bit
generator and then it produces a random 8-bit output which is treated as keystream.
The resulted keystream will be of size 1 byte, i.e., 8 bits. Stream ciphers are fast
because they encrypt data bit by bit or byte by byte, which makes them efficient for
encrypting large amounts of data [Link] ciphers work well for real-time
communication, such as video streaming or online gaming, because they can encrypt
and decrypt data as it's being transmitted.
 Symmetric Encryption
• Concept & Examples (AES, DES)
• A Symmetric encryption algorithm is an encryption
method that uses one key to encrypt and then decrypt
the data or message. Since this is a secret or private
key, the parties communicating using symmetric
encryption algorithms must securely exchange the
key. Symmetric encryption algorithms are in sharp
contrast to asymmetric encryption algorithms, which
rely on using one private key, and one public key to
encrypt and then decrypt the information.
• Symmetric key encryption algorithms have a key length of 128 or 256 bits.
Asymmetric encryption algorithms have a key length of 2048 (RSA) or higher.
• The symmetric encryption algorithms include AES, DES, 3DES, and RC4. The
algorithms that use asymmetric encryption are RSA and Diffie-Hellman.
• Symmetric encryption algorithms are generally used to send large amounts of data.
In contrast, asymmetric encryption algorithms are used to send small pieces of data.
• Symmetric encryption algorithms are not resource-intensive, at least not when
compared to asymmetric encryption algorithms, which generally consume more
compute and network resources.
• Symmetric encryption algorithms use one (1) key for encryption and decryption – it
is the same key. On the other hand, asymmetric encryption algorithms require two
(2) keys – one for encryption and another for decryption.
• Symmetric encryption has been around for some time. However, asymmetric
encryption is a more recent vintage and can perhaps better address some of the
problems organizations face today.
• Finally, symmetric encryption is generally fast when compared to asymmetric
encryption.
 AES-Advanced Encryption Standard

• Advanced Encryption Standard (AES) is a highly trusted encryption algorithm used to secure data
by converting it into an unreadable format without the proper key. It was developed by the
National Institute of Standards and Technology (NIST) in 2001. It is widely used today as it is much
stronger than DES and triple DES, despite being harder to implement. AES encryption uses
various key lengths (128, 192, or 256 bits) to provide strong protection against unauthorized
access. This data security measure is efficient and widely implemented in securing internet
communication, protecting sensitive data, and encrypting files. AES, a cornerstone of modern
cryptography, is recognized globally for its ability to keep information safe from cyber threats.
• AES is a Block Cipher.
• The key size can be 128/192/256 bits.
• Encrypts data in blocks of 128 bits each.
• That means it takes 128 bits as input and outputs 128 bits of encrypted ciphertext. AES relies on
the substitution-permutation network principle, which is performed using a series of linked
operations that involve replacing and shuffling the input data.
• AES performs operations on bytes of data rather than in bits. Since the block size is 128 bits, the
cipher processes 128 bits (or 16 bytes) of the input data at a time.
• AES considers each block as a 16-byte (4 byte x 4 byte = 128 ) grid in a column-major
arrangement.
• [ b0 | b4 | b8 | b12 |
| b1 | b5 | b9 | b13 |
| b2 | b6 | b10| b14 |
| b3 | b7 | b11| b15 ]
 AES-Advanced Encryption Standard
• AES is widely used in many applications that require secure data storage and transmission. Some
common use cases include:
• Wireless security: AES is used in securing wireless networks, such as Wi-Fi networks, to ensure
data confidentiality and prevent unauthorized access.
• Database Encryption: AES can be applied to encrypt sensitive data stored in databases. This helps
protect personal information, financial records, and other confidential data from unauthorized
access in case of a data breach.
• Secure communications: AES is widely used in protocols such as internet communications, email,
instant messaging, and voice/video calls. It ensures that the data remains confidential.
• Data storage: AES is used to encrypt sensitive data stored on hard drives, USB drives, and other
storage media, protecting it from unauthorized access in case of loss or theft.
• Virtual Private Networks (VPNs): AES is commonly used in VPN protocols to secure the
communication between a user's device and a remote server. It ensures that data sent and
received through the VPN remains private and cannot be deciphered by eavesdroppers.
• Secure Storage of Passwords: AES encryption is commonly employed to store passwords securely.
Instead of storing plaintext passwords, the encrypted version is stored. This adds an extra layer of
security and protects user credentials in case of unauthorized access to the storage.
• File and Disk Encryption: AES is used to encrypt files and folders on computers, external storage
devices, and cloud storage. It protects sensitive data stored on devices or during data transfer to
prevent unauthorized access.
•
 Data Encryption Standard (DES)
• Data Encryption Standard (DES) is a symmetric block cipher. By 'symmetric', we mean that the size
of input text and output text (ciphertext) is same (64-bits). The 'block' here means that it takes
group of bits together as input instead of encrypting the text bit by bit. Data Encryption Standard
(DES) has been found vulnerable to very powerful attacks and, therefore, it was replaced by
Advanced Encryption Standard (AES).
• It is a block cipher that encrypts data in 64-bit blocks.
• It takes a 64-bit plaintext input and generates a corresponding 64-bit ciphertext output.
• The main key length is 64-bit which is transformed into 56-bits by skipping every 8th bit in the
key.
• It encrypts the text in 16 rounds where each round uses 48-bit subkey.
• This 48-bit subkey is generated from the 56-bit effective key.
• The same algorithm and key are used for both encryption and decryption with minor changes.

• Working of Data Encryption Standard (DES)

• DES is based on the two attributes of the Feistel cipher, i.e., Substitution (also called confusion)
and Transposition (also called diffusion). DES consists of 16 steps, each of which is called a round.
Each round performs the steps of substitution and transposition along with other operations.
Data Encryption Standard (DES)
 Asymmetric Encryption- RSA Algorithm in
Cryptography
• Concept & Examples (RSA, ECC)
• RSA(Rivest-Shamir-Adleman) Algorithm is an asymmetric or public-key
cryptography algorithm which means it works on two different keys: Public Key and Private
Key. The Public Key is used for encryption and is known to everyone, while the Private Key is
used for decryption and must be kept secret by the receiver. RSA Algorithm is named after
Ron Rivest, Adi Shamir and Leonard Adleman, who published the algorithm in 1977.

• Example of Asymmetric Cryptography:

• If Person A wants to send a message securely to Person B:
• Person A encrypts the message using Person B's Public Key.
• Person B decrypts the message using their Private Key.

• RSA Algorithm is based on factorization of large number and modular arithmetic for
encrypting and decrypting data. It consists of three main stages:
• Key Generation: Creating Public and Private Keys
• Encryption: Sender encrypts the data using Public Key to get cipher text.
• Decryption: Decrypting the cipher text using Private Key to get the original data.
 Asymmetric Encryption- Elliptic Curve
Cryptography?
• ECC, an alternative technique to RSA, is a powerful cryptography
approach. It generates security between key pairs for public key
encryption by using the mathematics of elliptic curves.
• RSA achieves one-way encryption of things like emails, data, and software
using prime factorization.
• RSA does something similar with prime numbers instead of elliptic curves,
but ECC has gradually been growing in popularity recently due to its
smaller key size and ability to maintain security. This trend will probably
continue as the demand for devices to remain secure increases due to the
size of keys growing, drawing on scarce mobile resources. This is why it is
so important to understand elliptic curve cryptography in context.
• ECC bases its approach to public key cryptographic systems on how elliptic
curves are structured algebraically over finite fields. Therefore, ECC
creates keys that are more difficult, mathematically, to crack. For this
reason, ECC is considered to be the next-generation implementation of
public key cryptography and is more secure than RSA.