• Plaintext: Readable, unencrypted data
• Ciphertext: Encrypted, scrambled output
• Algorithm: Mathematical procedure for encryption (AES, RSA)
• Key: Secret value determining encryption output; same algorithm + different key = different ciphertext
• Key Length: Measured in bits; longer = exponentially harder to brute force (e.g., 128-bit vs 256-bit AES)
– Trade-off: Longer keys require more CPU/memory (hardware resources), latency in real-time comms
| Type | Purpose | Algorithms |
|---|---|---|
| Symmetric | Bulk confidentiality | AES256 |
| Asymmetric | Authentication | RSA2048, ECC256 |
| Hashing | Password storage | SHA2 (SHA256) |
| Key exchange | Forward secrecy | Diffie-Hellman |
• AES (Advanced Encryption Standard): Current standard; 128/192/256-bit keys; efficient in hardware/software
• Use Cases: Disk encryption, VPN tunnels (after key exchange), database encryption
• Key distribution problem-how to share the key securely?
• RSA: Industry standard; common key sizes 2048-bit (minimum) to 4096-bit
• ECC (Elliptic Curve Cryptography): Same security as RSA with smaller keys (faster, less CPU power); 256-bit ECC is good for IoT and mobile phones
• Use Cases: Checking identity (logging into remote servers e.g. SSH keys), key exchange, digital signatures, encrypting small amounts of data
• Rule: Encrypt with public, decrypt with private; Sign with private, verify with public
• SHA-256/SHA-3: Secure, current standard (SHA-2 family)
• MD5: Broken, vulnerable to collisions; never use for security
• HMAC: Hash-based Message Authentication Code; hash + secret key (authenticity + integrity)
• Same input = same hash; any change = completely different hash
Password Security
• Salting: Random data appended to password before hashing; prevents rainbow table attacks; unique salt per user
• Key Stretching: Repeat hashing thousands of times to slow brute-force attempts if you have to use an old algorithm (e.g. MD5)
• Obfuscation: Making code hard to read (not encryption), protects code from being stolen by other companies. Can be reversed
• Steganography: Hiding data within other data (images, audio, video); invisible to humans; provides confidentiality via obscurity
• Diffie-Hellman (DH): Key exchange protocol; two parties generate the same shared secret without exchanging the key (so it doesn't get intercepted)
• Perfect Forward Secrecy (PFS): Ephemeral DH keys that are deleted after being used. A compromise of the server's private key doesn’t decrypt past communications because attackers can't get the Diffie-Hellman session keys that were deleted
• Digital Signatures: Hash encrypted with sender’s private key; provides integrity (hash), authentication (private key), non-repudiation (only signer has private key)
• Cryptoprocessors: Dedicated chips for crypto operations (TPM, HSM)
• TPM (Trusted Platform Module): Hardware chip for key storage on the motherboard of an individual device
• HSM (Hardware Security Module): Network-wide server, tamper-resistant device for enterprise key management
• Framework managing digital certificates to bind public keys to identities
Components
• CA (Certificate Authority): Trusted third party issuing/signing certificates
• Digital Certificate: Electronic document (X.509 standard) containing public key, identity, validity period, CA signature
• Generation: Strong randomness (entropy) critical; weak RNG = predictable keys
• Storage: HSMs, TPMs, password managers; never hardcode in software
• Rotation: Periodic replacement to limit exposure window; automated vs manual
• Escrow: Third party holds decryption keys (recovery agents); controversial for privacy (government access) but necessary for business continuity (encrypted employee leaves)
• CSR (Certificate Signing Request): File sent to CA containing public key + requested identity info; encrypted with subject’s private key to prove possession
• Subject Name Attributes: CN (Common Name), O (Organization), OU (Org Unit), L (Locality), C (Country), SAN (Subject Alternative Name) – modern browsers require SAN, ignore CN
• Revocation: Canceling a certificate before it expires
– CRL (Certificate Revocation List): Downloaded list of revoked certs; updated periodically
– OCSP (Online Certificate Status Protocol): Real-time query; faster but leaks browsing history
– Stapling: Server attaches OCSP response to handshake (improves privacy/performance)
– Reasons for revoking: Compromised key, hostname change, CA compromise, company has closed its business
• Cryptographic Links: Each block contains hash of previous block to prove integrity
• Use Cases: Cryptocurrency, digital voting, supply chain integrity