In this blog post, we’ll explore what cryptography is and examine the concepts of confidentiality, integrity, authentication, and non-repudiation—which are used to protect information—as well as the principles of encryption and decryption.
What Is Cryptography? Let’s think about what we actually mean when we say we’re “encrypting” something. First and foremost, we want to ensure that third parties cannot decrypt this information; secondly, we want to prevent the information from being forged or tampered with. Simply put, cryptography provides mathematical means to achieve precisely these goals. Cryptography has four main objectives: confidentiality, integrity, authentication, and non-repudiation. These four concepts are easy to understand when compared to the steps we take when sending a letter. After writing a letter, we sign it, place it in an envelope, and seal it. Here, the envelope represents confidentiality, the seal represents integrity, and the signature serves the roles of authentication and non-repudiation. The envelope prevents anyone from easily reading the letter’s contents, and the seal prevents others from altering the contents while the letter is in transit. The signature serves two purposes: first, it verifies the identity of the person who wrote the letter, and second, it makes it difficult for the sender to deny having written the letter’s contents. Cryptography is a field that provides these four security objectives mathematically, rather than through physical means like a letter, and to understand cryptography, it is necessary to define these objectives specifically.
Confidentiality means making it extremely difficult for anyone other than the intended recipient to read a message. A common example is ensuring that, in the absence of a password, there is no better method than trying every possible password one by one. For instance, to break the commonly used AES-256 encryption algorithm by trying every possible key, one would have to check 2²⁵⁶, or approximately 1.157×10⁷⁷, possible combinations. Therefore, it is difficult to decrypt the message within a reasonable amount of time by simply trying every possible combination one by one. Naturally, for such algorithms to be useful, it should not take a long time for the user who knows the password to decrypt the encrypted message. Furthermore, these algorithms must make it difficult to deduce the password even if the message and the encrypted data are disclosed.
Integrity refers to the ability to detect when a message has been altered by a third party. In other words, if someone without authorization to modify the information alters the message, there must be a high probability that the intended recipient will detect it. HMAC-SHA256, an algorithm that provides integrity, ensures that only someone who knows the secret key can calculate the correct tag; the probability that someone who does not know the secret key will generate the correct tag is 1/2²⁵⁶, or approximately 8.636×10⁻⁷⁸. Conversely, verifying which tag matches a message does not take long.
Authentication is the process of verifying that the other party is indeed the person with whom you wish to communicate. Specifically, it provides this functionality by leveraging the fact that the RSA public-key algorithm is difficult to factor. Unlike the AES mentioned above, RSA uses a public key and a private key. Information encrypted with a private key can be verified using the public key, and conversely, information encrypted with the public key can be decrypted using the private key. If the public key is made available to many people and the private key is held by a specific individual, that person can prove their identity by signing a specific message using their private key. The digital certificates that have been used in South Korea also utilize the principles of this public-key cryptography.
Finally, non-repudiation ensures that a specific action could only have been performed by me, and the fact that I performed that action is proven, making it difficult to deny. In a way, it is similar to the authentication explained earlier, but it serves a distinctly different security purpose. Systems such as OTR (Off-The-Record) may guarantee authentication but deliberately omit non-repudiation. However, when implemented, it is done in a manner similar to authentication.
If cryptography is the discipline of creating algorithms that achieve these four security objectives, then analyzing and breaking such algorithms is cryptanalysis, another branch of cryptography. The combination of these two is called cryptology. Cryptanalysis primarily aims to completely neutralize an encryption system or devise methods that are more effective than randomly guessing passwords. For example, to break the Caesar cipher, rather than trying every possible shift value one by one, one can exploit the fact that the letter “e” is the most frequently used character in the English language. Assuming that the most frequently occurring letter in the encrypted message represents “e,” the cipher can be decrypted much more easily and quickly. Researching and developing such improved methods is precisely the job of a cryptanalyst.
We use technologies derived from cryptography every day without even realizing it. When we open encrypted web pages, enter passwords, and communicate with one another, we rely on various encryption technologies. Understanding how these technologies have evolved, what research is currently underway, and what vulnerabilities they have is essential knowledge for protecting our information.
