Cryptography: Study of securing communication and data from adversaries.

Encryption: Process of converting plaintext into unintelligible ciphertext.

• Used to protect data in all three states (rest/transit/use).
• Strength comes from the key, not the algorithm.

Key: Essential piece of information that determines the output.

• Use large keys and rotate frequently.
• Length of key is proportional to the level of security it provides.

Protect your keys!

1. Store in secure hardware modules.
2. Encrypt at rest.
3. Transmit keys securely when used.
4. Limit key access to regular audits and monitoring.

Symmetric vs Asymmetric

Symmetric (Private Key)

Symmetric: Uses single key.

• Sender and receiver must know the same shared secret using a private held key.
• Very fast.

Issues:

• Non-repudiation.
• Sharing the secret key, especially at scale.

Common Algorithms

1. Data Encryption Standard (DES): Breaks input into 64-bit blocks and uses transposition and substitution to create a ciphertext with effective key strength of 56-bits.
2. Triple DES (3DES): Uses three separate keys to encrypt, decrypt, and then encrypt the plaintext into ciphertext to increase the strength of DES.¹1. 3DES applies the DES cipher algorithm three times to each data block. It uses three keys. It encrypts with Key 1, decrypts with Key 2, and encrypts with Key 3. The “decryption” step in the middle causes further scrambling if Key 2 is different from Key 1, while allowing backward compatibility with standard DES if all three keys are identical.
3. International Data Encryption Algorithm (IDEA): Block cipher which uses 64-bit blocks.
4. Advanced Encryption Standard (AES): Block cipher that uses 128/192/256-bit blocks and a matching encryption key size to encrypt plaintext into ciphertext. Strongest in this list.
5. Blowfish: Block cipher that uses 64-bit blocks and a variable length encryption key.
6. Twofish: 128-bit blocks and 128/192/256 bit encryption keys.
7. RC Cipher Suite:
   • RC4: Stream cipher using variable key size from 40 to 2048 bits used in SSL and WEP.
   • RC5: Block cipher that uses key sizes up to 2048 bits.
   • RC6: Block cipher introduced as a replacement for DES (lost to AES).

Asymmetric (Public Key)

Asymmetric: Uses two keys (one for encrypting, another for decrypting).

• Provides Confidentiality, Integrity, and non-repudiation (typically with digital signature).

Common Algorithms

1. Diffie-Hellman: Used to conduct key exchanged and secure key distribution over an unsecure network. Used for key exchange inside of creating a VPN tunnel establishment as part of IPSec.
2. RSA: Relies on mathematical difficulty of factoring prime numbers. Supports 1024 and 2048 bit keys.
3. Elliptic Curve Cryptography (ECC): Heavily used in mobile devices, based on algebraic structure of elliptical curves over finite fields. Most commonly used for mobile devices and low computer-power devices. ECC with 256 bit key is just as secure as RSA with 2048 bit key.
   • Elliptic Curve Diffie-Hellman (ECDH): ECC version of Diffie-Hellman key exchange.
   • Elliptic Curve Diffie-Hellman Ephemeral (ECDHE): Uses different key for each portion of key establishing process in the Diffie-Hellman key exchange.
   • Elliptic Curve Digital Signature Algorithm (ECDSA): Used as a public key encryption algorithm by the US government in their digital signatures.

Hybrid Implementation

Use asymmetric encryption to transfer a private key to do symmetric encryption (to get the speed benefits of symmetric encryption).

Stream v. Block Cipher

Stream Cipher: Utilizes a keystream generator to encrypt data bit-by-bit using a XOR function to create the ciphertext.

• Good for real-time communication data streams like video and audio.
• Usually requires some special hardware.

Block Cipher: Breaks input into fixed-length blocks of data and performs encryption on each block.

• Easier to setup and less susceptible to security issues.

Hashing

One-way cryptographic function that takes an input and produces a unique message digest as its output.

• Hash digests are always the same length.
• Used for integrity and non-repudiation if combined with encryption (signature).

Popular Algorithms

1. MD5: Creates 128-bit hash. Very prone to collisions.
2. SHA Family:
   • SHA-1: 160-bit hash digest.
   • SHA-2: 224—512-bit hash digest.²2. SHA-2 uses 64 rounds of logical functions and modular additions for SHA-256, and 80 rounds for SHA-512. (SHA-224, SHA-256, SHA-384, SHA-512).
   • SHA-3: 224—512 bits, more secure because uses 120 rounds of computations.
3. RIPEMD (RACE Integrity Primitive Evaluation Message Digest): Comes in 160-bit, 256-bit, and 320-bit versions. RIPEMD-160 is an open-source hashing algorithm that was created as a competitor to the SHA family.
4. HMAC (Hash-based Message Authentication Code): Used to check integrity of a message and provide some level of assurance of its authenticity. Paired with other algorithms; e.g., HMAC-MD5, HMAC-SHA1, etc.

Increasing Hash Security

Pass the Hash Attack

Hacker authenticates with a remote server/service by using the underlying hash of a user’s password instead of the plaintext password. Mimikatz is a tool that automates the process of harvesting the hashes and conducting the attack. Defense: Only allow trusted Operating Systems to connect, Multi-Factor Authentication, least privilege.

Birthday Attack

When hacker is able to use a collision.

Defense

1. Key Stretching: Technique used to mitigate a weaker key by increasing time needed to crack it.
2. Salting: Adding random data to the data before hashing (thwarts dictionary, brute force, and rainbow attacks).
   • Dictionary: Attacker tries every word from a predefined list.
   • Brute-force: Tries every possible combination.
   • Rainbow tables: Precomputed tables for reversing cryptographic hash functions.
3. Nonces: Stands for number used once, unique, often random number that is added to password-based authentication process. Basically the stored hash is always changing/ephemeral. Also defends against replay attacks where the attack is trying to record a successful authentication and play it back.
4. Limit Failed Logins: Drastically increase security.

Public Key Infrastructure (PKI)

Entire system of hardware, software, policies, procedures, and people based on asymmetric encryption.

PKI and Public Key Cryptography are related but NOT the same.

• PKI: System that creates the asymmetric key pairs that consist of the public and private keys that are used in the encryption and decryption process. It is the system that creates the whole connection from end-to-end. Pivotal in ensuring secure communication and data exchange over the internet.
• Public Key Cryptography: The encryption and decryption process. It is a small part of the PKI.
• Certificate Authority (CA): Trusted third party who issues digital certificates and keeps the level of trust between all of the certificate authorities around the world.
• Key Escrow: Process where cryptographic keys are stored in a secure third-party location. If an organization loses access to their encryption keys or a legal investigation they can still retrieve keys from the escrow account. If a malicious actor gets access to the escrow they can potentially decrypt vast amounts of data; so the escrow has to be extremely secure.

Digital Certificates

Digitally signed electronic document that binds a public key with a user’s identity.

Certificates

• Wildcard Certificate: Allows all subdomains to use the same public key certificate and have it displayed as valid.³3. A wildcard certificate applies to the primary domain and all its first-level subdomains (e.g., *.domain.com covers mail.domain.com and www.domain.com). Makes it easy to maintain, but means if you need to revoke a certificate, you need to revoke for everyone.
• Subject Alternate Name (SAN) Field: Certificate that specifies what additional domains and IP addresses are going to be supported. e.g., if you want to use the same certificate for a website on two different domains.
• Single-Sided Certificate: Only requires the server to be validated. The user does not need to be validated.
• Dual-Sided Certificate: Server and user must be validated. Requires twice the processing power on the server, so used in high-security environments.
• Self-Signed Certificate: Signed by same entity whose identity it certified (e.g., not by a third party or certificate authority). Not the same level of trust because no external verification.
• Third-party Certificate: Digital certificate issued and signed by a trusted Certificate Authority. Usually embedded into the web browser.

• Root of Trust: Each certificate is validated using concept of a root of trust or chain of trust which moves from bottom all the way to the top. The root of trust tends to be a large service provider like Verisign, Amazon, Google, Cloudflare.
• Registration Authority (RA): Requests identifying information from user and forwards certificate request unto the certificate authority to create a digital certificate.
• Certificate Signing Request (CSR): Block of encoded text that contains information about the entity requesting the certificate (Includes: Organization Name, Domain Name, Locality, Country). When an entity wants a digital certificate from a CA, they generate a CSR that includes the entity’s public key. The CA uses the public key to create the final digital certificate. The private key is never shared with anyone.
• Certificate Revocation List (CRL): Online list of digital certificates that a CA has revoked. Every CA maintains its own CRL. This lists every certificate that has ever been revoked, the CA checks this list before giving a user the public key associated with a certificate.
• Online Certificate Status Protocol (OCSP): Lets you determine the revocation status of any digital certificate using its serial number. Alternative to CRL. Faster than the CRL because you do not need to set up a whole connection. Downside is less secure.
• OCSP Stapling: Allows certificate holder to get the OCSP record from the server at regular intervals. Eliminates user having to make an extra connection to check OCSP, speeding up tunnel creation process.
• Public Key Pinning: Allows HTTPS website to resist persistent impersonation attacks by presenting a set of trusted public keys as part of the HTTP header.
• Key Escrow: When secure copy of user’s private key is being held. Used by organizations that cannot accept data loss.
• Key Recovery Agent: Specialized software that allows restoration of a lost or corrupted key. Used in cases of major incident or disaster.

Blockchain

Shared immutable ledger for recording transactions, tracking assets, and building trust.

• A really long series of information with each block containing information; and each block contains the hash of the block before it.
• Applications not limited to financial or cryptocurrencies.

Public Ledger: Record-keeping system that maintains participants’ identities in a secure and anonymous format.

Smart Contracts: Self-executing contracts where the terms of agreement or conditions are written directly into lines of code.

• Once a smart contract is deployed, it cannot be altered, making the agreement tamper-proof and trustworthy.
• Recording everything transparently on the blockchain can form a chain of trust.

Permissioned Blockchain: Used for business transactions.

• Promotes new levels of trust and transparency using immutable public ledgers.
• Puts the entire supply chain of a piece of data onto an immutable public ledger.

Encryption Tools

Trusted Platform Module (TPM)

Dedicated microcontroller designed to secure hardware through integrated cryptographic keys (e.g., Windows Bitlocker).

Hardware Security Module (HSM)

Physical device that safeguards and manages digital keys for mission critical situations like financial transactions.

• While TPM is like a personal vault, HSM is like a bank vault.
• Generates cryptographic keys and provides accelerated cryptographic operations.
• Used by companies especially to reach regulatory compliance to deal with sensitive data.

Key Management Systems

Integrated approach for generating, distributing, and managing cryptographic keys for devices and applications.

• Controls entire lifecycle of cryptographic keys from inception to retirement and destruction.

Secure Enclave

Co-processor integrated in the main processor of some device designed with sole purpose of protecting information.

• By keeping data separate form main processor, even if device gets compromised, data in secure enclave remains untouched (e.g., Apple Face ID is stored in a secure enclave).

Obfuscation

Steganography

Concealing a message within another so the existence of a message is hidden.

• Goal is not to prevent unauthorized access, but to prevent suspicion there is any hidden data.
• Frequently used alongside encryption.

Tokenization

Substituting sensitive data elements with non-sensitive equivalents (tokens) that have no meaningful value.

Data Masking

Ensure data is recognizable but does not include sensitive information.

• e.g., showing only last few digits of a SSN or credit card; Replacing customer names and locations when testing a non-production system.

Cryptographic Attacks

Techniques and strategies that adversaries employ to exploit vulnerabilities in cryptographic systems with intent to compromise the Confidentiality, Integrity, or Availability of data.

Downgrade Attacks

Aims to force a system to use a weaker/older cryptographic standard/protocol than it is currently using.

Defenses:

• Provide no backwards compatibility.

Collision Attacks

Aims to find two different inputs that produce the same hash output.

Birthday Attack: Probability that two distinct inputs will produce a collision.

Quantum Computing

Quantum computing is designed for very specific use cases and has enormous computation power. Cryptography relies on doing simple math problems to create a very complex thing; but quantum computers have been shown to be capable of breaking the asymmetric key exchange the entire PKI relies on.

Post-Quantum Cryptography: New kind of cryptographic algorithm that can be implemented using today’s classical computers but is also impervious to attacks from future quantum computers.

Methods:

1. Increase key size to combat brute force (Works well for symmetric).
2. Other approaches (e.g., lattice-based cryptography, super singular isogeny key exchange).

Current Post-Quantum Standards:

• For general encryption: CRYSTALS-Kyber (recommended by NIST).
• Signatures: CRYSTALS-Dilithium (recommended by NIST), FALCON, SPHINCS+.