Home > Notes > Computer-Networks > Cryptography

Cryptography Fundamentals

Cryptography is the science of securing information through techniques like encryption, hashing, and key exchange, ensuring properties like confidentiality, integrity, and authenticity. Below, I explain each concept in detail, building from basics to advanced applications, with examples for clarity.

Hashing Algorithm

A hashing algorithm (or hash function) is a one-way mathematical transformation that converts input data (of any size) into a fixed-length output string (hash/digest). It is deterministic (same input = same output) but irreversible (can't reconstruct input from hash).

Key Properties

Common Algorithms

Algorithm Output Size Security Level Use Case
MD5 128 bits Broken (collisions easy) Legacy checksums
SHA-1 160 bits Weak (collisions found) Phasing out
SHA-256 256 bits High (SHA-2 family) Password hashing, digital signatures
SHA-3 256–512 bits Highest (Keccak sponge) Post-quantum candidate

Example (Python):

import hashlib
data = "Hello, World!"
hash_obj = hashlib.sha256(data.encode())
print(hash_obj.hexdigest())  # a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e

Applications: Password storage (salted hashes), file integrity (checksums), blockchain (Merkle trees).

Message Integrity

Message Integrity ensures data has not been altered during transmission or storage. Cryptography achieves this via hashing or Message Authentication Codes (MACs), verifying the receiver gets the exact sender's content.

Key Concepts

Mechanisms

  1. Hash-Based (Integrity Only): Sender appends hash of message; receiver recomputes and compares.
  2. Limitation: No authenticity (anyone can generate hash).
  3. MAC (Integrity + Authenticity): HMAC (Hash-based MAC) = hash(message + key).
  4. HMAC-SHA256: Secure, fast.
  5. Digital Signatures: Asymmetric (private key signs hash which means hash of message + key is encrypted using private key) for non-repudiation. Signing is typically performed on the hash of a message rather than the message itself, primarily because the message may be large, and cryptographic operations like modular exponentiation are computationally expensive when applied directly to large data

Process

Example (Python HMAC):

import hmac
import hashlib
key = b'secret-key'
message = b"Hello, World!"
mac = hmac.new(key, message, hashlib.sha256).digest()
# Verify: hmac.new(key, message, hashlib.sha256).digest() == mac

Applications: File verification (SHA checksums), API requests (HMAC in AWS signatures), blockchain blocks.

Confidentiality

Confidentiality (or privacy) ensures data is accessible only to authorized parties, preventing unauthorized reading (e.g., via encryption).

Key Concepts

Mechanisms

Applications: HTTPS (TLS encrypts traffic), disk encryption (BitLocker), VPNs.

Symmetric Encryption

Symmetric Encryption uses the same key for encryption and decryption (shared secret).

Key Concepts

AES Example (Block Cipher)

Python Example:

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
key = b'16-byte-key!!'
iv = b'16-byte-iv!!'
cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
encryptor = cipher.encryptor()
ciphertext = encryptor.update(b'plaintext') + encryptor.finalize()

Pros: Fast, simple. Cons: Key distribution risk.

Asymmetric Encryption

Asymmetric Encryption (public-key cryptography) uses a key pair: public (shareable) for encryption, private (secret) for decryption.

Key Concepts

Algorithms

Algorithm Basis Use
RSA Prime factorization Encryption/signing.
ECC (Elliptic Curve) Elliptic math Efficient mobile.

Pros: Secure key exchange. Cons: Slower than symmetric.

Using Asymmetric Keys

Nuance: Asymmetric for small data (keys, hashes); symmetric for bulk.

Authentication

Authentication verifies identity (who you are), using credentials or tokens.

Types

Mechanisms

Applications: Login, API auth.

Anti-Replay

Anti-Replay prevents attackers from reusing intercepted messages (replay attacks).

Mechanisms

Example (JWT): Include iat (issued-at) and nonce; validate server-side.

Nuance: Combine with TLS for freshness.

RSA Example

RSA (Rivest-Shamir-Adleman, 1977) is a public-key algorithm for encryption/signing based on prime factorization difficulty.

Key Generation

  1. Choose primes p, q (e.g., 1024-bit each).
  2. n = p × q (modulus, 2048 bits).
  3. φ(n) = (p-1)(q-1) (Euler's totient).
  4. e = public exponent (e.g., 65537, coprime to φ(n)).
  5. d = private exponent (d × e ≡ 1 mod φ(n)).
  6. Public Key: (n, e); Private Key: (n, d).

Encryption/Decryption

Signing/Verification

Python Example (RSA Signing):

from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes, serialization

# Generate keys
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()

message = b"Hello, RSA!"
# Sign
signature = private_key.sign(
    message,
    padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
    hashes.SHA256()
)
# Verify
try:
    public_key.verify(
        signature,
        message,
        padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
        hashes.SHA256()
    )
    print("Signature valid")
except:
    print("Invalid signature")

Nuance: RSA for small data (use hybrid with AES for large).

Diffie-Hellman Key Exchange

Diffie-Hellman (DH) is a method for two parties to agree on a shared secret key over insecure channels, without exchanging the key directly (1976, Diffie/Hellman).

How It Works (Modular Exponentiation)

  1. Public Parameters: Shared prime p (large, e.g., 2048-bit) and generator g (primitive root mod p).
  2. Private Keys: Alice chooses a (secret); Bob chooses b (secret).
  3. Public Values: Alice computes A = g^a mod p, sends A. Bob computes B = g^b mod p, sends B.
  4. Shared Secret: Alice computes K = B^a mod p = (g^b)^a mod p = g^(ab) mod p.
    Bob computes K = A^b mod p = g^(ab) mod p.
  5. Result: Both have identical K (shared secret), used for symmetric encryption (e.g., AES key).

Security

Nuance: Vulnerable to MITM (use authenticated DH, e.g., with signatures); ephemeral for forward secrecy.