Cryptography and Its Types |Cryptography in cyber security

Some Basic Terminology of Cryptography...

Plain Text: An original message is known as the plain text. It is the actual message that both sender and receiver can understand also by anyone else who gets an access to that message.

Cipher text: The coded message is called the ciphertext. When any plain text is codified using a suitable scheme and the resulting message is cipher text.

Encryption: The process of converting plaintext into ciphertext is known as enciphering or encryption.

Decryption: Restoring the plaintext from the cyphertext is known as deciphering or decryption.

Cryptography: The art and science to achieve security by encoding messages to make them unreadable are known as Cryptography. 

Cryptanalysis: The technique to decode an unreadable code to readable again without knowing how they were initially converted from readable to unreadable is Cryptanalysis.

Cryptology: The areas of cryptography and cryptanalysis together are called cryptology

Thus, Cryptology = Cryptography + Cryptanalysis.

Cryptography:

Cryptography is a technique of secret writing. It is the process of hiding or coding information so that only the person a message was intended for can read it. A common cryptography definition is the practice of coding information to ensure only the person that a message was written for can read and process the information. Cryptography is the art of keeping information secure by transforming it into form that unintended recipients cannot understand.

Cryptography is associated with the process of converting ordinary plain text into unintelligible text and vice-versa. It is a method of storing and transmitting data in a particular form so that only those for whom it is intended can read and process it.

Cryptography is the study of secure communications techniques that allow only the sender and intended recipient of a message to view its contents. The term is derived from the Greek word kryptos, which means hidden. It is closely associated to encryption, which is the act of scrambling ordinary text into what's known as ciphertext and then back again upon arrival. 

Cryptography not only protects data from theft or alteration, but can also be used for user authentication. It is used in many applications like banking transactions cards, computer passwords, and e- commerce transactions.

The main objectives of cryptography are:

Confidentiality: To ensure that the information is not read by anyone for whom it was unintended and is read only by authorized parties.

Integrity: To ensure that the information wasn’t altered in storage or transit between sender and intended receiver.

Non-repudiation: To ensure that the sender of the information cannot deny at a later stage his or her intentions in the creation or transmission of the information.

Authentication: To ensure that the sender and receiver can confirm each others identity and the origin/destination of the information.

 

There are two basic types of cryptographic systems:

1.  Public Key Cryptography

2.  Private Key Cryptography

Public Key Cryptography: Public key cryptography also known as asymmetric cryptography is a class of cryptographic system that uses two keys- a public key and a private key. A public key is known to everyone while private key (or secret key) is known only to the recipient of the message.

With asymmetric crypto, two different keys are used for encryption and decryption. Every user in an asymmetric cryptosystem has both a public key and a private key. The private key is kept secret at all times, but the public key may be freely distributed.

Private Key Cryptography: Private key cryptography, also known as Symmetric Cryptography or Secret key cryptography is a method in which the same key is used to encrypt and decrypt the message. In private key cryptography, sender and the recipient of the message must agree on a common key via some alternative secure channel. The sender encrypts the plaintext message using the key and sends it to the recipient who then uses the same key to decrypt it and unlock the original plaintext message.

With symmetric cryptography, the same key is used for both encryption and decryption. Both the sender and receiver share a single key. The sender uses this key to encrypt plaintext and send the cipher text to the receiver. On the other side the receiver applies the same key to decrypt the message and recover the plain text.

The Importance of Cryptography:

Cryptography remains important to protecting data and users, ensuring confidentiality, and preventing cyber criminals from intercepting sensitive corporate information. Common uses and examples of cryptography include the following:

Privacy and Confidentiality: Individuals and organizations use cryptography on a daily basis to protect their privacy and keep their conversations and data confidential. Cryptography ensures confidentiality by encrypting sent messages using an algorithm with a key only known to the sender and recipient. A common example of this is the messaging tool WhatsApp, which encrypts conversations between people to ensure they cannot be hacked or intercepted. 

Cryptography also secures browsing, such as with virtual private networks (VPNs), which use encrypted tunnels, asymmetric encryption, and public and private shared keys.

Authentication and Integrity: Similar to how cryptography can confirm the authenticity of a message, it can also prove the integrity of the information being sent and received. Cryptography ensures information is not altered while in storage or during transit between the sender and the intended recipient. For example, digital signatures can detect forgery or tampering in software distribution and financial transactions.

Non-repudiation: Cryptography confirms accountability and responsibility from the sender of a message, which means they cannot later deny their intentions when they created or transmitted information. Digital signatures are a good example of this, as they ensure a sender cannot claim a message, contract, or document they created to be fraudulent. Furthermore, in email non-repudiation, email tracking makes sure the sender cannot deny sending a message and a recipient cannot deny receiving it.

Cryptanalysis and Brute-Force Attack:

Typically, the objective of attacking an encryption system is to recover the key in use rather than simply to recover the plaintext of a single ciphertext. There are two general approaches to attacking a conventional encryption scheme:

 

Cryptanalysis:

Cryptanalysis is the science of recovering plaintext of the message without having access to the key. It is a technique of converting ciphertext to plaintext. It's also known as cracking codes. The main objective of cryptanalysis is to discover weaknesses in or otherwise defeat encryption algorithms.

Cryptanalysis is the decryption and analysis of codes, ciphers or encrypted text. It uses mathematical formulas to search for algorithm vulnerabilities and break into cryptography or information security systems. Cryptanalysis also termed code-cracking, is the in-depth understanding of several methods in order to decode and decrypt the encrypted information and data, without any access to the confidential information.

Cryptanalysis is the study of methods for obtaining the meaning of encrypted information, without access to the secret information that is typically required to do so. Typically, this involves knowing how the system works and finding a secret key. Cryptanalysis is also referred to as codebreaking or cracking the code. The ciphertext is generally the easiest part of a cryptosystem to obtain and, therefore, is an important part of cryptanalysis. Depending on what information is available and what type of cipher is being analyzed, cryptanalysts can follow one or more attack models to crack a cipher. 

Various Cryptanalysis Attacks:

Cryptanalytic attacks rely on the nature of the algorithm plus some knowledge of the general characteristics of the plaintext or even some sample plaintext-ciphertext pairs.

There are 5 types of cryptanalytic attacks, and all of them are given below:

Ciphertext Only attacks: Attacker uses known ciphertext collections. In this attack, the attacker only has some ciphertext and attempts to decrypt the encryption key and plaintext using only the ciphertext. It is considered that attacker understand the algorithm and can intercept the ciphertext.

This type of attack is conceivable when the attacker just has access to some ciphertext and is attempting to decipher the encryption key and plaintext.

In this sort of attack, the attacker only has some ciphertext and attempts to decrypt the encryption key and plaintext using only the ciphertext. The ciphertext-only attack is the easiest to defend against because the opponent has the least amount of information to work with.


Known Plaintext attacks: In this type of attack, the analyst may be able to capture one or more plaintext messages as well as their encryptions. Or the analyst may know that certain plaintext patterns will appear in a message.

The cryptanalyst understand some plaintext pairs that have been collected earlier, moreover the intercepted ciphertext that it wants to break. In this case the attacker is aware of plaintext-ciphertext pairings. An attacker just needs to map those pairings to find the encryption key. This assault is quite simple since the attacker already has a wealth of information at his disposal.

Some plaintext-ciphertext combinations are previously known in this type of attack. In order to find the encryption key, the attacker maps them. This assault is easy to carry out because a large amount of information is already available.


Chosen Plaintext attacks: The attacker selects random plaintexts, obtains the ciphertexts, and attempts to decrypt the message. Chosen-plaintext attack is same to known-plaintext attack but the plaintext pairs have been selected by the attacker himself. This type of attack is simpler to implement but they are less likely to appear.

This attack is carried out by selecting random plaintexts and then acquiring the ciphertexts that correspond to them. The encryption key must be discovered by the attacker. Though it is comparable to KPA and is reasonably easy to deploy, it has a low success rate.

Chosen Ciphertext attack: The chosen-ciphertext attack is same to the chosen plaintext. In this, the attacker selects some ciphertext and decrypts it to develop a plaintext. This attack is applicable if the attacker has access to the receiver’s computer.


Chosen Text attack: It is the combination of Chosen Plaintext attack and Chosen Ciphertext attack.


Following table summarizes the various types of cryptanalytic attacks based on the amount of information known to the cryptanalyst:

Type of Attack	Known to Cryptanalyst
Ciphertext Only	·    Encryption algorithm ·    Ciphertext
Known Plaintext	·    Encryption algorithm ·    Ciphertext ·    One or more plaintext-ciphertext pairs formed with the secret key
Chosen Plaintext	·    Encryption algorithm ·    Ciphertext ·    Plaintext message chosen by cryptanalyst, together with its corresponding ciphertext generated with the secret key
Chosen Ciphertext	·    Encryption algorithm ·    Ciphertext ·    Ciphertext chosen by cryptanalyst, together with its corresponding decrypted plaintext generated with the secret key
Chosen Text	·    Encryption algorithm ·    Ciphertext ·    Plaintext message chosen by cryptanalyst, together with its corresponding ciphertext generated with the secret key ·    Ciphertext chosen by cryptanalyst, together with its corresponding decrypted plaintext generated with the secret key

Brute-Force Attack:

A brute-force attack involves trying every possible key until an intelligible translation of the ciphertext into plaintext is obtained. On average, half of all possible keys must be tried to achieve success. That is, if there are X different keys, on average an attacker would discover the actual key after X/2 tries. A brute force attack against a cipher consists of breaking a cipher by trying all possible keys.

A brute force attack uses trial-and-error to guess login info, encryption keys, or find a hidden web page. Hackers work through all possible combinations hoping to guess correctly. The attacker submits combinations of usernames and passwords until they finally guess correctly. During the brute-force attack, the intruder tries all possible keys (or passwords), and checks which one of them returns the correct plaintext. A brute-force attack is also called an exhaustive key search.

These attacks are done by ‘brute force’ meaning they use excessive forceful attempts to try and ‘force’ their way into your private account(s). This is an old attack method, but it's still effective and popular with hackers.

A brute-force attack is a trial-and-error method used by application programs to decode login information and encryption keys to use them to gain unauthorized access to systems. Using brute force is an exhaustive effort rather than employing intellectual strategies.

Difference between Cryptography and Cryptanalysis:

Cryptography is used to disguise information, particularly via an unprotected route or transmission method. Most messages, including bank interactions and email correspondence, are now sent via the internet. As a result, message security is essential. This technique converts a plaintext (message to be conveyed) message to a ciphertext message using encryption techniques. Decryption is the process of converting plaintext to ciphertext.

Cryptanalysis is a method of converting ciphertext to plaintext. An unauthorized individual attempts to decode the communication by listening in on the unsecured connection. It is also known as code-breaking. This person is not bound by any rules. He may obtain in any manner.

Traditional Symmetric Ciphers:

There are two ways by which we can primarily change plain text to cipher text. The two basic building blocks of all encryption techniques are:

• Substitution Technique
• Transposition Technique

Substitution Technique:

Substitution Technique is a way of encrypting the message where characters or symbols replace the original plaintext. It is a classical encryption technique where the characters present in the original message are replaced by the other characters or numbers or by symbols. If the plain text (original message) is considered as the string of bits, then the substitution technique would replace bit pattern of plain text with the bit pattern of cipher text.

Some of the substitution techniques which will help us to understand the procedure of converting plain text o cipher text are explained below:

1. Caesar Cipher

2. Monoalphabetic Cipher

3. Playfair Cipher

4. Hill Cipher

5.  Polyalphabetic Cipher

6. One-Time Pad

 

Caesar Cipher:

Caesar Cipher is the simplest substitution technique proposed by Julius Caesar. In this technique, each character of the plaintext message will be replaced by another character, symbol or number. To encrypt the plain text, each alphabet of the plain text is replaced by the alphabet three places further it. And to decrypt the cipher text each alphabet of cipher text is replaced by the alphabet three places before it.

 

Formula is as follows:

Encryption:  

Cipher = (plaintext + 3) mod 26

For each plaintext letter p, substi-tute the ciphertext letter C:

C = E(3, p) = (p + 3) mod 26

Decryption:

 plaintext = (Cipher – 3) mod 26

The general Caesar algorithm is

C= E(k,P)= (P+k) mod26

where k takes on a value in the range 1 to 25.

 

The decryption algorithm is simply

 P= D(k, C) = (C - k) mod 26            

 

Example:

Plain Text: meet me tomorrow

Cipher Text: phhw ph wrpruurz

We have replaced, ‘m’ with ‘p’ which occur three places after, ‘m’. Similarly, ‘e’ is replaced with ‘h’ which occurs in three places after ‘e’.

Example:

Plain Text: I am studying Data Encryption

Key: 4

Cipher Text: M eq wxyhCmrk Hexe IrgvCtxmsr

 If we have to replace the letter ‘z’ then the next three alphabets counted after ‘z’ will be ‘a’ ‘b’ ‘c’. So, while counting further three alphabets if ‘z’ occurs it circularly follows ‘a’.

There are also some drawbacks of this simple substitution technique. If the hacker knows that the Caesar cipher is used then to perform brute force cryptanalysis, he has only to try 25 possible keys to decrypt the plain text. The hacker is also aware of the encryption and decryption algorithm.

Playfair Cipher:

The playfair cipher is also known as Playfair Square. It is a cryptographic technique used for manual encryption of information. This scheme was developed by Charles Wheatstone in 1854.

The Playfair cipher was used by the British army in World War I and by the Australian in World War II. This was applicable because the playfair cipher is perfectly fast to use and does not demand some specific equipment to be used.


Playfair cipher is a substitution cipher which involves a 5X5 matrix.

Rules for generating ciphertext in Playfair Cipher:

• Firstly, create a 5×5 matrix from given keyword.
• Secondly, create pairs of alphabets, if same letters are there in pair, add ‘x’ in between.
• Thirdly, if pair appears in same row, shift the letter with immediate right letter.
• If pair appears in same column, replace it with the letter below it.
• In case pairs are in different rows and columns, replace it with the letters on corner of same row.

For instance, Keyword: OCCURENCE,

Plaintext: TALL TREES.

Here, resultant pair will be: TA LX LT RE ES.


Keyword matrix is as follows:

O	C	U	R	E
N	A	B	D	F
G	H	I/J	K	L
M	P	Q	S	T
V	W	X	Y	Z

5×5 matrix in Playfair Cipher:

Hence, here ‘TA’ are in different rows and columns, so replace it by ‘PF’. Thus, ciphertext = PF IZ TZ EO RT

Transposition Technique:

Transposition technique (No replacement of character) is an encryption method which is achieved by performing permutation over the plain text. Mapping plain text into cipher text using transposition technique is called transposition cipher.

The transposition technique is a cryptographic technique that converts the plain text to cipher text by performing permutations on the plain text, i.e., changing each character of plain text for each round. The substitution technique substitutes a plain text symbol with a cipher text symbol. On the other hand, the transposition technique executes permutation on the plain text to obtain the cipher text.

 

Transposition Techniques Types:

1. Rail Fence Transposition

2. Columnar Transposition

3. Improved Columnar Transposition

 

 

Rail-Fence Technique:

Rail-Fence is the simplest transposition technique in which the plaintext is written down as a sequence of diagonals and then reading it row by row to produce the ciphertext.

For example, to encipher the message “meet me tomorrow” with a rail fence of depth 2, we write the following:

m

e

m

t

m

r

o

e

t

e

o

o

r

w

Once you have written the message as a sequence of diagonals, to obtain the cipher text out of it you have to read it as a sequence of rows. So, reading the first row the first half of cipher text will be:

m e m t m r o

 

reading the second row of the rail fence, we will get the second half of the cipher text:

e t e o o r w

 

Now, to obtain the complete cipher text combine both the halves of cipher text and the complete cipher text will be:

Cipher Text: M E M T M R O E T E O O R W

 

Rail fence cipher is easy to implement and even easy for a cryptanalyst to break this technique. So, there was a need for a more complex technique.

Columnar Transposition Technique

 

A. Basic Technique:

The columnar transposition cipher is more complex as compared to the rail fence. The steps to obtain cipher text using this technique are as follow:

Step 1: The plain text is written in the rectangular matrix of the initially defined size in a row by row pattern.

Step 2: To obtain the cipher text read the text written in a rectangular matrix column by column. But you have to permute the order of column before reading it column by column. The obtained message is the cipher text message.

 

 B. Columnar Transposition Technique with Multiple Rounds

It is similar to the basic columnar technique but is introduced with an improvement. The basic columnar technique is performed over the plain text but more than once. The steps for columnar technique with multiple rounds are as follow:

Step 1: The plain text is written in the rectangle of predetermined size row by row.

Step 2: To obtain the cipher text, read the plain text in the rectangle, column by column. Before reading the text in rectangle column by column, permute the order of columns the same as in basic columnar technique.

Step 3: To obtain the final cipher text repeat the steps above multiple time.

FAQ:

1. What is the meaning of cryptography?

2. What are the two main types of cryptography?

3. What is cryptography and its types?