Chapter – 3

Cryptography

1
 Cryptography
 is a study how to mathematically encode and decode messages

 The science and methods of transforming an intelligible message

into an unintelligible, then retransforming that message back to its
original form using an algorithms

 The algorithms are used to generation cryptographic key, digital

signing, verification to protect data privacy

 protecting confidential transactions such as credit card and debit

card transactions on the Internet using web browser

2
 Types Of Cryptography

1. Symmetric Cryptography: a single key is used for encryption

and decryption

 It is faster and simpler

 Problem : how exchange keys between sender and receiver in a

secure manner e.g. DES

3
 Types Of Cryptography
2. Asymmetric Cryptography: different keys are used for encryption and
decryption.

 Use public key for encryption and a private key for decryption.

 E.g. RSA algorithm

4
 Cont’d …

3. Hash functions: are irreversible, one-way functions that protect the data, at
the cost of not being able to recover the original message

 Basic terms of cryptography

 Plaintext: original intelligible message

 Cipher Text: encoded format of the original message that cannot be

understood by humans

 Encryption (or Enciphering): the conversion of plain text to cipher text

 Decryption (or Deciphering): the conversion of cipher text to plain

text, i.e., reverse of encryption
5
 Cont’d …
Applications Of Cryptography:
 Computer passwords

 Secure web browsing

 Electronic Signatures

 Authentication

 Cryptocurrencies

 End-to-end encryption

6
 Symmetric encryption model
 A symmetric cipher model is composed of five essential parts:

 Plain Text (x): the original data/message to be communicated to the

receiver by the sender.

 It is the inputs to the encryption algorithm.

 Secret Key (k): is a key used by the encryption and decryption

algorithm to encode and decode the plain text to cipher text and
7
vice-versa
 Symmetric encryption model
 A symmetric cipher model is composed of five essential parts:

 Encryption Algorithm (E): takes plain text and secret key as inputs
and produces Cipher Text as output using techniques such as
substitutions, E(x, k) = y

 Cipher Text (y): It is the formatted form of the plain text (x) which
is unreadable for humans

 Decryption Algorithm (D): It performs reversal of the encryption

algorithm at the recipient’s side.

 It takes secret key ciphertext as input and decodes to plain text

D(y, k) = x 8
 Cryptography
 Three Dimensions of Cryptographic Systems

1. The type of operations used for transforming plaintext to ciphertext

 Substitution and Transposition:

2. The number of keys used: Symmetric key and Asymmetric key

3. The way in which the plaintext is processed: block cipher and stream cipher

 Substitution techniques: is classical encryption technique where the characters

present in the original message are replaced by the other characters or numbers or
by symbols.

 If the plain text is considered as the string of bits, then the substitution technique
would replace bit pattern of plain text

 It is widely used in cryptography to protect information from being accessed by

9
unauthorized people
 Substitution technique
[Link] cipher: it know as shift cipher

 It is a type of substitution cipher in which each letter in the plaintext

is 'shifted' a certain number of places down the alphabet.

 E.g. shift of 3, A would be replaced by D, B would become E, and

so on.

 General Caesar algorithm for encryption is

C = E (p) = (p+k) mod 26
 The decryption algorithm is simply
P = D(C) = (C-k) mod 26
e.g. plain text: pay more money Cipher text: SDB PRUH PRQHB10
 Substitution technique ….

 Exercise: plain text: meet me after the lunch time

 Cipher text: ?????

 Monoalphabetic ciphers :- are a type of substitution cipher that use a fixed

key to replace each letter of the plain text with another letter of the alphabet.

 a form of symmetric encryption the same key can be used to both encrypt
and decrypt a message.

 Frequency analysis is a common approach used to help decrypt a mono-

alphabetic substitution cipher

 It can be randomly mapped to any letter

11
 Substitution technique ….

 E.g. plaint text: a simple message cipher text: B TJNQMF

NFTTBHF

 Playfair Cipher : it is multiple-letter encryption cipher

 Use diagrams substitution plain letter as single units and translates

into ciphertext diagrams

 Playfair algorithm is based on the use of a 5 x 5 matrix of letters

12
constructed using a keyword
 Substitution technique ….
 Matrix is constructed by filling in the letters of the keyword (minus duplicates) from left to
right and from top to bottom, E.g. Keyword = MONARCHY

 Rules: Repeating plaintext letters that are in the same pair are separated with a filler letter

E.g. balloon = ba lx lo on

1. Two plaintext letters on same row of the matrix replace by letter to the right. E.g. ar RM

2. Two plaintext letters on same column replace by letter beneath, with the top element of the
column e.g. mu  CM

3. Each plaintext letter in a pair is replaced by the letter that lies in its own row and column13
 Substitution technique ….

 E.g. plain text = attack ciphertext:=RSSRDE

 Hill Cipher

 it is a multi-letter cipher developed by Lester hill in 1929

 Encrypts a group of letters: digraph, trigraph, and polygraph based on the

key-value

 Use matrix arithmetic module 26, Square matrix , multiplicative inverse

matrix, and determinant

 Hill algorithm can be expressed as

 C=E(K,P) =PxK mod26

 D= D(K,C)= (Cxmod26 = (PxKxmod26 14

 Substitution technique ….
Hill Cipher algorithm for encryption …
= mod 26
c1 = (k11p1 + k21p2 + k31p3) mod 26
c2 = (k12p1 + k22p2 + k32p3) mod 26
c3 = (k13p1 + k23p2 + k33p3) mod 26
e.g. Encrypt for the plaintext pay more money and use the encryption key
K=
encrypt for pay (c1 c2 c3)=(15 0 24
C1=15x17+0x21+2x24 mod 26 =303mod 26 =17
C2=15x17+0x21+2x24 mod 26 = 303mod26=17
C3=15x17+0x21+2x24 mod 26 =531mod26 =11
pay = RRL

15
 Substitution technique ….
encrypt for mor (c1 c2 c3)=(12 14 17)
C1=12x17+14x21+2x7 mod 26 =532mod 26 =12
C2=12x17+14x18+2x17 mod 26 = 490mod26=22
C3=5x12+14x21+17x19 mod 26 =677mod26 =1
mor = MWB
encrypt for emo (c1 c2 c3)=(4 12 14)
C1=4x17+12x21+2x14 mod 26 =348mod 26 =10
C2=4x17+12x18+2x14 mod 26 = 312mod26=0
C3=5x4+12x21+14x19 mod 26 =538mod26 =18
emo= KAS

16
 Substitution technique ….

encrypt for ney (c1 c2 c3)=(13 4 24)

C1=13x17+4x21+2x24 mod 26 =353mod 26 =15
C2=13x17+4x18+2x24 mod 26 = 341mod26=3
C3=5x13+4x21+24x19 mod 26 =605mod26 =7
ney = PDH
Encryption of :pay more money =RRLMWBKASPDH

17
 Substitution technique ….

 decryption using hill algorithm

 decryption requires the inverse of matrix K

Find the determinant K and cofactor to find inverse of K

DetK =(17(18x19 -2x21)-17(21x19-2x21)+5(21x2-2x18))mod26

= 17(300)-17(357)+5(6) mod26
=5100-6069+30 mod26
=-939mod 26
= -3mod 26 =-3 but => -3+26 =23
Therefore determinant of K =23

18
 Substitution technique ….
 decryption using hill algorithm
 decryption requires the inverse of matrix K

Find the determinant K and cofactor to find inverse of K

DetK =(17(18x19 -2x21)-17(21x19-2x21)+5(21x2-2x18))mod26

= 17(300)-17(357)+5(6) mod26
=5100-6069+30 mod26
=-936mod 26
= -3mod 26 =-3 but => -3+26 =23
Therefore determinant of K =23

19
 Substitution technique ….
 decryption using hill algorithm…
Find adjoint of K to find adjoint ,first find cofactor Aij
A11 = A12= A13=
18x19-2x21=300 21x19-2x21=-357 21x2-2x18 =6
A21 = A22= A23=
17x19-2x5 =-313 17x19-2x5=313 2x17-2x17 =0
A31 = A32= A33=
17x21-18x5=267 17x21-5x21=-252 17x18-21x17 =-51
Aij=mod26 = mod26

20
 Substitution technique ….
 decryption using hill algorithm…
AdjK =(
mod26 =, =
mod 26

= 17 mod 26

mod 26=

21
 Substitution technique ….
 decryption using hill algorithm …
 decryption: RRLMWBKASPDH
p=C mod 26
(p1p2p3)=(17 17 11) mod 26
P1= (17x4+15x17+24x11)mod26 =587mod26 =15 P
P2= (17x9+17x17+0x11)mod26 =442mod26 =0 A
P3= (17x15+6x17+17x11)mod26 =544mod26 =24 Y
The palintext of RRL = PAY and use the same procedure for the other
Exercise
a. Encrypt the message “meet me at the usual place at ten rather than eight
oclock” using the Hill cipher with the key a Show your calculations and the
result.
b. decryption of the ciphertext to recover the original plaintext.

22
 TRANSPOSITION TECHNIQUES

 Transposition cipher: is a cryptographic algorithm the order

of alphabets in the plaintext is rearranged to form a

ciphertext.

 The simplest such cipher is the rail fence technique, in

which the plaintext is written down as a sequence of

diagonals and then read off as a sequence of rows.

 E.g. encipher the message “meet me after the toga party “

with a rail fence of depth 2

23
The encrypted message: MEMATRHTGPRYETEFETEOAAT
 TRANSPOSITION TECHNIQUES

 Transposition cipher …

 A more complex scheme, write the message in a rectangle, row by

row, and read the message off, column by column but permute the
order of the columns.

 The order of the columns then becomes the key to the algorithm

 Key: 4 3 1 2 5 6 7

 Encrypt plaintext: attack postponed until two am. using

transposing

24
 TRANSPOSITION TECHNIQUES

 Transposition cipher …

 x y z  dummy character
 Cipher text: TTNAAPTMTSUOAODWCOIXKNLYPETZ

 exercise

 Plain text: I HAVE A COMPLETED EXAM WITH SOLUTION

 Key: CIPHER
25
 Stream Ciphers
 the plaintext is processed one bit at a time

 one bit of plaintext is taken, and a series of operations is

performed on it to generate one bit of ciphertext .

plain Text : 10011001 Cipher Text : 01011010

xor xor
Keystream : 11000011
Keystream : 11000011
Cipher Text : : 01011010 Plain Text : 10011001 26
 Block cipher
 the plain binary text is processed in blocks of bits at a time

 a block of plaintext bits is selected, a series of operations is

performed on the block to generate a block of ciphertext bits.

 The number of bits in a block is fixed.

 use the same key to encrypt and decrypt the message

 DES 64 bit length and AES used 128 bit length

27
 THE FEISTEL STRUCTURE FOR BLOCK CIPHERS

 Named after cryptographer Horst Feistel and implemented in the

Lucifer cipher by Horst Feistel and Don Coppersmith.

 A cryptographic system based on Feistel structure uses the same

basic algorithm for both encryption and decryption.

 Feistel structure consists of multiple rounds of processing of the

plaintext, with each round consisting of a substitution followed by a
permutation steps.

 The input block to each round is divided into two halves denote as
left half ( L) and the right half (R )

28
 Data Encryption Standards(DES)

 it is a symmetric block cipher algorithm that was developed by IBM

in the 1970s and adopted by the US government as a standard for
encrypting sensitive data.

 the same key is used for both encryption and decryption.

 56 key bits is used to permute and transform the input plaintext

block of 64 bits through a series of 16 rounds of substitution and
permutation operations.

 A block of 64 bits ciphertext is produced.

 Substitution and permutation operations are used based on the

Feistel network structure, which splits the input block into29 two
 Data Encryption Standards(DES)

 Weakness : vulnerable to brute-force attacks due to small size of key

 no longer considered secure for modern cryptographic applications,

and replaced by AES.

30
 Advanced Encryption Standard(AES)

 The AES algorithm is designed to be very secure against a wide

range of attacks, including brute-force attacks.

 The strength of AES lies on key length and the complexity of its
substitution and permutation operations

 AES supports key sizes of 128, 192, or 256 bits, which makes it
much more secure than DES, which only supports a 56-bit key size

 Reading assignment for more detail ( DES and AES) algorithms

31
 Asymmetric (public-key )cryptography
 It is a process of using a pair of related keys i.e. public key and
private key to encrypt and decrypt a message protect it from
unauthorized access or use.

32
 Asymmetric (public-key )cryptography
 Rivest–Shamir–Adlemam (RSA) is an asymmetric cryptography
algorithm.

 It is currently the most widely used asymmetric cryptographic scheme

 It works on two different keys i.e. Public Key and Private Key.

 The RSA scheme is a block cipher in which the plaintext and

ciphertext are integers between 0 and n - 1 for some n.

 Plaintext is encrypted in blocks, each block having a binary value less

than some number n.

 The block size must be less than or equal to in practice, the block size
is i bits, where < n ≤ . 33
 Asymmetric (public-key )cryptography
 Encryption and decryption are of the following form for plaintext
block M and ciphertext block C.

C = mod n

M = mod n = mod n = mod n

 Both sender and receiver must know the value of n.

 The sender knows the value of e, and only the receiver knows the
value of d.

 a public-key encryption algorithm with a public key of PU = {e, n}

and a private key of PR = {d, n}.
34
 Asymmetric (public-key )cryptography
 To be satisfactory algorithm for public-key encryption, the following
requirements must be met.

1. It is possible to find values of e, d, n such that mod n = M for all M

< n.

2. It is relatively easy to calculate mod n and mod n for all values of

M < n.

3. It is infeasible to determine d given e and n.

35
 Asymmetric (public-key )cryptography
 the keys were generated as follows.
 Select p, q p and q both prime, p ≠ q
 Calculate n = p * q
 Calculate ∅(n) = (p - 1)(q - 1)
 Select integer e gcd (∅(n), e) = 1; 1< ∅ < ∅(n)
 Calculate d, d = 𝑒^(−1)(mod ∅(n))
 Public key PU = {e, n} and Private key PR = {d, n}

36
 Asymmetric (public-key )cryptography
 the keys were generated as follows.
 Select p, q p and q both prime, p ≠ q
 Calculate n = p * q
 Calculate ∅(n) = (p - 1)(q - 1)
 Select integer e gcd (∅(n), e) = 1; 1< ∅ < ∅(n)
 Calculate d, d = 𝑒^(−1)(mod ∅(n))
 Public key PU = {e, n} and Private key PR = {d, n}

37
 Asymmetric (public-key )cryptography
 Select two prime numbers, p = 17 and q = 11.

 Calculate n = pq = 17 * 11 = 187.

 Calculate ∅(n) = (p - 1)(q - 1) = 16 * 10 = 160.

 Select e such that e is relatively prime to ∅(n) = 160 and less than ∅(n) ; we
choose e = 7.

 Determine d such that de =1 (mod 160) and d <160.

 The correct value is d = 23, because 23 * 7 = 161 = (1 * 160) + 1; d can be

calculated using the extended Euclid’s algorithm

 The resulting keys are public key PU = {7, 187} and private key PR = {23, 187}.

 The example shows the use of these keys for a plaintext input of M = 88. For
encryption, we need to calculate C = mod 187
38
 Asymmetric (public-key )cryptography

 mod 187 = [( mod 187) * ( mod 187) * (mod 187)] mod 187

 mod 187 = 88

 mod 187 = 7744 mod 187 = 77

 mod 187 = 59,969,536 mod 187 = 132

 mod 187 = (88 * 77 * 132) mod 187 = 894,432 mod 187 = 11

 For decryption, we calculate M = mod 187:

 mod 187 = [( mod 187) * ( mod 187) * (mod 187)* ( mod 187) * (mod 187)]
mod 187

 mod 187 = (11 * 121 * 55 * 33 * 33) mod 187 = 79,720,245 mod 187 = 88

 Exercise: two prime number p =13 , q=11 find ,n, ∅(n) , e,d, c and m. 39
 Key management and exchange in cryptography
 The processes of generating, distributing, and managing cryptographic keys

that are used to secure communication between two or more parties.

 Cryptographic keys are critical to ensuring the confidentiality, integrity, and

authenticity of information that is being transmitted over a network.

 Methods for key management and exchange in cryptography:

1. Symmetric-key cryptography: the same key is used for both encryption and

decryption. The key is generated and distributed securely between the

communicating parties.

2. Asymmetric-key cryptography: used a public key for encryption and a

private key for decryption. The public key is distributed widely, while the private
40
key is kept secret.
 Key management and exchange in cryptography…
3. Key exchange protocols: protocols enable two parties to exchange keys
securely over an insecure network.

 key exchange protocols include: Diffie-Hellman and RSA key

exchange protocols

 Diffie-Hellman key exchange: use modular arithmetic to derive a

shared secret key based on two inputs: a generator value and a large
prime number. Each party independently generates a public-private
key pair and exchanges their public keys over the insecure channel.

 The shared secret key is then calculated by each party using their own
private key and the other party's public key.
41
 Key management and exchange in cryptography…
 In RSA key exchange protocol: each party generates a public-private key pair

1. Party A generates a random secret number called a session key and encrypts it
using Party B's public key. Party A then sends the encrypted message to Party B.

2. Party B receives the encrypted message from Party A and decrypts it using its
own private key, obtaining the session key.

3. Party B generates a random secret number and encrypts it using Party A's
public key. Party B then sends the encrypted message to Party A.

4. Party A receives the encrypted message from Party B and decrypts it using its
own private key, obtaining the session key.

 The security of RSA key exchange relies on the difficulty of factoring large
numbers into two prime factors.
42
 Key management and exchange in cryptography…
4. Key management systems: are used to manage the lifecycle of cryptographic
keys, including key generation, exchange, storage, use, crypto-shredding
(destruction) and replacement of keys

 Why key management ???

 Helps to reduce risk of data breaches, unauthorized access, and other security
threats.

 helps to ensure the confidentiality, integrity, and availability of data and

systems

 provide compliance with certain standards and regulations to ensure

companies are using best practices when protecting cryptographic keys.

 key management compliance refers to meeting the regulatory and industry

43
standards related to the secure management of cryptographic keys.
 Cryptographic hash functions

 a mathematical function that converts a large amount of

arbitrary data (such as a file or message) into a smaller fixed-

size value, called a hash or hash value

 Main purpose of a hash function is to provide to verify the

integrity of data.

 If the original data changes in any way, even by a single bit, the
hash value will be completely different.

44
 Cryptographic hash functions

 how it works

 by taking the input data and running it through a complex

mathematical algorithm that produces the hash value.

 The algorithm is designed to be one-way, which is easy to compute

the hash value from the input data, but extremely difficult to
generate the original input data from the hash value.

 By comparing the hash value of original data with hash value of the
received or stored data, one can easily determine whether the data
has been tampered with or corrupted.
45
 Cryptographic hash functions

 There are many well-known cryptographic hash function like

MD5,SH-1,SHA-2, SHA-3
 These cryptographic hash functions are extensively used in digital
signature , message authentication code etc.

46
 Cryptographic hash functions
 Properties of Hash Functions

 The following are properties of hash functions

1. Pre-Image Resistance(one way function)

 It is computationally infeasible to reconstruct the original message

from the given hash value.

 for a given hash value h, it is infeasible to find the original message

m such that hash(m) =h

m H(m) h

47
 Cryptographic hash functions…

 PROPERTIES…

2. Second Pre-Image Resistance:(weak collision resistant):-it is

computationally infeasible to find a second message (preimage) that
produce the same hash value

 E.g. given an input x it is difficult to find a message y where y ≠ x

and hash(y)=hash(x).

48
 Cryptographic hash functions…

 PROPERTIES…

3. collision resistance: a hash function should be designed to make

difficult to find two different input values produce the same hash value,
known as a collision.

 It should be computationally infeasible to find two inputs that

produce the same hash output.

 It infeasible to find any pair of distinct inputs m1, m2 such that

H(m1) = H(m2)

 This is important to prevent attackers from being able to create

fake data with the same hash value as legitimate data 49
 Cryptographic hash functions…
 Purpose of hashing :

 To verify data integrity.

 Authentication.

 To store sensitive data.

 Types of Hash Algorithms used in cryptography and computer security are:

1. MD5 (Message Digest 5): a widely-used hash algorithm produces a 128-bit hash
value.

 It is commonly used for checking the integrity of files and messages

 but is considered insecure for cryptographic due to vulnerability to collision

attacks.

2. SHA-1 (Secure Hash Algorithm 1):widely-used hash algorithm produces a 160-bit

50
hash value.
 Cryptographic hash functions…
3. SHA-2 (Secure Hash Algorithm 2): is a family of hash algorithms that includes
SHA-224, SHA-256, SHA-384, and SHA-512.

 These algorithms produce hash values of different lengths, ranging from 224 bits
to 512 bits.

 They are widely-used for digital signatures, password storage, and other
cryptographic applications.

4. SHA-3 (Secure Hash Algorithm 3): is a recent addition to the SHA family of hash
algorithms.

 It was developed as a result of a competition sponsored by the National Institute

of Standards and Technology (NIST), and produces hash values of different
lengths, ranging from 224 bits to 512 bits.

 It is considered to be more secure than SHA-2, and is increasingly being used

51 for
 Certificates and Certificate Authorities (CAs)
 are a critical component of the public key infrastructure (PKI) used in
modern cryptography. Here's an overview of certificates and CAs:

1. Certificates: are digital documents that contain information about the

identity of a person, organization, or system.

 used to establish trust between parties in a cryptographic system.

 Certificates typically include the following information:

 The name of the certificate holder

 The public key of the certificate holder

 The expiration date of the certificate

 The name of the issuer of the certificate

 The digital signature of the certificate issuer 52

 Certificates and Certificate Authorities (CAs)
 Certificates are commonly used for digital signatures, secure
communication, and user authentication.

 They are issued by Certificate Authorities (CAs).

 Certificate Authorities (CAs) are trusted third-party entities that issue and
manage digital certificates.

 are responsible for verifying the identity of certificate holders and

ensuring that the certificates they issue are valid and trustworthy.

 use a variety of methods to verify the identity of certificate holders,

including physical ID checks, email verification, and phone verification.

 It is also manage certificate revocation and expiration.

53
 Certificates and Certificate Authorities (CAs)

 Secure Sockets Layer (SSL) is a protocol used for secure communication

over the internet.

 SSL is now deprecated and has been replaced by Transport Layer Security
(TLS), but the terms SSL and TLS are often used interchangeably.

 SSL/TLS is used to encrypt data sent between a client (web browser) and a
server (web server) to ensure that the data cannot be intercepted or
tampered with by third parties.

 SSL/TLS uses public key cryptography to establish a secure connection

between the client and the server.

54
 Certificates and Certificate Authorities (CAs)
 How SSL/TLS works

1. Handshake: establishing a secure connection b/n client and server, exchange information

about the SSL/TLS version and cipher suites they support, session ID etc.

 The client and server also exchange public keys and digital certificates to establish trust.

2. Key Exchange: after handshake, client and server use the exchanged public keys to establish

a shared secret key for encrypting and decrypting data.

 The key exchange can use either symmetric or asymmetric encryption, depending on the

cipher suite used.

3. Data Transfer: Once shared secret key is established, client and server can encrypt and

decrypt data sent between them.

4. Session Termination: client and server terminate the SSL/TLS connection and shared secret

key is discarded, and the session cannot be resumed. 55

End of chapter 3

56