PUBLICATIONS  Quick Start Guide  CryptoGraf Manual  Product Description  Tech Description  FAQ on Crypto

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1. What is Cryptography?

2. What Are The Uses Of Crypto?

3. How does Crypto Work?

4. What Is A Secure Size for Secret Keys Used in Crypto?

5. What Makes Secret Key Crypto Secure?

6. Comparing Secret Key Crypto Methods

7. What Makes Public Key Crypto Secure?

8. Comparing Public Key Crypto Systems

9. What Can Crypto Do For Me?

10. What Can Crypto Not Protect Against?

 

 

 

 

 

1. What is Cryptography?

Crypto (technically also referred to as cryptography) includes many techniques for protecting messages.Crypto allows you to transform text, images, sound and video messages to be hidden from others who do not have a specific key needed to decode the message. Using crypto to encode a message is called encryption , to decode a message is called decryption .

 

Crypto is one of the technologies that can be used for both military and civilian purposes. Most historical records about the use of crypto involve military, spies and diplomats. Julius Caesar used a simple way to encrypt messages sent from his field commanders. During the 2 nd World War, Hitler very effectively used an Enigma machine to encrypt messages sent by radio to coordinate his battalions and U-Boats. Civilian use of crypto also goes back many centuries. Crypto was used to protect science and industry secrets, and also to keep romantic relationships private. During the 2 nd World War, lovers sent many more encrypted letters than spies, but the lovers almost always used weaker crypto methods. Lovers and spies had the same reason to use crypto, to prevent the wrong person from reading their letters and keep the contents secret. Crypto has always been used to protect privacy.

Currently, use of crypto for business and trade has overtaken the volume of crypto used by governments and militaries combined. Crypto is used to encode satellite television signals, protect banking and ATM networks, and almost every purchase done over the internet. Without crypto, internet based e-commerce would not be as widespread. Crypto is a way to maintain trust, keep secrets and reduce the risk of trade.

 

3. How does Crypto Work?

Messages are encrypted with an encryption algorithm .

In a secret key encryption algorithm (technically also referred to as symmetric key algorithm), a secret key is needed to encrypt and decrypt a message. A message encrypted with a certain key cannot be decrypted with a different key. The secret key acts like a password to protect the message, where the password is only known among people who need to know the message. The sender and receiver of the message need to have the same secret key in order to ensure that the contents of their message are kept secret. This type of algorithm has been in use for many centuries.
In a public key encryption algorithm (technically also referred to as asymmetric key algorithm), a public key is needed to encrypt and a private key is needed to decrypt the message. The public key is made available to anyone in public. The private key is kept only by the one person, who needs to decrypt the message. This can considered as similar to a mailbox, anyone in public can send a letter to the mailbox, only the owner of the mailbox can open it and read the letters in the mailbox. This type of algorithm was invented relatively recently in the early 1970s. This type of algorithm is based on the public key and the private key being mathematically related.
Secret key crypto is generally much faster than public key crypto. It is relatively easy to build systems using secret key crypto. But secret key crypto has some limitation when it comes to practical use in the real world.
1. Secret keys need to be exchanged in a secure manner, only then can encrypted messages be exchanged between the sender and receiver. If the sender and receiver have never met or do not meet frequently enough, this can be a problem.
2. The sender and receiver need to keep a copy of the secret key througout the time they want to keep exchanging encrypted messages. If the secret key is lost or stolen or intercepted from either the sender or receiver, then their encrypted messages may not be secret.
3. Each pair of sender and receiver need a unique secret key. This clearly becomes a problem when you think about the scenarios possible. For 2 people to send secret messages to each other they need to exchange 1 secret key. For 1 person to send secret messages with 2 other people they need 2 secret keys, but if all 3 people need to exchange secret messages with each other they need to exchange 3 secret keys. For 1 person to send secret messages with 4 other people they need 4 secret keys, but for all 5 people to exchange secret messages to each other they need 10 unique secret keys. For 1 person to send secret messages with 9 other people they need 9 secret keys, but for all 10 people who want to exchange secret messages to each other they need to exchange 45 unique secret keys. For 1 person to send secret messages with 700 million people on the internet they need around 700 million unique secret keys, but for all 700 million who want to exchange secret messages with each other they need to exchange 244 billion unique secret keys. For 1 person to send secret messages with 1.6 billion people on their mobiles they need around 1.6 billion unique secret keys, but for all 1.6 billion who want to exchange secret messages with each other they need to exchange around 1.28 trillion unique secret keys.
Clearly, for practical purposes the secure storage and secure distribution of secret keys becomes a limitation when needed for use on a larger scale (when more people and longer distances are involved).
Public key crypto does not have the above limitations since it uses 2 matching keys, a public key and private key. The public key, which can be widely distributed (just like a phone number), is used for encrypting the message. The private key, which is kept only by the owner, is used for decrypting messages.
Public keys enable people to receive secret messages from anyone. While the private key ensures that only one person can decrypt messages that have been encrypted using the corresponding public key. For example, to send Jane a secret message, you just need to get a copy of her public key, encrypt your message and send it to her. Jane is the only person who can decrypt your message because she keeps her private key in a safe place.
Public key crypto can also be used for digital signing of electronic documents or messages. Just like a signature on a paper document, a digital signature is used to indicate trust or an agreement. Just as signing a sale or contract agreement, you can digitally sign an online transaction while trading on the internet using your private key. Other people can check or verify your digital signature using your public key.
Public key crypto systems have the limitation that they are much slower than secret key crypto. Most modern crypto systems actually use a combination. The public key is used to securely exchange a secret key for the purposes of the online session (e.g. chat session or online shopping cart for checkout). Another combined crypto technique involves using the secret key to encrypt a message and using the public key to encrypt the secret key, the encrypted message and encrypted secret key are then sent together where the receiver decrypts the secret key before using it to decrypt the message (e.g. secure email).
Since secret key crypto is faster, it is used for encrypting large amounts of stored data and even encrypting streaming data (e.g. voice and video transmissions). While public key crypto is usually only used for encrypting secret keys and digital signatures.

 

4. What Is A Secure Size for Secret Keys Used in Crypto?

Short keys can have drastic consequences for the security of encrypted messages. Attackers can attempt to decrypt messages by guessing every possible key, and this is feasible today, using the computing power that is available within homes and organizations or even using the aggregated computing power of networked computers.

However, the measure of security based on secret key length is only based on one method to attack crypto. That method involves a brute force search for all possible keys that can decrypt a message. There are many other methods for attacking a crypto system as discussed in the next section.

 

5. What makes Secret Key Crypto Secure?

Secret key crypto systems are not all equally secure. Some crypto systems do not protect messages well enough against attackers. For some crypto systems, an attacker does not even need to know the secret key to be able to decrypt the message. The security of a secret key crypto system depends on many factors:

- Secrecy of the secret key.
- Secret key size or length generally increases the complexity in guessing or trying all possible keys, a brute force attack.
- Any backdoors or trojans that can be used by an attacker who does not have the secret key.
- Complexity of decrypting the whole message when part of the message is already known.
- Random number generators are essential to get quality secret keys. If the random number generator does not provide enough randomness, then this directly impacts on the security of secret keys for crypto.
Every now and again, some person or organization claim to invent a new secret key algorithm that is more secure. Generally, it is best to avoid such new algorithms since they may not have been tried and tested thoroughly enough. It is best to use known secret key algorithms in ways that are widely accepted and already standardised.
The Data Encryption Standard (DES) is a secret key algorithm that was invented around 1975 by IBM and standardised in 1977. DES became the first widely used secret key crypto technique. There was some suspicion of tampering of the S-boxes with trapdoors to make DES easier to attack by the US National Security Agency (NSA). The fact that DES was limited to use secret key size of 56 bits also added to the conspiracy theories. US companies were also forbidden from exporting products using DES and only during the 1990s were they allowed to export products using DES but limited to 40 bit secret key size. Commonly used web browsers, Netscape (1994) and Internet Explorer (1995), were subject to this 40 bit secret key size restriction for their exported version. However, these measures worked to the disadvantage of US commercial interests since many other countries did not have any such restrictions on companies exporting products that used crypto. In January 2000, after pursuing many unfeasible and unaccepted alternatives that included key escrow and bureaucratic controls, the US Government finally relented and allowed export of crypto products except to places listed as terrorist countries .
The NSA is now widely known to operate a worldwide network for intelligence surveillance, referred to as ECHELON. Originally created during the 1960s to monitor the Soviet Union and their communist allies during the Cold War, today ECHELON is assumed to search for hints of terrorism activity, drug dealers and diplomatic intelligence. The European Union has criticised ECHELON activities as being used for commercial espionage and technology theft on a large scale and also invasion of privacy. It is relatively feasible for a well funded organization to undertake such operations since the majority of communications goes without encryption over phone lines, fiber optic cables, satellite transponders and wireless frequencies. Often, there is no need to know the content of the communications, there is also value to be gained from knowledge about the frequency and pattern of communications (technically also referred to as traffic analysis ). It is widely assumed that the NSA has enough computing power to brute force some encrypted messages, but it is unlikely that they would be able to consistently brute force all encrypted messages sent around the world.
Knowing NSA capabilities for eavesdropping and brute forcing encrypted messages, there were conspiracy theories about the security of DES. Some of the suspicion turned out to be unfounded, as research published in 1990 and analysis by crypto experts showed that the S-boxes were securely designed for DES. The secret key size for DES, however, was proven to be inadequate. In 1997, a project that recruited donors of 15,000 computers connected over the internet managed to brute force search for the 56 bit secret key of a DES encrypted message. This search tried 37 million billion (37 x 10-16) secret keys out of a possible 72 million billion (72 x 10-16) secret keys to unlock the message, using 59 days of networked computing time. It was assumed, in 1997, that the NSA could have used a US$300 million computer to crack the same DES encrypted message in 12 seconds.
Since the 1990s several secret key crypto methods have been proposed and analysed to be more secure than DES. 3DES (Triple DES), technically referred to as TDES, is based on DES but uses a larger secret key of 168 bits while repeating the DES operations 3 times to encrypt a message. 3DES is still quite secure and would require a billion dollar computer to spend many years to crack an 3DES encrypted message. Currently, some banks use 3DES crypto hardware. However, 3DES is quite slow when used in software for encrypting and decrypting messages.

During 2000, the US National Institute of Standards and Technology (NIST) approved a crypto method as the new Advanced Encryption Standard (AES). AES is around six times faster than 3DES when used in software, while in hardware AES it also still much faster than 3DES. AES is now much more widely used in many sectors, including banking, finance, business, military and government. As of June 2003, the US Government announced that AES may be used to protect SECRET level classified information, while TOP SECRET information will require using secret key size of 192 or 256 bits. This is the first time that the general public is able to use crypto certifiably approved by the NSA even for TOP SECRET information.

 

6. Comparing Secret Key Crypto Methods

There are many secret key crypto methods in use nowadays. Here's a comparison of most of the algorithms available.

DES

Triple-DES (3DES or TDES)

I DEA

RC2 and RC4

RC5

RC6

Blowfish

Twofish

AES

7. What Makes Public Key Crypto Secure?

Public key crypto is typically used to encrypt messages and digitally sign messages.

For encrypting messages, a public key is needed to encrypt and a private key is needed to decrypt the message. The public key is made available to anyone in public. The private key is only kept by the person who needs to decrypt the message. This can be considered as similar to a mailbox, anyone in public can send a letter to the mailbox, only the owner of the mailbox can open it and read the letters in the mailbox.
The encrypted message is usually longer than the original unencrypted message due to header information needed for decrypting by the receiver of the message. There is a relatively large overhead when short messages are encrypted.
For digitally signing messages, the sender uses a private key to digitally sign a message before sending, and the public key is used by the receiver to verify that the message has been digitally signed by the sender. Digitally signing a message helps the receiver verify the integrity (message has not been tampered or corrupted during transmission) and authenticity (message was sent by the sender and not by someone pretending to be the sender) of the message.
The most feasible kind of attacks on messages encrypted by a public key is a key search . The public key's corresponding private key can be searched using a technique called factoring. This technique is particularly fascinating to mathematicians, who are actively trying to discover a fast and general purpose method for factoring large numbers. Most recently, in May 2005, a public key of 663 bits was successfully factored to obtain the private key. Advances in methods for factoring, advances in general discrete logarithmic attacks, elliptic curve discrete logarithm attacks and quantum computing may leave some public key algorithms or key sizes completely insecure. It is generally estimated, in 2006, that a public key size of 1024 bits should securely protect messages until the year 2010. A public key size of 2048 bits should securely protect messages until the year 2030. The use of larger key sizes than required may take unnecessarily longer to encrypt and decrypt messages. However, the use of key sizes that are too small may not provide the needed protection.
Public key distribution has an impact on the security of messages. Key distribution must be secure to avoid man-in-the-middle attacks . Mike can send Bob a public key and claim that it belongs to Andy Every time Bob sends Andy an encrypted message, Mike can intercept and decrypts the message and then encrypt with Andy 's public before forwarding the message to her. Bob and Andy would not know that Mike has been malicious intercepting and reading their secret messages. This kind of man-in-the-middle attack can be avoided by using digital certificates or a public key infrastructure. Strong crypto and key size alone are not sufficient to ensure security. It is vital that the implementation of the crypto methods, key generation and storage, and also the random number generation be correctly well tested to ensure the security of messages. A software implementation that has bugs, bad random number generation or mishandling of crypto keys may all increase the risk to the secrecy of your messages. Law enforcement, criminals or even your friends and family may be interested to know about your encrypted messages.

 

8. Compare Public Key Crypto Systems

There are many secret key crypto methods in use nowadays. Here's a comparison of the algorithms available.

Diffie-Hellman Key Exchange

DSA/DSS

Elliptic Curves

RSA

RSA is a well known public key crypto system developed in the 1970s. RSA is named after the acronym of it's inventors Rivest, Shamir and Adleman. RSA is now very widely used due to the efforts at standardisation and non-proprietary specification. RSA is commonly used for sending data over the internet and is the trusted engine driving e-commerce. RSA can be used to encrypt messages and for digital signatures. The US National Institute of Standards and Technology (NIST), recommends using RSA key size of 1024 bits for securing messages until the year 2010, after which RSA key size of 2048 bits must be used.

 

9. What Can Crypto Do For Me?

Authenticate

Authorize

Confidential

Integrity

Integrity means that messages sent over any network connection arrives unmodified on the other side. Crypto methods, digitally signed message digests, are used to verify that a message has not been altered while in transit.

 

10. What Can Crypto Not Protect Against?

Unencrypted Messages

Stolen Keys

Denial of Service Attacks

Traffic Analysis

Trojaned Systems