Sangameshwar College CNS

UNIT 2

Cryptography

Cryptography is the art of achieving security by encoding messages to make

them non-readable.

Fig: shows the conceptual view of cryptography

Cryptanalysis is the technique of decoding messages from a non-readable

format back to a readable format without knowing how they were initially converted
from readable format to nonreadable format.

Fig: Cryptanalysis

Cryptology is a combination of cryptography and cryptanalysis

1
 Sangameshwar College CNS

Fig: Cryptography + Cryptanalysis = Cryptology

PLAIN TEXT AND CIPHER TEXT

Clear text, or plain text, signifies a message that can be understood by the
sender, the recipient, and also by anyone else who gets access to that message.an
example, they replace each alphabet with the alphabet that is actually

three alphabets down the order. So, each A will be replaced by D, B will be
replaced by E, C will be replaced by F, and so on. To complete the cycle, each W will
be replaced by Z, each X will be replaced by A, each Y will be replaced by B and each
Z will be replaced by C. We can summarize this scheme as shown in following Fig. .
The first row shows the original alphabets, and the second row shows what each
original alphabet will be replaced with.

fig: A scheme for codifying messages (replacing each alphabet with an alphabet
three places down the line)

Thus, using the scheme of replacing each alphabet with the one that is three
places down the line, a message I love you shall become L ORYH BRX as
shown in following Fig.

2
Sangameshwar College CNS

fig: Codification using the alphabet-replacement scheme.

It is not necessary to replace each alphabet with the one that is three places
down the order. It can be the one that is four, five or more places down

the order. The point is, however, that each alphabet in the original message can
be replaced by another to hide the original contents of the message. The
codified message is called cipher text. Cipher means a code or a secret message.

When a plain-text message is codified using any suitable scheme, the resulting
message is called cipher text. Based on these concepts, let us put these terms
into a diagrammatic representation, as shown in following Fig.

fig: Elements of a cryptographic operation

3
Sangameshwar College CNS

Fig: Example of a plain-text message being transformed into cipher text

Fig: Techniques for transforming plain text to cipher text

SUBSTITUTION TECHNIQUES

1.Caesar Cipher

The scheme explained earlier (of replacing an alphabet with the one three places
down the order) was first proposed by Julius Caesar, and is termed Caesar
cipher. It was the first example of substitution cipher. In the substitution-cipher
technique, the characters of a plain-text message are replaced by other

characters, numbers or symbols. The Caesar cipher is a special case of

substitution technique wherein each alphabet in a message is replaced by an
alphabet three places down the line. For instance, using the Caesar cipher, the
plain-text ATUL will become cipher-text DWXO.

4
Sangameshwar College CNS

In the substitution-cipher technique, the characters of a plain-text message are

replaced by other characters, numbers or symbols.

Clearly, the Caesar cipher is a very weak scheme of hiding plain-text messages.
All that is required to break the Caesar cipher is to do the reverse of the Caesar
cipher process—i.e. replace each alphabet in a cipher-text message produced by
Caesar cipher with the alphabet that is three places up the line. Thus,
to work backwards, take a cipher text produced by Caesar cipher, and replace
each A with X, B with Y, C with Z, D with A, E with B and so on. The simple
algorithm required to break the Caesar cipher can be summarized as shown in
following Fig.

Fig: Algorithm to break Caesar cipher

The process shown above will reveal the original plain text. Thus, given a
cipher-text message L ORYH BRX, it is easy to work backwards and obtain the
plain text I LOVE YOU as shown in following fig.

Fig: Example of breaking Caesar cipher

2.Modified Version of Caesar Cipher

The Caesar cipher is good in theory, but not so good in practice. Alphabet A in
plain text would not necessarily be replaced by D. It can be replaced by any
valid alphabet, i.e. by E or by F or by G, and so on. Once the replacement
scheme is decided, it would be constant and will be used for all other alphabets
in that message. As we know, the English language contains 26 alphabets. Thus,
an alphabet A can be replaced by any other alphabet in the English alphabet set,
(i.e. B through Z). Of course, it does not make sense to replace an alphabet by

5
Sangameshwar College CNS

itself (i.e. replacing A with A). Thus, for each alphabet, we have 25 possibilities
of replacement. Hence, to break a message in the modified version of Caesar
cipher, our earlier algorithm would not work. Let us write a new algorithm to
break this version of the Caesar cipher, as shown in following Fig.

Fig: Algorithm to break the modified Caesar cipher

Let us take a cipher-text message produced by the modified Caesar cipher, and
try breaking it to obtain the original plain-text message by applying the
algorithm shown earlier. Since each alphabet in the plain-text can be potentially
replaced by any other of the 25 alphabets, we have 25 possible plain-text

messages to choose from. Thus, the output produced by the above algorithm to
break a cipher-text message KWUM PMZN is shown in following Fig

We can see that the cipher text shown in the first row of the figure needs 25
different attempts to break in, as depicted by the algorithm shown earlier. As it
turns out, the 18th attempt reveals the correct plain text corresponding to the
cipher text. Therefore, we can actually stop at this juncture. For the sake of
completeness, however, we have shown all the 25 steps, which is, of course, the
worst possible case.

An attack on a cipher-text message, wherein the attacker attempts to use all

possible permutations and combinations, is called a brute-force attack. The
process of trying to break any cipher-text message to obtain the original plain-
text message itself is called cryptanalysis, and the person attempting a
cryptanalysis is called a cryptanalyst.

A cryptanalyst is a person who attempts to break a cipher-text message to obtain

the original plain-text message. The process itself is called cryptanalysis.

6
Sangameshwar College CNS

the following points to break a cipher-text message using the brute-force attack,
in this scheme:

1. Substitution technique was used to derive the cipher text from the original
plain text.

2. There are only 25 possibilities to try out.

3. The language of the plain text was English.

A cryptanalyst attempting a brute-force attack tries all possibilities to derive the

original plaintext message from a given cipher-text message. Anyone armed
with this knowledge can easily break a cipher text produced by the modified
version of Caesar cipher.

3.Mono-alphabetic Cipher

The major weakness of the Caesar cipher is its predictability. Once we decide to
replace an alphabet in a plain-text message with an alphabet that is k positions
up or down the order, we replace all other alphabets in the plain-text message
with the same technique. Thus, the cryptanalyst has to try out a maximum of 25
possible attacks, and he/she is assured of success.

Now imagine that rather than using a uniform scheme for all the alphabets in a
given plain-text message, we decide to use random substitution. This means that
in a given plain-text message, each A can be replaced by any other alphabet (B
through Z), each B can also be replaced by any other random alphabet (A or C
through Z), and so on. The crucial difference being, there is no relation between
the replacement of B and replacement of A. That is, if we have decided to
replace each A with D, we need not necessarily replace each B with E—we can
replace each B with any other character!To put it mathematically, we can now
have any permutation or combination of the 26 alphabets, which

means (26 X 25 X 24 X 23 X … 2) or 4 X 1026 possibilities! This is extremely

hard to crack. It might actually take years to try out these many combinations
even with the most modern computers .Mono-alphabetic ciphers pose a difficult
problem for a cryptanalyst because it can be very difficult to crack, thanks to the
high number of possible permutations and combinations .There is only one
hitch. If the cipher text created with this technique is short, the cryptanalyst can

7
Sangameshwar College CNS

try different attacks based on his/her knowledge of the English language. As we

know, some alphabets in the English language occur more frequently than
others. Language analysts have found that given a single alphabet in cipher text,
the probability that it is a P is 13.33%—the highest. After P comes Z, which

is likely to occur 11.67%. The probability that the alphabet is C, K, L, N or R is

almost 0—the lowest.A cryptanalyst looks for patterns of alphabets in a cipher
text, substitutes the various available alphabets in place of cipher-text alphabets,
and then tries his/her attacks.Apart from single-alphabet replacements, the
cryptanalyst also looks for repeated patterns of words to try the attacks. For
example, the cryptanalyst might look for two-alphabet cipher text patterns since
the word to occurs very frequently in English. If the cryptanalyst finds that two
alphabet combinations are found frequently in a cipher-text message, he/she
might try and replace all of them with to, and then try and deduce the remaining
alphabets/words. Next, the cryptanalyst might try to find repeating three
alphabet patterns and try and replace them with the word the, and, and so on.

4. Homophonic Substitution Cipher

The homophonic substitution cipher is very similar to mono-alphabetic cipher.

Like a plain substitution cipher technique, we replace one alphabet with another
in this scheme. However, the difference between the two techniques is that
whereas the replacement alphabet set in case of the simple substitution
techniques is fixed (e.g. replace A with D, B with E, etc.), in the case of
homophonic substitution cipher, one plain-text alphabet can map to more than
one cipher-text alphabet. For instance, A can be replaced by D, H, P, R; B can
be replaced by E, I, Q, S, etc.

Homophonic substitution cipher also involves substitution of one plain-text

character with a cipher-text character at a time, however the cipher-text
character can be any one of the chosen set.

5. Polygram Substitution Cipher

In the polygram substitution cipher technique, rather than replacing one plain-
text alphabet with one cipher text alphabet at a time, a block of alphabets is

8
Sangameshwar College CNS

replaced with another block. For instance, HELLO could be replaced by

YUQQW, but HELL could be replaced by a totally different cipher text block

TEUI, as shown in following Fig.. This is true in spite of the first four
characters of the two blocks of text (HELL) being the same. This shows that in
the polygram substitution cipher, the replacement of plain text happens block by
block, rather than character by character.

Fig: Polygram substitution

Polygram substitution cipher technique replaces one block of plain text with
another block of cipher text—it does not work on a character-by-character basis.

6. Polyalphabetic Substitution Cipher

Leon Battista invented the polyalphabetic substitution cipher in 1568. This

cipher has been broken many times, and yet it has been used extensively. The
Vigenére cipher and the Beaufort cipher are examples of polyalphabetic
substitution cipher.

This cipher uses multiple one-character keys. Each of the keys encrypts one
plain-text character. The first key encrypts the first plain-text character; the
second key encrypts the second plain-text character, and so on. After all the
keys are used, they are recycled. Thus, if we have 30 one-letter keys, every 30th

character in the plain text would be replaced with the same key. This number (in
this case, 30) is called the period of the cipher.

The main features of polyalphabetic substitution cipher are the following.

(a) It uses a set of related monoalphabetic substitution rules.

9
Sangameshwar College CNS

(b) It uses a key that determines which rule is used for which transformation.

For example, let us discuss the Vigenére cipher, which is an example of this
cipher. In this algorithm,26 Caesar ciphers make up the mono-alphabetic
substitution rules. There is a shifting mechanism, from a count of 0 to 25. For
each plain-text letter, we have a corresponding substitution, which we call the

key letter. For instance, the key value is e for a letter with shift as 3.

To understand this technique, we need to take a look at a table, which is

formally known as Vigenére tableau. This table is shown in following Fig.

Fig: Vigenére tableau

The logic for encryption is quite simple. For key letter p and plain-text letter q,
the corresponding cipher-text letter is at the intersection of row titled p and
column titled q. For this very particular case, the cipher text, therefore, would
be F, based on the above table.

10
Sangameshwar College CNS

TRANSPOSITION TECHNIQUES

1. Rail-Fence Technique

The rail-fence technique is an example of transposition. It uses a simple

algorithm as shown in Fig.

Fig: Rail-fence technique

Let us illustrate the rail-fence technique with a simple example. Suppose that
we have a plain-text message :Come home tomorrow. This is shown in
following Fig. As the figure shows, the plain-text message ‘Come home
tomorrow’ transforms into ‘Cmhmtmrooeoeoorw’ with the help of rail-fence
technique.
Rail-fence technique involves writing plain text as a sequence of diagonals and
then reading it row by row to produce cipher text.

Fig: Example of rail-fence technique

11
Sangameshwar College CNS

2 .Simple Columnar Transposition Technique

1. Basic Technique

Basic Technique Variations of the basic transposition technique such as rail-

fence technique exist. Such a scheme is shown in following Fig. which we shall
call simple columnar transposition technique.

Fig: Simple columnar transposition technique

Let us examine the simple columnar transposition technique with an example.

Consider the same plaintext message ‘Come home tomorrow’. This is illustrated
in following Fig.

Fig: Example of simple columnar transposition technique

The simple columnar transposition technique simply arranges the plain

text as a sequence of rows of a rectangle that are read in columns randomly.

12
Sangameshwar College CNS

2. Simple Columnar Transposition Technique with Multiple Rounds

To improve the basic simple columnar transposition technique, we can

introduce more complexity. The idea is to use the same basic procedure as used
by the simple columnar transposition technique, but to do it more than once.
That adds considerably more complexity for the cryptanalyst. The basic
algorithm used in this technique is shown in following Fig.

Fig: Simple columnar transposition technique with multiple rounds.

As we can see, the only addition in this technique to the basic simple columnar
transposition technique is step 4, which results in the execution of the basic
algorithm on more than one occasion. Although this sounds trivial, in reality, it
makes the cipher text far more complex as compared to the basic simple
columnar transposition technique. Let us extend our earlier example to now
have multiple rounds of transposition, as shown in following Fig

13
Sangameshwar College CNS

Fig: Example of simple columnar transposition technique with multiple rounds

As the figure shows, multiple rounds or iterations add more complexity to the
cipher text produced by the basic simple columnar transposition technique. The
more the number of iterations, the more complex is the cipher text thus
produced.

Cipher text produced by the simple columnar transposition technique with

multiple rounds is much more complex to crack as compared to the basic
technique

3. Vernam Cipher (One-Time Pad)

The Vernam cipher, whose specific subset is called one-time pad, is

implemented using a random set of non-repeating characters as the input cipher
text. The most significant point here is that once an input cipher text for
transposition is used, it is never used again for any other message (hence the
name onetime). The length of the input cipher text is equal to the length of the
original plain text. The algorithm used in the Vernam cipher is described in
following Fig

14
Sangameshwar College CNS

Fig: Algorithm for Vernam cipher

Let us apply the Vernam cipher algorithm to a plain-text message HOW ARE
YOU using a one-time pad NCBTZQARX to produce a cipher-text message
UQXTRUYFR as shown in following Fig.

Fig: Example of Vernam cipher

It should be clear that since the one-time pad is discarded after a single use, this
technique is highly secure and suitable for small plain-text message, but is
clearly impractical for large messages. The Vernam Cipher was first
implemented at AT&T with the help of a device called the Vernam machine.

Vernam Cipher uses a one-time pad, which is discarded after a single use, and
therefore, is suitable only for short messages

4. Book Cipher/Running-Key Cipher

The idea used in book cipher, also incorrectly called running-key cipher, is quite
simple, and is similar in principle to the Vernam cipher. For producing cipher
text, some portion of text from a book is used, which serves the purpose of a
one-time pad. Thus, the characters from a book are used as onetime pad, and
15
Sangameshwar College CNS

they are added to the input plain-text message similar to the way a one-time pad
works

ENCRYPTION AND DECRYPTION

The process of encoding plaintext messages into cipher text messages is

called encryption.

The reverse process of transforming cipher-text messages back to plain text

messages is called decryption.

Fig: Decryption

Decryption is exactly the opposite of encryption. Encryption transforms a plain-

text message into cipher text, whereas decryption transforms a cipher text
message back into plain text.

In computer-to-computer communications, the computer at the sender’s end

usually transforms a plaintext message into ciphertext by performing
encryption. The encrypted cipher-text message is then sent to the receiver over a
network (such as the Internet, although it can be any other network). The
receiver’s computer then takes the encrypted message, and performs the reverse
of encryption, i.e. it performs the decryption process to obtain the original plain-
text message.

16
Sangameshwar College CNS

To encrypt a plain-text message, the sender (we shall henceforth treat the term
sender to mean the sender’s computer) performs encryption, i.e. applies the
encryption algorithm. To decrypt a received encrypted message, the recipient
performs decryption, i.e. applies the decryption algorithm. The decryption
algorithm must be the same as the encryption algorithm.The second aspect of
performing encryption and encryption of messages is the key.

Every encryption and decryption process has two aspects: the algorithm and the
key used for encryption and decryption.

Fig: Encryption and decryption in the real world

Fig: Aspects of encryption and decryption

17
Sangameshwar College CNS

Broadly, there are two cryptographic mechanisms, depending on what keys are
used. If the same key is used for encryption and decryption, we call the
mechanism symmetric key cryptography. However, if two different keys are
used in a cryptographic mechanism, wherein one key is used for encryption, and
another, different key is used for decryption; we call the mechanism
asymmetric key cryptography

Fig: Cryptography techniques

Symmetric key cryptography involves the usage of the same key for encryption
and decryption. Asymmetric key cryptography involves the usage of one key for
encryption, and another, different key for decryption.

STEGANOGRAPHY
Steganography is a technique that facilitates hiding of a message that is to be
kept secret inside other messages. This results in the concealment of the secret
message itself! Historically, the sender used methods such as invisible ink, tiny
pin punctures on specific characters, minute variations between handwritten
characters, pencil marks on handwritten characters, etc.

KEY RANGE AND KEY SIZE

The concept of key range leads us to the principle of key size. At the simplest
level, the key size can be just 1 bit. This means that the key can be either 0 or 1.
If the key size is 2, the possible key values are 00, 01, 10, 11. From a practical
viewpoint, a 40-bit key takes about 3 hours to crack. However, a 41-bit key
would take 6 hours, a 42-bit key takes 12 hours, and so on. This means that
every additional bit doubles the amount of time required to crack the key.

18
Sangameshwar College CNS

Fig: key range

POSSIBLE TYPES OF ATTACKS

Fig: Types of attacks

1. Cipher-Text Only Attack -In this type of attack, the attacker does not
have any clue about the plain text. She has some or all of the cipher text.
(Interestingly, we should point out that if the attacker does not have an
access even to the cipher text, there would be no need to encrypt the plain
text to obtain cipher text in the first place!).

19
Sangameshwar College CNS

The attacker analyzes the cipher text at leisure to try and figure out the original
plain text. Based on the frequency of letters (e.g. the alphabets e, i, a are very
common in English, etc.) the attacker makes an attempt to guess the plain text.
Obviously, the more cipher text available to the attacker, more are the
chances of a successful attack. For instance, consider a very small cipher text
block, RTQ. It is very difficult to guess the original plain text, given this block.
There could be numerous possible plain texts, which yield this cipher text upon
encryption. In contrast, if the cipher text size is bigger, the attacker
can narrow down the various permutations and combinations to try and obtain
the original plain text. The concept is shown in Fig.

Fig: Cipher text- only attack

The reason behind this is simple. For instance, if the attacker has cipher text
available as ABC and knows that the encryption algorithm used was
Monoalphabetic cipher, it is almost impossible to try and deduce the correct
plain text. There are so many three-letter words in English that could
correspond to this cipher text. Does this cipher text map to CAT, RAT, MAT,
SHE, ARE, …? This problem is shown in following Fig.

fig: Confusion for the attacker

20
Sangameshwar College CNS

2. Known Plain-Text Attack

In this case, the attacker knows about some pairs of plain text and
corresponding cipher text for those pairs. Using this information, the attacker
tries to find other pairs, and therefore, know more and more of the plain text.
Examples of such known plain texts are company banners, file headers, etc.,
which are found commonly in all the documents of a particular company. How
can the attacker obtain the plain text, in the first place? This can happen because
plain-text information may become outdated over time, and hence, become
public knowledge. Alternatively, it could be leaked inadvertently. This is shown
in following fig.

Fig: Known plain text attack

3. Chosen Plain-Text Attack

Here, the attacker selects a plain-text block, and tries to look for the encryption
of the same in the cipher text. Here, the attacker is able to choose the messages
to encrypt. Based on this, the attacker intentionally picks patterns of cipher text
that result in obtaining more information about the key.
For example, a telegraph company may offer a paid service where they encrypt
people’s messages and send them to the desired recipient. The telegraph
company on the other side would decrypt the message and give the original
message to the recipient. Therefore, it is quite possible for the attacker to choose
some plain text, which she thinks is quite commonly used in secret messages.

21
Sangameshwar College CNS

Therefore, the attacker chooses some such plain text and pays the telegraph
company to encrypt it. The result of this is that the attacker now has access to
some plain text that he/she had chosen, and its corresponding cipher text.

fig: Chosen plain-text attack

4. Chosen Cipher-Text Attack

In the chosen cipher-text attack, the attacker knows the cipher text to be
decrypted, the encryption algorithm that was used to produce this cipher text,
and the corresponding plain-text block. The attacker’s job is to discover the key
used for encryption. However, this type of attack is not very commonly used.

5. Chosen-Text Attack
The chosen-text attack is essentially a combination of chosen plain-text attack
and chosen cipher-text attack. This is shown in following Fig

fig: Chosen text attack

22
Sangameshwar College CNS

Summary of types of attacks

Symmetric Key and Asymmetric Key

Symmetric Key Cryptography

In symmetric key cryptography, an individual key is used for both encryption

and decryption. The sender needs the key to encrypt the plaintext and sends the
cipher document to the receiver. The receiver used the similar key (or ruleset) to
decrypt the message and recover the plaintext. Because an individual key is
used for both functions, symmetric key cryptography is also known as
symmetric encryption.

Symmetric key cryptography schemes are usually categorized such as stream

ciphers or block ciphers. Stream ciphers works on a single bit (byte or computer
word) at a time and execute some form of feedback structure so that the key is
constantly changing.

23
Sangameshwar College CNS

Asymmetric cryptography

Asymmetric cryptography uses two keys for encryption and decryption. It

depends on the technique of public and private keys. A public key, which is
interchanged between higher than one user. Data is decrypted by a private key,
which is not transformed. It is slower but more secure. The public key used in
this encryption technique is applicable to everyone, but the private key used in it
is not revealed.

In asymmetric encryption, a message that is encrypted utilizing a public key can

be decrypted by a private key, while if the message is encrypted by a private
key can be decrypted by utilizing the public key. Asymmetric encryption is
broadly used in dayto- day communication channels, particularly on the
internet.

Key Differences Symmetric Encryption Asymmetric Encryption

Smaller cipher text Larger cipher text

Size of cipher text compares to original plain compares to original plain
text file. text file.

Used to transmit small

Data size Used to transmit big data.
data.

Symmetric key encryption Asymmetric encryption

Resource Utilization works on low usage of requires high consumption
resources. of resources.

RSA 2048-bit or higher

Key Lengths 128 or 256-bit key size.
key size.

Much safer as two keys

Less secured due to use a
Security are involved in encryption
single key for encryption.
and decryption.

24
Sangameshwar College CNS

Key Differences Symmetric Encryption Asymmetric Encryption

Symmetric Encryption Asymmetric Encryption

Number of keys uses a single key for uses two keys for
encryption and decryption. encryption and decryption

It is a modern encryption
Techniques It is an old technique.
technique.

A single key for encryption Two keys separately made

and decryption has for encryption and
Confidentiality
chances of key decryption that removes
compromised. the need to share a key.

Symmetric encryption is Asymmetric encryption is

Speed
fast technique slower in terms of speed.

RC4, AES, DES, 3DES, RSA, Diffie-Hellman, ECC

Algorithms
and QUAD. algorithms.

25