Chapter summary

Subject: security
Chapter summary:
Chapter 1: Basics of security and
cryptography
1. Plaintext: This is the information that a sender wants to transmit to a receiver. or cleartext
Pages: 1-9
2. Encryption: Encryption is the process of encoding messages (or information) in such a way that
eavesdroppers or hackers cannot read it, but authorized parties can.
key terms:

key: is a piece of information or 3. Ciphertext: Ciphertext (sometimes spelled cyphertext) is the result of encryption performed on
parameter that determine the plaintext using an algorithm, called a cipher.
functional output of a crypto
algorithm 4. Cipher: A cipher is an algorithm for performing encryption or decryption—a series of well-
defined steps that can be followed as a procedure.
Hash: a mathematical function that
garbles data and makes it 5. Decryption: This is the process of decoding the encrypted text and getting it back in the plaintext
unreadable. Hashing algorithms are format.
one-way programs, so the text can't
be unscrambled and decoded by
6. Cryptographic key: Generally, a key or a set of keys is involved in encrypting a message. An
anyone else
identical key or a set of identical keys is used by the legitimate party to decrypt the message. A
key is a piece of information that determines the functional output of a cryptographic algorithm
or cipher. Sometimes key means just some steps or rules to follow to twist the plaintext before
Questions transmitting it via a public medium.

7. Stream cipher: A stream cipher is a method of encrypting text (to produce ciphertext) in which a
cryptographic key and algorithm are applied to each binary digit in a data stream, one bit at a
time.

8. Block cipher: A block cipher is a method of encrypting text (to produce ciphertext) in which a
cryptographic key and algorithm are applied to a block of data (for example, 64 contiguous bits)
at once as a group rather than one bit at a time.
kk
Cryptology: Cryptology is the general area of mathematics, such as number theory, and the application of formulas and algorithms, that
underpin cryptography and cryptanalysis.
Cryptography includes techniques such as microdots, merging words with images, and other ways of hiding information in storage or transit.
In today’s computer-centric world, cryptography is most of the time associated with scrambling plaintext into ciphertext, and then back again
(i.e., decryption). Individuals who practice this field are known as cryptographers.
Cryptanalysis: Cryptanalysis refers to the study of ciphers, ciphertext, or cryptosystems (that is, secret code systems) with the goal of finding
weaknesses in these that would permit retrieval of the plaintext from the ciphertext, without necessarily knowing the key or the algorithm used
for that. This is also known as breaking the cipher, ciphertext, or cryptosystem.

Cryptosystem: This is the shortened version of cryptographic system. A cryptosystem is a pair of algorithms that take a key and convert
plaintext to ciphertext and back.
Symmetric cryptography: Symmetric cryptography (or symmetric key encryption) is a class of algorithms for cryptography that use the same
cryptographic keys for both encryption of plaintext and decryption of ciphertext.

Symmetric key ciphers are valuable because:

• It is relatively inexpensive to produce a strong key for these types of ciphers.
• The keys tend to be much smaller in size for the level of protection they afford.
• The algorithms are relatively inexpensive to process
Public-key cryptography or asymmetric cryptography:
Public-key cryptography (PKC), also known as asymmetric cryptography, refers to a cryptographic algorithm that requires two separate
keys, one of which is secret (or private) and the other public. Although different, the two parts of this key pair are mathematically linked.
Public-key cryptography enables the following:

1. Encryption and decryption, which allow two communicating parties to disguise data that they send to each other. The sender encrypts, or
scrambles, the data before sending Them via a communication medium (or such). The receiver decrypts, or unscrambles, the data after
receiving them. While in transit, the encrypted data are not understood by an intruder (or illegitimate third party).
2. Nonrepudiation (formally defined later), which prevents: The sender of the data from claiming, at a later date, that the data were never
sent. - The data from being altered.

Digital signature: A digital signature is an electronic signature that can be used to authenticate the identity of the sender of a message or the
signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital
signatures are usually easily transportable, cannot be imitated by someone else, and can be automatically timestamped

Digital certificate: There is a difference between digital signature and digital certificate. A digital certificate provides a means of proving
someone’s identity in electronic transactions. The function of it could be considered pretty much like a passport or driving license does in face-
to-face interactions.
For instance, a digital certificate can be an electronic “credit card” that establishes someone’s credentials when doing business or other
transactions via the web. It is issued by a certification authority (CA).
Typically, such a card contains the user’s name, a serial number, expiration dates, a copy of the certificate holder’s public key (used for
encrypting messages and digital signatures), and the digital signature of the certificate-issuing authority so that a recipient can verify that the
certificate is real.

Certification authority (CA): a certification authority is an authority in a network that issues and manages security credentials and public keys
for message encryption.
Information security basically tries to provide five types of functionalities:
1. Authentication

2. Authorization

3. Confidentiality or privacy
4. Integrity

5. Nonrepudiation

The Perimeter of Cryptography in Practice

Most of the time, cryptography is associated with the confidentiality (or privacy) of information only. However, except authorization,
it can offer other four functions of security (i.e., authentication, confidentiality, integrity, and nonrepudiation). Let us now see what these
terms mean in this context to talk about the functionalities that cryptography usually has or is supposed to provide.

Things That Cryptographic Technologies Cannot Do:

• Cryptographic technologies cannot provide solutions to all security issues.

• We previously have learned that they cannot provide the authorization aspect of security—that process is basically the task of the
system or network operating system.
• In general, cryptography-based security systems provide sufficient security when used properly within the capabilities and limitations
of the cryptographic technology.
• However, such a technology only provides part of the overall security for any network and information.
• The overall strength of any security system depends on many factors, such as the suitability of the technology, adequate security
procedures and processes, and how well people use the procedures, processes, and technology.
• To put it in another way, security depends on the appropriate protection mechanism of the weakest link in the entire security system.