Summary of Introduction to Cryptography and Security
Introduction to Cryptography & Security for Students
Introduction
Cryptography is the art and science of protecting information so that only intended parties can read or use it. This study material provides a compact, clear overview of core cryptographic concepts, attacker models, randomness, standards (like AES), and practical considerations you need to understand cryptography as a not-attending student.
Definition: Cryptography — techniques for securing data against adversaries, including confidentiality, integrity, and authenticity.
Definition: Cryptanalysis — methods and practice of finding weaknesses in cryptographic constructions.
Definition: Steganography — concealing a message within other, seemingly innocuous data.
Core Concepts and Terminology
Cryptography vs. Cryptanalysis vs. Cryptology
- Cryptography: design and construction of secure systems.
- Cryptanalysis: breaking or finding weaknesses in those systems.
- Cryptology: the combined study of both.
Encoding vs. Encryption
- Encoding transforms data to a different representation using a public, known mapping (e.g., ASCII). It does not provide secrecy.
- Encryption transforms data using a secret key so that only holders of the key can reverse the mapping.
Definition: Encryption — a reversible transformation parameterized by a secret key $K$, written as $E_K(x)$.
Example: encoding the text "My pin is 1234" into ASCII results in a known sequence of bytes; encryption would transform that byte sequence using a secret key so the output appears random to an adversary.
Kerckhoffs' Principle
- A system should remain secure even if everything about it, except the key, is public knowledge. This discourages security-by-obscurity and encourages robust key management.
Did you know that Kerckhoffs formulated his principle in the 19th century and it still underpins modern cryptographic practice?
Attacker Models
Clear specification of what the attacker can and cannot do is crucial when evaluating security.
- Passive adversary: observes communications but does not modify them. Examples: eavesdropping, ciphertext-only and known-plaintext attacks.
- Active adversary: can inject, alter, or replay messages and interact with legitimate parties. Examples: chosen-plaintext and chosen-ciphertext attacks.
Table: Attacker capabilities
| Capability | Passive adversary | Active adversary |
|---|---|---|
| Observe messages | Yes | Yes |
| Modify or inject messages | No | Yes |
| Query encryption/decryption oracles | No | Often yes |
Randomness and Its Importance
Cryptography depends on unpredictable values: keys, nonces, IVs, challenges.
Definition: True Random Number Generator (TRNG) — derives randomness from non-deterministic physical processes (thermal noise, radioactive decay).
Definition: Pseudorandom Number Generator (PRNG) — generates deterministic sequences from an internal state and seed.
Definition: CSPRNG — cryptographically secure PRNG that resists state compromise analysis.
Key tradeoffs:
- TRNG: nondeterministic and unpredictable but often slow. Good for seeding.
- PRNG/CSPRNG: fast and suitable for generating many values if properly seeded by a TRNG.
Practical guidance:
- Use system-provided CSPRNGs (e.g., modern OS sources like /dev/urandom combined with system entropy) rather than general-purpose functions such as rand() or java.util.Random.
- Avoid PRNGs that leak internal state via outputs.
Recommended PRNGs and RNG designs
- CSPRNGs based on vetted primitives: ChaCha20 stream, AES in CTR mode, iterative hash constructions.
- Number-theoretic options for special use cases: Blum Blum Shub.
- System RNG designs that collect entropy: Yarrow, Fortuna.
Not recommended: Mersenne Twister, simple rand(), Dual_EC_DRBG (historical backdoor concerns), RC4.
Sign up for the full summaryAlready have an account? Sign in
Cryptography Essentials
Klíčová slova: Cryptography, Symmetric Encryption, Course Policies
Klíčové pojmy: Cryptography secures data; cryptanalysis finds weaknesses., Encoding is public mapping; encryption uses a secret key $K$ via $E_K(x)$., Kerckhoffs' principle: security should rely only on secret keys., Specify attacker model: passive vs active adversaries., Use TRNGs to seed CSPRNGs; avoid rand() and weak PRNGs., CSPRNGs: ChaCha20, AES-CTR, iterative hashing recommended., Standards like AES provide vetted, interoperable building blocks., Never roll your own cryptographic algorithms or primitives., Ensure unique nonces/IVs and avoid reuse under the same key., System RNGs (e.g., /dev/urandom) combine TRNG and PRNG advantages., Active attacks include chosen-plaintext and chosen-ciphertext capabilities., Randomness failures or leaked PRNG state lead to catastrophic key compromises.