Underneat / Cryptography

1. What's the Goal? (Confidentiality, Integrity, Authenticity)

Cryptography aims to provide several key security guarantees:

• Confidentiality: Keeping information secret from unauthorized viewers. Like putting a letter in a locked box only the recipient can open.
• Integrity: Ensuring information hasn't been altered or tampered with since it was created. Like an unbroken wax seal on a document.
• Authenticity: Verifying the origin of the information; proving it came from who it claims to be from. Like recognizing a trusted signature.
• Non-repudiation: Preventing the sender from later denying they sent the message.

Different cryptographic techniques help achieve these goals.[1][3]

2. Keeping Secrets: Encryption (Scrambling Data)

Encryption is the process of converting readable information (called "plaintext") into an unreadable, scrambled format (called "ciphertext").[4][5] Only someone with the correct "key" can reverse the process (decryption) to get the original plaintext back. There are two main types:

a) Symmetric Encryption (Shared Secret Key)

Imagine Alice and Bob have identical keys to the same lockbox. Alice puts her message inside, locks it, and sends it to Bob. Bob uses his identical key to unlock it. The crucial part is that they both use the same secret key for locking (encrypting) and unlocking (decrypting).[1][5]

Challenge: How do Alice and Bob securely share the secret key in the first place without someone intercepting it?

Symmetric Encryption: Same key locks and unlocks.

b) Asymmetric Encryption (Public/Private Key Pair)

This is more like a mailbox.[5][10] Bob has two keys that are mathematically linked: a Public Key and a Private Key.

• He shares his Public Key freely (like the mail slot – anyone can use it to put mail in).
• He keeps his Private Key absolutely secret (like the key to open the mailbox – only he has it).

If Alice wants to send Bob a secret message, she finds his Public Key, uses it to encrypt her message, and sends the ciphertext. Only Bob, with his corresponding Private Key, can decrypt and read it.[1][3][9] This solves the key sharing problem of symmetric encryption.

Asymmetric Encryption: Public key encrypts, private key decrypts.

3. Ensuring Integrity: Hashing (Digital Fingerprints)

Hashing is different from encryption. It doesn't use a key in the same way, and it's a one-way process – you can't "un-hash" something to get the original data back.[6][8]

A hash function takes an input (any data, like a file or message) and produces a fixed-size string of characters, called a "hash" or "digest". Think of it like a unique fingerprint for the data.[7][10]

• Even a tiny change in the input data will result in a completely different hash.
• It's computationally infeasible to find two different inputs that produce the same hash (collision resistance).
• It's impossible to figure out the original input data just by looking at the hash.

Hashing is used to verify data integrity. If Alice calculates the hash of a file and sends both the file and the hash to Bob, Bob can recalculate the hash on the file he receives. If his calculated hash matches the one Alice sent, he knows the file wasn't tampered with during transit.[1][8] (This is how blockchain ensures blocks haven't been altered).

Hashing creates a fixed-size, unique fingerprint of data.

4. Proving Authenticity: Digital Signatures

Digital signatures use asymmetric cryptography (public/private keys) and hashing together to prove who created a message and that it hasn't been altered.[1][9][10]

Here's a simplified view:

1. Hashing: Alice calculates the hash (fingerprint) of her message.
2. Encrypting the Hash: She then encrypts only the hash using her own Private Key. This encrypted hash is the digital signature.
3. Sending: She sends the original message + the digital signature to Bob.
4. Verification (Bob's side):
   • Bob decrypts the signature using Alice's Public Key. This reveals the original hash calculated by Alice.
   • Bob independently calculates the hash of the message he received.
   • If the hash he calculated matches the hash revealed by decrypting the signature, he knows two things: 1) The message wasn't altered (hashes match), and 2) Alice must have sent it (only her Private Key could create a signature that her Public Key can decrypt).

Digital signatures combine hashing and asymmetric encryption for authenticity and integrity.

5. Where Is Cryptography Used Every Day?

Cryptography is constantly working behind the scenes:

• Secure Websites (HTTPS): When you see the padlock icon in your browser address bar, that site uses TLS/SSL protocols, which rely heavily on asymmetric encryption (for key exchange), symmetric encryption (for the actual data transfer), and digital signatures (to verify the website's certificate).[1][3][4]
• Secure Messaging Apps: End-to-end encrypted apps (like Signal or WhatsApp) use cryptography to ensure only the sender and intended recipient(s) can read messages.
• Virtual Private Networks (VPNs): Encrypt your internet traffic to protect it from eavesdropping, especially on public Wi-Fi.
• Email Security: Tools like PGP or S/MIME use encryption and digital signatures to secure emails.
• Cryptocurrencies: Technologies like Bitcoin use hashing extensively (in the blockchain) and digital signatures (to authorize transactions).[6]
• Password Storage: Websites typically store hashes of passwords, not the passwords themselves, making breaches less damaging.

6. Why Should I Care?

Understanding basic cryptography helps you appreciate:

• Your Online Privacy: It's the foundation protecting your personal messages, browsing habits, and sensitive data from being easily exposed.
• Financial Security: It secures online banking, shopping transactions, and cryptocurrency holdings.
• Trust Online: It provides mechanisms (like digital signatures and certificates) to help verify the authenticity of websites and software, reducing the risk of phishing and malware.
• Data Integrity: It helps ensure the information you receive (like software updates or important documents) hasn't been maliciously altered.

While you don't need to be an expert, knowing the principles empowers you to make better choices about the tools and services you use to protect your digital life.