13.2 Encryption Concepts & Cryptographic Applications

Encryption Concepts & Cryptographic Applications

Exam Focus: Cryptography transforms sensitive information into mathematically protected representations, safeguarding Confidentiality, Integrity, and Non-repudiation. Technicians must master the core operational differences between Symmetric encryption (single shared key, rapid bulk execution) and Asymmetric encryption (public/private key pairs, key exchange, digital signatures). Furthermore, understanding how cryptography protects data in all operational states—specifically Data at Rest via Full Disk Encryption (BitLocker and TPM) and Data in Transit via TLS and IPsec—is essential, alongside distinguishing two-way encryption from one-way cryptographic hashing.

---

Cryptographic Foundations: Plaintext, Ciphertext, and Keys

At its core, cryptography is the science of encoding communications so that only authorized entities possessing specific mathematical keys can decode the information.

• Plaintext (Cleartext): The original, unencrypted, human-readable or machine-readable data (e.g., a credit card number, a text message, or an operating system executable).
• Ciphertext: The scrambled, unreadable output produced after a cryptographic algorithm processes plaintext using an encryption key. To an unauthorized observer, ciphertext appears as completely random binary noise.
• Cryptographic Algorithm (Cipher): The mathematical function or formula defining the steps required to encrypt and decrypt data (e.g., AES, RSA, SHA-256).
• Cryptographic Key: A specific string of binary bits fed into the cipher alongside the plaintext. The key dictates the exact mathematical transformation. Without the corresponding key, ciphertext cannot be decrypted.
• Kerckhoffs's Principle: A foundational doctrine of modern cryptography stating that a cryptographic system should be secure even if everything about the system—including the complete algorithm and source code—is public knowledge, so long as the key remains secret. Proprietary, "secret" algorithms (security through obscurity) consistently fail; robust ciphers are published openly and subjected to years of intense mathematical cryptanalysis.

+-------------------------------------------------------------------------+
|                       CRYPTOGRAPHIC ENCRYPTION FLOW                     |
+-------------------------------------------------------------------------+
|                                                                         |
|   [ PLAINTEXT ] ---> +--------------------+ ---> [ CIPHERTEXT ]         |
| "Transfer $5,000"    | Encryption Cipher  |      "7f8b9a2c4e1d..."      |
|                      +--------------------+      (Unreadable Noise)     |
|                                ^                                        |
|                                |                                        |
|                        [ ENCRYPTION KEY ]                               |
|                                                                         |
|   [ CIPHERTEXT ] ---> +--------------------+ ---> [ PLAINTEXT ]         |
| "7f8b9a2c4e1d..."    | Decryption Cipher  |      "Transfer $5,000"      |
|                      +--------------------+                             |
|                                ^                                        |
|                                |                                        |
|                        [ DECRYPTION KEY ]                               |
|                                                                         |
+-------------------------------------------------------------------------+

---

Symmetric vs. Asymmetric Encryption

All modern encryption algorithms fall into one of two fundamental architectural classes based on how they utilize cryptographic keys:

                               CRYPTOGRAPHIC ARCHITECTURES
                                            |
         +----------------------------------+----------------------------------+
         |                                                                     |
SYMMETRIC ENCRYPTION                                                  ASYMMETRIC ENCRYPTION
(Single Shared Key)                                                   (Public / Private Key Pair)
  * Same key encrypts and decrypts                                      * Public Key: Encrypts data / Verifies signature
  * Blazing fast computational speed                                    * Private Key: Decrypts data / Creates signature
  * Primary Use: Bulk data (Disks, TLS payloads)                        * Primary Use: Key exchange, Digital signatures
  * Algorithms: AES-128/256, 3DES                                       * Algorithms: RSA-2048/4096, ECC-256/384
  * Key Distribution Problem: How to share key securely?                 * Solves Key Distribution Problem

1. Symmetric Encryption (Private / Secret Key Cryptography)

In a symmetric cryptosystem, the exact same secret key is used for both encryption and decryption. Both communicating parties must possess a copy of this shared secret key before secure communication can occur.

• Primary Advantages:
  • Extreme Computational Speed: Symmetric mathematical operations (substitutions, permutations, bitwise XORs) are computationally lightweight, executing hundreds of times faster than asymmetric algorithms.
  • Hardware Acceleration: Modern processors incorporate dedicated instruction sets (such as Intel/AMD AES-NI) that execute symmetric encryption directly within silicon, providing gigabytes-per-second throughput with negligible CPU overhead.
  • Bulk Data Processing: Ideal for encrypting entire storage drives, massive database volumes, video streams, and large network payloads.
• The Critical Disadvantage: The Key Distribution Problem:
  • If Alice wants to send an encrypted file to Bob over the internet using symmetric encryption, how does Alice securely deliver the secret key to Bob? If an eavesdropper intercepts the key in transit, the confidentiality of all past and future communications is compromised.
  • Key Scaling Problem: In a network of $N$ users where every user needs to communicate privately with every other user, the number of required symmetric keys is $\frac{N(N-1)}{2}$. For 1,000 users, nearly 500,000 individual keys must be generated, distributed, and safeguarded.
• Prominent Symmetric Algorithms:
  • AES (Advanced Encryption Standard): The worldwide gold standard for symmetric encryption, adopted by NIST in 2001 (Rijndael cipher). AES operates on 128-bit blocks of data using key sizes of 128, 192, or 256 bits. AES is a widely adopted modern standard; when implemented and managed correctly, approved AES key sizes are used for sensitive government and commercial data, and no practical attack against the full AES algorithm is publicly known.
  • 3DES (Triple DES): An interim standard that applied the legacy 56-bit DES algorithm three times consecutively. 3DES is computationally slow, possesses small 64-bit block vulnerabilities (Sweet32), and is deprecated across modern systems.
  • DES (Data Encryption Standard): Developed in the 1970s with a 56-bit key. Modern computers can brute-force DES in hours; it is completely insecure.

2. Asymmetric Encryption (Public Key Cryptography)

Asymmetric cryptosystems utilize two mathematically linked, distinct keys: a Public Key and a Private Key.

• Public Key: Freely published, shared openly, and distributed to anyone in the world (via public key directories, email signatures, or digital certificates).
• Private Key: Guarded with extreme security, kept strictly secret, and known only to the individual owner. It is mathematically infeasible to deduce the private key from the public key.

The Dual Operations of Asymmetric Cryptography

Asymmetric cryptography supports two distinct security functions:

1. Data Confidentiality (Encryption Flow):
   • For a public-key encryption scheme, Alice encrypts data for Bob using Bob's public key.
   • The corresponding private key is required to decrypt the ciphertext. In practice, applications normally use this mechanism to protect a small symmetric key rather than a large file.
2. Authenticity and Integrity (Digital Signature Flow):
   • Alice computes a digest of the document and uses her private key with a digital-signature algorithm to create a signature. Signing is not accurately described as generic private-key encryption; schemes such as RSA-PSS and ECDSA use different mathematical operations.
   • Bob uses Alice's public key to verify the signature against a freshly computed digest. Successful verification supports authenticity and integrity, while operational non-repudiation also depends on protecting the private key and establishing who controlled it.

Asymmetric Algorithms

• RSA (Rivest-Shamir-Adleman): The most historically prominent asymmetric cryptosystem, based on the mathematical difficulty of factoring large prime numbers. Key sizes range from 2048 to 4096 bits.
• ECC (Elliptic Curve Cryptography): A modern asymmetric approach based on the algebraic structure of elliptic curves over finite fields.
  • The ECC Advantage: ECC provides equivalent cryptographic security to RSA at vastly smaller key sizes. A 256-bit ECC key delivers the equivalent security level of a 3072-bit RSA key.
  • Smaller key sizes translate to lower memory consumption, significantly reduced CPU overhead, and dramatically faster connection handshakes—making ECC the premier choice for smartphones, smart cards, and IoT devices.
• Diffie-Hellman (DH / ECDH): A specialized asymmetric mathematical key exchange protocol allowing two parties who have no prior knowledge of each other to securely establish a shared symmetric secret key over an insecure, public channel.

3. Hybrid Cryptography: The Best of Both Worlds

In production systems (such as HTTPS/TLS), IT architectures never rely exclusively on asymmetric encryption for data transmission because asymmetric operations are hundreds of times slower than symmetric ciphers. Instead, modern systems deploy hybrid cryptosystems:

1. Authentication & Key Establishment: In modern TLS, a digital certificate and signature authenticate the server, while an ephemeral Diffie-Hellman exchange such as ECDHE establishes shared key material. Older TLS versions could use RSA key transport, but TLS 1.3 does not.
2. Symmetric Authenticated Encryption for Application Data: Both endpoints derive symmetric traffic keys and use an authenticated cipher such as AES-GCM or ChaCha20-Poly1305 for efficient confidentiality and integrity. Security still depends on correct validation, configuration, implementation, and key handling.

---

Data States and Cryptographic Protections

Information security requires protecting digital data across all three of its operational states:

+-----------------------+   Transmission   +-----------------------+
|     DATA AT REST      | ---------------> |    DATA IN TRANSIT    |
|  (Storage Drives,     |   (Encrypted     |  (Network Packets,    |
|   Databases, Backups) |    via TLS/VPN)  |   TLS 1.3, IPsec ESP) |
+-----------------------+                  +-----------------------+
            |                                          |
            v                                          v
+------------------------------------------------------------------+
|                          DATA IN USE                             |
|      (Data in CPU Registers & System RAM: Secure Enclaves)       |
+------------------------------------------------------------------+

1. Data at Rest: Protecting Stored Assets

Data at rest refers to all static data stored on physical or virtual non-volatile storage media: solid-state drives (SSDs), hard disk drives (HDDs), optical media, storage area networks (SAN), and backup tapes.

• Full Disk Encryption (FDE): Encrypts every individual storage sector on the physical drive, including the operating system files, temporary system caches, swap partitions, and user files. If an encrypted laptop or drive is physically stolen, the thief cannot read any data without the decryption passphrase or key.
• Microsoft BitLocker & The Trusted Platform Module (TPM):
  • BitLocker: The native full disk encryption feature included in enterprise and professional editions of Windows.
  • TPM (Trusted Platform Module): A dedicated, tamper-resistant cryptographic microchip soldered directly onto the computer's motherboard (TPM 2.0 standard). The TPM serves as the hardware root of trust.
  • How BitLocker Uses a TPM: BitLocker encrypts the volume with a full-volume encryption key and protects the Volume Master Key with one or more key protectors. A TPM can seal a protector to expected boot measurements recorded in Platform Configuration Registers (PCRs). If the measured firmware and boot path satisfy policy, the TPM can unseal the protector; an unexpected measurement or moving the drive to another computer can trigger recovery. This measured-boot policy detects a changed boot state but does not prove that every operating-system file is malware-free.
• Apple FileVault: The native hardware-accelerated full disk encryption system for macOS, utilizing XTS-AES-128 or XTS-AES-256 encryption. On modern Mac computers, encryption keys are securely held and managed by the Apple Silicon Secure Enclave processor.
• Mobile Device Encryption: Modern mobile operating systems (iOS and Android) enforce hardware-backed File-Based Encryption (FBE) by default. Different files are encrypted with different keys tied to the user's lock-screen passcode and protected by dedicated hardware security processors.

2. Data in Transit: Protecting Moving Packets

Data in transit (data in motion) refers to information traversing untrusted public networks (the internet) or private local area networks. If transmitted in cleartext, packets can be intercepted, read, or modified by packet sniffers or Man-in-the-Middle (MitM) attackers.

• Transport Layer Security (TLS 1.2 / TLS 1.3): The cryptographic protocol powering HTTPS (Hypertext Transfer Protocol Secure, operating on TCP port 443). TLS encrypts web browser traffic, API transactions, and secure email retrieval (IMAPS on port 993, POP3S on port 995). TLS replaced the obsolete Secure Sockets Layer (SSL) protocol.
• IPsec (Internet Protocol Security): A comprehensive suite of protocols operating at the Network Layer (Layer 3) of the OSI model. IPsec uses Encapsulating Security Payload (ESP) to provide confidentiality, integrity, and authentication for Virtual Private Networks (VPNs). Site-to-site VPNs link remote branch offices, while client-to-site VPNs secure teleworker internet connections.
• Secure Shell (SSH): A cryptographic network protocol operating on TCP port 22, providing secure remote command-line terminal management, file transfers (SFTP), and port tunneling. SSH replaced unencrypted, vulnerable legacy protocols such as Telnet (port 23) and rlogin.
• Secure Email Protocols (S/MIME and PGP/GPG): Can provide end-to-end encryption and digital signatures for email messages when keys and recipients are configured correctly.
• Mobile Applications: A mobile application commonly protects API requests and synchronized account data with validated TLS while data is in transit. Sensitive local app data may also use platform-backed file or database encryption at rest. Developers must not disable certificate validation, embed long-lived secrets in the app, or treat transport encryption as a substitute for authentication and authorization.

3. Data in Use: Protecting Active Memory

Data in use refers to information actively residing in system RAM, CPU caches, or CPU registers while applications process it. It may be exposed to malware, privileged software, or physical memory attacks. Some platforms offer hardware-isolated execution or confidential-computing features, such as protected enclaves or encrypted virtual-machine memory, but availability and protection boundaries vary by processor and configuration.

---

Cryptographic Hashing vs. Encryption

A critical distinction on certification exams is differentiating Encryption from Cryptographic Hashing. While both rely on advanced mathematics, their architectural objectives are completely distinct:

+------------------------------------+------------------------------------+
|         TWO-WAY ENCRYPTION         |          ONE-WAY HASHING           |
+------------------------------------+------------------------------------+
|  Plaintext  --->  Ciphertext       |  Input Data  --->  Fixed Digest    |
|      |                  ^          |  (Any Size)        (Fixed Length)  |
|      v                  |          |        |                           |
|  Ciphertext --->  Plaintext        |        +--------X (Cannot Reverse) |
|                                    |                                    |
| * Two-way reversible process       | * One-way irreversible function    |
| * Requires cryptographic keys      | * Does NOT use keys (standard hash)|
| * Objective: CONFIDENTIALITY       | * Objective: DATA INTEGRITY        |
| * Example: AES-256, RSA-4096       | * Example: SHA-256, SHA-512        |
+------------------------------------+------------------------------------+

Properties of Secure Cryptographic Hash Functions

1. Deterministic: The exact same input data will always produce the identical alphanumeric hash digest.
2. Fixed Output Length: Regardless of whether the input is a single character ("a") or an entire 50-gigabyte operating system ISO image, the resulting hash digest is always exactly the same fixed length (e.g., SHA-256 always outputs 256 bits, rendered as 64 hexadecimal characters).
3. The Avalanche Effect: Changing a single bit in the input file drastically changes the output digest—typically flipping more than 50% of the characters in the resulting hash, making tampering immediately obvious.
4. One-Way (Pre-image Resistance): A secure hash is designed so that finding an input that matches a given digest is computationally infeasible. A hash is not encryption and has no decryption key, although attackers can still test guesses against predictable inputs.
5. Collision Resistance: It is mathematically infeasible to find two different input files ($M_1 \neq M_2$) that produce the exact same output hash digest ($H(M_1) = H(M_2)$).

Hash Algorithm Families

• MD5 (Message Digest 5): Produces a 128-bit hash. MD5 is cryptographically broken; researchers have demonstrated practical collision attacks where two different files produce the identical MD5 digest. It must never be used for security purposes.
• SHA-1 (Secure Hash Algorithm 1): Produces a 160-bit hash. Also cryptographically broken due to demonstrated collision attacks. Deprecated across the industry.
• SHA-2 Family (SHA-256, SHA-512): Designed by the NSA and published by NIST. Highly secure and widely used across all modern operating systems, digital certificates, and blockchain ledgers.
• SHA-3 Family: A modern sponge-construction algorithm (Keccak) developed as an alternative architecture to SHA-2, offering high resilience against cryptanalytic attacks.

Practical Applications: Checksums and Password Salting

• Integrity Checksums: Software vendors publish cryptographic hashes (e.g., SHA-256 checksums) alongside software installers and OS ISO downloads. After downloading, a user calculates the hash of the local file; if the calculated hash matches the vendor's published string, the user knows the file was not corrupted during transit or secretly modified by malware.
• Salted Hashes for Password Storage:
  • Storing user passwords in plaintext is an extreme security violation. Storing simple, unsalted hashes is also dangerous because attackers use rainbow tables (precomputed databases containing billions of pre-calculated hashes for common passwords) to crack hashes instantaneously.
  • The Cryptographic Salt Solution: A salt is a cryptographically random string (e.g., 16+ bytes) uniquely generated for each user account. The verifier stores a unique salt and applies a dedicated, costed password-hashing or key-derivation function such as Argon2, scrypt, bcrypt, or PBKDF2: $\text{Verifier} = \text{KDF}(\text{Password}, \text{Salt}, \text{Cost})$. A fast general-purpose hash such as plain SHA-256 is not sufficient by itself for password storage because attackers can test guesses too quickly.
  • The resulting hash and the unique salt are stored in the database. A sufficiently long, randomly generated per-record salt defeats reuse of generic precomputed rainbow tables and makes equal passwords overwhelmingly likely to produce different stored verifier values. The costed password-hashing function is still essential because a salt does not prevent offline guessing.

---

Cryptographic Algorithms & Applications Comparison Matrix

---

Common Exam Traps & Real-World Pitfalls

• Trap 1: Believing That Hashing Can Be Decrypted. Hashing is strictly a one-way mathematical operation. There is no key that can "decrypt" a SHA-256 digest back into the original document. If a scenario asks for a technology that scrambles data so that it can be later recovered by an authorized user, the answer is always encryption, never hashing.
• Trap 2: Confusing Key Roles in Asymmetric Confidentiality vs. Digital Signatures. For confidentiality, you encrypt with the recipient's public key (so only the recipient can decrypt with their private key). For digital signatures, you encrypt with the sender's private key (so anyone with the sender's public key can verify that only the sender could have authored it). Confusing these key pairings is a frequent exam error.
• Trap 3: Assuming TPM Stores Data Directly. A Trusted Platform Module (TPM) is not a storage drive; it does not store operating system files or documents. The TPM is a cryptographic co-processor that stores cryptographic keys, performs platform boot measurements, and acts as a hardware root of trust.
• Trap 4: Overlooking the Performance Bottleneck of Asymmetric Encryption. Asymmetric encryption is computationally expensive. Systems never encrypt multi-gigabyte files or live video streams with RSA or ECC; they use asymmetric ciphers solely to exchange a symmetric key, then use symmetric AES for bulk data.