3.1 Symmetric & Asymmetric Cryptographic Algorithms

Symmetric & Asymmetric Cryptographic Algorithms

Quick Summary: Cryptography forms the backbone of digital security, confidentiality, and authentication. For the CREST Practitioner Security Analyst (CPSA) examination, candidates must master both symmetric (shared secret) and asymmetric (public/private key) cryptosystems. This includes understanding stream ciphers (RC4), block ciphers (DES, 3DES, AES), modes of operation (ECB, CBC, CTR, GCM), mathematical hardness assumptions (integer factorization, discrete logarithms, elliptic curves), and forward secrecy.

---

Foundations of Cryptography & Kerckhoffs's Principle

At its core, cryptography transforms intelligible information (plaintext, denoted as $P$) into an unreadable form (ciphertext, denoted as $C$) through an encryption algorithm ($E$) parameterized by a key ($K$). The inverse operation, decryption ($D$), restores the plaintext using the corresponding decryption key.

$\text{Encryption: } C = E_K(P)$ $\text{Decryption: } P = D_K(C)$

In 1883, Dutch cryptographer Auguste Kerckhoffs formulated six design principles for military cryptography, the second of which remains the governing axiom of modern cryptosystems:

Kerckhoffs's Principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Claude Shannon later reformulated this axiom as Shannon's Maxim: "The enemy knows the system." In penetration testing and security evaluations, attempting to achieve confidentiality by hiding the implementation details, protocol logic, or source code is known as Security through Obscurity. Obscurity provides no measurable security margin; proprietary or secret algorithms almost universally fail when subjected to peer review or binary reverse engineering.

---

Symmetric Cryptography (Secret Key Encryption)

Symmetric cryptography uses a single, shared secret key for both encryption and decryption. Both communicating entities must possess this secret key prior to initiating secure communication.

Core Characteristics of Symmetric Cryptography

• High Performance: Symmetric ciphers use fast, hardware-optimized bitwise operations (such as XOR, substitution, and permutation), making them ideal for bulk data encryption (e.g., hard drives, database volumes, VPN tunnels, and TLS application traffic).
• Key Distribution Dilemma: If $n$ parties need to communicate securely in pairs, the network requires $\frac{n(n - 1)}{2}$ distinct secret keys. For 1,000 users, that equals 499,500 keys, creating massive key management and secure exchange challenges.
• Lack of Inherent Non-Repudiation: Because both sender and receiver possess identical keys, either party could theoretically forge a ciphertext or message authentication code.

Symmetric Bulk Encryption:
Plaintext ───► [ Encryption Engine (AES-256) ] ───► Ciphertext ───► [ Decryption Engine (AES-256) ] ───► Plaintext
                       ▲                                                   ▲
                       │                                                   │
                 Shared Secret (K) ────────────────────────────────── Shared Secret (K)

Symmetric ciphers fall into two structural architectures: stream ciphers and block ciphers.

---

Stream Ciphers: RC4 Architecture & Inherent Weaknesses

Stream ciphers encrypt plaintext continuously, typically one bit or one byte at a time. The algorithm expands a short secret key into an infinitely long, pseudorandom keystream ($K_1, K_2, K_3, \dots$). Encryption is a bitwise XOR (${^}$) between the plaintext stream and keystream:

$C_i = P_i \oplus K_i$ $P_i = C_i \oplus K_i$

Because XOR is an involution ($A \oplus B \oplus B = A$), decryption is mathematically identical to encryption. The primary operational danger in stream ciphers is keystream reuse: if the same keystream encrypts two plaintexts ($C_A = P_A \oplus K$ and $C_B = P_B \oplus K$), an eavesdropper can XOR the ciphertexts together to eliminate the key entirely:

$C_A \oplus C_B = (P_A \oplus K) \oplus (P_B \oplus K) = P_A \oplus P_B$

Once $P_A \oplus P_B$ is exposed, frequency analysis or known-plaintext attacks easily recover both underlying messages.

RC4 (Rivest Cipher 4)

Designed by Ron Rivest in 1987, RC4 was the most widely deployed stream cipher in computing history, powering IEEE 802.11 WEP/WPA and early versions of SSL/TLS.

• Internal State: Consists of a 256-byte permutation array ($S$) and two 8-bit index pointers ($i, j$).
• Key Scheduling Algorithm (KSA): Initializes the array $S[0\dots255]$ with values $0$ to $255$, then permutes them based on the secret key (variable length from 40 to 2048 bits).
• Pseudo-Random Generation Algorithm (PRGA): Continuously cycles through the array, swapping elements and emitting byte-sized pseudorandom keystream output.

Critical Flaws and Deprecation

RC4 suffers from severe statistical biases in its early keystream output:

1. FMS Attack (Fluhrer, Mantin, and Shamir): In WEP, RC4 concatenated a 24-bit cleartext Initialization Vector (IV) with a static secret key. Because the IV rotated predictably and early keystream bytes strongly correlated with the first few key bytes, attackers could recover the full WEP key in minutes by capturing ~20,000 packets (aircrack-ng).
2. Bar Mitzvah Attack (CVE-2015-2808): Fluhrer and McGrew demonstrated invariance weaknesses where specific byte combinations occur with non-random probability in keystream bytes 1 through 512. In TLS, an attacker observing millions of encrypted connections could recover sensitive session cookies byte-by-byte.
3. RFC 7465 Formal Prohibition (2015): The IETF officially banned RC4 across all TLS versions due to practical plaintext recovery attacks.

---

Block Ciphers: DES, 3DES, and AES

Block ciphers operate on fixed-size groups of bits known as blocks. If the final plaintext block is shorter than the block length, cryptographic padding (such as PKCS#7) must be appended before encryption.

Data Encryption Standard (DES)

Adopted as a federal standard in 1977, DES uses a Feistel Network structure where the 64-bit block is split into left ($L$) and right ($R$) 32-bit halves. For 16 rounds, the right half is passed through a round function $F$ (expansion, S-box substitution, permutation) combined with a 48-bit subkey derived from the master key, and XORed into the left half:

$L_{i} = R_{i-1}$ $R_{i} = L_{i-1} \oplus F(R_{i-1}, K_i)$

DES's fatal flaw is its 56-bit key length, providing only $2^{56} \approx 7.2 \times 10^{16}$ possible keys. In 1998, the Electronic Frontier Foundation (EFF) built the "Deep Crack" custom hardware machine for $250,000, which brute-forced a DES key in 56 hours. Modern FPGA clusters and cloud GPUs crack DES keys in minutes. DES is obsolete and completely insecure.

Triple DES (3DES / TDEA)

To extend the life of legacy DES hardware without rewriting core cryptographic libraries, NIST standardized Triple DES using an Encrypt-Decrypt-Encrypt (EDE) sequence across three keys ($K_1, K_2, K_3$):

$C = E_{K3}(D_{K2}(E_{K1}(P)))$

• 3-Key 3DES ($K_1 \neq K_2 \neq K_3$): Total key length of 168 bits. Due to meet-in-the-middle attacks, the effective cryptographic security strength is reduced to 112 bits.
• 2-Key 3DES ($K_1 = K_3 \neq K_2$): Total key length of 112 bits. Effective security is approximately 80 bits, making it vulnerable to specialized cryptanalysis.
• Backward Compatibility: When $K_1 = K_2 = K_3$, the decryption step cancels out the first encryption step ($D_{K1}(E_{K1}(P)) = P$), producing standard single DES.

The Sweet32 Birthday Attack (CVE-2016-2183)

Although 3DES mitigated key-space brute-forcing, it kept the legacy 64-bit block size. According to the Birthday Paradox, in any block cipher using block size $b$ bits in Cipher Block Chaining (CBC) mode, a collision between two ciphertext blocks occurs with a probability of $p \approx 0.5$ after observing approximately $2^{b/2}$ blocks.

For a 64-bit block cipher:

$2^{64/2} = 2^{32} \text{ blocks} = 2^{32} \times 8 \text{ bytes} \approx 32 \text{ gigabytes}$

If an attacker forces a client (e.g., via malicious JavaScript) to send large amounts of repetitive HTTP requests over a long-lived 3DES TLS connection, a ciphertext collision will occur within 32 GB of captured traffic. In CBC mode, if $C_i = C_j$, then:

$P_i \oplus C_{i-1} = P_j \oplus C_{j-1} \implies P_i = P_j \oplus C_{i-1} \oplus C_{j-1}$

If the attacker controls or guesses one plaintext block (e.g., standard HTTP headers), they immediately recover the adjacent secret block (e.g., an authentication session cookie). Consequently, NIST SP 800-131A and PCI DSS completely deprecated 3DES.

Advanced Encryption Standard (AES / Rijndael)

Selected by NIST in 2001 following a 5-year public cryptographic competition, Belgian cryptographers Joan Daemen and Vincent Rijmen developed Rijndael, standardized as FIPS 197.

Unlike DES, AES is a Substitution-Permutation Network (SPN) operating on a fixed 128-bit block size (16 bytes arranged in a $4 \times 4$ column-major matrix of bytes called the State).

AES supports three standardized key lengths, each defining the number of transformation rounds:

• AES-128: 128-bit key, 10 rounds
• AES-192: 192-bit key, 12 rounds
• AES-256: 256-bit key, 14 rounds

Each round (except the final round) executes four distinct algebraic transformations on the State array:

1. SubBytes: Non-linear byte substitution using an inverted Rijndael S-box over Galois Field $GF(2^8)$, providing high confusion and resisting differential cryptanalysis.
2. ShiftRows: Linear permutation where rows 1, 2, and 3 are cyclically shifted to the left by 1, 2, and 3 bytes respectively (row 0 remains stationary), ensuring diffusion across columns.
3. MixColumns: Matrix multiplication over $GF(2^8)$ that mixes each 4-byte column independently, providing complete diffusion across the block (omitted in the final round).
4. AddRoundKey: Bitwise XOR of each column in the State array with a 128-bit round subkey generated from the master key via the Rijndael Key Schedule.

Modern x86 and ARM processors include dedicated hardware instruction sets (AES-NI) that execute these four operations in constant time, eliminating cache-timing side-channel attacks and delivering gigabit-per-second encryption throughput.

---

Block Cipher Modes of Operation

A raw block cipher only encrypts a single 128-bit block. To encrypt data of arbitrary length, a mode of operation must be applied. The selection of mode determines security, parallelizability, error propagation, and integrity.

Block Cipher Modes Summary:
1. ECB (Insecure)  ──► Plaintext blocks encrypted independently; leaks patterns.
2. CBC (Legacy)    ──► Chains blocks via XOR with previous ciphertext; requires IV.
3. CTR (Fast)      ──► Turns block cipher into parallelizable stream cipher via counter.
4. GCM (AEAD)      ──► Combines CTR confidentiality with GHASH authentication tags.

1. Electronic Codebook (ECB) Mode

In ECB, each plaintext block $P_i$ is encrypted independently with the same secret key $K$:

$C_i = E_K(P_i)$

• The "Penguin Problem": Because identical plaintext blocks always yield identical ciphertext blocks under the same key, structural patterns are entirely preserved. In the famous Tux penguin demonstration, encrypting a bitmap image in ECB mode leaves the penguin clearly visible in the ciphertext.
• Vulnerabilities: ECB allows attackers to perform block deletion, reordering, and splicing attacks without knowing the key. ECB must never be used for multi-block data.

2. Cipher Block Chaining (CBC) Mode

In CBC mode, each plaintext block $P_i$ is XORed with the preceding ciphertext block $C_{i-1}$ before being encrypted. The first block is XORed with an Initialization Vector (IV):

$C_1 = E_K(P_1 \oplus \text{IV})$ $C_i = E_K(P_i \oplus C_{i-1}) \quad (i > 1)$

• IV Requirements: The IV must be unpredictable (cryptographically random) and unique per encryption session under the same key. A predictable IV (e.g., incrementing sequence numbers) enables the BEAST attack (Browser Exploit Against SSL/TLS).
• Error Propagation: Corrupting a single bit in ciphertext block $C_i$ completely scrambles the decrypted block $P_i$, but in block $P_{i+1}$ it alters only the exact corresponding bit, leaving all subsequent blocks unaffected.
• Vulnerabilities: CBC mode does not provide cryptographic message integrity. In web applications and TLS, CBC implementations that leak padding verification errors are vulnerable to Padding Oracle Attacks (e.g., POODLE, Lucky Thirteen).

3. Counter (CTR) Mode

CTR mode turns a block cipher into a stream cipher. An incrementing counter concatenated with a unique nonce is encrypted by the block cipher, and the resulting block is XORed with the plaintext:

$C_i = P_i \oplus E_K(\text{Nonce} \parallel \text{Counter}_i)$

• Advantages: Fully parallelizable (encryption and decryption can process any block independently), allows random read access to ciphertext, and requires no padding.
• Catastrophic Failure on Nonce Reuse: If a nonce/counter value is ever reused under the same key, it results in a two-time pad key reuse vulnerability ($C_A \oplus C_B = P_A \oplus P_B$).

4. Galois/Counter Mode (GCM)

GCM is an Authenticated Encryption with Associated Data (AEAD) mode. It combines CTR mode for confidentiality with universal hashing over Galois Field $GF(2^{128})$ (GHASH) to generate an authentication tag ($T$):

• AEAD Capability: GCM encrypts the confidential payload while simultaneously authenticating additional cleartext data (such as IP headers, sequence numbers, or protocol versions) known as Associated Data (AD).
• Integrity Guarantee: Any tampering with the ciphertext or the associated data causes the authentication tag verification to fail, terminating processing before decryption occurs.
• Performance: GCM is parallelizable, highly efficient, and hardware-accelerated via processor instructions (e.g., PCLMULQDQ on Intel/AMD).

---

Asymmetric Cryptography (Public Key Encryption)

Asymmetric cryptography solves the symmetric key distribution dilemma by using mathematically linked key pairs:

• Public Key ($K_{\text{pub}}$): Distributed freely to the world; used by senders to encrypt data or verify digital signatures.
• Private Key ($K_{\text{priv}}$): Kept strictly confidential by the owner; used to decrypt received data or generate digital signatures.

Public Key Encryption (Confidentiality):
Alice ──► Encrypts with Bob's Public Key ──► [Ciphertext in Transit] ──► Bob Decrypts with Bob's Private Key

Digital Signatures (Authenticity & Non-Repudiation):
Alice ──► Signs with Alice's Private Key ──► [Signature in Transit]  ──► Bob Verifies with Alice's Public Key

Asymmetric algorithms rely on one-way trapdoor functions: mathematical operations that are computationally easy to perform in one direction, but virtually impossible to invert without possessing special trapdoor information (the private key).

---

Asymmetric Algorithms: RSA, Diffie-Hellman, and ECC

1. RSA (Rivest, Shamir, Adleman)

Formulated in 1977, RSA derives its security from the Integer Factorization Problem: multiplying two large prime numbers ($p$ and $q$) is computationally trivial, but factoring their product ($n = p \times q$, a large semiprime) back into its constituent primes is practically impossible for sufficiently large integers.

Key Generation Algorithm

1. Choose two distinct, large secret prime numbers $p$ and $q$.
2. Compute the modulus $n = p \times q$.
3. Calculate Euler's totient function: $\phi(n) = (p - 1)(q - 1)$.
4. Select a public exponent $e$ such that $1 < e < \phi(n)$ and $\gcd(e, \phi(n)) = 1$ (industry standard is $e = 65537 = 2^{16} + 1$).
5. Calculate the private exponent $d$ using the Extended Euclidean Algorithm such that $d \equiv e^{-1} \pmod{\phi(n)}$, meaning $d \times e \equiv 1 \pmod{\phi(n)}$.

$\text{Public Key: } (e, n) \qquad \text{Private Key: } (d, n)$ $\text{Encryption: } c = m^e \pmod n \qquad \text{Decryption: } m = c^d \pmod n$

Key Length Guidelines & Standards

• 1024-bit RSA: Broken/deprecated. NIST SP 800-131A disallowed 1024-bit RSA in 2013 due to advances in the Number Field Sieve (NFS) algorithm and distributed computing.
• 2048-bit RSA: The current baseline standard across modern PKI, offering approximately 112 bits of symmetric security equivalence.
• 4096-bit RSA: Used for high-security Root Certificate Authorities and long-term storage, but incurs heavy computational overhead (decryption is $\approx 7\times$ slower than 2048-bit).

Note on RSA Padding: Textbook (raw) RSA is malleable and insecure. Real-world implementations must use Optimal Asymmetric Encryption Padding (OAEP) for encryption (to thwart Bleichenbacher padding oracle attacks) and Probabilistic Signature Scheme (PSS) for digital signatures.

2. Diffie-Hellman Key Agreement (DH)

Published in 1976 by Whitfield Diffie and Martin Hellman, DH allows two parties (Alice and Bob) to establish a shared secret key across an unencrypted, hostile communications channel without transmitting the key itself.

Mathematical Mechanism

DH relies on the Discrete Logarithm Problem over a finite cyclic group modulo a large prime $p$ with generator $g$:

1. Alice selects a secret random integer $a$ and sends public value $A = g^a \pmod p$.
2. Bob selects a secret random integer $b$ and sends public value $B = g^b \pmod p$.
3. Alice computes the shared secret: $S = B^a \pmod p = (g^b)^a \pmod p = g^{ab} \pmod p$.
4. Bob computes the identical secret: $S = A^b \pmod p = (g^a)^b \pmod p = g^{ab} \pmod p$.

An eavesdropper observes $p, g, A,$ and $B$. Computing $g^{ab} \pmod p$ without knowing $a$ or $b$ requires solving the discrete logarithm, which is computationally infeasible for large primes ($p \ge 2048$ bits).

Static DH vs. Ephemeral DH & Perfect Forward Secrecy (PFS)

• Static Diffie-Hellman: The server reuses a static, long-term DH public key across multiple sessions. If the server's private key is ever compromised, an attacker can decrypt all historically recorded sessions.
• Ephemeral Diffie-Hellman (DHE): A new, unique, temporary private key is generated for every individual TLS session and destroyed immediately after the session key is derived.
• Perfect Forward Secrecy (PFS): DHE provides PFS. If an attacker records encrypted network traffic today and breaches the server's private host key five years in the future, they still cannot decrypt the recorded traffic because the ephemeral session keys were never stored.

Vulnerability: Unauthenticated Diffie-Hellman is inherently vulnerable to active Man-in-the-Middle (MitM) attacks. To prevent MitM, DH must be authenticated using digital signatures (such as RSA or ECDSA).

3. Elliptic Curve Cryptography (ECC)

ECC builds upon the algebraic structure of elliptic curves over finite fields, defined by the Weierstrass equation:

$y^2 = x^3 + ax + b$

Rather than multiplying integers, ECC defines an addition law over points on a curve. Given a base point $G$ and an integer scalar $k$, computing point multiplication $Q = k \cdot G$ (adding $G$ to itself $k$ times) is computationally trivial. However, determining the scalar integer $k$ given only points $Q$ and $G$ is the Elliptic Curve Discrete Logarithm Problem (ECDLP), for which no sub-exponential solving algorithm is known.

Core ECC Protocols

• ECDSA (Elliptic Curve Digital Signature Algorithm): Digital signature generation and verification.
• ECDH / ECDHE (Elliptic Curve Diffie-Hellman Ephemeral): Fast, forward-secure key exchange.
• Ed25519: Edwards-curve digital signature algorithm based on Curve25519, resistant to side-channel attacks and offering high verification performance.

Security Equivalence: ECC vs. RSA

Because ECDLP is significantly harder to solve than integer factorization for equivalent key lengths, ECC achieves equivalent security with vastly smaller keys:

Why ECC Dominates Modern Security Assessments

• Reduced Bandwidth: Smaller keys and signatures reduce TLS handshake packet sizes.
• Lower CPU & Battery Overhead: Mobile devices, smartcards, and embedded IoT systems execute ECC handshakes significantly faster than multi-thousand-bit RSA calculations.
• Forward Secrecy Standard: Modern protocols (TLS 1.3, WireGuard, Signal) mandate or heavily favor ECDHE suites (e.g., X25519, secp256r1).