Cryptography I: symmetric and asymmetric encryption and the cryptographic life cycle

Sub-domain 3.6 asks you to select and determine cryptographic solutions. Cryptography is the toolset that protects confidentiality and integrity when data is stored or travels across networks you do not control, and it underpins authentication and nonrepudiation. The CISSP does not expect you to do the mathematics of modern ciphers, but it does expect you to know what each kind of algorithm is for, how keys are managed, which algorithms and key lengths are current, and why most cryptographic failures come from people and processes rather than broken mathematics. This lesson covers symmetric and asymmetric encryption and the life cycle of cryptographic choices; lesson 9 covers hashing, signatures and public key infrastructure; and lesson 10 covers attacks and post-quantum cryptography.

Core ideas

Encryption transforms readable plaintext into unreadable ciphertext using an algorithm, also called a cipher, and a key; decryption reverses the process. Kerckhoffs's principle, from the nineteenth century, says a cryptosystem should remain secure even if everything about it except the key is public. Modern practice follows it: algorithms such as AES are published and scrutinized worldwide, and security rests entirely on keeping keys secret. The strength of a well-designed algorithm against brute force depends on its key space, the number of possible keys. A key of n bits has 2 to the power n possible values, and an attacker trying keys at random will on average find the right one after trying half of them.

Classic ciphers illustrate two building blocks still used inside modern algorithms. Substitution replaces each symbol with another, as in the Caesar cipher, which shifts each letter a fixed number of places. Transposition rearranges the order of symbols. Both are easily broken alone, but modern block ciphers apply many rounds of substitution and permutation to achieve what Claude Shannon called confusion, hiding the relationship between key and ciphertext, and diffusion, spreading the influence of each plaintext bit across the whole ciphertext. The one-time pad, which combines the message with a truly random key as long as the message and never reused, is the only cipher proven unbreakable, but its key distribution problem makes it impractical for almost all uses.

rate = 10**12  # keys tested per second (a large, well-funded attacker)
year = 365.25 * 24 * 3600
for bits in (56, 80, 128, 256):
    avg_years = (2**bits / 2) / rate / year
    print(f"{bits}-bit key: about {avg_years:.3g} years on average")

56-bit key: about 0.00114 years on average
80-bit key: about 1.92e+04 years on average
128-bit key: about 5.39e+18 years on average
256-bit key: about 1.83e+57 years on average

Symmetric encryption

Symmetric, or secret key, cryptography uses the same key to encrypt and decrypt. It is fast and suitable for bulk data, which is why it protects disks, databases, backups and the data inside network sessions. Its weakness is key distribution and scale: both parties must already share the key securely, and every pair of parties needs its own key. For n people who all need to communicate privately, the number of keys is n times n minus 1, divided by 2. Ten people need 45 keys; a thousand people need 499,500. Symmetric cryptography provides confidentiality and, with the right modes, integrity, but it cannot provide nonrepudiation, because anyone who holds the shared key could have produced the message.

The Advanced Encryption Standard, AES, is the dominant symmetric algorithm. It was selected by NIST in 2001 from the Rijndael submission by two Belgian cryptographers after an open international competition, and is published as FIPS 197. AES uses a block size of 128 bits and keys of 128, 192 or 256 bits, with 10, 12 or 14 rounds respectively. Its predecessor, the Data Encryption Standard, DES, used a 56-bit key, which was publicly broken by brute force in 1998; Triple DES, which applies DES three times, has now been retired by NIST, with its use for encryption disallowed after 2023. ChaCha20, a stream cipher, is widely used with the Poly1305 authenticator in TLS and on mobile devices that lack AES hardware support. Older ciphers you may see in study materials include Blowfish, Twofish, IDEA, RC4, now prohibited in TLS, and RC5 and RC6.

Block ciphers encrypt fixed-size blocks and need a mode of operation to handle longer messages. Electronic codebook mode, ECB, encrypts each block independently, so identical plaintext blocks give identical ciphertext, revealing patterns; it should not be used for data. Cipher block chaining, CBC, mixes each block with the previous ciphertext using an initialization vector. Counter mode, CTR, turns a block cipher into a stream cipher by encrypting a counter. Galois/counter mode, GCM, adds authentication to counter mode, providing both confidentiality and integrity in one operation; this kind of authenticated encryption is now the default choice in TLS 1.3. A common implementation failure is reusing an initialization vector or nonce with the same key, which in counter-based modes can expose plaintext.

Asymmetric encryption

Asymmetric, or public key, cryptography uses a key pair: a public key that can be shared with anyone and a private key that the owner keeps secret. What one key encrypts, only the other can decrypt. Encrypting with the recipient's public key provides confidentiality, because only the recipient's private key can decrypt. Encrypting, or more precisely signing, with the sender's private key provides authentication, integrity and nonrepudiation, because anyone can verify with the sender's public key that only the sender could have produced it. Each participant needs only one key pair, so n people need 2n keys in total, which solves the scaling and key distribution problems of symmetric cryptography. The trade-off is speed: asymmetric operations are hundreds to thousands of times slower than symmetric ones.

RSA, published by Rivest, Shamir and Adleman in 1977, bases its security on the difficulty of factoring the product of two large primes. Current guidance calls for keys of at least 2,048 bits, with 3,072 bits giving security roughly equivalent to 128-bit symmetric keys. Elliptic curve cryptography, ECC, bases its security on the elliptic curve discrete logarithm problem and achieves similar strength with much smaller keys: a 256-bit elliptic curve key is roughly as strong as a 3,072-bit RSA key, which makes ECC attractive for phones, smart cards and high-traffic servers. Diffie-Hellman key exchange, published in 1976, lets two parties agree on a shared secret over an open channel without ever sending it. It provides no authentication on its own, so it is vulnerable to man-in-the-middle attacks unless combined with signatures or certificates. Its ephemeral forms, DHE and ECDHE, create fresh keys for each session, giving forward secrecy: stealing a server's long-term key later does not decrypt past sessions. ElGamal and the Digital Signature Algorithm are related discrete logarithm schemes.

# Toy RSA with tiny primes -- for illustration only, completely insecure
p, q = 61, 53
n = p * q                 # modulus
phi = (p - 1) * (q - 1)
e = 17                    # public exponent
d = pow(e, -1, phi)       # private exponent
m = 65                    # message as a number smaller than n
c = pow(m, e, n)          # encrypt with the public key (e, n)
print('n =', n, ' d =', d)
print('ciphertext =', c)
print('decrypted  =', pow(c, d, n))

n = 3233  d = 2753
ciphertext = 2790
decrypted  = 65

# Toy Diffie-Hellman -- insecure sizes, for illustration only
p, g = 23, 5              # public prime modulus and generator
a, b = 6, 15              # private values chosen by Alice and Bob
A = pow(g, a, p)          # Alice sends A in the open
B = pow(g, b, p)          # Bob sends B in the open
print('public values:', A, B)
print('Alice computes', pow(B, a, p), ' Bob computes', pow(A, b, p))

public values: 8 19
Alice computes 2  Bob computes 2

Hybrid cryptography

Real systems combine both kinds. In a hybrid system, asymmetric cryptography establishes or protects a symmetric session key, and the fast symmetric cipher encrypts the bulk data. TLS works this way: the client and server use ECDHE to agree on keys, authenticate the server with a certificate and signature, and then encrypt the session with AES-GCM or ChaCha20-Poly1305. Encrypted email such as S/MIME or PGP encrypts the message with a random symmetric key and encrypts that key with each recipient's public key. This combination gives the scalability of public keys and the speed of symmetric ciphers.

The cryptographic life cycle

Cryptographic choices age. Algorithms that were strong become weak as computing power grows and new attacks appear, so organizations need to manage cryptography through a life cycle: select algorithms and key lengths from current guidance, implement them in validated libraries and modules, operate and monitor them, and plan their retirement. NIST describes algorithm status in SP 800-131A with terms such as acceptable, deprecated, disallowed and legacy use. Crypto agility is the design property that lets algorithms be replaced without rebuilding whole systems, for example by keeping algorithm choices in configuration rather than hard-coding them. A cryptographic inventory, a list of where and how cryptography is used across the organization, is the starting point for any migration, including the move to post-quantum algorithms covered in lesson 10.

Export controls also apply. Canada's Export Control List, under the Export and Import Permits Act, includes information security items in Group 1, Category 5 Part 2, following the international Wassenaar Arrangement. Exporters of strong encryption products may need permits, although many mass-market products benefit from exemptions. Check with Global Affairs Canada before exporting or sharing controlled cryptographic technology.

Thinking like a manager

When a question asks which cryptography provides nonrepudiation, the answer is asymmetric, through digital signatures. When it asks how to encrypt large amounts of data efficiently, the answer is symmetric. When it describes a scaling or key distribution problem, public key cryptography or a key distribution centre is usually the fix. And when it describes an old algorithm still in use, the managerial answer is a planned migration based on an inventory and crypto agility, not ignoring it or rewriting everything at once.