Introduction to cryptography

Cryptography can feel intimidating, but don’t worry—we’ll keep it straightforward. This post is about understanding the basics: how we use cryptography to protect data and why it’s such a key part of security.

Cryptography is the practice of secure communication in the presence of third parties. It forms the foundation of modern technology today. Almost every system, application, and device uses cryptography in some way. Even accessing this website is facilitated by cryptography! It is literally everywhere.

You might be thinking, if it is everywhere, why haven’t I heard of it? The answer is because cryptography is complex and thus, abstracted from you. For example, when you set a PIN number / biometric on your mobile device, that PIN is used to protect the information on your device using cryptography. Heck, even unlocking your phone using your face/fingerprint is done using cryptography.

In this post, we will dive into cryptography and introduce the fundamental concepts. By the end of this post, you’ll know about the building blocks that are used in almost every modern cryptographic system and how to approach breaking them.

What is Cryptography?

Cryptography uses mathematical algorithms and protocols to transform data into a format that keeps it secret in the presence of third parties. The goal of these algorithms is to provide mechanisms that either individually or together can:

1. Stop unauthorized parties from being able to access data.
2. Verify data integrity, i.e. verify if information has been altered.
3. Authenticate data, i.e. did X data originate from Y person/system?

To demonstrate these concepts, imagine you wanted to send a letter to a friend. The contents of the letter are secret and you don’t want anyone else reading it. What are your options?

Without cryptography, you have two options. You either need to deliver the letter yourself, or delegate the delivery of the letter to someone you trust. Both of these options are not secure. If someone intercepts the letter in transit, they can read the contents, and or modify the contents without your friend knowing. In addition, even if your friend receives the letter, they have no way of verifying you sent the letter unless you deliver it yourself.

With cryptography, you can make sure the contents of the letter are only readable by the intended recipient. Meaning even if the letter is intercepted in transit, the interceptor cannot read the contents or modify the contents. In addition, the recipient can also verify you sent the letter, even if you don’t deliver it. This means you can delegate the delivery of the letter to anyone while maintaining confidentiality.

Cryptography plays a foundational role in security, if you recall back to the Confidentiality, Integrity, and Availability (CIA) triad. It is foundational to both Confidentiality (keeping data secret) and Integrity (keeping data consistent).

Over time the techniques used in cryptography have advanced as attackers and technologies have advanced. Starting learning cryptography with modern algorithms is a recipe for disaster, it’s like trying to build the Eiffel Tower as your first Do It Yourself (DIY) project. Instead, let’s start by introducing the fundamentals through a primitive cryptographic algorithm, the Caesar Cipher.

Caesar Cipher

The Caesar Cipher is one of the simplest and most well-known cryptographic algorithms. It is iconic because it was used by Julius Caesar over 2 millenniums ago to protect his private correspondence. Much like our letter example earlier, Julius needed a mechanism to securely communicate with people without being physically next to them. During Julius’ time, all long-distance correspondence was done through messengers and letters. Both required delegating trust to another person. The sensitive nature of Julius’ messages meant a breach of confidentiality would literally have life-and-death consequences.

Functionally, Julius needed something that would convert his messages into something that could only be understood by certain individuals. In practice, this meant he needed something that would:

1. Transform text into a format that cannot be read.
2. Revert the transformed text back to the original text by authorized parties.

To achieve this, Julius invented the Caesar Cipher cryptographic algorithm. This algorithm uses substitution to replace letters by a fixed number of positions in the alphabet. For example, with a shift of 3, A would become D, and B would become E.

Likewise, this means we can shift the transformed text back 3 positions to convert D back to A, and E back to B.

Caesar Cipher in practice

To demonstrate how Caesar Cipher works, we will walk through an example and use modern cryptographic terminology.

Let’s say we have the text retreat, this is the input to our cryptographic function which it is referred to as the plain-text. The output of our cryptographic function is transformed text that cannot be read and is referred to as the cipher-text. The process of converting the plain-text into the cipher-text is referred to as encryption. The encryption operation for our function requires a shift, this is referred to as a secret or key. In this example, the secret is a shift of 2, meaning the letter, r becomes t, e becomes g, and so on.

The output of our encryption operation is the cipher-text tgvtgcv. We can then convert the cipher-text (tgvtgcv) back to the plain-text (retreat) by reversing the operation with the secret of 2. The process of converting the cipher-text back to the plain-text is referred to as decryption. With a key of 2, the letter t becomes r, g becomes e, and so on.

Julius could use this mechanism to provide a messenger with the cipher-text “tgvtgcv” and have the assurance that the contents are secure. If the message was intercepted, the contents would not be readable. Likewise, if the messenger was an adversary they would not be able to decipher the message (cipher-text) without the key 💃.

Hands-on exercise

Now that you have a good understanding of how this primitive algothim works, let’s put your knowledge to test.

We now have a high-level understanding of what a plain-text, cipher-text, and secret / key is. As well as what is encryption and decryption. Let’s apply these concepts further by looking at encryption and decryption from an adversary’s perspective.

Breaking The Caesar Cipher

By today’s standards, the Caesar Cipher algorithm is terribly insecure. However, two millenniums ago, it would have been the most secure algorithm on the planet. Seriously, imagine you intercepted the cipher-text tgvtgcv with the technology two millenniums ago, it would have been the bar for security.

Fortunately, we have the technology and knowledge of today, so let’s walk through how we would break a Caesar Cipher encrypted cipher-text. Using the previous cipher-text of tgvtgcv, let’s obtain the plain-text without the key 🕵️.

The brute-force method

The first approach to breaking the cipher-text is to guess all the possible keys. Given that there are only 26 letters in the alphabet, there are only 25 other possible keys. Let’s quickly script this up in Python to automate this process for us. Our code takes the cipher-text and outputs the 25 other possible keys.

def caesar_cipher(text: str, key: int = 0) -> str:
 alphabet = ["a", "b", "c", "d", ...]  # Continues all the way to Z
 res = ""

 for i in range(0, len(text), 1):
     # offset the current index by the key and use modulus to loop back around
     # the alphabet because there are 26 characters in the alphabet
     res += alphabet[(alphabet.index(text[i]) + key) % 25]

 return res

def main() -> None:
 cipher_text = "tgvtgcv"

 # Obtain the output of each key permutation
 for i in range(0, 25, 1):
     print(caesar_cipher(text=cipher_text, key=i))

if __name__ == "__main__":
 main()

This produces the following output:

➜ python3 main.py
tgvtgcv
uhwuhdw
vixviex
wjywjfy
xkaxkga
ylbylhb
amcamic
bndbnjd
coecoke
dpfdplf
eqgeqmg
frhfrnh
gsigsoi
htjhtpj
iukiuqk
jvljvrl
kwmkwsm
lxnlxtn
myomyuo
napnavp
obqobwq
pcrpcxr
qdsqdys
retreat
sfusfbu

By reading the output we can see the plain-text “retreat” stands out. The method of guessing all of the possible keys is known as brute force attacks.

The Frequency analysis method

Brute forcing is great but is there a smarter way to do this? Yes, let’s take a step back and look at the cipher-text. Immediately we can spot three patterns:

1. The character “t” appears twice:

2. The character “g” appears twice:

3. And finally the character “v” appears twice:

Using these patterns, we can infer that the plain-text might have some repeated characters. In addition, we can infer that the plain-text is probably 7 characters long because the cipher-text is 7 characters long. Let’s use these assumptions to start making some educated guesses.

The most common letters in the English language are a, e, i, o, u, h, n, r, and t, see Letter Frequency. If we start substituting occurrences of t, g, and v in the cipher-text with these characters, we could convert the cipher-text tgvtgcv to retre_t. We could then assume the final character c in the cipher-text is a and obtain the plain-text without the key. This method of breaking cipher-texts is known as frequency analysis.

Hands-on exercise

We now know the strength of an encryption algorithm is determined by how difficult it is to break the cipher-text without the key. However, modern algorithms are much harder to break than this. For example, it is estimated that it would take billions of years to break AES (256 bit) and RSA (4096 bit) cipher-texts using current computing technology.

Conclusion

In this post, we’ve taken our first step into the world of cryptography, touching on its core concepts and practicing with the Caesar cipher. This peek into encryption’s basics is just the beginning. As you’ve seen, cryptography is not just about coding and decoding messages; it’s about understanding the essence of secure communication.

In the next post in this series, we’ll look at symmetric and asymmetric cryptography, where the stakes get higher and the encryption becomes more complex and powerful. These methods are the foundation of modern security protocols.