Fundamentals of Cryptography

Fundamentals of Cryptography: Core Concepts Explained

Cryptography is the backbone of modern cybersecurity. Whether you are protecting personal data, securing communications, or building a trusted online service, understanding the basic principles of cryptographic algorithms and protocols is essential. This course distills the key ideas tested in a typical introductory quiz, turning each question into a learning module. By the end of the lesson you will be able to explain diffusion and confusion, describe key exchange mechanisms, evaluate block cipher modes, and appreciate the advantages of elliptic‑curve cryptography.

1. Diffusion vs. Confusion

One of the earliest design goals for a secure cipher is to make the relationship between the plaintext, the key, and the ciphertext as complex as possible. Claude Shannon introduced two complementary properties:

• Confusion: Hides the connection between the key and the ciphertext. It is typically achieved through substitution operations that replace each input byte with another value.
• Diffusion: Spreads the influence of a single plaintext bit over many ciphertext bits. In practice, this means that flipping one bit of the plaintext should change roughly half of the bits in the resulting ciphertext.

Diffusion is crucial because it prevents attackers from deducing patterns in the plaintext by analyzing the ciphertext. Modern block ciphers such as AES achieve diffusion through operations like MixColumns and ShiftRows.

2. The Diffie‑Hellman Key Exchange

Secure communication often requires two parties to agree on a shared secret without transmitting it directly. The Diffie‑Hellman (DH) protocol accomplishes this using modular exponentiation:

1. Both parties agree on a large prime p and a generator g (public parameters).
2. Alice selects a private exponent a and computes g^a mod p. This value, called her public component, is sent to Bob.
3. Bob does the same with his secret exponent b, sending g^b mod p to Alice.
4. Each party raises the received component to their own secret exponent, yielding the shared secret (g^b)^a mod p = (g^a)^b mod p.

The value g^a mod p that Alice transmits is not the secret itself; it is a public value that, together with Bob’s counterpart, enables both sides to compute the same secret independently.

3. Block Cipher Modes of Operation

Block ciphers encrypt fixed‑size blocks (e.g., 128‑bit for AES). How these blocks are combined determines the overall security of the encryption scheme. Two common modes are discussed below.

3.1 Electronic Codebook (ECB) Mode

ECB encrypts each block independently. While simple, it suffers from a critical weakness: identical plaintext blocks produce identical ciphertext blocks. This deterministic behavior leaks patterns, making ECB unsuitable for most real‑world data, especially when the data contains repeated structures such as images or logs.

3.2 Cipher Block Chaining (CBC) Mode

CBC introduces a random initialization vector (IV) for the first block and then XORs each subsequent plaintext block with the previous ciphertext block before encryption. The random IV ensures that even if two plaintext blocks are identical, their ciphertexts will differ, preventing pattern leakage. Additionally, CBC provides error propagation only forward: a corrupted block affects its own decryption and the next block, but not the entire message.

4. RSA Key Generation and Secret Primes

RSA relies on the mathematical difficulty of factoring a large composite number n = p × q. The public key consists of n and an exponent e, while the private key uses the secret primes p and q to compute the private exponent d. If an attacker discovers p and q, they can efficiently compute d and break the encryption. Therefore, the primes must remain confidential to preserve the security of the RSA key pair.

5. Elliptic‑Curve Cryptography (ECC)

ECC offers comparable security to RSA but with dramatically smaller key sizes. For example, a 256‑bit ECC key provides roughly the same security as a 3072‑bit RSA key. The benefits are twofold:

• Reduced computational load: Smaller keys mean faster key generation, signing, and verification, which is especially valuable on constrained devices such as smartphones and IoT sensors.
• Lower bandwidth usage: Transmitting shorter keys reduces network overhead and storage requirements.

These efficiencies make ECC the preferred choice for modern protocols like TLS 1.3, Bitcoin, and many mobile‑payment systems.

6. AES Round Function Details

The Advanced Encryption Standard (AES) processes data through a series of rounds. Each round (except the final one) applies four transformations:

1. SubBytes – a non‑linear substitution using an S‑box.
2. ShiftRows – a cyclic shift of rows to create diffusion.
3. MixColumns – a matrix multiplication that further spreads bits across the state.
4. AddRoundKey – XORing the state with a round‑specific key.

In the final round, the MixColumns step is omitted. This design choice simplifies the decryption process while preserving security, because the preceding rounds have already provided sufficient diffusion.

7. Cryptographic Hash Functions for Password Storage

Storing passwords in plain text is a catastrophic security risk. Instead, systems use a cryptographic hash function to transform a password into a fixed‑size digest. Important properties of a good hash function include:

• Pre‑image resistance – it is computationally infeasible to recover the original password from its hash.
• Collision resistance – finding two different inputs that produce the same hash is extremely difficult.
• Determinism – the same password always yields the same hash, enabling verification.

When combined with a unique salt and a slow hashing algorithm (e.g., bcrypt, Argon2), this approach protects against brute‑force and rainbow‑table attacks.

8. The Role of a Random IV in CBC Mode

A random IV is essential for CBC because it randomizes the encryption of the first block. Consequently, even if two messages start with identical plaintext, their ciphertexts will diverge from the very first block onward. This property eliminates the leakage of structural patterns and enhances confidentiality.

Summary of Key Takeaways

• Diffusion ensures that a single bit change in plaintext affects many ciphertext bits.
• In Diffie‑Hellman, the transmitted value g^a mod p is a public component, not the secret itself.
• ECB mode is insecure because it reveals patterns; CBC with a random IV mitigates this risk.
• RSA security hinges on keeping the prime factors p and q secret.
• ECC provides comparable security to RSA with much shorter keys, improving performance.
• The final AES round omits MixColumns, simplifying decryption without sacrificing security.
• Hash functions store passwords as non‑reversible digests, especially when salted and iterated.
• A random IV in CBC ensures each encryption of identical plaintext yields distinct ciphertext.

By mastering these concepts, you build a solid foundation for deeper study in cryptographic protocols, secure software design, and advanced cybersecurity practices.