Cryptography is Interwoven in our Daily Life

Five Essays on Cryptography (1/5)

Cryptography is one of the core disciplines that we use to protect digital information today. It is part of the larger area of Information Security which has become recently one of the most discussed topics across industries. This series of five articles is aimed at those who would like to have an overview of the domain of cryptography, a bit of its history, and a grasp on important concepts and recent developments.

All articles in this series

• 1 Cryptography is Interwoven in our Daily Life
• 2 A Tool for Information Warfare Becomes a Field of Science
• 3 Asymmetric and Symmetric Encryption
• 4 Cryptographic Hashes and Credentials Management
• 5 The Use of Cryptography in our Economy (to appear)

Special thanks to my friend Philipp Jovanovic (Twitter @Daeinar) for sharing his expert opinion on this series of articles.

Comments, Feedback: Laurent Balmelli (Twitter Laurent Balmelli)

The Place of Encryption in Information Security

One of the goals in information security is the balanced application of the so-called CIA triad, i.e., confidentiality, integrity, and availability.

The practical enforcement of all or any of these properties is performed across the different fields that are attached to information security in general. The general field cryptography is one of those fields that provides all the ingredients to satisfy confidentiality and integrity in particular. In contrast, information availability is addressed with different mechanisms: for example to prevent a compromise of the system holding the data, or a denial of service attack. I will not address availability in this series of articles since it goes beyond the scope of cryptography.

Encryption plays a key part in implementing confidentiality in information security. Ensuring confidentiality equates to guaranteeing that any discussion (or more generally any piece of information) can only be accessed by its legitimate parties. One goal of this series of articles is to review the key mechanisms that are used today to guarantee information confidentiality, in particular in practical settings such as such as online communications and the World Wide Web.

However in order to guarantee the security of information, confidentiality is only one aspect to look after. Two additional aspects, i.e., integrity (as seen above) and authenticity are equally important. Authenticity and others (such a non-repudiation, privacy, etc.) are often considered in addition to the triad.

Integrity enables us to ensure that information has not been tampered with before we could access it. For example in an encrypted communication somebody could tamper with the data during transmission even if it was in encrypted form (which would likely result in some nonsense, but not necessarily).

Finally authenticity allows us to guarantee that the sender of the information is indeed the person she claims to be.

Where You Can Find Encryption Today

I will review in this series of articles a few aspects of the history of encryption and more generally data security. Today the use of encryption is prevalent and many services and products use it intensively. We will see also that encryption is in effect the bedrock of our modern economy, actually the world could not run without it!

Expectedly, encryption originates from needs first identified by the military, in particular during wartime. For this reason, we find the use of encryption in any device that is used for transmission or storage of data by the military. However, not so long ago, i.e., until the late 1990s, strong encryption was actually reserved for military applications and the export of products providing strong encryption was restricted. That has changed at the beginning of the 21st century century and strong encryption became available for free or commonly embedded into products that you use everyday on your computer or smartphone, for example to protect your data and transmission. Finally, as hinted before, today all financial transactions (many non-financial transactions as well) occurring on the Internet are (ideally) encrypted.

Note also that today encryption methods and systems can also guarantee integrity and authenticity. Hence they are not confined to guaranteeing confidentiality. I will explain how this is achieved through examples across this series of articles.

A Few Examples of Encryption Products and Services

One of the most prevalent usages of encryption is for secure storage of data. All modern operating systems today are making use of it and distribute products for that purpose. On Windows the product BitLocker is included since Windows Vista. BitLocker is what is referred to as a full-disk encryption. It will protect your data if your laptop is stolen for example. Somebody who does not know the key (usually a passphrase) cannot access the data. Note that, usually only the data in use is decrypted (as opposed to the entire disk) whereas the rest of data on the disk rests encrypted. On the Mac the equivalent product is called FileVault and has to be enabled to be active, for example when installing the OS for the first time. On Android and iOS encryption is available as well, provided that it has been enabled. Typically when full disk encryption is enabled on Android the OS will ask for password to decrypt the data at boot time.

It is important to understand that once encryption is enabled it is critical that the key used to encrypt the data (which is often generated from the password that was chosen by the user) is safeguarded. If the key is lost it is actually impossible in to recover the data, typically by trying all combinations of possible keys. The guarantee of security offered by encryption systems today is based on the premise that it is not possible with today’s computers to brute-force a key in case it is sufficiently long, i.e., typically 128 or more bits.

They have been many reported stories in the media, in particularly around the mismanagement of Bitcoin wallets, that losing a key results in significant monetary loss. In December of 2018, the founder of the Bitcoin exchange QuadrigaCX died unexpectedly and took to the grave with him the passphrase that was used to encrypt a wallet of cryptocurrencies worth around 137 million dollars. Hence in the case where the data that is encrypted has potentially significant value, extra care must be taken in order to protect the passphrase or the key that was used. Note that, a recent article in engadget sheds new lights on that case detailing that there might more to simple misfortune.

How Encryption is Defeated Today

We just saw in the last section that encryption cannot be brute-forced (provided that the key has sufficient length), i.e. that it is time-wise unfeasible to try all possible combinations of the key in order to find the one used to encrypt the data. This security assurance is provided by the mathematical properties on which encryption is based, namely that the number of possible combinations is just too large. However, interestingly this does not necessarily mean that encryption as a security mechanism cannot be defeated.

In some cases, it might be possible to defeat encryption because the system that implements it is flawed. In other words, sometimes encryption can be bypassed because its implementation contains vulnerabilities. This is especially true when encryption systems are implemented by non-experts. Because encryption is more and more used today and actually few of the systems are implemented by experts, it is not uncommon to find vulnerabilities.

Even systems created by world-class companies such as Apple are prone to exploitation, although achieving such a feat is often reserved to a few (because of their technical skills) or to nation-states (because of their financial means). The best example is the iPhone at the center of the 2015 terrorist attack in San Bernardino California. The phone of one of the terrorists was encrypted and the FBI requested Apple to give them access to the locking mechanism of the phone and to the phone’s data. Apple refused to comply with the order, It was also recognized that Apple might not actually be able to provide access the encrypted data (well they should not, considering what I explained in the previous section…). The details of the dispute are explained in this page.

The dispute fueled a long-running debate about whether governments should have backdoor access to encryption products created by manufacturers in the case where this access might be requested through a court-order — I will discuss this topic again in one of the coming articles in this series-. Eventually the FBI was able to access the phone and likely the data that it contained, i.e., bypassing encryption by exploiting a vulnerability of the implementation!

This was likely a flaw that was unknown to Apple as well. A mechanism to exploit an unknown vulnerability of a product is called a zero-day in the cyber-security industry.

Zero-days are discovered by security researchers and sometimes communicated to manufacturers such that they can be patched. However more often than not, zero-days are simply treated as commercial products and sold in an underground market. Zero-days can be snippets of codes or even manual routines, or something the combination of both. It was reported by TechCrunch that the FBI indeed used a zero day, but did not report the price that was paid. A zero-day can often cost around up a million dollars, in particular one and such a popular product as the iPhone.

What I Will Go Over in this Series of Essays

The subject of encryption and more generally data security is an exciting one, because it is not only a technological challenge but also because it’s definitely having an impact on our society and the way we treat data and privacy.

I pointed out in the previous example that it is today an intense topic of discussion, which potentially has impact on freedom and democracy as we know it. Hence here I will discuss it mainly from two points of views, i.e., technological and also societal.

In this series, I will first briefly review the history of encryption and how it was used by the Romans to secure their communications on the battlefield. I will also discuss the modern history of encryption and the current techniques that are used to protect data.

I will explain cryptography mostly through its uses, which is not limited to only encrypting data, but also signing it to guarantee authenticity, in addition to other applications. I will review popular examples such as the way electronic transactions are secured today, i.e., the way documents can be electronically signed, and also how the block chain works from a cryptographic perspective.

In the next article, I will address how encryption, initially a tool used for information warfare progressively became a field of science.

Check my other articles about security, technology and societal aspects.