Home → Cyber Security → Unit III

Cryptography Basics

Confidentiality, integrity, and authenticity through math

Symmetric Crypto

  • Same key for encrypt/decrypt. Algorithms: AES (block), ChaCha20 (stream).
  • Modes: CBC (needs unpredictable IV; no built-in integrity) vs GCM/ChaCha20-Poly1305 (AEAD: encrypts and authenticates).
  • Key mgmt: rotate keys; store in KMS/HSM; never hardcode keys.

Asymmetric Crypto

  • Public/private pairs. RSA (≥2048) and ECC (P-256, Curve25519).
  • Use cases: key exchange (ECDH) to derive a symmetric session key; signatures (ECDSA/RSA-PSS).
  • Hybrid crypto: asymmetric protects the symmetric key; data encrypted symmetrically.

Hashing & MAC

  • Cryptographic hashes: SHA-256/3. Properties: preimage, second-preimage, collision resistance.
  • Passwords: use Argon2id/scrypt/bcrypt with salt and cost; never store plain hashes like SHA-256.
  • Integrity: HMAC-SHA256 with a secret key, or AEAD modes (GCM/ChaCha20-Poly1305).

PKI & Certificates

Certificates bind identities to public keys, signed by Certificate Authorities, enabling trust in TLS.

  • TLS 1.3: ECDHE for Perfect Forward Secrecy; AEAD ciphers (AES-GCM/ChaCha20-Poly1305).
  • Client validation: hostname match, chain verification, OCSP/CRL for revocation, optional pinning.

Crypto Attacks

  • Padding oracle (CBC): exploit MAC-less encryption; use AEAD or encrypt-then-MAC.
  • Replay: reusing old messages; defend with nonces, sequence numbers, and timestamps.
  • Side-channel: timing/power/cache leaks; mitigate with constant-time libs and hardened hardware.

Quick Revision

  • Use AEAD (AES-GCM or ChaCha20-Poly1305) to get confidentiality + integrity.
  • Passwords: Argon2id with salt; NEVER raw SHA-256.
  • Prefer TLS 1.3 with ECDHE for forward secrecy.