Cryptography

As explained in Hacking Cryptography

The practice and study of securing information and communications through mathematical techniques such as encryption, authentication, and digital signatures.

Cryptography uses mathematical algorithms and their software or hardware implementations to protect data. Its core security goals are confidentiality, integrity, and authenticity: keep data from unauthorized disclosure, prevent alteration, and prevent impersonation of digital entities. Encryption makes a message incomprehensible without the corresponding secret; integrity and authenticity extend protection beyond secrecy. section 1.1 section 1.5

Figure 1.1 Security goals of cryptography

The three security goals provide a practical way to judge what protection a cryptographic component is meant to deliver. section 1.1

A lockbox illustrates confidentiality: a sender can ship a locked box through ordinary mail, while carriers can see its destination but not its contents. Similarly, internet packets may traverse providers while cryptography protects message contents from eavesdroppers. Modern cryptographic tools also protect against tampering and establish authenticity. section 1.1

Cryptographic engineering separates sound goals from risky implementation details:

• Mathematical cryptographic ideas can be difficult to break, but programming and hardware flaws often give attackers easier paths around them. section 1.0 section 1.3
• Subtle defects can defeat an entire system security goal; side-channel analysis of device power consumption can expose a cryptographic key. section 1.3
• Production systems should rely on widely used, thoroughly tested implementations rather than homegrown cryptography; even established components can interact in weak ways. section 1.4 section 1.5

Encryption keys: symmetric and asymmetric

Symmetric encryption uses the same private key to encrypt and decrypt. Stream and block ciphers reduce the secret material needed compared with a one-time pad, but participants still need a way to exchange the shared key securely. Asymmetric cryptography addresses that distribution problem with a keypair: a public key may be shared openly, while its corresponding private key remains secret. Symmetric keys can also be wrapped with asymmetric keys. section 8.1 section 8.1

Implementation failure: PlayStation 3

A cryptographic implementation can fail even when the protected private key never appears on consumer hardware. Improper random-number generation in a critical operation allowed Sony’s private key to be calculated and published, undermining the console’s software-approval security goal. section 1.3

Use cryptography as an engineering discipline, not merely a collection of algorithms. Run implementations and exploits when learning, treat precision as a security requirement, and seek broad expert review when cryptographic code must be written from scratch. section 1.4 section 1.5

How Hacking Cryptography covers it

How deep it goes

Explains implementation failures and key-management models while explicitly deferring underlying mathematical theory.

Examples

Uses a mailed lockbox, internet packets, PlayStation 3 key recovery, power analysis, and symmetric and asymmetric key exchange.

What you can do after

Evaluate/understand why implementation flaws and key handling can defeat cryptographic security goals.

How it connects

Connects encryption, integrity, authenticity, stream ciphers, block ciphers, one-time pads, and asymmetric cryptography.

liveBookmanning.com

Read Hacking Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographyThe practice and study of protecting information and communications against unauthorized access or manipulation using mathematical techniques.
• 

  liveBookmanning.com
  Software Security for DevelopersCryptography is the study and practice of securing information and communications through mathematical techniques such as encryption and digital signatures.
• 

  liveBookmanning.com
  Go in Practice, Second EditionCryptography is the discipline of protecting information and communications through techniques such as encryption, hashing, and authentication.

Compare how 4 books explain cryptography →

Related concepts

• confidentialityaddresses · Confidentiality is the security property of protecting information from access or disclosure to unauthorized parties.
• encryptionuses · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
• data integrityaddresses · Data integrity is the property that data remains accurate, complete, consistent, and valid, with changes made only through authorized actions.
• secure multi-party computationincludes · Secure multi-party computation is a cryptographic technique that enables multiple parties to jointly compute a function while keeping their private inputs concealed from one another.
• nonrepudiationaddresses · Nonrepudiation is the security property of providing evidence linking an action or message to its purported originator, limiting credible denial.

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.