Cryptography and Public Key Infrastructure

Introduction and Context

Cryptography is the disciplined use of mathematical techniques to protect information and communications. In cybersecurity, it supports confidentiality, integrity, authentication, non-repudiation, and secure key exchange. Cryptography does not, by itself, make a system secure. A sound algorithm can be undermined by poor key storage, weak passwords, insecure random-number generation, incorrect protocol design, or compromised endpoints.

Modern security systems commonly combine several mechanisms. Symmetric encryption protects large volumes of data efficiently; asymmetric cryptography establishes trust and exchanges keys; hash functions provide compact integrity representations; digital signatures authenticate messages and their origins; and Public Key Infrastructure (PKI) manages certificates and trust relationships.

Learning Objectives

By the end of this chapter, you should be able to:

• distinguish symmetric encryption, asymmetric encryption, hashing, and digital signatures;
• explain confidentiality, integrity, authentication, and non-repudiation;
• select suitable cryptographic techniques for common applications;
• describe certificates, certificate authorities, and PKI trust chains;
• apply practical principles of key generation, storage, rotation, recovery, and revocation;
• identify implementation limitations, governance responsibilities, and post-quantum concerns.

Security Services and Cryptographic Building Blocks

The main security objectives are often summarized as follows:

These objectives are related but not interchangeable. Encryption can hide a message without proving who sent it. A hash can detect accidental or malicious alteration only when the expected hash is protected. A digital signature can authenticate a sender and protect integrity, but it does not normally provide confidentiality.

Threat Models and Kerckhoffs’s Principle

A cryptographic system should remain secure even when the algorithm is public. Security should depend on the secrecy of keys, not on keeping the algorithm obscure. This principle supports public review, standardized algorithms, interoperability, and independent cryptanalysis.

A threat model should identify the attacker’s capabilities. An attacker may be able to observe traffic, alter messages, replay old messages, impersonate a party, steal stored keys, or control an endpoint. The appropriate cryptographic design depends on these assumptions.

Symmetric Encryption

Symmetric encryption uses the same secret key, or closely related secret keys, for encryption and decryption. Let plaintext be P, ciphertext be C, and secret key be K:

Here, E is the encryption algorithm and D is the decryption algorithm. Correct decryption requires the legitimate recipient to possess K and the algorithm to be correctly implemented.

Symmetric encryption is computationally efficient and is therefore used for disk encryption, database protection, backups, virtual private networks, and the bulk-data portion of protocols such as TLS. Modern examples include AES and ChaCha20.

Block and Stream Ciphers

A block cipher processes fixed-size blocks. AES processes 128-bit blocks and supports 128-, 192-, and 256-bit keys. A block cipher must be used with an appropriate mode of operation. Electronic Codebook mode is generally unsuitable for structured data because identical plaintext blocks produce identical ciphertext blocks. More appropriate authenticated-encryption modes include GCM and CCM.

A stream cipher produces a keystream that is combined with plaintext, commonly using exclusive OR. ChaCha20 is a widely used stream cipher. A critical rule is that a nonce must not be reused with the same key in situations where the construction forbids reuse. In GCM, nonce reuse can seriously compromise confidentiality and authentication.

Authenticated Encryption

Encryption alone does not necessarily detect modification. Authenticated Encryption with Associated Data (AEAD) provides ciphertext confidentiality and an authentication tag. It can also authenticate associated data, such as a protocol header, without encrypting it.

Conceptually:

where K is the key, N is a nonce, P is plaintext, A is associated data, C is ciphertext, and T is the authentication tag. Decryption accepts the plaintext only if the tag verifies. Nonce uniqueness, key secrecy, tag verification, and failure handling are essential assumptions.

Advantages and Limitations

Symmetric encryption is fast and suitable for large data sets, but key distribution is difficult. If n parties need independent pairwise keys, the number of pairwise keys is:

This assumes every pair requires a distinct shared key. For 100 parties, that is 4,950 pairwise keys. Centralized key management, group keys, or public-key techniques can reduce this administrative burden, although each introduces different risks.

Hash Functions and Message Authentication

A cryptographic hash function maps an input of arbitrary length to a fixed-length digest:

M is the message and h is its digest. A secure hash function should provide preimage resistance, second-preimage resistance, and collision resistance. Collision resistance means it should be computationally infeasible to find distinct messages M₁ and M₂ such that:

SHA-256 and SHA-3 are examples of general-purpose cryptographic hash functions. MD5 and SHA-1 should not be selected for collision-resistant security applications.

A hash is not encryption: it is not designed to be reversed. Passwords should not be stored as ordinary hashes. Password-storage functions such as Argon2id, scrypt, or bcrypt use salts and deliberate computational or memory costs to make large-scale guessing more expensive.

A Message Authentication Code (MAC) uses a shared secret:

A valid tag demonstrates that a party possessing K generated or approved the message, but it does not distinguish which holder of the shared key created it. HMAC is a widely used MAC construction based on a cryptographic hash function.

Asymmetric Cryptography

Asymmetric cryptography uses a key pair: a public key and a private key. The public key can be distributed widely, while the private key must remain secret. The mathematical relationship between the keys enables operations that are difficult to perform without the private key.

For public-key encryption, a sender encrypts using the recipient’s public key and the recipient decrypts with the private key:

In practice, public-key encryption is usually used to establish or protect a symmetric session key rather than encrypt large files directly. RSA-OAEP and elliptic-curve-based key-establishment mechanisms are examples of technologies used in suitable contexts.

Key agreement is different from encryption. In Diffie–Hellman-style exchange, two parties derive a shared secret over a public channel. Authentication must be added; otherwise, a person-in-the-middle can establish separate keys with both parties.

Asymmetric algorithms are slower and require larger or more structured keys than symmetric algorithms. Their major benefits are scalable key distribution, digital signatures, and identity binding through certificates.

Digital Signatures

A digital signature combines a private signing key with a message or message digest. Verification uses the corresponding public key:

The verifier checks S against M and K_pub. A valid signature provides evidence of integrity and possession of the private key at signing time, subject to trust in the key-binding process and protection of the private key.

Common signature families include RSA-PSS, ECDSA, and EdDSA. Signature schemes have precise requirements concerning randomness, encoding, parameter choices, and verification. For example, poor nonce generation in ECDSA can reveal the private key. Implementations should use vetted libraries rather than writing cryptographic primitives from scratch.

Non-repudiation is not purely a mathematical property. Legal effect depends on jurisdiction, identity proofing, organizational controls, signing policies, audit records, and the ability to show that the private key was controlled appropriately.

Hybrid Cryptography in Practice

Most secure protocols use hybrid cryptography:

1. authenticate the communicating parties, often with certificates;
2. perform an authenticated key exchange;
3. derive symmetric session keys using a key-derivation function;
4. protect application data with AEAD;
5. provide integrity, replay protection, and secure session termination.

This design combines the scalability of asymmetric cryptography with the performance of symmetric encryption. TLS is a prominent example. A browser validates a server certificate, negotiates cryptographic parameters, establishes session keys, and then uses symmetric authenticated encryption for application traffic.

Certificates and Public Key Infrastructure

A digital certificate is a signed data structure that binds an identity or subject to a public key. In the widely used X.509 model, a certificate may contain the subject, public key, issuer, validity period, serial number, permitted uses, and the certificate authority’s signature.

A Certificate Authority (CA) is an entity trusted to issue certificates according to defined policies. A root CA is normally self-signed and serves as a trust anchor. Intermediate CAs are signed by a root or another intermediate CA. An end-entity certificate is issued to a server, person, device, or service.

A certificate chain is valid only when several conditions hold:

• signatures in the chain verify;
• the chain terminates at a trusted anchor;
• validity dates are satisfied;
• the subject name matches the intended identity;
• key-usage and extended-key-usage constraints permit the operation;
• the certificate has not been revoked or otherwise invalidated;
• acceptable algorithms and key sizes are used.

PKI includes more than certificates. It encompasses policies, registration and identity verification, certificate issuance, publication, renewal, revocation, auditing, trust stores, hardware protection, and incident response.

Revocation

A certificate may need revocation when a private key is compromised, identity information becomes unreliable, or the certificate was issued incorrectly. Certificate Revocation Lists provide signed lists of revoked serial numbers. The Online Certificate Status Protocol provides status information for individual certificates. Stapled status responses can reduce privacy and availability problems associated with clients contacting a CA directly.

Revocation is operationally difficult. Clients may be offline, status services may be unavailable, and some software does not check status consistently. Short certificate lifetimes, automated renewal, key rotation, and rapid incident procedures often reduce dependence on perfect revocation checking.

Figure: A simplified PKI trust chain and the conditions checked by a client.

Key Management

Key management is often more important than algorithm selection. It covers the entire key lifecycle:

1. Generation: use approved algorithms and a cryptographically secure random-number generator.
2. Distribution: deliver keys through authenticated and protected channels.
3. Storage: protect private and high-value symmetric keys using access controls, encryption, hardware security modules, or secure enclaves where justified.
4. Use: restrict purpose through key separation and usage policies.
5. Rotation: replace keys according to risk, exposure, cryptoperiod, and policy.
6. Backup and recovery: preserve availability without creating uncontrolled copies.
7. Revocation and destruction: invalidate compromised keys and securely erase them when no longer required.

Keys should be separated by environment, application, tenant, and purpose. A key used for signing should not normally be reused for encryption. Access should follow least privilege, with dual control or multi-person approval for highly sensitive operations. Logs should record key-management events without exposing secret material.

Key loss can make encrypted data permanently inaccessible; key compromise can expose data, enable impersonation, or invalidate signatures. Organizations therefore need documented ownership, recovery testing, emergency rotation procedures, and an inventory of cryptographic dependencies.

Selecting Appropriate Cryptography

A practical selection process asks:

• What must be protected: data in transit, data at rest, identity, integrity, or all of these?
• Who are the trusted parties and what can an attacker observe or alter?
• How long must protection remain effective?
• Are keys generated, stored, rotated, and recovered securely?
• Does the protocol provide authentication and replay protection?
• Are algorithms standardized, reviewed, and supported by maintained libraries?
• Are performance, regulatory, interoperability, and post-quantum requirements relevant?

For bulk data, use authenticated symmetric encryption such as AES-GCM or ChaCha20-Poly1305 in a correctly configured protocol. For passwords, use a password-hashing scheme rather than encryption or a fast general-purpose hash. For integrity with a shared secret, use a MAC. For public verification or identity binding, use digital signatures and certificates. For key establishment, use a protocol that provides authentication and forward secrecy where appropriate.

Worked Example: Protecting a Web Application

An organization operates an online payment portal. It needs to authenticate the server, protect customer traffic, detect modification, and avoid storing recoverable passwords.

A suitable design is:

• a CA-issued certificate for the server name;
• an authenticated TLS key exchange with forward secrecy;
• symmetric AEAD for application traffic;
• Argon2id for password verification, with a unique salt per password;
• a managed key service or HSM for high-value private keys;
• logging and monitoring for certificate renewal and key use.

The server certificate does not encrypt all traffic by itself. It helps the client authenticate the server and supports the handshake. The negotiated symmetric session keys then protect the traffic efficiently. The password verifier does not need to recover the user’s password; it compares the result of the approved password-hashing process with the stored verifier.

Illustrative Case Study: Certificate Compromise

Background. A university uses certificates for its student portal, library service, and administrative applications. The private key for one internet-facing service is accidentally copied to a developer workstation.

Problem. Malware on the workstation may obtain the key. An attacker could impersonate the service if clients trust a certificate associated with that key.

Analysis. The incident is not solved by merely deleting the workstation copy. The organization must determine whether the key was accessed, identify every certificate using it, preserve evidence, and assess whether other systems share the same key.

Approach. Security staff isolate the workstation, revoke the affected certificate, generate a new key in a protected service, issue a replacement certificate, deploy it, and review logs. They search repositories and build pipelines for additional copies, enforce secret-scanning controls, shorten renewal intervals, and document ownership and emergency contacts.

Outcome. The service resumes with a new key. The university improves key isolation and automated certificate renewal. The incident also reveals that revocation alone cannot repair a system if clients do not check status; rapid replacement and removal of trust in the compromised key are essential.

Learning points. Private-key exposure is an identity compromise, not merely a confidentiality event. Key inventories, least privilege, automated renewal, incident playbooks, and tested recovery procedures reduce impact.

Limitations, Ethics, and Governance

Cryptography cannot protect data after an attacker controls an unlocked endpoint, captures plaintext before encryption, or obtains valid credentials. Metadata such as timing, traffic volume, and identities may remain visible. Weak implementations can fail through side channels, padding-oracle behavior, nonce reuse, timing leakage, memory disclosure, or insecure error handling.

Organizations should define cryptographic policies, approved algorithms, minimum key sizes, certificate practices, retention periods, and exception procedures. Privacy principles require collecting and retaining only necessary information; encryption should not become a justification for excessive collection. Access to decryption keys may have legal, investigative, or safety implications and should be governed transparently, with authorization and audit controls.

Cryptographic systems also create responsibilities concerning accessibility, lawful data recovery, cross-border data handling, and third-party providers. Compliance with a standard does not prove that an implementation is secure; governance must include testing, monitoring, supplier assessment, and incident response.

Contemporary and Post-Quantum Concerns

Large-scale quantum computers could use Shor’s algorithm to threaten widely used public-key systems based on integer factorization and discrete logarithms. Grover’s algorithm provides a quadratic search advantage against idealized brute-force search, which makes adequate symmetric key lengths and hash outputs important. The timing and practical effect of these threats depend on technological progress and implementation details.

Post-quantum cryptography seeks algorithms believed resistant to relevant quantum attacks while running on conventional computers. Standardization efforts have focused on lattice-based key-establishment and signature schemes, as well as other mathematical approaches. Organizations should not replace algorithms casually: they should inventory cryptographic use, identify long-lived confidential data and public keys, monitor standards, test interoperability, and design systems for algorithm agility.

A transition plan should consider “harvest now, decrypt later” attacks, in which adversaries collect encrypted traffic today in hope of decrypting it in the future. Hybrid key establishment may provide transitional protection, but it increases complexity and must be implemented according to current standards. Post-quantum algorithms may have larger keys, ciphertexts, signatures, or computational costs, so performance and denial-of-service implications require testing.

Best Practices

• Use modern, standardized, reviewed algorithms and authenticated protocols.
• Prefer well-maintained cryptographic libraries and secure defaults.
• Never invent a cipher or protocol for production use.
• Generate keys with a cryptographically secure random source.
• Protect keys more carefully than ordinary configuration data.
• Use unique nonces where required and validate authentication tags before releasing plaintext.
• Separate keys by purpose, environment, and security domain.
• Automate certificate issuance and renewal, while monitoring failures.
• Maintain a cryptographic inventory and test restoration and rotation.
• Plan for compromise, revocation, algorithm migration, and post-quantum transition.
• Treat endpoint security, identity management, patching, and access control as essential companions to cryptography.

Chapter Summary

Cryptography provides mechanisms for confidentiality, integrity, authentication, and evidence of origin, but secure outcomes depend on correct protocols, trustworthy implementations, and disciplined key management. Symmetric encryption is efficient for bulk data, while asymmetric cryptography supports scalable key exchange and signatures. Hashes create fixed-length integrity representations; MACs authenticate messages using shared secrets; and digital signatures use private keys to provide publicly verifiable integrity and origin evidence. Certificates bind identities to public keys, while PKI establishes trust through certificate authorities, chains, policies, validation, and revocation. Effective key management covers generation, distribution, storage, rotation, recovery, and destruction. Finally, organizations must account for implementation flaws, governance obligations, endpoint compromise, and the migration challenges posed by quantum computing.

Key Terms

Cryptography: The study and practice of protecting information using mathematical techniques.

Symmetric encryption: Encryption using a shared secret key.

Asymmetric cryptography: Cryptography using related public and private keys.

Plaintext: Information in its readable or original form.

Ciphertext: Transformed data produced by encryption.

Hash function: A function that maps arbitrary input to a fixed-length digest.

Collision resistance: The property that finding two inputs with the same digest is computationally difficult.

MAC: A keyed integrity and authentication code.

Digital signature: A private-key-generated value that can be publicly verified.

AEAD: Authenticated Encryption with Associated Data.

Nonce: A value intended for one-time or controlled use with a cryptographic operation.

Key exchange: A protocol for establishing cryptographic keys between parties.

Certificate: A signed binding between an identity and a public key.

Certificate Authority: A trusted entity that issues and manages certificates.

PKI: The policies, people, systems, and processes supporting public-key trust.

Trust anchor: A certificate or public key trusted independently by a validator.

Revocation: The process of invalidating a certificate or key before normal expiry.

Forward secrecy: Protection preventing a later compromise of long-term keys from decrypting earlier sessions.

Cryptoperiod: The authorized period during which a key may be used.

Post-quantum cryptography: Cryptography designed to resist relevant quantum-computer attacks.

Review Questions

Short Answer Questions

1. What is the principal difference between symmetric and asymmetric encryption?
2. Why is a cryptographic hash not considered encryption?
3. What role does a certificate authority play in PKI?
4. Why must nonce reuse be avoided in many AEAD systems?
5. Name three stages in the lifecycle of a cryptographic key.

Long Answer Questions

1. Explain how hybrid cryptography combines asymmetric and symmetric techniques in a secure web protocol.
2. Describe the validation process for an X.509 certificate chain.
3. Compare encryption, hashing, MACs, and digital signatures in terms of their security services.
4. Discuss why key management is frequently more difficult than choosing an algorithm.
5. Explain how quantum computing may affect current public-key cryptography and how organizations should prepare.

Analytical / Application Questions

1. A company encrypts database backups with a shared key but stores the key in the same backup repository. Analyze the risks and propose a revised key-management design.
2. A browser receives a certificate whose signature is valid, but the certificate name does not match the requested website. Should the connection be trusted? Explain the relevant validation conditions.
3. A development team proposes using SHA-256 alone to protect an API request from alteration by an attacker. Analyze whether this is sufficient and recommend a suitable alternative.

Multiple Choice Questions with Answers

Question 1

Which mechanism is most appropriate for encrypting a large volume of application data efficiently?

A. Symmetric authenticated encryption

B. A certificate authority

C. A digital signature for every byte

D. A password recovery question

Correct Answer: A. Symmetric authenticated encryption

Question 2

What does a cryptographic hash function normally produce?

A. A reversible ciphertext of fixed secret length

B. A fixed-length digest from an input

C. A certificate chain

D. A private key from a public key

Correct Answer: B. A fixed-length digest from an input

Question 3

Which key is normally used to verify a digital signature?

A. The verifier’s password

B. The signer’s public key

C. The recipient’s symmetric session key

D. The certificate serial number

Correct Answer: B. The signer’s public key

Question 4

What is the primary purpose of a certificate in PKI?

A. To bind an identity to a public key

B. To compress encrypted files

C. To replace all access controls

D. To store a user’s password in recoverable form

Correct Answer: A. To bind an identity to a public key

Question 5

Why is nonce reuse dangerous in many AEAD constructions?

A. It automatically revokes the certificate

B. It can compromise confidentiality and authentication

C. It makes public keys secret

D. It prevents all forms of hashing

Correct Answer: B. It can compromise confidentiality and authentication

Question 6

Which technology is designed specifically for storing password verifiers with resistance to guessing?

A. Argon2id

B. MD5 without a salt

C. Plaintext AES keys

D. A server certificate

Correct Answer: A. Argon2id

Question 7

If 100 parties require a distinct pairwise symmetric key for every pair, how many keys are needed?

A. 100

B. 495

C. 4,950

D. 10,000

Correct Answer: C. 4,950

Question 8

Which condition is required when validating a server certificate?

A. The certificate subject name must match the intended server identity

B. The certificate must contain the user’s password

C. The certificate must be self-signed by the server

D. The certificate must use an expired validity period

Correct Answer: A. The certificate subject name must match the intended server identity

Question 9

What is forward secrecy intended to provide?

A. Protection of earlier sessions if a long-term private key is later compromised

B. Permanent validity of revoked certificates

C. Recovery of forgotten passwords

D. Faster hashing of large files

Correct Answer: A. Protection of earlier sessions if a long-term private key is later compromised

Question 10

Which is a sensible post-quantum preparation activity?

A. Removing all key inventories

B. Using unreviewed homemade algorithms immediately

C. Identifying cryptographic dependencies and planning algorithm agility

D. Reusing public keys across every application

Correct Answer: C. Identifying cryptographic dependencies and planning algorithm agility