Cryptography and Public Key Infrastructure

Introduction

Cryptography is the disciplined use of mathematical techniques to protect information and communications. Modern cybersecurity depends on cryptography for confidentiality, integrity, authentication, non-repudiation, secure software updates, digital payments, virtual private networks, cloud services, and web security. Cryptography does not, by itself, make a system secure. It must be used with sound protocols, secure key management, authenticated implementations, access controls, monitoring, and appropriate governance.

The central challenge is that legitimate users must be able to use protected information while attackers must be prevented from reading, modifying, impersonating, or replaying it. Cryptographic systems address this challenge through algorithms and keys. An algorithm specifies the transformation; a key provides the secret or private value that makes the transformation usable by authorized parties.

Learning Objectives

By the end of this chapter, students should be able to:

• distinguish symmetric encryption, asymmetric encryption, hashing, message authentication, and digital signatures;
• explain key exchange and the role of public key infrastructure (PKI);
• describe certificates, certificate authorities, trust chains, and revocation;
• select cryptographic controls for common business and technical situations;
• identify implementation weaknesses and key-management risks;
• explain the security implications of quantum computing and post-quantum cryptography.

1. Security Services and Cryptographic Building Blocks

Cryptographic controls support several security objectives:

• Confidentiality: unauthorized parties cannot understand protected data.
• Integrity: unauthorized modification can be detected.
• Authentication: an entity or message source can be verified.
• Non-repudiation: a signer cannot easily deny having produced a valid signature, subject to legal and operational conditions.
• Freshness: an old message cannot be accepted as a new one.

These objectives are related but not interchangeable. Encryption provides confidentiality, but unauthenticated encryption may allow undetected modification. Hashing supports integrity verification, but a plain hash does not prove who created a message. Digital signatures provide origin authentication and integrity, but do not normally provide confidentiality.

1.1 Kerckhoffs’s principle

A sound cryptosystem should remain secure even when the algorithm is public; security should depend on the secrecy of the key. Keeping an algorithm secret is not a substitute for strong design and independent review. This principle explains why widely studied algorithms such as AES and SHA-2 are preferable to proprietary, unreviewed encryption schemes.

1.2 Threats against cryptographic systems

Attackers may target:

• the algorithm, by exploiting mathematical weaknesses;
• the implementation, through coding errors, unsafe randomness, or side channels;
• the protocol, through replay, downgrade, or man-in-the-middle attacks;
• the key, through theft, guessing, exposure in logs, or poor storage;
• the surrounding system, such as certificate validation or access control.

Consequently, “the data is encrypted” is not sufficient evidence of security.

2. Symmetric Encryption

In symmetric encryption, the same secret key, or keys derived from the same secret, is used for encryption and decryption. If plaintext P is transformed using key K into ciphertext C, the relationship may be represented as:

Decryption recovers the plaintext:

Here, Enc and Dec are the encryption and decryption algorithms. Correct decryption requires the authorized recipient to possess the appropriate secret key and the algorithm to be used under its specified conditions.

Symmetric encryption is computationally efficient and is therefore used for bulk data: files, databases, backups, and network sessions. AES is a widely deployed block cipher with a 128-bit block size and key sizes of 128, 192, or 256 bits. ChaCha20 is a modern stream-cipher design commonly paired with Poly1305 for authenticated encryption.

2.1 Modes and authenticated encryption

A block cipher encrypts fixed-size blocks, but real messages are usually longer and have varying structure. A mode of operation specifies how blocks are processed. ECB mode reveals repeated patterns and should not be used for general message encryption. CBC requires careful random initialization vectors and separate authentication. CTR converts a block cipher into a stream-like construction and must never reuse a nonce with the same key.

Authenticated Encryption with Associated Data (AEAD) combines confidentiality and integrity. It produces ciphertext and an authentication tag:

K is the secret key, N is a nonce, P is plaintext, and A is associated data that remains visible but is authenticated. T is the authentication tag. The nonce normally need not be secret, but its uniqueness requirements are critical. Reusing a nonce with the same key can seriously compromise security, especially in counter-based modes.

Examples of suitable AEAD constructions include AES-GCM and ChaCha20-Poly1305. Implementations must verify the authentication tag before releasing or processing plaintext.

2.2 Key distribution problem

Symmetric cryptography creates a scalability challenge. If every pair of users needs a distinct secret key, the number of pairwise keys for n users is:

This assumes one unique shared key for every unordered pair and no group-key optimization. For 100 users, K = 100 × 99 ÷ 2 = 4,950 pairwise keys are required. Centralized key-distribution services can reduce operational complexity, but they become high-value targets.

3. Hash Functions and Message Authentication

A cryptographic hash function maps input of arbitrary length to a fixed-length digest:

M is the message and h is its digest. A secure cryptographic hash should provide:

• Preimage resistance: given h, finding a message M such that H(M) = h is computationally infeasible.
• Second-preimage resistance: given M₁, finding a different M₂ with the same digest is infeasible.
• Collision resistance: finding any two different messages with the same digest is infeasible.

Hashing is one-way in normal use; it is not encryption and cannot be “decrypted.” SHA-256 and SHA-3 are examples of modern hash families. MD5 and SHA-1 should not be selected for collision-sensitive security applications.

A hash alone does not authenticate a message. An attacker can alter a message and calculate a new hash. A keyed-hash message authentication code (HMAC) addresses this problem:

Only parties possessing secret key K should be able to generate a valid tag. HMAC is useful when communicating parties share a secret. For password storage, general-purpose fast hashes are inappropriate because attackers can test guesses rapidly. Passwords should be processed with a password-specific, salted, and deliberately expensive function such as Argon2id, scrypt, or PBKDF2, with parameters selected according to current hardware and periodically reviewed.

4. Asymmetric Cryptography

Asymmetric, or public-key, cryptography uses a related key pair:

• a public key, which may be distributed widely;
• a private key, which must be protected by its owner.

The keys are mathematically related, but deriving the private key from the public key should be computationally infeasible under the scheme’s assumptions.

4.1 Public-key encryption

A sender encrypts using the recipient’s public key; the recipient decrypts using the corresponding private key:

PK_B and SK_B are the recipient’s public and private keys. In practice, public-key encryption is usually used in a hybrid design: asymmetric cryptography establishes or protects a short-lived symmetric session key, and symmetric AEAD encrypts the data. This combines flexible key establishment with efficient bulk encryption.

RSA encryption must use an approved randomized padding scheme such as RSA-OAEP; raw textbook RSA is unsafe. Elliptic-curve schemes offer strong security with smaller keys, but they require correct curve selection and implementation.

4.2 Digital signatures

A signature is generated with a private key and verified with the corresponding public key:

A secure signature scheme provides integrity and evidence that the holder of the private key approved the message. It does not encrypt the message. Examples include RSA-PSS, ECDSA, and EdDSA. Signature implementations require secure randomness or deterministic procedures as specified by the algorithm. Reusing or predictably generating a nonce in ECDSA can expose the private key.

Signatures do not automatically establish legal non-repudiation. That conclusion depends on identity proofing, private-key control, audit records, applicable law, and organizational procedures.

5. Key Exchange and Hybrid Protocols

A key-exchange protocol allows two parties to establish a shared secret over an untrusted network. Diffie–Hellman (DH) and elliptic-curve Diffie–Hellman (ECDH) are important examples. In abstract form, two participants derive the same shared value from their private contribution and the other party’s public contribution. The shared value should then be processed through a key-derivation function rather than used directly as an encryption key.

A simplified finite-field DH example uses a public prime p and generator g. Alice chooses private value a and sends:

Bob chooses b and sends:

Alice calculates B^a mod p, while Bob calculates A^b mod p. Both values equal g^ab mod p. This example illustrates the mechanism, not recommended production parameters. Authentication is essential: unauthenticated DH is vulnerable to a man-in-the-middle attack.

Modern protocols add authentication, transcript binding, key derivation, nonce handling, and often forward secrecy. Forward secrecy means that compromise of a long-term private key does not allow an attacker to decrypt previously recorded sessions, assuming ephemeral session keys were securely erased and the protocol was correctly implemented.

TLS is a practical example of a hybrid protocol. It authenticates a server using a certificate, negotiates cryptographic parameters, establishes traffic keys, and then protects application data using AEAD. A secure implementation must reject obsolete protocol versions, weak algorithms, invalid certificates, and authentication-tag failures.

6. Public Key Infrastructure

Public-key cryptography solves some key-distribution problems, but a user still needs to know whether a public key really belongs to the claimed entity. PKI supplies a framework for binding identities to public keys through certificates, authorities, policies, and lifecycle procedures.

6.1 Digital certificates

A digital certificate is a signed data structure containing information such as:

• subject identity or names;
• subject public key and algorithm;
• issuer identity;
• validity period;
• permitted uses and constraints;
• a unique serial number;
• the issuer’s digital signature.

The most common web certificate format is X.509. A certificate does not make the subject trustworthy in every context. It asserts that a certificate authority (CA), operating under stated policies, verified specified attributes and bound them to a public key.

6.2 Trust chains and validation

A typical chain contains an end-entity certificate, one or more intermediate CA certificates, and a trusted root CA. The root is usually distributed through an operating system, browser, enterprise device, or application trust store. During validation, software should check:

1. the signature on each certificate;
2. the chain to a trusted root;
3. validity dates and time handling;
4. the requested hostname or identity;
5. key-usage and extended-key-usage constraints;
6. basic constraints and path length;
7. revocation status where required by policy;
8. acceptable algorithms and key sizes.

Trust stores are a major security boundary. An attacker who adds a malicious root certificate may intercept supposedly secure connections. Organizations must control trust-store changes and monitor them.

6.3 Certificate lifecycle

The lifecycle includes policy definition, key generation, identity validation, certificate issuance, deployment, renewal, suspension or revocation, expiry, archival, and destruction. Automation is valuable because manual renewal causes outages and encourages dangerous workarounds, such as disabling certificate validation.

Revocation may be communicated through certificate revocation lists (CRLs) or the Online Certificate Status Protocol (OCSP). Revocation is not a perfect solution: status may be delayed, unavailable, cached, or ignored. Short certificate lifetimes, rapid automated replacement, and strong private-key protection reduce exposure.

7. Key Management

Cryptographic strength is often defeated by poor key management rather than by breaking the algorithm. A mature key-management program addresses the entire lifecycle:

• generation using an approved cryptographically secure random number generator;
• registration and ownership assignment;
• secure storage in a hardware security module (HSM), key-management service, or protected operating-system facility;
• controlled use and separation of duties;
• rotation based on risk, algorithm limits, and policy;
• backup and recovery with carefully protected copies;
• revocation or disabling after compromise;
• secure destruction and evidence of disposal.

Keys should be classified according to sensitivity and purpose. Encryption keys, signing keys, key-encryption keys, certificate-authority keys, and recovery keys should not be casually reused across unrelated functions. Least privilege applies to key operations: an application may be allowed to request encryption without being allowed to export the key.

Secrets should not be embedded in source code, container images, tickets, or ordinary configuration files. Access should be logged, monitored, and periodically reviewed. Backup encryption must include protection of the backup keys; otherwise the backup merely transfers the confidentiality problem.

8. Selecting Cryptographic Controls

Control selection should begin with the asset, threat, lifecycle, and regulatory context rather than with a fashionable algorithm.

A practical design normally uses multiple controls. For example, an online banking service may use certificates for server authentication, ephemeral key exchange for forward secrecy, AEAD for traffic confidentiality and integrity, HMAC or signatures for selected application messages, and an HSM for high-value signing keys.

9. Implementation Weaknesses and Assessment

Security assessment should examine both design and operation. Common weaknesses include:

• use of obsolete algorithms such as MD5, SHA-1 for signatures, DES, or unauthenticated encryption;
• hard-coded, reused, or low-entropy keys;
• predictable random-number generation;
• nonce reuse in AEAD or ECDSA;
• failure to validate certificate names, dates, chains, or key usage;
• accepting invalid certificates during development and leaving the exception in production;
• missing signature verification on software updates;
• poor password hashing parameters;
• keys exposed through logs, crash dumps, backups, or source repositories;
• excessive trust anchors and uncontrolled certificate issuance;
• insecure error handling that leaks sensitive information;
• side-channel exposure through timing, memory access, power, or electromagnetic behavior.

Assessment techniques include configuration review, source-code analysis, dependency and algorithm inventory, certificate scanning, key-access audits, penetration testing, protocol testing, and tabletop exercises for key compromise. A useful inventory records algorithm, key size, purpose, owner, storage location, expiry or rotation date, and migration dependency. Cryptographic agility—the ability to replace algorithms and parameters without redesigning the whole system—is increasingly important.

10. Case Study: Protecting a University Examination Platform

This is an illustrative case.

Background

A university operates an online examination platform. Exams are uploaded before the examination period, students connect through browsers, and marks are transferred to a student-record system. The institution must protect unreleased questions, authenticate staff and students, detect tampering, and preserve reliable audit evidence.

Problem

An initial review finds that exam files are encrypted with a shared password stored in a deployment script. The web server accepts any certificate presented by an internal service, passwords are stored using unsalted SHA-256, and software updates are installed without signature verification.

Analysis

The design has four distinct problems. First, the shared password is difficult to rotate and may be exposed through source-code access. Second, accepting any certificate removes server authentication and permits an internal man-in-the-middle attack. Third, fast unsalted hashing enables efficient offline password guessing and allows identical passwords to produce identical stored values. Fourth, unsigned updates allow an attacker who compromises the deployment path to install malicious code.

Approach and solution

The university adopts the following architecture:

1. Exam files are encrypted with an AEAD scheme using data-encryption keys generated by a managed key service. Key-encryption keys are held under stricter administrative control.
2. The web platform uses current TLS with certificate and hostname validation. Internal services use certificates issued by an enterprise CA, with automated renewal.
3. Passwords are migrated to Argon2id with unique salts and parameters selected through performance testing. Multi-factor authentication is required for staff with examination privileges.
4. Release packages are signed with a dedicated signing key protected in an HSM. Deployment systems verify signatures before installation.
5. Audit logs record key use, certificate changes, administrative actions, and release verification. Logs are access-controlled and protected against alteration.
6. A documented incident process covers suspected key compromise, certificate revocation, emergency rotation, backup restoration, and communication.

Outcome

The revised design separates confidentiality, authentication, integrity, and operational accountability instead of relying on one shared password. It also reduces the impact of a single compromised server because keys cannot be freely exported and software provenance is checked.

Learning points

Cryptographic design should map each threat to a specific control. Key management and validation are as important as algorithm choice. Automated lifecycle management reduces human error, while independent monitoring provides evidence that controls continue to operate.

11. Post-Quantum Implications

Quantum computing affects public-key systems differently from symmetric systems. Shor’s algorithm, if implemented on a sufficiently capable fault-tolerant quantum computer, would threaten widely used RSA and elliptic-curve systems by making their underlying mathematical problems tractable. Grover’s algorithm provides a quadratic speedup for brute-force search against ideal symmetric constructions. The practical response for symmetric cryptography is generally to use adequately large keys, such as AES-256 where appropriate, rather than to abandon symmetric encryption.

Post-quantum cryptography (PQC) develops algorithms intended to resist known classical and quantum attacks. Standardization efforts have focused especially on lattice-based key encapsulation and digital signatures, while also considering code-based and other constructions. PQC keys, ciphertexts, and signatures may be larger or have different performance characteristics than current algorithms. Implementations must follow current standards and validated libraries rather than experimental algorithms.

A major present concern is “harvest now, decrypt later”: an adversary may record encrypted traffic today and attempt decryption when quantum capability improves. Organizations should inventory long-lived confidential data, identify vulnerable public-key uses, test hybrid migration strategies, and design systems for cryptographic agility. Migration is not simply an algorithm replacement; certificates, protocols, hardware, embedded devices, legal records, and operational procedures may all require change.

12. Governance, Ethics, and Professional Practice

Cryptography can protect privacy and safety, but it can also conceal fraud, facilitate ransomware, or obstruct legitimate investigations. Professionals should apply data-protection principles, minimize unnecessary collection, restrict access to keys, and document lawful purposes. Key escrow or recovery mechanisms require careful analysis because they introduce additional trust and compromise risks.

Organizations should define ownership for root keys, certificate authorities, trust stores, signing keys, and emergency recovery. Separation of duties is important: the person who requests a high-value certificate should not unilaterally approve it and export its private key. Policies should address retention, lawful access, breach reporting, third-party providers, and decommissioning.

Chapter Summary

Symmetric encryption efficiently protects bulk data but requires secure secret-key distribution and lifecycle management. Asymmetric cryptography uses public and private keys for authentication, signatures, encryption, and key establishment, but it is slower and depends on difficult mathematical problems. Hash functions provide fixed-length integrity digests; HMAC authenticates messages shared by parties with a secret; digital signatures authenticate origin and integrity through a private key.

Key exchange protocols establish session secrets, but they must be authenticated to prevent man-in-the-middle attacks. Hybrid protocols use public-key mechanisms for establishment and symmetric AEAD for data protection. PKI binds identities to public keys through certificates, certificate authorities, trust chains, validation, and revocation. The quality of a cryptographic system depends heavily on randomness, key storage, rotation, certificate validation, secure implementation, monitoring, and incident response.

Effective practitioners select controls according to risk and purpose, assess weaknesses across algorithms and operations, and plan for post-quantum migration. Cryptography is therefore both a mathematical technology and a governance discipline.

Key Terms

Cryptography: Techniques for protecting information using algorithms and keys.

Symmetric encryption: Encryption using a shared secret key.

Asymmetric cryptography: Cryptography based on related public and private keys.

Plaintext: Information in its readable or original form.

Ciphertext: Transformed data produced by encryption.

AEAD: Authenticated Encryption with Associated Data; a construction providing confidentiality and integrity.

Nonce: A value intended for one-time or controlled-use operation in a cryptographic protocol.

Hash function: A function producing a fixed-length digest from arbitrary input.

Collision resistance: Difficulty of finding two different inputs with the same hash.

HMAC: A keyed construction for message authentication using a hash function.

Digital signature: A private-key-generated value verified with a public key.

Key exchange: A protocol for establishing a shared secret over a network.

Forward secrecy: Protection of past sessions from later compromise of long-term keys.

PKI: The framework of certificates, authorities, policies, and procedures for public-key trust.

Certificate authority: An entity that issues and signs digital certificates.

X.509 certificate: A standardized certificate structure commonly used in PKI and TLS.

Trust store: A collection of trusted root certificates or anchors.

HSM: Hardware Security Module; a protected device for cryptographic operations and keys.

Cryptographic agility: The ability to change algorithms or parameters with limited redesign.

Post-quantum cryptography: Cryptography designed to resist attacks from classical and quantum computers.

Review Questions

Short Answer Questions

1. What are the main differences between symmetric and asymmetric encryption?
2. Why is a cryptographic hash not an encryption algorithm?
3. What information does a digital certificate bind together?
4. Why must an AEAD nonce generally not be reused with the same key?
5. What is forward secrecy, and why is it valuable?

Long Answer Questions

1. Explain how a TLS connection can combine certificates, key exchange, asymmetric cryptography, symmetric AEAD, and certificate validation.
2. Describe the lifecycle of a cryptographic key from generation through destruction.
3. Compare HMAC and digital signatures in terms of keys, verification, scalability, and typical uses.
4. Explain how a certificate chain is validated and discuss the role of root and intermediate CAs.
5. Discuss the principal implementation weaknesses that can defeat otherwise strong cryptographic algorithms.

Analytical / Application Questions

1. A company encrypts database backups with AES but stores the encryption key in the same unrestricted storage account. Identify the risks and design a stronger key-management arrangement.
2. An enterprise service accepts any certificate from an internal network. Analyze the attacks this permits and propose a certificate-validation and PKI design.
3. A government agency must protect records for 25 years and currently uses RSA and ECDSA in externally exposed services. Develop a phased assessment and post-quantum migration plan, including inventory, prioritization, testing, and operational controls.

Multiple Choice Questions with Answers

Question 1

Which control provides confidentiality and integrity for bulk data when correctly implemented?

A. A plain cryptographic hash

B. Authenticated encryption with associated data

C. A digital certificate by itself

D. An unsalted password hash

Correct Answer: B. Authenticated encryption with associated data

Question 2

What is the primary purpose of a digital signature?

A. To provide message confidentiality

B. To compress a message

C. To provide integrity and evidence of possession of a private key

D. To generate a random nonce

Correct Answer: C. To provide integrity and evidence of possession of a private key

Question 3

For 100 users, how many unique pairwise symmetric keys are required under the pairwise-key assumption?

A. 100

B. 990

C. 4,950

D. 10,000

Correct Answer: C. 4,950

Question 4

Which statement about a cryptographic hash is correct?

A. It is normally reversible using a public key

B. It produces a fixed-length digest from an input of arbitrary length

C. It always authenticates the sender

D. It provides confidentiality by hiding the plaintext

Correct Answer: B. It produces a fixed-length digest from an input of arbitrary length

Question 5

What is a critical requirement for a nonce in many AEAD constructions?

A. It must always be secret

B. It must be longer than the plaintext

C. It must never be reused with the same key where the construction forbids reuse

D. It must be generated from the password

Correct Answer: C. It must never be reused with the same key where the construction forbids reuse

Question 6

In a normal certificate chain, which certificate is generally installed as a trust anchor?

A. The end-entity certificate only

B. The root CA certificate

C. The session certificate generated for each message

D. The password database certificate

Correct Answer: B. The root CA certificate

Question 7

What weakness is especially associated with unauthenticated Diffie–Hellman key exchange?

A. A man-in-the-middle attack

B. Automatic password salting

C. Guaranteed forward secrecy

D. Collision-free hashing

Correct Answer: A. A man-in-the-middle attack

Question 8

Which approach is most appropriate for storing user passwords?

A. Plaintext storage

B. MD5 without a salt

C. A fast unsalted SHA-256 digest

D. A salted, deliberately expensive password-hashing function such as Argon2id

Correct Answer: D. A salted, deliberately expensive password-hashing function such as Argon2id

Question 9

Which key should normally be used to verify a digital signature?

A. The signer’s public key

B. The signer’s password

C. The recipient’s symmetric session key

D. The certificate serial number

Correct Answer: A. The signer’s public key

Question 10

Why are post-quantum migration plans needed for RSA and elliptic-curve systems?

A. Quantum computers eliminate the need for encryption

B. Shor’s algorithm could threaten their underlying mathematical problems

C. Hash functions cannot be used with certificates

D. Symmetric encryption becomes impossible on classical computers

Correct Answer: B. Shor’s algorithm could threaten their underlying mathematical problems