Cryptographic Foundations and Symmetric Cryptography

Introduction

Cryptography is the discipline of protecting information by transforming it so that only authorised parties can understand or verify it. It supports confidentiality, integrity, authentication, and non-repudiation across applications such as online banking, virtual private networks, secure messaging, wireless networks, cloud storage, and digital payment systems.

This chapter focuses on cryptographic foundations and symmetric cryptography. It explains how plaintext, ciphertext, keys, entropy, randomness, cryptanalysis, and security strength relate to one another. It then introduces substitution concepts, stream and block ciphers, the Advanced Encryption Standard (AES), modes of operation, and authenticated encryption. Particular attention is given to obsolete algorithms and implementation failures, because a mathematically sound cipher can still be insecure when deployed incorrectly.

Learning Objectives

By the end of this chapter, you should be able to:

• distinguish plaintext, ciphertext, keys, encryption, and decryption;
• explain entropy, randomness, key space, and security strength;
• describe substitution, stream-cipher, and block-cipher concepts;
• explain AES structure and the purpose of common modes of operation;
• select suitable authenticated-encryption approaches;
• identify obsolete algorithms and common cryptographic implementation failures; and
• analyse a practical cryptographic deployment and recommend improvements.

1. Fundamental Cryptographic Concepts

1.1 The basic model

A symmetric encryption system uses the same secret key, or closely related secret material, for encryption and decryption. Let plaintext be represented by P, ciphertext by C, and key by K. Encryption and decryption can be represented as:

Here, E_K is the encryption transformation using K, and D_K is the corresponding decryption transformation. Correctness requires that decryption recover the original plaintext:

These relationships assume that the algorithm is correctly implemented, the key is valid, and ciphertext has not been altered in a way that prevents successful decryption. Encryption alone does not necessarily provide integrity: an attacker may modify ciphertext even if they cannot read it.

Plaintext is the original readable or structured information, such as a message, database record, image, or file. Ciphertext is the transformed output intended to conceal plaintext. A cryptographic key is secret or controlled information that parameterises the transformation. The algorithm may be public; modern security should depend on the secrecy of the key rather than secrecy of the algorithm. This principle is commonly associated with Kerckhoffs's principle.

1.2 Security services

Cryptography can support several security objectives:

• Confidentiality: preventing unauthorised disclosure.
• Integrity: detecting unauthorised modification.
• Authentication: establishing the identity or origin of a message or party.
• Non-repudiation: providing evidence that can help prevent a signer from credibly denying an action. This generally requires digital signatures and appropriate governance, not symmetric encryption alone.

A confidentiality-only design may be inadequate. For example, encrypted commands sent to an industrial controller could remain secret but be modified by an attacker. Authenticated encryption addresses confidentiality and integrity together.

1.3 Cryptographic keys and key space

A key space is the set of all possible keys. If a uniformly random key has n bits, the number of possible keys is:

An exhaustive-search attacker may need to test up to 2^n keys and, on average, approximately 2^(n−1) keys. These figures describe an ideal brute-force setting. Real security may be lower because of weak passwords, poor random-number generation, key reuse, implementation flaws, side-channel leakage, or cryptanalytic attacks.

Key length is therefore important but not sufficient. A long key generated from a predictable password does not provide the security associated with a uniformly random key. Likewise, a strong algorithm used with a reused nonce can fail catastrophically.

1.4 Entropy and randomness

Entropy describes uncertainty. In cryptography, it is used both informally to describe unpredictability and formally in information theory. For a discrete random variable X with possible outcomes x, Shannon entropy is:

In this formula, p(x) is the probability of outcome x, and H(X) is measured in bits. The formula applies to a defined probability distribution. If there are N equally likely outcomes, entropy becomes:

For example, a fair six-sided die has log₂6 ≈ 2.585 bits of Shannon entropy per roll. This does not mean that six rolls automatically produce a secure 15.5-bit key, because the generation process, encoding, independence, and attacker knowledge must also be considered.

Cryptographic systems require unpredictability, not merely variation. A cryptographically secure pseudorandom number generator (CSPRNG) uses a carefully protected internal state and a secure algorithm to produce outputs that are computationally difficult to predict. Operating-system facilities such as a platform's approved cryptographic random source should normally be preferred to manually collecting timings, mouse movements, process identifiers, or similar weak sources.

A nonce is a value intended to be used once in a particular context. A nonce may not need to be secret, but its uniqueness or unpredictability requirement depends on the algorithm. An initialisation vector (IV) is an input used to initialise a cipher mode. Some modes require an IV to be unpredictable; others require only uniqueness. These requirements must not be confused.

2. Cryptanalysis and Security Strength

Cryptanalysis is the study of methods for analysing cryptographic systems and recovering plaintext, keys, or useful information without authorised access. It includes mathematical attacks, brute-force search, statistical analysis, protocol analysis, fault attacks, side-channel attacks, and exploitation of implementation errors.

A useful distinction is between:

• Cipher security: resistance of the mathematical transformation to attack.
• Implementation security: resistance of software, hardware, key storage, error handling, and interfaces to attack.
• Operational security: correct key lifecycle management, configuration, monitoring, and retirement.

An attacker model specifies what the adversary can observe or control. Common models include ciphertext-only attack, known-plaintext attack, chosen-plaintext attack, and chosen-ciphertext attack. Modern encryption schemes are expected to withstand realistic chosen-plaintext and, where relevant, chosen-ciphertext conditions.

Security strength is an estimate of the work required for the best known practical attack, often expressed in bits. A system with approximately 128-bit security strength is intended to require work on the order of 2^128 basic operations under an idealised model. This is not a guarantee of exactly 128 years or operations; hardware, parallelism, algorithmic advances, quantum computing, and implementation weaknesses affect the estimate.

The avalanche effect is a desirable property in which a small change in plaintext or key causes a large, apparently unpredictable change in ciphertext. It helps prevent patterns from surviving encryption, but it is not by itself a proof of security.

3. Substitution and the Evolution of Ciphers

A substitution cipher replaces symbols or groups of symbols with other symbols. In a Caesar cipher, each letter is shifted by a fixed amount. If letters are represented by values 0 through 25, encryption can be described as:

where P is the plaintext letter value, C is the ciphertext value, and k is the shift. The modulus 26 reflects the English alphabet assumption. This cipher has only 26 possible keys and is readily defeated by exhaustive search.

A monoalphabetic substitution cipher uses one fixed substitution alphabet. It has a larger key space, but repeated plaintext letters produce repeated ciphertext patterns. Frequency analysis can exploit the non-uniform distribution of letters and common word structures. A polyalphabetic cipher uses multiple substitution alphabets, historically improving resistance to simple frequency analysis, but many such systems remain vulnerable when keys are short, repeated, or poorly managed.

These historical examples are educational rather than suitable for protecting modern data. Their importance is conceptual: they show why large key spaces, diffusion, confusion, secure randomness, and resistance to known attack models matter.

4. Stream Ciphers

A stream cipher generates a keystream and combines it with plaintext, commonly using exclusive OR (XOR):

Here, P_i and C_i are plaintext and ciphertext units, S_i is the keystream unit, and ⊕ denotes XOR. XOR has the property that applying the same value twice restores the original value.

The keystream must be computationally unpredictable and must not be reused with the same key and nonce. If two plaintexts are encrypted with the same keystream, then:

The keystream cancels out, potentially revealing relationships between the plaintexts. This failure is often called a two-time pad problem. A true one-time pad can provide information-theoretic confidentiality only when its key is uniformly random, at least as long as the message, kept secret, and never reused. Those distribution requirements make it impractical for most general systems.

Modern stream-cipher designs include ChaCha20, commonly used with the Poly1305 authenticator in an authenticated-encryption construction. Older stream ciphers such as RC4 have serious weaknesses and should not be used in new systems.

5. Block Ciphers

A block cipher transforms fixed-size blocks under a key. For a block size of b bits, the transformation maps b-bit inputs to b-bit outputs for each fixed key. AES has a 128-bit block size and supports 128-, 192-, and 256-bit keys.

A block cipher by itself is not a complete method for encrypting arbitrary-length messages. A mode of operation specifies how blocks are processed, how IVs or nonces are used, and whether integrity is provided.

5.1 Electronic Codebook mode

ECB encrypts each block independently. Identical plaintext blocks produce identical ciphertext blocks under the same key. Consequently, patterns can remain visible, especially in structured data or images. ECB should not be used for general message or file encryption.

5.2 Cipher Block Chaining mode

CBC combines each plaintext block with the previous ciphertext block before encryption. The first block uses an IV. CBC can provide confidentiality when correctly configured, but it does not provide authentication. Incorrect padding validation can create padding-oracle vulnerabilities. If CBC is used in legacy interoperability situations, it must be combined with a robust, separately verified integrity mechanism and carefully designed error handling.

5.3 Counter mode

CTR mode turns a block cipher into a stream-like construction by encrypting successive counter values and XORing the resulting keystream with plaintext. Counter values must never repeat under the same key and nonce. CTR provides no integrity by itself.

5.4 Galois/Counter Mode

GCM combines counter-mode confidentiality with authentication. It is an authenticated-encryption mode and is widely deployed. The central operational rule is that a nonce must never repeat with the same key. For the common 96-bit nonce format, systems should generate unique nonces, often by using a carefully managed counter or a secure protocol-level construction. Random nonces require sufficient collision protection and correct handling of persistence and distributed systems.

5.5 XTS mode

XTS is designed primarily for storage-device encryption. It provides confidentiality for sectors but is not a general-purpose authenticated-encryption mode. Systems requiring detection of arbitrary modification need an additional integrity design or a different construction.

6. AES: The Modern Symmetric Standard

The Advanced Encryption Standard is based on the Rijndael cipher and standardised with a 128-bit block size and three key lengths: 128, 192, and 256 bits. AES operates on a 4 × 4 array of bytes called the state. The number of transformation rounds depends on key size: 10 rounds for AES-128, 12 for AES-192, and 14 for AES-256.

Each ordinary AES round applies four conceptual transformations:

1. SubBytes: substitutes each byte using a nonlinear substitution table.
2. ShiftRows: cyclically shifts rows of the state.
3. MixColumns: combines bytes within columns to provide diffusion.
4. AddRoundKey: combines the state with a round key using XOR.

The final round omits MixColumns. A key-expansion procedure derives round keys from the original key. The details are important for implementation, but developers should normally use a maintained, reviewed cryptographic library rather than implementing AES themselves.

AES-128 and AES-256 are both considered strong when used correctly. AES-256 does not automatically make a complete system twice as secure; mode selection, nonce management, key protection, authentication, and endpoint security remain essential.

7. Authenticated Encryption

Authenticated encryption with associated data (AEAD) protects confidentiality and integrity of both encrypted plaintext and selected unencrypted metadata. The abstract interface is:

K is the secret key, N is a nonce, P is plaintext, A is associated data, C is ciphertext, and T is an authentication tag. Associated data is authenticated but not encrypted; examples include protocol version, message type, or sequence number.

Decryption must verify the tag before releasing plaintext to the application. Systems should not continue processing unauthenticated plaintext. Authentication failure should produce a controlled result without revealing excessive diagnostic information.

Common AEAD choices include AES-GCM, AES-CCM, and ChaCha20-Poly1305. Selection depends on platform support, performance, hardware acceleration, protocol standards, and library quality. The decisive requirement is correct use of the complete construction, including nonce rules.

8. Obsolete Algorithms and Common Failures

Algorithms such as DES, 3DES, RC4, and unsalted MD5 or SHA-1 for password storage are unsuitable for new security designs. DES has a short effective key; 3DES is legacy and inefficient; RC4 has statistical weaknesses; MD5 and SHA-1 are not appropriate for collision-resistant new designs. A general-purpose hash function is also not a password-storage algorithm. Passwords should be processed with a dedicated, memory-hard password hashing scheme such as Argon2id, with a unique salt and an appropriately selected work factor.

Frequent implementation failures include:

• hard-coded keys in source code or mobile applications;
• storing keys beside the encrypted data without access controls;
• using passwords directly as encryption keys;
• generating keys or nonces with predictable random functions;
• reusing a nonce with GCM or a counter-mode construction;
• using ECB for structured data;
• encrypting without authenticating;
• accepting unauthenticated plaintext before tag verification;
• logging keys, plaintext, tokens, or decrypted sensitive data;
• failing to rotate, revoke, back up, or destroy keys appropriately;
• confusing encoding with encryption; and
• writing custom cryptographic algorithms instead of using reviewed libraries.

Base64, hexadecimal, and URL encoding change representation, not secrecy. A base64-encoded password remains exposed to anyone who can decode it.

9. Key Management and Professional Practice

Cryptography is best understood as a lifecycle rather than a single function. Key management includes generation, registration, distribution, storage, use, rotation, revocation, backup, archival, and destruction. High-value keys should be protected by hardware security modules, trusted platform facilities, or managed key services where appropriate.

A sound design separates keys by purpose. For example, a data-encryption key should not also be used as a key-encryption key or authentication key unless a standard explicitly defines that use. Key derivation functions can derive context-specific keys from a high-entropy secret. Password-based derivation must include a salt and computational cost to resist guessing.

Professional teams should document algorithms, key sizes, nonce formats, rotation rules, failure behaviour, ownership, and recovery procedures. Cryptographic choices should be reviewed against current standards and organisational requirements, including applicable privacy, payment, health, or government regulations.

10. Illustrative Case: Protecting a Healthcare Records Service

Background

A small healthcare provider stores patient records in a cloud database. The application currently encrypts selected fields with AES-CBC, uses a key stored in an application configuration file, and logs decryption errors containing portions of submitted data.

Problem

A security review finds that ciphertext modifications are not reliably detected, the key is accessible to every application instance, and logs may disclose sensitive information. The design also has no documented rotation process.

Analysis

AES-CBC can provide confidentiality but does not authenticate ciphertext. An attacker who gains database write access may alter records or attempt to exploit differences in padding-error responses. The configuration-file key increases the impact of application compromise. Excessive logging creates a second disclosure channel.

Approach and solution

The provider migrates to an approved AEAD construction, such as AES-GCM, using a unique nonce for every encryption under a given key. Record identifiers, schema version, and tenant identifier are included as associated data where appropriate. Keys are generated by a CSPRNG and stored in a managed key service. The application receives narrowly scoped access to perform encryption and decryption, while raw key material is not placed in source code or ordinary logs.

The migration includes versioned ciphertext records, tag verification before data release, generic failure responses, redacted logging, key rotation with controlled re-encryption, access monitoring, and tested backup and recovery procedures.

Outcome

The revised system provides confidentiality and tamper detection, reduces key exposure, improves auditability, and establishes a repeatable key lifecycle. It does not eliminate all risk: endpoint compromise, authorisation errors, insecure backups, and insider threats still require separate controls.

Learning points

The case demonstrates that algorithm choice is only one part of security. Authenticated encryption, nonce discipline, key management, least privilege, safe error handling, and operational governance must work together.

11. Contemporary Developments and Limitations

Modern protocols increasingly prefer AEAD and formally analysed constructions. Hardware acceleration improves AES performance, while ChaCha20-Poly1305 provides a strong alternative on systems without dedicated AES instructions. Cryptographic agility allows algorithms and parameters to be replaced, but excessive agility can also create configuration complexity; supported choices should therefore be limited and centrally managed.

Quantum computing motivates migration planning. Grover's algorithm could reduce the idealised brute-force exponent for symmetric keys, although practical impact depends on quantum hardware and implementation costs. Using sufficiently large symmetric keys and following current standards is a sensible long-term measure. Quantum concerns do not justify abandoning present-day secure symmetric encryption or adopting unreviewed alternatives.

Formal verification, constant-time programming, side-channel-resistant implementations, reproducible builds, and independent testing are increasingly important. Artificial intelligence can assist code review, configuration analysis, and anomaly detection, but generated cryptographic code must not be trusted without expert review, testing, and conformance validation. AI systems may also expose secrets if sensitive code or keys are submitted to inappropriate external services.

Best-Practice Checklist

1. Use modern, standardised algorithms and maintained libraries.
2. Prefer AEAD, such as AES-GCM or ChaCha20-Poly1305, for general message encryption.
3. Generate keys and nonces using approved cryptographic facilities.
4. Never reuse a nonce where the selected mode forbids reuse.
5. Keep keys separate from encrypted data and restrict access by least privilege.
6. Authenticate before releasing decrypted data.
7. Use dedicated password-hashing functions for passwords.
8. Plan rotation, revocation, backup, recovery, and destruction.
9. Avoid revealing secrets through logs, errors, timing, or diagnostic interfaces.
10. Test interoperability, failure cases, load behaviour, and security assumptions.

Chapter Summary

Symmetric cryptography uses a shared secret key to transform plaintext into ciphertext and back again. Security depends on the algorithm, key size, entropy, randomness, implementation, and operational controls. Historical substitution ciphers illustrate weaknesses caused by small key spaces and statistical patterns. Stream ciphers require secure keystream generation and strict nonce or key-use discipline. Block ciphers such as AES require a suitable mode of operation; ECB leaks patterns, while CBC and CTR do not provide integrity by themselves. AEAD modes such as GCM combine confidentiality with tamper detection, provided that keys and nonces are managed correctly. DES, 3DES, RC4, and unsound password-hashing practices should not be used in new systems. Effective cryptographic engineering includes key lifecycle management, safe error handling, reviewed libraries, secure random generation, testing, governance, and planning for future developments.

Key Terms

Plaintext: Original readable or structured data before encryption.

Ciphertext: Transformed data produced by encryption.

Key: Secret or controlled value that parameterises a cryptographic operation.

Symmetric cryptography: Cryptography using shared secret key material.

Entropy: A measure of uncertainty in a probability distribution.

CSPRNG: Cryptographically secure pseudorandom number generator.

Nonce: A value intended for one-time use in a defined cryptographic context.

Initialisation vector: Input that helps initialise a cipher mode.

Substitution cipher: Cipher that replaces symbols or groups with other symbols.

Stream cipher: Cipher that combines plaintext with a generated keystream.

Block cipher: Cipher that transforms fixed-size blocks under a key.

AES: Standardised modern block cipher with a 128-bit block size.

Mode of operation: Method for applying a block cipher to messages or sectors.

AEAD: Authenticated encryption with associated data.

Authentication tag: Value used to detect unauthorised modification.

Cryptanalysis: Study of methods for attacking or evaluating cryptographic systems.

Security strength: Estimated computational effort required for the best known attack.

Key space: Set of all possible keys for an algorithm and key length.

Key rotation: Controlled replacement of cryptographic keys.

Side-channel attack: Attack using unintended leakage such as timing or power consumption.

Review Questions

Short Answer Questions

1. What is the difference between plaintext and ciphertext?
2. Why is a CSPRNG preferred to an ordinary pseudorandom function for generating cryptographic keys?
3. Why is ECB mode unsuitable for most structured data?
4. What is the purpose of an authentication tag?
5. Name two obsolete algorithms or practices discussed in this chapter.

Long Answer Questions

1. Explain the relationship between key length, key space, entropy, and practical security strength.
2. Compare stream ciphers and block ciphers, including their handling of plaintext and the importance of nonce management.
3. Describe the main transformations performed by AES and explain why using a reviewed library is recommended.
4. Explain how AEAD protects both ciphertext and associated data, and describe correct tag-verification behaviour.
5. Discuss the cryptographic key lifecycle and the controls required at each major stage.

Analytical / Application Questions

1. A development team encrypts every message with AES-GCM using the same key and a fixed nonce. Analyse the failure and propose a safer design.
2. A database stores AES-CBC ciphertext but has no integrity tag. Explain two risks and recommend a migration strategy.
3. Design a high-level cryptographic architecture for a cloud service storing sensitive customer records. Justify your choices of algorithm, nonce handling, key storage, rotation, logging, and failure behaviour.

Multiple Choice Questions with Answers

Question 1

Which item is the original readable data before encryption?

A. Ciphertext

B. Plaintext

C. Authentication tag

D. Nonce

Correct Answer: B. Plaintext

Question 2

How many possible keys are there in an ideal n-bit key space?

A. n²

B. 2n

C. 2^n

D. n!

Correct Answer: C. 2^n

Question 3

What is the main danger of reusing a nonce with AES-GCM under the same key?

A. The block size becomes smaller

B. Confidentiality and authentication can be seriously compromised

C. The key automatically rotates

D. The ciphertext becomes base64 encoded

Correct Answer: B. Confidentiality and authentication can be seriously compromised

Question 4

Which property does authenticated encryption add to confidentiality?

A. Compression

B. Integrity and authenticity detection

C. Password recovery

D. An increase in plaintext length only

Correct Answer: B. Integrity and authenticity detection

Question 5

Which AES mode is generally unsuitable for encrypting structured data because identical blocks remain identifiable?

A. GCM

B. CTR

C. ECB

D. XTS

Correct Answer: C. ECB

Question 6

What does a CSPRNG provide?

A. Guaranteed secrecy for any output

B. Computationally unpredictable random-looking output when properly seeded and implemented

C. A replacement for authentication

D. Automatic key rotation

Correct Answer: B. Computationally unpredictable random-looking output when properly seeded and implemented

Question 7

Which algorithm is considered obsolete for new general-purpose encryption designs?

A. AES

B. ChaCha20

C. RC4

D. AES-GCM

Correct Answer: C. RC4

Question 8

In AEAD, what happens to associated data?

A. It is authenticated but not encrypted

B. It is always discarded

C. It replaces the key

D. It is compressed instead of authenticated

Correct Answer: A. It is authenticated but not encrypted

Question 9

Why should decrypted plaintext normally not be released before tag verification?

A. Verification changes the plaintext format

B. Unauthenticated or modified data could be processed as trustworthy

C. The cipher cannot decrypt without a second key

D. It prevents all denial-of-service attacks

Correct Answer: B. Unauthenticated or modified data could be processed as trustworthy

Question 10

A Caesar cipher over the 26-letter alphabet has how many possible shift keys?

A. 13

B. 26

C. 52

D. 256

Correct Answer: B. 26