History of Cryptography

I know you purchased this book not for history lessons, but for information on how to become an ethical hacker. Yet you can learn things by studying the history of cryptography that can help you relate to the techniques a little better. Early cultures taught us that cryptography is simply a technique or group of techniques used to protect information. The primitive techniques of times past may look antiquated and simple in the face of today’s complex and mind-numbing technologies, but the basic concept has not changed.

Cryptography is far from being a new technology and has existed for a very long time. The story goes back at least 4,000 years if not longer. Some systems developed during the science’s long history may have dropped out of use whereas others have evolved, yet the concept is the same. Let’s look at some of the early applications of cryptography to demystify this topic and make it more understandable.

The intricate patterns and glyphs used in Egyptian hieroglyphics were commonly used for spiritual and religious reasons. The ancient Egyptians were probably using the system not so much to withhold secrets but because they wanted a special writing system to commune with their gods and eternity. It is believed that only members of the royal family and the religious orders could fully understand how to read and write the system and comprehend it fully.

The pictograms served as a way to illustrate the life story of the deceased of royal and noble descent. From what we can tell, the language was purposely controlled and designed to be cryptic, to provide an air of mystery about it, and to inspire a sense of awe. However, over time the writing system became more complex; eventually the public and those who could write the language either passed away or turned their interests to other endeavors, and the ability to decipher the symbols was lost for a time. It wasn’t until the middle of the eighteenth century that several attempts were made by Europeans to uncover its secrets, which were perceived to be either mystical or scientific. The symbols, despite the work of scholars, stubbornly held onto their secrets for many more years.

In 1799, a chance discovery in the sands of Egypt by the French Army uncovered something that would be instrumental in decoding the language. The Rosetta Stone was the key that allowed modern civilization to understand a language that was nearly lost, though it took over 20 years of concerted effort to reveal the language to the world once again.

Tracing the Evolution

As with the ancient Egyptians and Romans, who used secret writing methods to obscure trade or battle information and hunting routes, one of the most widely used applications of cryptography is in the safeguarding of communications between two parties wanting to share information. Guaranteeing that information is kept secret is one thing, but in the modern world it is only part of the equation. In today’s world, information must not only be kept secret, but provisions to detect unwelcome or unwanted modifications are just as important. In the days of Julius Caesar and the Spartans, keeping a message secret could be as simple as writing it in a language the general public didn’t, or wasn’t likely to, understand. Later forms of encryption require that elaborate systems of management and security be implemented in order to safeguard information.

Is the body of knowledge relating to cryptography only concerned with protecting information? Well, in the first few generations of its existence the answer is yes, but that has changed. The knowledge is now used in systems to authenticate individuals and to validate that someone who sent a message or initiated an action is the right party.

Cryptography has even made some of the everyday technologies that you use possible. One area that owes its existence to cryptography is e-commerce. E-commerce demands the secure exchange and authentication of financial information. The case could be made that e-commerce would not exist in anything resembling its current form without the science of cryptography.

Another area that has benefited tremendously from the science of cryptography is mobile technologies. The careful and thoughtful application of the science has led to a number of threats such as identity theft being thwarted. Mobile technologies implement cryptographic measures to prevent someone from duplicating a device and running up thousands in fraudulent charges or eavesdropping on another party.

So what does the field focus on? Each of the following is a topic you need to understand to put the tools and techniques in their proper context:

Confidentiality Confidentiality is the primary goal that cryptography seeks to achieve. Encryption information is done to keep that information secret or away from prying eyes. Under the right conditions, encryption should be impossible to break or reverse unless an individual possesses the correct key. Confidentiality is the more widely sought aspect of encryption.

Integrity Cryptography can help you detect changes in information and thus determine its integrity. You’ll learn more about this in the section “Understanding Hashing,” later in this chapter.

Authentication Cryptography allows a person, object, or party to be identified with a high degree of confidence. Authentication is an essential component of a secure system because it allows software and other things to be positively identified. A common scenario for authentication nowadays is in the area of device drivers, where it provides a means of having a driver signed and verified as coming from the actual vendor and not from some other unknown (and untrusted) source. Authentication in the context of electronic messaging provides the ability to validate that a particular message originated from a source that is a known entity which, by extension, can be trusted.

Nonrepudiation The ability to provide positive identification of the source or originator of an event is an important part of security. One of the most common applications of nonrepudiation and cryptography is that of digital signatures, which provides positive identification of where the message came from and from whom.

Key Distribution Arguably one of the most valuable components of a cryptosystem is the key, which represents the specific combination or code used to encrypt or decrypt data.

So How Does It Work?

Cryptography has many different ways of functioning. Before you can understand the basic process, you must first become familiar with some terminology. With this in mind, let’s look at a few of the main terms used in the field of cryptography.

Plaintext/Cleartext Plaintext is the original message. It has not been altered; it is the usable information. Remember that even though Caesar’s cipher operates on text, it is but one form of plaintext. Plaintext can literally be anything.

Ciphertext Ciphertext is the opposite of plaintext; it is a message or other data that has been transformed into a different format using a mechanism known as an algorithm. It is also something that can be reversed using an algorithm and a key.

Algorithms Ciphers, the algorithms for transforming cleartext into ciphertext, are the trickiest and most mysterious part of the encryption process. This component sounds complex, but the algorithm or cipher is nothing more than a formula that includes discrete steps that describe how the encryption and decryption process is to be performed in a given instance.

Keys Keys are an important, and frequently complicated, item. A key is a discrete piece of information that is used to determine the result or output of a given cryptographic operation. A key in the cryptographic sense can be thought of in the same way a key in the physical world is: as a special item used to open or unlock something—in this case, a piece of information. In the encryption world, the key is used to produce a meaningful result and without it a result would not be possible.

Next let’s look at the two major types of cryptography: symmetric and asymmetric (aka public-key cryptography).

Symmetric Cryptography

Symmetric algorithms do some things really well and other things not so well. Modern symmetric algorithms are great at all of the following:

• Preserving confidentiality
• Increasing speed
• Ensuring simplicity (relatively speaking, of course)
• Providing authenticity

Symmetric algorithms have their drawbacks in these areas:

• Key management issues
• Lack of nonrepudiation features

First let’s focus on the defining characteristic of symmetric encryption algorithms: the key. All algorithms that fit into the symmetric variety use a single key to both encrypt and decrypt (hence the name symmetric). This is an easy concept to grasp if you think of a key used to lock a gym locker as the same key used to unlock it. A symmetric algorithm works the exactly the same way: the key used to encrypt is the same one used to decrypt.

Asymmetric, or Public Key, Cryptography

Asymmetric, or public key, cryptography is a relatively new form of cryptography that was only fully realized in the mid-1970s by Whitfield Diffie and Martin Hellman. The new system offered advantages, such as nonrepudiation and key distribution benefits, that previous systems did not.

Public key systems feature a key pair made up of a public and a private key. Each person who participates in the system has two keys uniquely assigned to them. In practice the public key will be published in some location whereas the private key will remain solely in the assigned user’s possession and will never be used by anyone else (lest security be compromised).

Both keys can be used to encrypt, but when either key is used only the other key can reverse it. For example, if you were to encrypt a message with my public key I am the only one who could decrypt it since I have the private key that can open it. The reverse is true as well.

The only requirement is that public keys must be associated with their users in a trusted manner. With PKI, anyone can send a confidential message by using public information, though the message can be decrypted only with the private key in the possession of the intended recipient. Furthermore, public key cryptography meets the needs for privacy and authentication.

IPSec

Internet Protocol Security (IPSec) is a set of protocols designed to protect the confidentiality and integrity of data as it flows over a network. The set of protocols is designed to operate at the Network layer of the OSI model and process packets according to a predefined group of settings.

Some of the earliest mechanisms for ensuring security worked at the Application layer of the OSI model. IPSec is a new technology that works at the Network layer of the OSI model and has proven to be more successful than many of the previous methods. IPSec has been widely adopted not only because of its tremendous security benefits, but also because of its ability to be implemented without major changes to individual computer systems. IPsec is especially useful for implementing virtual private networks and for remote user access through dial-up connection to private networks.

IPSec provides two mechanisms for protecting information: Authentication Header and Encapsulating Security Payload. The two modes differ in what they provide:

• Authentication Header (AH) provides authentication services and provides a way to authenticate the sender of data.
• Encapsulating Security Payload (ESP) provides a means to authenticate information as well as encrypt the data.

The information associated with each of these services is inserted into the packet in a header that follows the IP packet header. Separate key protocols, such as the ISAKMP/Oakley protocol, can be selected.

The following steps show you how to create an IPSec Negotiation policy on Computer A:

1. On Computer A, click Start All Programs Administrative Tools, and then select Local Security Policy.
2. Right-click the IP Security Policies on the Local Computer node, and then choose Create IP Security Policy.
3. On the Welcome screen of the IP Security Policy Wizard, click Next.
4. In the Name field, type Secure21. In the Description field, type Policy to encrypt FTP, and then click Next.
5. On the Default Response Rule Authentication Method screen, choose the option Use This String To Protect The Key Exchange (Preshared Key) and type password.
6. On the Completing The IP Security Policy Wizard screen, ensure that Edit Properties is selected, and then click Finish.
7. In the Secure21 Properties dialog box, click Add.
8. On the Welcome To The Create IP Security Rule Wizard screen, click Next.
9. On the Tunnel EndPoint screen, click This Rule Does Not Specify A Tunnel. Click Next.
10. On the Network Type screen, click All Network Connections, and then click Next.
11. On the IP Filter List screen, click Add.
12. In IP Filter List dialog box that appears, type Link1986, and then click Add.
13. On the Welcome screen of the IP Filter Wizard, click Next.
14. In the Description field, type 21 IPSec Filter. Click Next.
15. On the IP Traffic Source screen, click Any IP Address, and then click Next.
16. On the IP Traffic Destination screen, click Any IP Address, and then click Next.
17. On the IP Protocol Type screen, click TCP in the drop-down list, and then click Next.
18. On the Protocol Port screen, select From This Port, type 21 in the text box, select To Any Port, and then click Next.
19. On the Completing The IP Filter Wizard screen, click Finish, and then click OK.
20. In the IP Filter list, select Link1986, and then click Next.
21. In the Filter Action dialog box, click Add.
22. In the Filter Action Wizard dialog box, click Next.
23. In the Filter Action Name dialog box, type Secure21Filter, and then click Next.
24. In the Filter Action General Options dialog box, select Negotiate Security, and then click Next.
25. On the Communicating With Computers That Do Not Support IPsec screen, select Do Not Allow Unsecured Communications, and then click Next.
26. On the IP Traffic Security screen, select Integrity and Encryption, and then click Next.
27. On the Completing The IP Security Filter Action Wizard screen, click Finish.
28. In the Filter Action dialog box, select Secure21Filter, and then click Next.
29. In the Authentication Method dialog box, select Use This String To Protect The Key Exchange (Preshared Key), type password, and then click Next.
30. On the Completing The Security Rule Wizard screen, click Finish.
31. In the Secure21 Properties dialog box, click OK.

Once you’ve created the policy you must activate it, so let’s do that.

On Computer A:

1. Click Start All Programs Administrative Tools Local Security Policy.
2. Select the Local Computer node IP Security Policies, and in the right pane right-click the Secure21 policy and click Assign.

On Computer B:

1. In the Local Security Policy Microsoft Management Console (MMC) console, on the Local Computer node right-click IP Security Policies, select All Tasks, and then click Export Policies.
2. In the Save As dialog box, type C:IPSecPolicyIPsecurityPolicy21.ipsec, and then click Save. You must then save the IPSec policy.

Import the security policy to a Windows machine.

Next, configure a Security Association rule in the Windows Firewall with Advanced Security MMC:

1. On Computer A, click Start Administrative Tools Windows Firewall With Advanced Security.
2. Select and then right-click Connection Security Rules, and then click New Rule.
3. In the New Connection Security Rule Wizard, select Server-To-Server, and then click Next.
4. On the Endpoints screen, select Any IP Address for both options, and then click Next.
5. On the Requirements screen, select Require Authentication For Inbound And Outbound Connections, and then click Next.
6. On the Authentication Method screen, select Preshared Key, type password in the text box, and then click Next.
7. On the Profile screen, verify that the Domain, Private, and Public options are selected, and then click Next.
8. In the Name text box, type Secure Server Authentication Rule, and then click Finish.
9. Perform steps 1–8 on Computer B.

Pretty Good Privacy

Pretty Good Privacy (PGP) is another application of cryptographic technologies. Using public key encryption, PGP is one of the most widely recognized cryptosystems in the world. PGP has been used to protect the privacy of e-mail, data, data storage, and other forms of communication such as instant messaging.

PGP was designed to provide the privacy and security measures that are not currently present in many forms of online communication. The e-mail or instant message travels to the destination or recipient in this encrypted form. The recipient will use PGP to decrypt the message back into plaintext.

The PGP system is a simple but innovative mechanism that uses a process similar to the public and private key system we explored earlier in this chapter. The key pair consists of a public key and a private key; the public key encrypts messages, and the private key decrypts them.

A PGP user can also use their private key to digitally sign outgoing mail so that the recipient knows the mail originated from the named sender. A third party would not have access to the private key, so the digital signature authenticates the sender.

Sensitive data files stored on your hard drive or on removable media can also be protected using PGP. You can use your public key to encrypt the files and your private key to decrypt them. Some versions also allow the user to encrypt an entire disk. This is especially useful for laptop users in the event the laptop is lost or stolen.

Secure Sockets Layer (SSL)

Another important mechanism for securing information is the Secure Sockets Layer (SSL). The SSL protocol was developed by Netscape in the mid-1990s and rapidly became a standard mechanism for exchanging data securely over insecure channels such as the Internet.

When a client connects to a location that requires an SSL connection, the server will present the client with a digital certificate that allows the client to identify the server. The client makes sure the domain name matches the name on the CA and that the CA has been generated by a trusted authority and bears a valid digital signature.

Once the handshake is completed, the client will automatically encrypt all information that is sent to the server before it leaves the computer. Encrypted information will be unreadable en route. Once the information arrives at the secure server, it is decrypted using a secret key. If the server sends information back to the client, this information will also be encrypted on the server end before being transmitted.