Spotlight article: Domain 3, Cryptography

This article has been depreciated. See the editor's note below for more information.

Editor's note: This article has been depreciated and no longer features up-to-date information. For updated information...

on the cryptography domain of the Common Body of Knowledge, see our most recent spotlight article on cryptography.

Cryptography is defined as the transformation of clear text into an unreadable form. It is the predominant method used in the enterprise to store and transmit messages safely so that only the intended recipient can read them. This domain spotlight provides an overview of the history of cryptography and the many complex, imaginative approaches that are used in contemporary enterprise encryption.

Cryptography background
While the systems for ensuring message secrecy have been around for millennia, modern day information technology poses new and challenging problems for individuals, corporations and nations who require secrecy of their communications. Cryptography as a science has evolved exponentially and rapidly over the last 50 years, producing new and more powerful methods that were well beyond the capability of humans unaided by computer technology. Early cipher methods based on substitution and transposition still form the basis of clear text-to-cipher text translation, but the algorithms used in transformation have become increasing complex, aided by computer processing, which enables complexity well beyond human capability. The evolution of cryptography from its earliest known application is demonstrated, and the reader is provided with the foundation needed to understand the complex approaches in current use today.

One way the strength of a cryptographic system is measured is by the strength of its underlying algorithm and the complexity of methods applied to accomplish the end-to-end task. The more important way to comprehend and measure the strength of a cryptosystem is through its implementation. Today we have amazingly strong algorithms, but compromises are still taking place. This is mainly because when developers integrate algorithms into their code they don't implement all of the necessary pieces properly, which leaves vulnerabilities. We have seen many examples of this as in when SSL was first released (could be broken in two minutes) and with the Wired Equivalent Privacy (WEP) protocol, which can be broken in about 30 minutes depending upon the amount of traffic. Proper cryptography isn't just using a strong algorithm, but understanding all of the pieces and parts that are involved with the process.

In the past, messengers were used as the transmission mechanism, and encryption helped protect the message in case the messenger was captured. Today, the transmission mechanism has changed from human beings to packets carrying 0s and 1s passing through network cables or open airwaves. The messages are still encrypted in case an intruder captures the transmission mechanism (the packets) as they travel along their paths.

Cryptography components
The algorithm, the set of mathematical formulas, dictates how enciphering and deciphering take place. Many algorithms are publicly known and aren't the secret part of the encryption process. In fact, it's often said that secrecy of the algorithm is not something that you should base your security on. The way that encryption algorithms work can be kept secret from the public, but many of them are publicly known and well understood. If the internal mechanisms of the algorithm aren't a secret, then something must be.

The secret piece of using a well-known encryption algorithm is the key. The key is a value that's made up of a large sequence of random bits. Is it just any random number of bits crammed together? Not really. An algorithm contains a keyspace, which is a range of values that can be used to construct a key. The key is made up of random values within the keyspace range. The larger the keyspace, the more available values can be used to represent different keys -- and the more random the keys are, the harder it is for intruders to figure them out. For example, if an algorithm allows a key length of 2 bits, the keyspace for that algorithm would be 4, which indicates the total number of different keys that would be possible. That would not be a very large keyspace, and certainly it would not take an attacker very long to find the correct key that was used.

In a cryptosystem that uses symmetric cryptography, both parties will be using the same key for encryption and decryption. This approach provides dual functionality. Symmetric keys are also called secret keys, because this type of encryption relies on each user to keep the key a secret and properly protected. If an intruder were to get this key, the intruder could decrypt any intercepted message encrypted with this key. Symmetric cryptography has several issues that were solved by using asymmetric and symmetric algorithms together.

Here are some of the symmetric algorithms covered in the CISSP exam: Data Encryption Standard (DES), Triple DES (3DES), Blowfish, IDEA, RC4, RC5, and RC6, Advanced Encryption Standard (AES).

In symmetric key cryptography, a single secret key is used between entities, whereas in public key systems, each entity has different keys, or asymmetric keys. The two different asymmetric keys are mathematically related. If a message is encrypted by one key, the other key is required in order to decrypt the message. In a public key system, the pair of keys is made up of one public key and one private key. The public key can be known to everyone, and the private key must only be known and used by the owner.

In the hybrid approach, the two technologies (symmetric and asymmetric) are used in a complementary manner, with each performing a different function. A symmetric algorithm creates keys that are used for encrypting bulk data, and an asymmetric algorithm creates keys that are used for automated key distribution.

Here are some of the asymmetric algorithms covered in the CISSP exam: RSA, Elliptic Curve Cryptosystem (ECC), Diffie-Hellman, El Gamal, Digital Signature Algorithm (DSA), Knapsack.

Cryptography methods and uses
Public Key Infrastructure (PKI) consists of programs, data formats, procedures, communication protocols, security policies, and public key cryptographic mechanisms working in a comprehensive manner to enable a wide range of dispersed people to communicate in a secure and predictable fashion. In other words, a PKI establishes a level of trust within an environment. PKI is an ISO authentication framework that uses public key cryptography and the X.509 standard protocols. The framework was set up to enable authentication to happen across different networks and the Internet. Particular protocols and algorithms aren't specified, which is why PKI is called a framework and not a specific technology. The CISSP exam covers the roles and responsibilities of many of the components of a PKI: registration authority, certification authority, certificate repository, certification revocation list, and more.

A one-time pad is a perfect encryption scheme, because it's unbreakable by brute force, and each pad is used exactly once. A one-time pad uses a truly non-repeating set of random bits that are combined bitwise using the binary XOR function. The bits of the message are XORed to the bits in the pad to generate ciphertext. The random pad is the same size as the message and is only used once. Because the entire pad is random and as long as the message, it is said to be unbreakable even with infinite resources. Each bit in the pad is XORed with each bit of the message, and this step ensures that each bit is encrypted by a nonrepeating pattern of bits. The sender encrypts the message and then destroys the one-time pad. After the receiver decrypts the message, he destroys his copy of the one-time pad.

Secure Sockets Layer (SSL) protects a communication channel instead of individual messages. It uses public key encryption and provides data encryption, server authentication, message integrity and optional client authentication.

The Internet Protocol security (IPsec) protocol suite is a method of setting up a secure channel for protected data exchange between two devices. The devices that share this secure channel can be two servers, two routers, a workstation and a server, or two gateways between different networks. IPsec is a widely accepted standard for providing network layer protection. It can be more flexible and less expensive than application- and link-layer encryption methods.

IPsec has strong encryption and authentication methods. Although it can be used to enable communication between two computers, it's usually used to establish virtual private networks (VPNs) among networks across the Internet.

A one-way hash is a function that takes a variable-length string and a message, and produces a fixed-length value called a hash value that represents that original data. A hash value is also called a message digest. This technology is used to ensure integrity of data and packets either during storage or transmission.

The CISSP exam covers these technologies and protocols, in much more depth, and many more standards (steganography, message authentication code, secure electronic transmission, SSH).

CISSP® is a registered certification mark of the International Information Systems Security Certification Consortium, Inc., also known as ISC(2). 

This was last published in September 2008

Dig Deeper on CISSP certification