Sie sind auf Seite 1von 145

Table

of Contents
Acknowledgments:
Preface:
Chapter 1: Introduction to Cryptography
1.1 What is Cryptography?:
1.2 Basic Terminology:
1.3 Application of Mathematics:
Chapter 2: Classical Ciphers
2.1 Substitution Ciphers:
2.2 Caesar Cipher (Shift Cipher):
2.3 ROT1 Cipher:
2.4 ROT13 Cipher:
2.5 Atbash Cipher:
2.6 Transposition Ciphers:
2.7 Morse Code:
2.8 Fractionated Morse Cipher:
2.9 Book Ciphers:
2.10 Masonic Cipher (Pigpen Cipher):
2.11 Monoalphabetic Ciphers:
2.12 Polyalphabetic Cipher:
2.13 Homophonic Ciphers:
2.14 Vigenre Cipher:
2.15 Gronfeld Cipher:
2.16 Polybius Square:
2.17 Rail Fence Cipher:
Chapter 3: Cryptography encountered today
Chapter 4: Applications of Cryptography
4.1 Investigative Applications:
4.2 Applying what youve learned:
Chapter 5: Cryptanalysis Code Breaking Tips
Chapter 6: Mechanical Ciphers
6.1 Greek Scytale (First known appearance of a Cipher Device):
6.2 Alberti Cipher Wheel:
6.3 Vigenres Cipher Wheel:
6.4 16th Century Cipher Machine:
6.5 Jefferson Cipher Cylinder:
6.6 Wheatstone Wheel:
6.7 Mexican Army Cipher Wheel:
6.8 First known Rotor Cipher Machine:
6.9 Enigma & Lorenz:
6.10 Bombe and Bomba:
6.11 Swiss NEMA Cipher Machine:
6.12 Later Cipher Machines:
Chapter 7: Modern Ciphers
7.1 Symmetric Ciphers:

7.2 Binary:
7.3 Hexadecimal:
7.4 Block Ciphers:
7.5 Public Key Cryptography:
7.6 RSA:
7.7 DES (Data Encryption Standard):
7.8 3DES (Triple Data Encryption Standard):
7.9 Multipurpose Internet Mail Extensions (MIME):
7.10 Secure Multipurpose Internet Mail Extensions (S/MIME):
7.11 Privacy Enhanced Messaging (PEM):
7.12 AES:
7.13 IDEA:
7.14 Digital Signatures:
7.15 Certificate Authority (CA):
7.16 Digital Certificates:
7.17 Paired-keys:
7.18 Pretty Good Privacy (PGP):
7.19 Public Key Infrastructure (PKI):
7.20 Diffie-Hellman Key Exchange:
7.21 Elliptical Curve Cipher Algorithms:
7.22 Secure Socket Layer (SSL) & Transport Layer Security (TLS):
7.23 Virtual Private Networks (VPNs) and Internet Protocol Security (IPSec):
7.24 Quantum Ciphers:
7.25 Using Encryption With Your Devices:
Chapter 8: The Future of Cryptography
8.1 Legal Developments in cryptography:
8.2 Privacy Advocate:
8.3 National Security Advocates:
8.4 Global Trends Leaning Toward Evasive Surveillance Legislation:
8.5 The Political side of this issue:
8.6 US Court decisions:
8.7 Authors Insights:

Cryptography
An
Introductory
Crash Course on the Science and
Art of Coding and Decoding of
Messages, Ciphers,
Cryptograms and
Encryption
by
George Bull

Bull, G. (2016).
This book is the intellectual property of the author. If referencing content within this book,
follow copyright and intellectual property laws concerning fair use. Following fair use
guidelines on citation respects the author by giving proper credit for the work and time
spent on writing this book.
(Beyond that, I dont really care.)
Warning:
If you are an individual that is more concerned with Political Correctness then dealing
with reality, this may not be the right book for you. If you choose to continue to read this
book, know this, Youve Been Warned.

Acknowledgments:
I would like to express my gratitude and thanks to my family and friends for their support
and dedicate this book to my Parents. I also express my thanks to all my students whom
encouraged me to write. Additionally, I thank all Professors throughout my educational
career for sharing their knowledge and experiences with their students. I express special
thanks to the Stockton University Oratorio Society lead by Professor Beverly Vaughn. Her
outlook on life and never-ending energy inspires all and encourages everyone to sing.
Lastly, to all my colleagues over the years whom expressed an interest in seeing my
scholarly works published. I thank all of you!

Preface:
This book provides a crash course in Cryptography and Cryptanalysis. As the description
indicated this book is presented using a ground-up approach to learning so that readers of
all knowledge levels can understand the content. It was specifically designed to allow
readers with no prior Cryptography or Cryptanalysis knowledge the chance to gain some
practical cryptographic skills. Readers will start with a brief history of Cryptography and
be able to define what Cryptography is and why it is so important in securing everyones
digital data today. Classical Ciphers will be discussed in chapter 2. Chapters 3 and 4 will
cover Cryptography encountered within our daily lives, and Applications of Cryptography.
The focus is on two specific areas. First on the average individuals need to ensure their
information is secure. The second focuses on Investigative Applications. In discussing
investigative applications short stories are provided to highlight how Cryptography can be
applied within the fields of Law Enforcement, National Security as well as Archeology. In
4.2 readers have the opportunity to practice their new found Cryptography skill set.
Several Cryptanalysis code breaking tips are also provided within chapter 5. Within
chapters 6 and 7 discussions touch on Mechanical Ciphers and Modern Computerized
Ciphers. This book ends with a candid discussion on the Future of Cryptography focusing
on evolving legal issues. These include arguments from Privacy and National Security
Advocates; current international legislative trends; US Court Decisions and a few Author
Insights.
This book contains a small part of the culmination of Cryptographic Knowledge I have
acquired over the years. This wealth of knowledge draws upon various investigative and
scientific fields. My expertise, lead me to became a security professional specializing in
Forensic Science, Cybersecurity, Digital Forensic Investigation and Healthcare
Information Privacy and Security. I began my Cybersecurity and Digital Forensics
Training from, among other places, The University of New Havens Henry C. Lee College
of Criminal Justice and Forensic Sciences and the National Criminal Justice Computer
Laboratory and Training Center or Search Group in Sacramento California. Ive earned
recognition for my Cybersecurity and Digital Forensics expertise and hold professional
membership with NC4s DHS-Sponsored Cybercop Portal also known as the Cybercop
Situational Readiness Network. This affiliation allows me to stay current with updates
from Cybercop Global, The Homeland Security Group, and the Electronic Crime
Technology Center of Excellence through Cybercops Secure Network. As such,
Cryptography has been an interest of mine for years. My Forensic Science education was
also received from The University of New Havens Henry C. Lee College of Criminal
Justice and Forensic Sciences (UNH) in West Haven Connecticut as well as Stockton
University in Galloway New Jersey. Currently, I teach part-time at the rank of Assistant
Professor. Due to University needs and mostly fast-track classes, my course load consisted
of 25 undergraduate credits for the 2015-2016 academic year. Additional Security related
training includes National Security Incident Mapping, Security Vulnerability Assessments,
and Bio-Terrorism and Defense received from the University of New Haven in
collaboration with the Sandia National Laboratory in Livermore California. As a
Professor, I have taught coursework in Computer Science, Cybersecurity, Digital

Forensics and Healthcare Information Security at a University in North New Jersey since
January 2008.
A brief background the reader might find interesting, is that some news stations in the
northeastern US have occasionally talked about me over the past few years. Not for
ground breaking research or such, but because I was singing to some of my classes during
class. Not every course section, but still, now and then. They mentioned me for that and
later in 2015 for stopping a small riot on my campus by singing This is My Wish by
Kevin Ross after someone posted it online. So yes, Im the Singing Professor. This is why
I thank Dr. Vaughn in the Acknowledgments. Her inspiration is a key reason my singing
style continues to develop along the path it has taken allowing me to vocally perform Sole,
Motown, Jazz as well as other vocal genres. As for my students, over the years many
seemed confused by the explanations found in the typical albeit more traditional texts
when discussing course topics. Since many of my students are not shall we say the most
technologically savvy individuals when first enrolled in my classes, I have had to come up
with innovative ways of explaining things so that such students could at least begin to
comprehend the basic concepts of various course topics discussed including principles,
methodologies, and techniques found within cryptography and cryptanalysis. Several have
commented over the years that I should write a book on various subjects as my expertise
and explanations allowed them to have a better grasp of concepts they had previously
thought of as very complex and confusing fields of study. So I took their advice! As a
result, I acknowledge and thank all the students whom encouraged me to write. I wrote
this book in the hopes it will help others in the same way Ive helped them understand the
topics discussed within this book. To past students, this book contains more Cryptographic
knowledge then Ive ever conveyed during class. At this time, if it was not already
previously disclosed by the news media or social networks, the name of the School in
Bergen County NJ NYC Metro area where Im employed is Felician University, formerly
Felician College in 2015. Some students pointed out that there was another Professor with
the same name working for a different school in the NYC Metro area. Therefore, to
remove any confusion for those in that area, Felician is the only School Ive worked for as
a Professor in the NYC Metro area. I continue to ask the media to respect my wishes and
leave me be as I am merely a Professor not a public figure. As for my School, Felician
University follows the beliefs of the Franciscan Order of the Roman Catholic Church and
was founded by the Felician Sisters whom still reside on the Universitys Lodi campus. If
visiting the campus, please show proper respect and courtesy to the Sisters, Bothers, and
Fathers whose efforts promote peace and good will. I should also mention for potential
legal reason, at no time was any University resources or collaborative consultation with
others at the University used in writing this book. Nor did the University have any prior
knowledge of my writing activities. I wrote this book entirely on my own using free time
in July during the 2016 summer break. Having said that, this book should reflect
positively upon the University as an academic contribution that emerged from within the
ranks of its Faculty. While this book was primarily wrote in July, due to editing and
revisions release was delayed until August. Due to the time sensitive nature surrounding
this book release, I will monitor it and make corrections as needed. Due to the nature of
Amazons ebook distribution system, all updates will be available for download to your

devices. If critical errors are located, Amazon will notify each purchaser of the update. If
other important non-critical updates are made, your manage kindle content page will show
an update is available. I recommend looking now and then as the book may have new
content added or revisions made for a more enjoyable experience on some devices or for
better clarification purposes.
Lastly, given the multitude of sub-disciplines within Cybersecurity I would like to explain
why this subject was chosen. Cryptography is in my opinion, one of the most multidisciplinary fields of study today as it encompasses Computer Science, Cybersecurity,
Engineering, National Security, Forensic Analysis, and various Branches of Mathematics.
Additionally, when including Quantum Ciphers elements within the Natural Sciences
begin to play an important role as well. As such, this book encompasses greater levels of
scientific knowledge then a general Cybersecurity or Digital Forensics book could convey.
In other words, I chose the hardest most excruciating Cybersecurity related topic I could
think of and began writing. Glancing through the available book offerings on
cryptography, none of them seem to adequately teach exactly how cryptography works to
the layperson. Most seem to make assumptions that a baseline of knowledge is already
present. Others explain the concepts of modern computerized encryption and how to
implement different cryptosystems in textbook format, but do not explain exactly what is
being done behind the scenes to encrypt and decrypt data. This book provides a
rudimentary introduction (crash course) to Cryptography and Cryptanalysis that readers
can begin to apply within their own lives by teach them exactly how Cryptography works
to protect information in our modern Digital Age as well as its use in Ancient Times. This
provides a foundation which readers can continue to build upon. My original intentions
were to write this book as if it was a lecture being read rather then heard. Sometime during
the writing process the book took on a different form. It ended up resembling a
combination of traditional textbook format, presented with explanations similar to what
the reader would receive from in-person course lectures.
Now that all of this is out of the way and without any further ado, this book begins with an
Introduction to Cryptography.

Chapter 1: Introduction to Cryptography

1.1 What is Cryptography?:


Background
Welcome novice cryptographers and cryptanalysts! This book will attempt to provide the
beginner with a simple introductory crash course to the field of cryptography, although the
amateur and experienced cryptographer or cryptanalyst may also gain insight into a thing
or two that had previously eluded their grasps as well. Contrary to popular belief,
cryptography is not new. The word itself dates back to around 1635-1645 AD and is based
on the Greek words kryptos which means hidden and graphein meaning to write.
Therefore, the word cryptography means hidden or secret writing. However, while the
Greeks coined its name, its use dates back to the eras of Ancient Egypt, Rome, and
Greece. First we need to answer the question of what is cryptography? Cryptography is
the science and art of coding and decoding of secret messages, information or data. This
process of sharing encrypted messages between parties ensures that the content of
messages are kept secret or confidential allowing only authorized parties to gain meaning
from them. Attempts to ensure only the party or parties you are specifically corresponding
with will be able to understand or derive meaning from the message is what cryptography
is all about. In cryptography the coded message is considered ciphertext. The original and
decoded versions of the message are referred to as plaintext. Once applied correctly, the
coded message will look indiscernible to the reader unless they have the required cipher
key allowing them to decode the message into intelligible plaintext. It should be pointed
out that cryptology encompasses the scientific study of the fields of cryptography and
cryptanalysis. Cryptography itself is the science and art of applying cryptographic
methods to code and decode messages for use in real world applications to secure data.
That is what this book mainly discusses, and allows the reader the opportunity to actually
apply cryptographic methods discussed within this book via scenarios and easy to
complete do it yourself exercises. Before I begin with various examples, several important
concepts and terms need to be explained to provide readers with a knowledge base in
which this book will continue to build upon.
Brief History:
The science and art of secret writing has been around for a long time. Before
computerized encryption varieties of early ciphers were used, and are generally referred to
as classical ciphers today. The following are several of the earliest civilizations to employ
cryptography. The Ancient Egyptians developed the hieroglyphic writing system which
they called mdju netjer, or Words of the Gods as spoken in their language. This later
became known as hieroglyphics in the Greek Language which can be interpreted to
mean Sacred Inscriptions, as well as Hidden or Secret Writing. The hieroglyphic writing
system was first used sometime between 3300-3000 BC, and is believed to have been
developed as a cipher. When first developed, only the High Priests are believed to have
had the knowledge of how to read and write hieroglyphs. This makes Ancient Egyptian
Hieroglyphs the first known cipher cryptosystem. In later Dynasties a newer version of
hieroglyphs was adopted for use within business, legal, literary and political
documentation. A group within Ancient Greece known as the Spartans used a device

known as a Scytale during the fifth century BC. The Scytale was believed to have been
implemented as a field cipher used by military commanders. Later, Julius Caesar used a
shift cipher for military and political use from 100-44 BC. These are just some examples
to show that cryptography has been around for many thousands of years. Sometime
around the 1950s, the term classical ciphers began to be used to generally describe PreWorld War II era ciphers. Within the next few chapters of this book, we will delve indepth into several popularly used classical ciphers. The simple substitution ciphers are
examples of classical ciphers. They replaced each letter in a message with another. Each
time that letter appears throughout the message, the new letter will instead take its place
thus encoding the message. Some forms of classical ciphers include but are not limited to
Caesar/Shift, ROT1, ROT13, Atbash, Vigenre Cipher, Transposition Ciphers, Book
Ciphers, and Block Ciphers. These and other non-computerized classical ciphers are still
used by many today throughout the world. Ciphers that were used during WWII are
generally referred to as Mechanical Ciphers which included the German Enigma and
Lorenz Cipher Machines. It should be noted that the Enigma and Lorenz Cipher Machines
are not the first examples of mechanical ciphers, but are the most advanced currently
known to have existed. Ciphers developed Post-World War II are considered modern
ciphers. Todays modern computer technologies have obviously greatly increased the
sophistication of todays computerized encryption based ciphers with multiply keys using
symmetric algorithms while other more secure ciphers utilize asymmetric algorithms or a
combination of both symmetric and asymmetric algorithms. These are more advanced
ciphers utilized in modern encryption and will be discussed within a later chapter. Several
examples of ciphers used today in the modern digital world include RSA, DES, 3DES,
S/MIME, AES, PEM, IDEA, SSL, Diffie-Hellman key exchange, Public-Key
Cryptography, PGP, PKI, IPSec, as well as the technologies used for Digital Signatures
and Digital Certificates. The following pictures represent some of the ciphers discussed
within this book.

1.2 Basic Terminology:


Cryptology:
Defined as the scientific study of cryptography and cryptanalysis
Cryptography:
The scientific field comprised of coding and decoding messages to protect data. The art of
Cryptography applies scientific methodologies for the purpose of establishing secure
communication. A traditional or classical definition is simply secret writing, or the process
of enciphering messages in an unreadable form and deciphering them back into readable
form. Today, it is generally referring to the process of computer technologies utilizing
encryption and decryption algorithms to secure information stored on electronic storage
devices, or transmitted over some form of computerized network media.
Cryptogram:
A message written in a code
Anagram:
Letters from a word, phrase, sentence or name that have been rearranging to form an
entirely new word, phrase, sentence or name.
Cryptanalysis:
A discipline born from the need to have the ability to solve coded message or cryptograms
generated by cryptographic methods. It employs scientific methodologies to discern
possible patterns, character frequency, and other tell tale signs that could be utilized to
decipher the enciphered data. While scientific methodologies are used, many with the
capability of devising systems they can utilize to decode ciphered message consider it
more of an art form then science.
Cryptanalyst:
An individual sometimes called a decoder or code breaker, skilled in the art of
Cryptanalysis whom uses scientific methods to analyze codes, cryptograms and ciphertext
in order to devise a means of decoding them back into intelligible plaintext. Cryptanalyst
can be hobbyists, archaeologists, professionally employed cryptographic experts in the
private sector with skill sets in cryptanalysis, while others may be governmentally or
militarily employed cryptographic technicians involved in secured communications or
intelligence-gathering operations.
Cryptographic System (cryptosystem):
A system utilizing mathematical algorithms for the purpose of devising techniques that
can be utilized for both the encoding and decoding of a message, information or data.
Cipher:
In cryptography, ciphers are mathematical algorithms used to provide a means of coding
messages from their readable state to an unreadable form to conceal its true meaning.

Ciphers use a key which can also be used to decode the encrypted message back into its
readable form.
Ciphertext:
The content of the enciphered message or code generated from plain text message by
applying a cipher used to encrypt it into an unreadable form.
Plaintext:
The contents of a message in its intelligible readable form. It is the message as it existed
before the application of a cipher is used to encode it, and post application of a cipher used
to decode the ciphertext form back into an intelligible message. In other words, the
intelligible message, information or data is completely and entirely readable to all
provided they understand the particular language in which the original message was wrote.
Encoding:
The process of coding plaintext into ciphertext. This is also known as coding, encrypting
or enciphering.
Decoding:
The process of decoding ciphertext back into plaintext, known as decrypting, or
deciphering
Encipher:
The process of using ciphers to code plaintext into ciphertext. Also known as coding,
encoding, encrypting or encryption
Decipher:
Deciphering is the process of retrieving plaintext from ciphertext. Also known as
decoding, decrypting or decryption
Encryption:
Derived from the word encrypt meaning the process of coding or change information from
one form to another to hide its true meaning. Additionally, the word is used to describe
modern mathematical algorithms utilized by computing technologies to hide or conceal
information using keys available to only the parties the information is intended for thus
concealing it from unauthorized parties. This is also referred to as coding or encoding.
Decryption:
The process of converting encrypted ciphertext back into readable plaintext. Before the
Digital Age, it refers to the processes the Cryptanalyst would employ to decode ciphered
documents manually. In the information age and beyond, it referred to the process of
utilizing computerized technologies using mathematical algorithms to reveal the message
hidden within encrypted ciphertext. However, in some cases it is still required for the
cryptanalyst to utilize their own knowledge and still manually decrypt ciphered messages.
Hash:

A Hash function refers to the process of converting an original source be it plaintext or


simply a file to a value known the hash value, hash code, hash sum, and sometimes hash
or hashes. While similar to encryption, it differs in that the resulting has value cannot be
converted back into its original state. The hash function is often used to establish that
information, a message or file has not been corrupted, changed, or altered through
accident, computer error, unauthorized tampering, or malware infection. It helps to prove
the integrity of the files we download, to ensure that are the ones we intended to obtain. In
cryptography, hash values are used as a means of authenticating the originator of a files,
document, message or transmission and are generally utilized within digital signatures.
Malware:
Although not a specific focus of this book, Malware is the general category that malicious
computer code, programs or apps such as Viruses, Worms, Trojan Horses, Spyware,
Adware, and other Potentially Unwanted Programs belong to. It should be noted that some
types of Malware utilize cryptographic systems to hide their presence on an infected
system. Some forms of malware are designed to create safe routes through security
measures without the users knowledge. Once these routes are created, it allows a nefarious
third party to install other types of malware designed to track all user activity. In some
cases, they are also designed to look for specific types of log files, documents, and all files
of a specific type or any file with certain key words. Sometimes they install a virus that
infects specific files or drives and or deletes them. Some can even allow the nefarious
party to see everything you are currently doing on your computer live. Some situations
this frequently occurs in include Cyber-stalking, Espionage, Identity Theft, as well as
others performing surveillance on potential victims for any number of other criminal
activities including simple burglary, making it of noteworthiness within this book.
Key:
Cryptographic Ciphers are essentially mathematical algorithms. In order for these
algorithms to function, they need to utilize keys. A key is simply a variable you need to
plug into the algorithm to have it produce the appropriate ciphertext and or decode it back
into readable plaintext. Some ciphers use just one key, while others use multiple keys.
Those using multiple keys are sometimes symmetric and other times asymmetric.
Symmetric Cryptography:
The concept of symmetric cryptography or symmetric ciphers is a simple one. All ciphers
classified as symmetric ciphers have exactly one key known as the secret key previously
discussed earlier in this chapter. The ROT1 substitution cipher discussed later in this book
is an example of symmetric cryptography. It should be noted that some ciphers have
several keys, but are used in overlaying layer fashion. Meaning, if you have a symmetric
cipher with three keys, you process them one at a time in sequence starting with
encrypting the message with the first key, Once the first key produces ciphertext, you then
encrypt the encrypted ciphertext with another layer of ciphertext and again with the third
key, for 3 layer phases needed to obtain the resulting final ciphertext. This is noticeably far
more secure than using just one secret key. However, once you have each of them, you can
still simply reverse the order by trial and error to find the correct sequence needed to

successfully decode the message back into plaintext.


Symmetric ciphers:
These ciphers have only one key used to encipher and decipher messages. See the
definition for Symmetric Cryptography above for a more in-depth look at how these
ciphers work.
Secret Key:
In symmetric cryptography, the cipher uses only one key. This key is known as the Secret
Key. The Secret key is used to code the message into ciphertext. Where the Secret key
differs from other keys used in asymmetric cryptography, is that once you understand the
process the secret key used to code the message, you can simply reverse it to decode the
message back into plaintext.
The following illustration shows the concept of applying symmetric cryptography using a
simple cipher to encrypt and decrypt messages.

In the previous illustration, notice the flow of data. On the left, you start with your
plaintext message. You then combine the plaintext with the secret key to create your
encrypted ciphertext message. Once in ciphertext form, you transmit it over networks such
as the internet as depicted here, to the party with whom you wish to communicate. Once
they receive it, they combine the ciphertext and secret key, thus decoding the message
back into its intelligible plaintext form.
Observe the below ciphertext.
J XFOU UP UIF TUPSF.
In this case, the secret key was to take every letter in your plaintext message and count
exactly one character forward in the alphabet to code it. Once you understand this, you can
easily reverse this process by counting one back to the previous letter within the alphabet
to decode it. Using this reversal method, the above message decodes to read as follows.
I WENT TO THE STORE.
Congratulation, you have just learned your very first cryptographic cipher, the ROT1

substitution cipher which well take a closer look at later in chapter 2.


Keyspace:
Modular Arithmetic will be discussed in section 1.3 of this chapter. This will help explain
that the expression (mod 26) represents a set consisting of 26 possibilities. When these
possibilities are referring to ciphers, keyspace refers to the total number of possible values
cipher keys can utilize within their cryptographic algorithms. Algorithms using larger
keyspaces can generate stronger ciphertext then those using smaller keyspaces. Keyspace
is determined by the number of permutations per each key used in a cryptosystem. If 3
separate keys with different symbols were used to code the final ciphertext, than the
possible keyspace for plaintext written in the English Language would be increased from
26 to 78 possible character values. Right?. Actually, this is correct and wrong. First, if you
truly want to code a message written in English, than you need to realize there are only 25
optional letters available as the 26th would return it to the original plaintext. Therefore, 3
separate keys each with the exact same alphabetic letters would have only 72 possible
ciphertext characters for each letter of plaintext. This is because you would not want the
ciphertext character matching the plaintext from the original message, nor having inner
tracks match the ciphertext character from other tracks. Therefore, you would have
25+24+23=72. However, when the cipher key is unknown is actually what keyspace deals
with and needs to be approached differently. In these instances, keyspace consists of the
number of permutations per each key used in a cryptosystem. Due to English having 26
letters, when using a simple substitution ciphers we have a keyspace of (26!-1). Where
asterisk (*) is used for multiplication the permutation for a simple Substitution Cipher
would be represented as (26!-1) or (where ^ represents exponents) about 2^88 which can
also be expressed as
26*25*24*23*22*21*20*19*18*17*16*15*14*13*12*11*10*9*8*7*6*5*4*3*2*1 =
approximately 403291461126605635583999999 possible permutations. If we know the
method of coding the message, say shift the plaintext letters forward in the alphabet, then
we reduce the possibilities to 25 ciphertext letters for each letter if the plaintext was
written in English. If we know the exact system say shift the plaintext letter 2 letters
forward in the alphabet, we can easily decode the ciphertext TQV VYQ into the
plaintext ROT TWO as this is an example of a ROT2 cipher similar to ROT1 we just
learned earlier within this chapter.
In Modern computerized encryption, keys are measured in bits instead of slots as the
previous examples depict. If the number of bits was set at 16 for each character, than
where ^ represents exponents the keyspace would be 2^16. As most modern computer
encryption algorithms have bits of 32, 64, 128, 256, 512, 1024 and 2048, they are
expressed as follows. 32Bits=2^32 ; 64bits=2^64 ; 128bits=2^128 ; 256bits=2^256 ;
512bits=2^512 ; 1024bits=2^1024 ; and 2048bits=2^2048
As you can see with higher bit values especially higher then 88, there are many more
possibilities with modern encryption algorithms than those used for simple substitution
ciphers.
Asymmetric Cryptography:

We just learned how symmetric cryptography using symmetric ciphers works by using a
single key known as a secret key to code and decode messages. Especially in the modern
technological world, computers can break these types of ciphers almost as easily as they
can use dictionary attacks to crack simple password. For those unfamiliar with password
attach methods, a computer programs or app uses a dictionary to crack a users password
by attempting to apply every single word within it as the possible password. These attack
methods can be completed in minutes to as little as seconds with modern notebook
computers as well as some tablets and high-end Smartphones. As a result, much stronger
encryption ciphers are needed to keep sensitive information safe and secure from the
prying eyes of unauthorized individuals. Asymmetric cryptography begins to address this
need. Asymmetric ciphers use two keys. One codes the message and the other decodes it.
The best forms of asymmetric ciphers use a system known as Public Key Cryptography.
Public Key Cryptography:
Public Key cryptographic ciphers use two key. One key the sender uses to code the
message into ciphertext. The receiving party that the sender wishes to securely
communicate with must use another key to decode the message into plaintext. An
important note to make is that once the message is coded with the senders key, their key
cannot decode it into plaintext. Only the key the receiving party has will be able to
successfully decode the encrypted ciphertext message back into readable plaintext. These
keys are referred to as the Public Key and Private Key respectively.
Public Key:
In Public Key Cryptography, the Public Key is used by the sender to code plaintext into
the ciphertext that they wish to securely transmit to another party over a network.
Private Key:
Public Keys used to code messages unlike secret key as seen in symmetric cryptography
cannot decode the passage of ciphertext it was just used to encrypt. Instead the recipient
uses the Private Key youve shared with them to decode the ciphertext into its intelligible
plaintext form. The concept is that public keys can only code messages. Once they are
coded, only its matching private key will be able to decode the message successfully into
plaintext.
The following illustration shows the concept of applying asymmetric public key ciphers to
encrypt and decrypt messages.

In the illustration above, notice the flow of data and how it differs from the illustration
shown for symmetric ciphers. On the left, you start with your plaintext message. You then
combine the plaintext with the public key to create your encrypted ciphertext message.
Once in ciphertext form, you transmit it through the internet to your desired
correspondent. Once they receive it, they combine the ciphertext with your private key to
successfully decode the message into intelligible plaintext form.
The following example attempts to illustrate the usefulness of employing Public Key
Cryptography over Symmetric Cryptography. Lets call this short story Jane and Dan.
These two individuals wish to secretly communicate with each other over the internet via
a messaging service. If a nefarious third party attempts to intercept the message they
would be able to read all correspondence unless they used cryptography to code their
messages. If encryption was used, the nefarious party would see gibberish instead of an
intelligible message. The nefarious party could be a number of different types of
individuals. They could be anything from a hacker, a technologically savvy identity thief,
cyberstalker or any number of other individuals engaged in utilizing technology to commit
criminal or illicit activities. Lets say this is a case involving cyberstalking. Dan is
unaware that he knows his stalker personally as they are friends. Knowing Dan in this way
would give the stalker access to where he lives. They could conceivably locate and gain
access to Dans cipher key used to code messages he sends to Jane. If a symmetric cipher
was used the stalker would than be able to read all messages in Dan and Janes
correspondence. If asymmetric cryptography was used instead, the stalker would only be
able to read Janes responses back to Dan but not the messages Dan sends to Jane. This
may have just confused readers that are about to say didnt you just say the public key
only codes and the private key only decodes. I understand this confusion, so allow me to
elaborate. When Dan and Jane decided to use asymmetric cryptography, one of them lets
say Dan creates the keys they will both use for their secure communications. Yes when
Dan codes his message he uses his Public Key to code it and only Janes Private Key can
now decode it. However, when Jane wishes to send a response back to Dan she then uses
her key to code her response she sends back to Dan and only Dans key can decode the
message Janes key coded. So think of the keys as a two way pairing system. Regardless
of which one codes the message, the encoded ciphertext can only be decoded by the

second matching key. So, if Dan codes the message at that moment his is the public key
and only its matching private key used by Jane can decode the message. If Jane codes the
message with her key, at that moment her key is acting as the public key and once Dan
receives the message and attempts to decode it, his key at that moment is acting as Janes
Private Key. So you see that regards of which direction the correspondence is occurring,
the one used to code the ciphertext message acts as the Public Key and the one actively
used to decode the ciphertext created by the other acts as the others Private Key.
Critical Characteristics of Information:
In Information Security, all information whether it be cyber or physical in nature, can be
broken down into what is known as their Critical Characteristics. Cybersecurity Specialist
focus on the CIA triangle (also called triad) within the Critical Characteristics of
Information. In this case, CIA does not stand for Central Intelligence Agency, but rather
Confidentiality, Integrity, and Availability. Some books say A stands for Authentication,
but in Cybersecurity the A in CIA is Availability. These are the three crucial
characteristics all information security professional must address when analyzing,
addressing, implementing, and maintaining an organizations Information Security Posture.
However, when it comes to cryptography in our modern world, it is not enough to just
focus on these three Critical Characteristics and should be expanded to 5 or more. Six of
the critical characteristics of information that impact productivity and concerning modern
cryptography are Confidentiality, Integrity, Availability, Authorization, Authentication,
and Nonrepudiation.
The reason to use cryptography is to keep sensitive information private when stored as
well as during transmission thus ensuring information transmitted is protected from
intercepts. This process is addressed by the critical characteristic of Confidentiality.
Whether it is industry or governmental, it is important to ensure the data the entitys
information infrastructure houses and transmits is genuine, accurate, uncorrupted and has
not been fraudulently altered inappropriately. The process to ensure your entitys
information is protected against such things is the critical characteristic known as
Integrity. As Cybersecurity Specialist, we often want to through a variety of security
measure together and implement them without taking into account the need for employees
to securely access information in a timely manner. Taking the need to access sensitive
information within a timely manner into account is addressed by the critical characteristic
Availability. Authorization is the process of assigning personnel access privileges they will
require to access confidential information. In cryptography, this also addresses who is
authorized to encrypt and decrypt ciphertext messages. Authentication is the process of
assuring the parties securely communicating are who they claim to be. In other words,
authorization is proof. If you send a securely encrypted document to someone,
authentication is the means that the receiving party can be assured that the document
received did originate from you. Lastly, Nonrepudiation is essentially proof or origin and
proof of destination. Through nonrepudiation techniques especially as seen in Public Key
Infrastructure, parties cannot refute, dispute or deny knowledge of transactions. This
allows for a means to hold all parties partaking in communications accountable for the
content exchanged during the transactions.

Session:
A session can be described as temporary access. Today, when we log into websites that
require usernames and passwords to access our accounts, a temporary assess is granted.
This access typically remains until the user logs off or if the site is set up for it, once a
predetermined amount of time has elapsed. The elapsed time could be due to user
inactivity, or an arbitrary time the site administrator has configured. In either event, once
the session is terminated, the user is required to sign back in (creating a new session) to
access their accounts.
Stream Ciphers:
Most ciphers are created and implemented before and after transmitting via a network
medium. Stream Ciphers are no exception to this statement. Stream Ciphers work by
encrypting each bit from the plaintext message one bit at a time. Binary Language which
we will discuss in chapter 7 is represented a 0s and 1s. It is the language modern
computer technology understands. Breaking the plaintext message down into its
corresponding bits, and than encoding each single bit one at a time is how the Stream
Cipher encodes data.
Block Ciphers:
This system works differently then that just explained for Stream Ciphers. Stream Ciphers
broke down the message into binary bits and encoded each bit one at a time. Block
Ciphers take groups of bits and encode them as if they were one unit. These bit groups are
known as a block. These blocks usually consist of 64, 128, and 256 bits when
implemented within encryption algorithms. Block Ciphers are discussed further within
chapter 7.

1.3 Application of Mathematics:


In applying Mathematical theorems, concepts, functions, formulas and algorithms to
Cryptography we see that the mathematics used is comprised of a variety of mathematical
branches. These various branches may include but are not limited to Number Theory,
Algebra, Modular Arithmetic, Statistics, Calculus, and Discrete Mathematics. The ones
used within this book are explained below.
Number Theory:
Number Theory is sometimes considered a newer way of referring to the branch of
mathematics known as Arithmetic. However, in this case, Higher Arithmetic would be
more accurate as the Arithmetic or Number Theory deals with pure numbers within a set
of positive integers. Yes, the main focus of the Arithmetic within Number Theory is on
whole numbers, or in other words positive integers with no decimal or fractional numbers
used within this mathematical theory. Some people may think of the numbers within this
theory as counting numbers, such as 0,1,2,3,4,5,6,7,8,9, etc. When learning this branch
of mathematics, concepts are introduced in such a way that no prior in-depth knowledge of
existing theorems are necessary in order to begin to comprehend the basics. Additionally,
as stated it usually focuses on positive integers or whole numbers, but can be adjusted to
accommodate negative values when necessary. In this event, the rule of no decimal or
fractionation still applies.
Algebra:
This branch of mathematics is often the most confusing to the average person. It is
actually very simple and easy to understand. In arithmetic we deal with using numbers as
values to be calculated. In Algebra, we deal with number and letters that are both used as
values to be calculated in formulas. The letters are what usually confuse people. Think of
the letters as a place holder for a number that you are going to plug into the formula. Take
the following simple Algebraic formula where f(x) in a function and y is a variable.
f(x) = ((y+3)*2)
The function f(x) can be thought of as a place holder that represents the results of the
calculation occurring on the other side of the equals sign. So just focus on the right side.
For the y within the parenthesis, pick a number and plug it into the formula. Lets say
you chose 6. Therefore, the formula will appear as follows.
f(x)=((6+3)*2)
Simply calculate the inner most parenthesis first and we get 9. Then take 9 and times it by
2 and the resulting value is 18. Therefore, the formula above with variable 6 can also be
represented as follows where f(x) equals the value of 18.
f(x) = ((y+3)*2)
y=6
f(x)=((6+3)*2) =18

f(x)=18
If it helps the reader, f(x)=18 can also be expressed as
18=((6+3)*2)
When it comes to using Algebraic expressions within this book, the variable y in the
case above is already predetermined for you when using existing ciphers. Plug in the value
that was already chosen by that cipher just as shown above with y=6. In Cryptography,
Algebra is often seen in algorithms for Substitution Ciphers which are explained further
during discussions on Classical Ciphers within Chapter 2.
Modulation (modular arithmetic):
Modular arithmetic is a concept within the mathematical discipline of Calculus. Though
the concept is a fairly simple one, it can be confusing at first. It works be establishing a
number set in which all possible numbers must fall within. The expression is generally
shown as (mod X) where X is the possible number of usable slots within the set. For
example if we used (mod 10) within an expression, then all possible values must fall
within the range of 0-9 or 1-10. While scientists generally express it as 0-9, if it helps
readers to better understand it, you can think of it conceptually as expressing a range from
1-10. Understanding modular arithmetic is of great importance to Cryptography. In the
Latin Language, there are only 24 Alphabetical character letters as opposed to English
which has 26. If a given messages plaintext was written in Latin instead of English, than
the modular expression would be (mod 24) as this confines the accepted characters to only
24 possibilities. English on the other hand would be expressed as (mod 26) to properly
represent the 26 possible character slots that are available within the English Alphabet.
The following table shows the Modular sets for several additional languages.

Statistics:
There are three types of statistical analysis used within this book which include frequency
distribution and combinations. Frequency distribution analysis is a type of attack method
used to break ciphertext utilizing the application of Statistical Probabilities. Break each
letter in a given alphabet down as a separate character. All written languages have
characters used more often in words then other characters. Knowing this, one can analyze
ciphertext to see a pattern begin to form in the way of statistical probability. In the case of
a simple substitution cipher being applied to a plaintext message written English, the
ciphertext character that would appear more then any other within the message would
statistically likely be the letter E. We can make this presumptive statement as the letter
E, has statistically been proven to be the most common alphabetic character that occurs
within passages, messages, articles or chapters when written in the English Language.
Since we can determine E is the most common, we can also discern the likely statistical
probability of each of the remaining letters and apply that to the ciphertext in much the

same way you would apply a ciphers key. When applying the frequency distribution attack
to simple substitution ciphers, more often then not the entire correctly decoded plaintext
message emerges from behind its shroud of ciphertext. Other Statistical Probabilities can
also include double letters, and the use of common words of varying lengths. The use of
combinations is observed when creating hash values as well as during cryptanalysis brute
force attacks. When discussing Statistics, most people have a hard time understanding the
difference between permutations and combinations. To aid readers with their
understanding a little, both permutations and combinations are strings of values. A set of
values are provided for use with the formulas. The main difference is that permutations
can only use each value listed once and never again in the string. The order of the values
matter with permutations. However, with combinations the order does not matter as much
allowing the same value to appear two or more times within a given string. Therefore,
there are more possible combinations then permutations for a given set of values.
Permutations are best seen in determining a Ciphers keyspace but are also employed
elsewhere within cryptography. One example is that some Hash values are created using
permutations.
Discrete Mathematics:
This is a branch or sub discipline within mathematics. The general concept of Discrete
Math is that not every problem can be solved through traditional mathematical
expressions. Logic problems fall into this category. Therefore, a brief explanation of
Discrete Mathematics is using math to solve logic problems. This is done in Propositional
Calculus and sometime in Propositional Algebra. For the purpose of this book, the only
aspects of Propositional Calculus I will use to assist in expressing ciphers mathematically
are the logical connective of implies, the set of, and the AND conjunction. For those
unfamiliar with the connective implies, the use of it in this book, can be thought of as, (if
this than that) and will be expressed Discretely as an arrow. So the expression of (AE)
reads A implies E when used in creating or deciphering ciphertext. This simply means for
every A in your plaintext message, use an E for every occurrence of A as your ciphertext
character. This can also be used for decoding by something like (EA) thus converting
every ciphertext E back into its plaintext A. Next, the mathematical representation of
the set of will be explained. This is represented in expressions as {} brackets. Lets say the
variable for a message is M. Therefore, {M} is the set of contents within message M. In
other words, {M} represents everything within message M. The last discrete mathematical
notion used in this book is the AND conjunction depicted as & in this book. To
understand AND conjunctions Lets look at A&B. This is read as A and B, and can be
thought of as using a true/false concept. Where T equals true and F equals false, the
possible true/false values for the A, B variables consists of, T T, T F, FT and FF
respectively. When using AND conjunction, it requires both variables be true. Now, lets
look at the expression A & BZ read A and B implies Z. In this expression, both A and B
must be true in order to have Z. If either A or B were false, Z would not be possible as Z
requires both A and B be true to exist.
Chapter Summary:

In this chapter, we saw that cryptography is by no means a new scientific field of study
and has its roots dating back to before Biblical times. Cryptography is the science and art
of protecting information in order to keep it confidential. It does so by utilizing
mathematical cipher algorithms to code and decode messages, information and or data.
Coded message are called ciphertext, while the original message as well as decoded
ciphertext is referred to as plaintext. The scope of cryptography ranges from classical
algorithmic ciphers, to mechanical cipher devices, and modern computerized encryption
algorithms used today. As ciphers are essentially mathematical algorithms, we discussed
various branches involving Number Theory, Algebra, Modular Arithmetic, Discrete
Mathematics specifically Propositional Calculus and Statistics as they pertain to
mathematical expressions contained within this book. Several basic terms were discussed
within the chapter. Summing up some of the most notable we start with the field of
Cryptanalysis. Cryptanalysis, also called decoding and code breaking is the field of study
that applies scientific methodologies to decoding ciphertext especially when the key is
unknown. Next we discussed ciphers which are mathematical algorithms for the purpose
of encrypting and decrypting secret messages, information or data. The coded messages
created by ciphers are referred to as ciphertext. In order for the encryption algorithms used
by ciphers require a variable to be plunged into them to encrypt or decrypt data. These
algorithmic variables are called keys. Depending on the types of cryptography being used
you could have just one key or several. If the algorithms only uses one single key to both
code and decode data called a Secret Key and is an example of a symmetric cipher.
However, some ciphers use multiple keys. If the cipher used one key to code known as a
Public Key and another to decode called a Private key then it is an example of an
asymmetric cipher.
To decode a message, you must make an assumption concerning the likely language in
which the plaintext message was written. This is important do to a concept of modulation
within modular arithmetic. This not only will identify the possible alphabetical letters to
choose from while decoding, but limit the possibilities mathematically to a number set.
For example English has 26 character letters within its alphabet. Therefore, the modular
arithmetic expression would be (mod 26) thus limiting a ciphertexts possible plaintext
equivalent to only 26 possible character to choose from. This knowledge is also a factor in
determining possible keyspace. In the example I just gave using English, only 1 key was
used. If a symmetric cipher used 3 different keys to code each with 26 possibilities, that
increases the possible keyspace to 78 possibilities. An explanation provided for Discrete
Mathematical concepts and theories including the use of the logical connective implies,
the set of, and the AND conjunction were discussed. Frequency distribution is a statistical
analysis to determine the likelihood each letter in a specific languages alphabet occurs
during passages. For example E is the most frequently occurring letter in a passage or
message wrote in English. We closed with a description of sessions, stream ciphers and
several critical characteristics of information.
Key Terms:
Cryptology: The scientific study of cryptography and cryptanalysis

Cryptography: The scientific study of coding and decoding message to protect data.
Classical Cryptographic Ciphers: Secret writing, a process of enciphering and
deciphering messages to and from an unreadable form or code called a cipher.
Modern Cryptographic Ciphers: Modern definition computer generated encryption and
decryption of information stored on electronic storage media, or transmitted over a
computerized networks.
Encryption: Another term used to describe a modern cipher.
Cryptogram: A message written in a code
Anagram: Letters from a word, phrase, sentence or name that have been rearranging to
form an entirely new word, phrase, sentence or name.
Cryptanalysis: The discipline of solving cryptograms and cryptographic systems or the art
of devising methods used to decode ciphered messages utilized in the field of
cryptanalysis.
Cryptanalyst: A person utilizing scientific methodologies skilled in the art of code
breaking. They are also called a decoder or code breaker.
Cryptographic Systems: Computer systems having the specific purpose of using
mathematical algorithms to code and decode message transmitted or stored electronically.
Cipher: In cryptography, ciphers are the way used to change a messages readable state to
conceal its true meaning. Used to code it making it unreadable to others without the key or
knowledge of how to decode the true message from the text provided.
Ciphertext: The content of the enciphered message or code generated from plain text
message by applying a cipher used to encrypt it into an unreadable form.
Plaintext: Information without encryption in its original intelligible/readable form.
Encoding: The process of coding plaintext into ciphertext. This is also known as coding,
encrypting or enciphering.
Decoding: The process of decoding ciphertext back into plaintext, known as decrypting,
deciphering
Encipher: The process of using ciphers to code plaintext into ciphertext. Also known as
coding, encoding, encrypting or encryption
Decipher: Deciphering is the process of retrieving plaintext from ciphertext. Also known
as decoding, decrypting or decryption
Encryption: In modern cryptography, employing computerized technology to the process
of converting plaintext into an unreadable form known a ciphertext.
Decryption: In modern cryptography, employing computerized technology to the process
of converting ciphertext into intelligible plaintext.
Malware: Malware is the general category that malicious computer programs or apps such
as Viruses, Worms, Trojan Horses, Spyware, Adware, and other Potentially Unwanted

Programs belong to.


Key: A variable that when added to an algorithmic cipher allows for the coding and or
decoding of messages.
Keyspace: The possible number of permutations each modular set used in an algorithm
can achieve is referred to as the ciphers keyspace. For English this is expressed as (26!-1)
when simple substitution ciphers are used.
Symmetric Cryptography: Cryptographic ciphers that use only one key known as a secret
key to both code and decode messages
Symmetric ciphers: These ciphers have only one key used to encipher and decipher
messages. See the definition for Symmetric Cryptography for a more in-depth look at how
these ciphers work.
Secret Key: In symmetric cryptography, the cipher uses only one key. This key is known
as the Secret Key. The Secret key is used to code and decode messages.
Frequency Analysis: The process of using statistics to mathematically analyze the
frequency distribution of each individual character used in a language, to determine the
likely identification of specific characters in a given ciphertext.
Asymmetric Cryptography: Cryptographic ciphers that uses two keys, one to code and the
other to decode a message
Modulation (modular arithmetic): A number set system used in math to limit the possible
number of slots or positions that can be used to tally the result of specific algorithms.
Discrete Mathematics: A mathematical discipline using math to solve logic problems
comprising of both Propositional Calculus and Propositional Algebra
Public Key Cryptography: A type of asymmetric cryptography, public key cryptography
uses two keys known as Public Key and Private Key to code and decode message..
Public Key: In Public Key Cryptography, the Public Key is used to code or encrypt a
message.
Private Key: In Public Key Cryptography, the Private Key is used to decode or decrypt a
message.
Critical Characteristics of Information: Information, broken down into its elemental
characteristics. Several important characteristics include Confidentiality, Integrity,
Availability, Authorization, Authentication and Nonrepudiation
Session: Temporary access privileges created while logged into secure websites.
Stream Ciphers: Cryptographic ciphers that create keys by encoding each binary bit of
plaintext one at a time.
Block Ciphers: Cryptographic ciphers that create keys by encoding groups of bits called
blocks at once.

Chapter 2: Classical Ciphers


In this chapter we will discuss Classical ciphers, as learning about them provides a good
understanding of exactly how cryptography works to keep messages confidential even
today. Among the easiest types of ciphers in cryptology is the class known as substitution
or shift ciphers. The Substitution cipher as weve already seen in the previous chapter is a
very simple way to code a message. As previously demonstrated with the ROT1 cipher,
they substitute each character in a plaintext message for another within the alphabet. This
will code the message making it unreadable unless you are aware of the procedure used to
decode it.

2.1 Substitution Ciphers:


Lets look at the very simple and easy to use substitution class of ciphers. There is no
single substitution cipher but rather a collection of a great many variations. In all cases of
substitution ciphers, the idea is to swap each letter in your plaintext with another. The
newly chosen letter would then become the ciphertext letter for that character within your
message. Remember the ROT1 cipher we learned about in chapter 1. We coded the
plaintext by shifting exactly 1 character to the right. As became Bs and so on. The B in
this case is the ciphertext we used every time an A appeared within the message. All
substitution ciphers are based on methods that simply replace one thing with another to
encode the ciphertext. However, once you know the system used, it is relatively easy to
simple reverse the process to obtain the decoded plaintext. We will now look at several
example of substitution ciphers in more depth.

2.2 Caesar Cipher (Shift Cipher):


Perhaps the most well known of all the substitution ciphers and one of the earliest ciphers
successfully used for governmental communications is known as the Caesar Cipher. The
Caesar Cipher named after Julius Caesar who used it to keep sensitive information private,
and often referred to as Julius Caesar Cipher or Shift Cipher, is an excellent example to
begin with. His method of coding messages used a shift in the alphabet. For ever instance
a letter would appear in his plaintext message, he counted over 3 characters to the right
and used that new letter as his ciphertext character.
The Math:
As almost all Ciphers can be expressed as mathematical algorithms. In creating an
algorithm for this type of simple substitution cipher, we need to convert the letters for use
with the algorithm. Do so by converting each letter into its numerical equivalent. I will use
the discrete logical connective operator of implies to do this, although you could also
simple use equals instead.
A0, B1, C2, D3, E4, F5, G6, H7, I8, J9, K10, L11, M12,
N13, O14, P15, Q16, R17, S18, T19, U20, V21, W22, X23,
Y24, Z25
In the algorithm below, the e(x) is the function to convert plaintext into ciphertext while
d(y) is the function to convert ciphertext back into plaintext where X is the position of the
plaintext character, and Y is the position of the ciphertext character. The variable K is used
as the shift value. Since the English alphabet has 26 possible character letters, (mod 26)
confines the mathematical operations to fall within this limited number set of character
slots.
The Caesar Cipher is expressed below with a variable (k) shift value of 3.
Encrypt: e(x) = (x+k)(mod 26)
Decrypt: d(y) = (y-k)(mod 26)
If I lost you, youre probably not alone! Breaking it down more simplistically, take the
following sentence.
SEND TROOPS TO THE BYZANTINE EMPIRE.
Using the encrypt function above to code the message using the Caesar Cipher, every S
becomes V, every E to H, every R to U and so on until the entire message is
encoded to resemble the following.
VHQG WURRSV WR WKH EBCDQWLQH HPSLUH.
To decode Caesar Ciphertext, apply the decrypt function above. Simplistically speaking,
merely count three characters to the left within the alphabet. Applying the decrypt
function, the V returns to the plaintext letter S. Just keep applying this decrypt
function to each character in the ciphertext to decode the entire message back into its
original plaintext version.

For those who prefer a more visual layperson illustration, see the below depiction.

As you can see it looks very much like the old cardboard decoder rings found in cereal
boxes during the 20th century and still occasionally today. Thats because those decoder
rings were based on a system used by the shift cipher. For those unfamiliar with the
decoder rings as presented here allow me to explain. Notice there are two separate rings,
an outer ring and an inner ring. With these rings, the inside track moved or rotated while
the outer ring stayed fixed. The concept was to move (usually in a counterclockwise
manner) the inner ring to the desired rotation aligned with the outer ring. The outer ring
would represent the characters as they appear in your plaintext message, while the inner
ring would provide the cipher character used in your ciphertext message. These decoder or
cipher rings were also in the form of actual rings worn on the hand. It should also be
noted, that some cipher ring layers of decoder rings were not actual alphabetical letters,
but instead shapes, hieroglyphic or hieratic depiction, as well as alphabetic letters from
other languages not the original language in which the original plaintext message was
written. However, in those cases the ciphers are not Shift but Transposition. In either
event, while not very secure by todays encryption standards, they are useful in decoding
encrypted messages found today in everything from TV shows, movies, comic books, and
even modern video games.
However like all substitution ciphers, while this system kept the content of Caesars
messages secret to only those who knew how to decode them, it uses symmetric
cryptography which employs a secret key. As discussed earlier, the secret key both codes
as well as decodes messages. Once a foe learned of this system, they could intercept
messages, read them, and forge fake ones encoded in Caesars Cipher method and pass
them off to Roman troops. As the orders would have been encoded in the correct method,
the false orders to lets say withdraw all forces from the Byzantine Empire would have
been believed to be genuinely authenticated. As such, the Roman forces would have
withdrawn from the Byzantine Empire leaving Byzantine vulnerable to attack.

2.3 ROT1 Cipher:


A message encrypted using the ROT1 Cipher shifted each character of plaintext forward
exactly one character in the alphabet to code it. However, as weve already seen reversing
this process can easily decode the ciphertext back into plaintext.
The Math:
The encrypt and decrypt functions for the ROT1 Cipher are expressed the same way
mathematically as with Caesar Cipher, only using a shift of 1 as variable (k) as illustrated
below.
Encrypt: e(x) = (x+k)(mod 26)
Decrypt: d(y) = (y-k)(mod 26)

2.4 ROT13 Cipher:


This is a shift cipher variant following the methods used in ROT1 and Caesar Cipher that
shifts each character of plaintext exactly 13 characters forward in the alphabet and uses
the new character as the ciphertext character. Following the typical Shift Cipher algorithm,
this cipher is expressed the same as with other shift ciphers only with a variable (k) shift
value of 13 instead of 1 as in ROT1 or 3 with Caesar Cipher.
The math:
Encrypt: e(x) = (x+k)(mod 26)
Decrypt: d(y) = (y-k)(mod 26)

2.5 Atbash Cipher:


The Atbash Cipher is a rather simple substitution cipher. It originally used the Hebrew
alphabet but was later converted to work with English as well as other languages as
needed. This ciphers use dates as far back as biblical time since it was used by Ancient
Israelite Rabbis to code sensitive documents. The key of this cipher was to reverse to
order of the alphabet. Therefore in English, instead of the letter sequence being AZ the
order would be ZA. Within the plaintext message, all As would become Zs, Bs to Ys
and so on.
The Math:
For those who prefer a more traditional algorithmic expression for an encrypt function,
one is provided below. Where the asterisk (*) is used for multiplication, notice how the
expression differs from those used for simple shift ciphers. Also, note most people use an
Affine system to decode Atbash. However, I chose not to use Affine. Instead, I devised the
following expressions where X is the numerical value for each letter of plaintext while Y
is the value for each encoded ciphertext. Note, the system Ive devised for Atbash works
by setting Z as 0 as shown below.
A 1, B2, C3, D4, E5, F6, G7, H8, I9, J10, K11, L12, M13,
N14, O15, P16, Q17, R18, S19, T20, U21, V22, W23, X24,
Y25, Z0
Encrypt: e(x) = (x-(x*2) +1)(mod 26)
Decrypt: d(y) = (y-(y*2) +1)(mod 26)
While the above are more traditional expressions, mathematically this can be more
simplistically expressed Discretely by, A Z, BY, CX, DW, EV, FU, GT,
HS, IR, JQ, KP, LO, MN, NM, OL, PK, QJ, RI, SH, TG,
UF, VE, WD, XC, YB, ZA
By using Discrete Mathematics, one can easily decode Abash ciphertext simply by
reversing the operation of the logical connectives above. Once completed, the message
will return to its original plaintext form. However, looking at the Discrete Math
expressions, we see the easiest way to decode Atbash is simply to reapply the exact same
key used to create the ciphertext. Notice in the traditional expressions, while I provide a
separate decrypt function for Atbash, it actually performs the exact same operation as the
encrypt function.
Lets take a look at what I mean in an example. After applying the Encrypt function to
plaintext we get the following.
Ciphertext: WVXLWVW
Merely reapplying the original cipher key in the same exact way used to encrypt this
ciphertext, will successfully decode it back into the plaintext message of DECODED.
Most algorithms for substitution ciphers work in one direction to code, and are reversed to
decode. However, whether it is Discretely expressed or represented by a more tradition

mathematical expression similar to what Ive provided, Atbash is one of a few ciphers
whose key works exactly the same regardless of whether applying it to plaintext or
ciphertext. While math is confusing for some, this proves that even with math, its best not
to over think the problem.

2.6 Transposition Ciphers:


The transposition ciphers have a key that rearranges the order of each character of
plaintext. Where transposition ciphers differ from shift ciphers, is that there is not one
mathematical expression that can be applied to all or the majority of transposition ciphers.
Some of the many thousands of possible types of transposition ciphers write entire
sentences and or paragraphs in reverse order. As used before with the ROT1 in chapter 1.
I WENT TO THE STORE.
Using a sentence reversal transposition cipher, the ciphertext would appear as thus.
EROTSEHTOTTNEWI
Other transposition ciphers rearrange the letters within each word. Of these types some
merely reverse the words as they appear in the sentence. So the store example above
would read like this.
ITNEWOTEHTEROTS
The next types of Transposition Ciphers discussed are commonly called anagrams. Simply
rearrange the letters as they appear in a word, phrase or sentence using only the number of
each character as they appear. You must use all characters from the original, without
exceeding or limiting the number each occurs. Following this system, the sentence I
WENT TO THE STORE has exactly one I, one W, three Es, one N four Ts,
two Os, one H, one S and one letter R. This system of rearranging letters to form
a new word, phrase, sentence or name is a popular way many villainous characters in
movies, books, comics, and stories create their code names. My example will show the
same sentence used in the above systems. In doing so, the sentence I WENT TO THE
STORE could become THESE WRITTEN TOO or TIES TO THERETOWN.
Another example of a transposition cipher works by pairing. Take a word, sentence or
phrase and pair every 2 characters together, then swap their positions. In other words pair
every two letters of plaintext together and then swap their position. Lets take the phrase
secret code and apply this cipher to it. This is illustrated in the example provided below
with plaintext at the top and ciphertext underneath.

The last example of a transposition cipher I will discuss is a columnar transposition cipher.
I will explain with the accompanying illustration below.

Write a sentence in a rectangular pattern similar to what is depicted at the top of the
accompanying illustration above. Now imagine there are five distinct vertical columns of
plaintext. In the example provided, from top to bottom they would be read as ITS WOT
ETO NHR TEE. The columnar transposition cipher works by rearrange the order of the
columns. Look at the bottom of the illustration to see the ciphertext. If you look closely,
you can discern the key. There are five columns, and each old numbered column was
moved from their original order exactly one to the right.
Since the last column was an odd number, it simply moved to the front of the columnar
structure. This examples key was to adjust each odd column exactly 1 column to the right.
However, there are many possible keys that could have been used instead. Some include
rearranging the even columns, swapping the order of paired columns, inverting the order
from top to bottom of each column, or changing the order of characters that appear in
every other column to name but a few. While transposition ciphers do encrypt messages in
code structures hard for some to comprehend, with practice an amateur
decoder/cryptanalyst can figure them out with a little effort and patience

2.7 Morse Code:


Morse code is the original method of communication through an electronic device over
long distances using a wire, known as the telegraph. Although telegrams are no longer in
use, this system was adapted for wireless communications via radio waves used by
aviators, maritimers, ham radio operators, and military personnel around the world for
decades. The system coverts every letter and number into short tones (dots) and long tones
(dashes.) By tapping on a physical key in a very precise way this took the form of a
ciphered message. While many people consider Morse Code as something transmitted
over radio waves using audible sounds, it can be written and conveyed visually. Morse
Code was a transmission medium created during the 1800s not entirely to hide messages,
but rather to transmit a message without words using electric pulses, lights, and sounds.
However, to anyone unfamiliar with the code, it essentially encrypted the message to the
extent that a substitution cipher does. This is why Morse Code is considered a substitution
cipher and takes its place among classical ciphers today. In the 20th century it was used by
various Armed Forces around the world up until the 1990s. It is still used by some
Amateur Radio Operators today and by the US Military Auxiliary Radio System (MARS.)
While the US Navy/Marine Corps MARS program was decommissioned in 2015, the US
Army and Air Force MARS programs are still very much alive at the time of this writing.
Due to the way some devices work, some illustrated Cipher Keys need to start on a new
page as is the case with the Cipher Key for Morse Code below.

The illustration above shows how this code worked. In this illustration you can see each
letter of the International English alphabet has a series of dots and dashes next to it. If
spoken allowed the dots are pronounced as dit, and the dashes as dah which is similar to
the audible sound created using the key when tapping the code during radio transmission.
Using light, a quick flash is used for

dit, while a longer flash is used for dah. Try to decode the following message.
Using the Morse code key shown previously, we can convert the coded message above to
the phrase Peace be with you. While this phrase has religious significance, in the state of
the world today, it should be taken as a general statement of concern for all people and
hopes that their future will be one filled with peace and prosperity.

2.8 Fractionated Morse Cipher:


This system converted a plaintext message to Morse Code. It then applied a cipher key to
the Morse Code characters and converted the newly created cipher code to an
alphanumeric character created using a system resembling something similar to the
columnar table as seen earlier in Transposition Ciphers.

In the partial table above, you see the letter S represented with 3 dits corresponds to A in
the table above. The xs represent a place holder for no More Code symbol used. Since not
every letter of More Code is represented by at least three symbols as in E which is just one
dit, this allows ciphertext for such letters to be possible. Now, if our message was
DECODED and we wanted to encode it with this system, the resulting ciphertext would
be OHEHCOHO when applying it to the table above. This is the way Fractionated
Morse Code worked to encrypt messages. This means, the letter A seen in the ciphertext is
not equate to the plaintext character A in the original plaintext message.

2.9 Book Ciphers:


Book Ciphers include a variety and can often be found in games, novels, and movies
today. The Allendorf Book Cipher was used in the movie National Treasure. In this case,
the key was in Silence. Meaning that the 3 digits keys which were fictitiously written in
invisible ink on the back of the Declaration of Independence. They pointed to a specific
page, line, and letter on that line within the series of Silence Dogood letters written in
1722. Other book ciphers use keys that list passages within a specific book. Some of them
take the first letter of each passage. In these cases, once the correct book, letters or
documents have been identified the code is used to find the original plaintext characters.
Although there are many types of book ciphers, one specific type I will discuss here are
the Beale Ciphers. It is suggested that Beale encrypted several messages detailing the
location of a sizable treasure cache. One of these messages is said to have been decrypted
and gave a description of the treasure. The others said to detail the location and exactly
who the treasure belonged or belongs to have yet to be deciphered. While you may not
believe this, the item needed to decrypt the description of the treasure was in fact the US
Declaration of Independence. It is likely the writers of National Treasure based the stories
plot partly on this fact. Although, I stress it was not written on the back with invisible ink.
Instead, used the first letter of specific words the key pointed to in order to reconstruct the
plaintext message Beale encoded.
While one could attempt to devise mathematical expressions for different book ciphers, in
my opinion it would prove to have little benefit. The variables involved concerning the
number of pages, lines, words, characters per word and per line changes dramatically from
one book, document, letter or text to another. In my belief, the cryptanalysts efforts would
be better spent focusing on determining the specific type of book cipher used, deciphering
the key, locating the specific book, letter, or document needed and applying it successfully.

2.10 Masonic Cipher (Pigpen Cipher):

This next classical cipher is quite commonly used in almost anything that has a Masonic
theme. That is because the Masonic Cipher or Pigpen Cipher is the code that was used by
Freemasons around the 1800s to code their messages, various texts, documents and
records to keep them confidential. It is a class of substitution cipher that works with
geometric symbols within a grid system rather then the methods other substitution ciphers
employ as previously discussed earlier in this chapter. The illustration above depicts this
system. Notice how the alphabet layout is used in this cipher. It is broken into a grid
system with lines and dots separating each character of the alphabet. Please note the
different shapes with and without dots that the grid makes next to each letter. Simplifying
it should help readers better understand what they are looking at. First, take a look at the
following ciphertext shown below.

Now, match the shape of each character of ciphertext to the grid system as shown above.
Doing so we see the first character which looks like an L with a dot corresponds to the
letter F, the second with A, etcWith this understanding the decoded plaintext becomes
the word FAITH. As expressed earlier with the example used for Morse Code, while faith
is generally associated with religion, it can also be applied to almost anything one
completely believes in such as science. However, I will point out that since scientific
experimentation returns tangible results to prove or disprove a hypothesis, it is not true
faith. True faith is believing in something greater then ones-self even when no tangible
proof exists. Whether that faith is in GOD, in individuals we hold with greater importance
than ourselves or both is up to each of us to decide for ourselves. I should also point out
that there are several different variations of this Cipher. Most of them are based on a
similar grid system. However, which letters are placed where can differ from variant to
variant. Using the letter T to illustrate this, T could be where it currently is, or in Us
slots, and most wearable novelty Masonic/Pigpen decoder rings, typically have T in Ns

slot in the illustration above. Other versions change the exact position the dots are located
within the gird, change the dots to another geometric shape or add double lines with one
more bold then the other to outline the shapes, and yet others do not use the X grid
structure but instead the 3x3 checkerboard with a 45 degree tilt. So you see there are many
different possible variations. Only one was provided here to illustrate the concept behind
the Masonic systems used for creating ciphertext.

2.11 Monoalphabetic Ciphers:


The monoalphabetic cipher is merely a simple substitution cipher. Most of the substitution
ciphers weve discussed thus far are examples of monoalphabetic ciphers. It replaces each
character within the plaintext message with a single ciphertext character for every
occurrence of that plaintext letter.

2.12 Polyalphabetic Cipher:


Since the majority of substitution ciphers only use a single ciphertext character to replace
each plaintext character, these ciphers are generally fairly easy to break. In these cases, the
cryptanalyst could utilize a frequency distribution analysis attack method to easily
decipher the ciphertext back into its plaintext form. Polyalphabetic Ciphers were one
answer to combat the frequency analysis attack method. Instead of replacing each
plaintext character with a single ciphertext character, the key could use two or more
possible ciphertext characters to encode each character of plaintext. Think of the
illustration shown for Caesar Cipher with the two tracked wheel. The inner track was used
for the ciphertext, while the outer for the plaintext. Imagine if the wheel had not just one
but two or more inner tracks, each with its own alphabet. It was not uncommon to mix
alphabets from different languages when utilizing Polyalphabetic keys. In this case, you
would code some of the message with one inner track and other parts with one or more of
the additional inner tracks. While this system was one of the first used to combat
frequency analysis attacks, it was still partially vulnerable to them.

2.13 Homophonic Ciphers:


This class of cipher is a substitution variant. It works by encrypting plaintext as weve
already seen in other substitution ciphers. Like the Polyalphabetic Cipher, the
Homophonic cipher enciphers plaintext into one of several possible ciphertext characters
instead of just one. What make it different is that Polyalphabetic ciphers were still
partially vulnerable to frequency distribution analysis attacks. Homophonic Ciphers use
techniques to equalize the frequency of ciphertext characters. This was one of many
techniques used by the Zodiac Killer in the now infamous cryptograms he wrote to the
media. In the case of those letters, mostly symbols were used for the ciphertext with a few
readable letters. However, in the unsolved letters, visible letters within the symbols of the
ciphertext should not necessarily be assumed to be intentionally uncoded plaintext.

2.14 Vigenre Cipher:


This cipher was another attempt to combat the frequency probability attack method. While
it is a substitution cipher, instead of using just one character for each character of
plaintext, it resulted in a number of potential possibilities. The way this cipher works is by
using the tabulus rectus cipher such as the one Ive provided below, and applying a key to
it to encipher your message. The key in this case is usually a word or phrase. The top row
(row 1) is in alphabetical order from left to right. From left to right you start with the first
letter of your key word or phrase and locate it on the top row. Now take a look at the left
most column (column 1) which is in alphabetical order from top to bottom. One at a time,
for each character of plaintext within the message you wish to code, find it along the left
column. Think of what you are about to do like a coordinate system similar to longitude
and latitude. Find the place in the tabulus rectus table where the first letter of you plaintext
message and the first letter of your key intersect. Once located, that will be your first
ciphertext character used in your coded ciphertext message.
For example, if hello world is the key and your plaintext message read as follows.
I need you to pick up package X.
You start by finding H in row 1, and I in column 1. Now locate the place where they
intersect and you get the letter P which is used as your ciphertext. For the second letter
in your message use the second letter in the key. Doing so, we get a ciphertext character of
R for our second ciphertext character. For those who keep doing this for each character
and you will soon notice that youve just run out of letters in the key to continue coding
leaving your message. Some of you

might say, my message is now only partially coded and I cannot continue so what was the

point in going this far. To you, I say dont jump to conclusions so quickly. Your current
ciphertext should read PRPPRUCLER. Every time you get to the end of the key, just
start from the beginning and continue coding until youve finished coding you ciphertext
message which should read PRPPRUCLERWMNVILDRNNHKPI.

2.15 Gronfeld Cipher:


The Gronfeld cipher is a variation of the Vigenre cipher. They are practically identical
with the exception of using numbers as the key. This is shown below. Instead of letters as
the characters in the left most column of tabulus rectus cipher table, numbers appear from
top to bottom. Also note that Gronfelds tabulus rectus table is not as lengthy due to the
general numerical key sequence only being within the range of 0-9. Lets now break the
table into X and Y axis shaded in black with white text in the provided illustration. In this
instance, the key is a number string and thus represented by the y axis in the tabulus rectus
table below. Lets code a message with this cipher system. Say we have a key which is the
number string 94721. Using this cipher method, we would order each character of our
plaintext message with this string starting with the first letter being matched with 9, the
second 4, third 7, etc Once we run out of numbers, start from 9 again and keep ordering
the plaintext characters in this way until the entire message is sequenced properly. Now,
lets say our plaintext message is the following sentence. Take me to your leader! To
complete the ciphertext process, match T along the top with 9 along the side, find the
location where they intersect and we see the ciphertext we should use for T which is the
letter C. Continuing on like this the completed ciphertext would read as thus. Plaintext:
take me to your leader
Key applied: 9472 19 47 2194 721947
Ciphertext: CERG NN XV APDV SGBMIY

2.16 Polybius Square:


This is another example of substitution cipher using a tabulus rectus variation. It is very
similar to the Vigenre Cipher but limits possible ciphertext characters even further then
Gronfeld. However, it utilizes two strings of number unlike Gronfeld that only used one. A
version of a key table for the Polybius Square is provided below. Note that the Polybius
Square was in a 5 by 5 grid. As such only 25 possible characters are present. Since there
was no J in Latin and I can easily be used instead, we will use I for letters I and J within
our plaintext message.

Using this system we match up our plaintext to the letters within the grid. Once located,
the ciphertext would become the numbers to the left and along the top in that order. The
letter Y encodes to 35 and C to 42. Using this method the plaintext Cryptography
becomes the following ciphertext:42 33 35 13 53 51 43 33 11 13 21 35

2.17 Rail Fence Cipher:


This is a simple transposition cipher cryptosystem. Simply write your message in a
diagonal formation within two or more row to encipher your message. The following is an
example of this.

Chapter Summary:
Classical Ciphers as a category were defined in the 1950s as all cryptographic ciphers that
existed prior to World War 2. These included the most common form of cipher known as
the substitution cipher. As discussed earlier, these cipher take a single character of
plaintext and encrypt it with a single ciphertext character. Simply stated this means that for
every t in plaintext replace it with another character. Therefore, for every t use a w
in its place as the ciphertext character. Some of the many types of substitution ciphers
discussed in this chapter include the Caesar Cipher also known as Shift Cipher, ROT1 and
ROT 13, Atbash, and a variety of Transposition Ciphers. Other classical ciphers discussed
comprise Book Ciphers, Morse Code and Fractionated Morse Code, Monoalphabetic,
Polyalphabetic, Homophonic, Vigenre, Gronfeld, and the Masonic Pigpen Cipher.
Discussed with each was how each are used to code and decode ciphertext to
communicate messages secretly between two or more parties. The reader should now
possess a good understanding of several cryptographic ciphers and how they work to
protect information that parties wish to securely or secretly share with one another.

Chapter 3: Cryptography encountered today


Why do I need to know about cryptography?:
Now that the really boring stuff is out of the way, we can proceed. Everyone today should
have at least a basic understanding of cryptography. Cryptography is far more prevalent
today then many are aware of. In todays world, everyone is a potential victim of having
some form of their information stolen. Lets start with our personal computers. Computers
have hard drives, which are the main storage devices that hold the bulk of our documents,
files and information we use on a daily basis. Anytime we connect to an external network
such as the internet, we are all potential victims and are vulnerable to having our
information stolen or compromised. Many people may think yeah OK, that will never
happen to me, or Im not important enough to be targeted in this way, or I dont do
anything where I need to worry about securing information. This is a common
misconception! While I do agree the average person does not need to encrypt their entire
hard drives, it is something to consider for those involved in ground breaking R&D
(Research and Development) or when handling sensitive or classified materials. In these
cases, the information you want to keep confidential (at least until it has been deemed
appropriate to release it) is vulnerable to attack from a hacker, or via espionage efforts
ranging from personal rivals, corporate competitors, to state sanctioned intelligence
operations. In these cases, encrypting entire hard drives should be considered as a possible
option to secure the information they contain. However, Cryptography is not the first line
of defense from attackers. Cybersecurity utilizes various access controls for protect data.
Some of these include Hardware Firewalls, Software Firewalls, Disconnect Switches,
Anti-Malware Software, Backup Plans, Intrusion Detection and Prevention Systems,
Network Account and Authorization Restrictions to name a few. When all other access
controls have failed to prevent unauthorized access, this is when Cryptography becomes
invaluable. As a result Cryptography is often considered the last line of defense when
securing information. The main exception to this is when transmitting information over
the internet. In this case, Cryptography via computerized encryption is the only defense
available to ensure the information being sent and received remains confidential. As
previously mentioned, Malware is another concern and potential threat to information
security, making information vulnerable. Furthermore in cases involving sensitive
information, other security measures should also be taken. These could include employing
additional security measures to limit access to sensitive information internally, and or
restrict remote access from external networks. When dealing with sensitive information,
one should also consider the possibility of completely isolating the system to simply
remove any possibility of remote external access to the systems containing sensitive
information to best protect the information residing within. While this situation does not
pertain to every single person, further examples will. These examples are discussed below.
Several areas the average person utilizes cryptography include the following. When you
sign into your bank or credit card accounts online, cryptography is used to protect you. Ecommerce is another big area cryptography plays a key role in. Whenever you make
purchases in Amazon, iTunes, Google Play, eBay or elsewhere online, cryptography is
there to protect you. When you swipe your chip verified credit cards, they employ

cryptography to protect you. Whenever you use Apple Pay, Samsung Pay, or similar apps
to purchase items, cryptography is used to protect your financial identity. When you store
your personal data, pictures, documents, etc in the cloud, cryptography is there to
protect your data. When your HIPAA protected health information (PHI) is sent online or
over computerized network, Public Key Infrastructure (PKI) encryption is used to protect
your confidential medical records, as well as your identity, and financial information.
Virtually any secure website uses encryption to protect not only you the consumer, but
also corporate assets. Businesses, Major Corporations and Governments use cryptography
to protect corporate assets, as well as confidential and highly sensitive information. When
people share personal data, pictures, documents, etc on social media sites, cryptography
is there to protect your data. Virtually any secure website you log into today employs
cryptography/encryption to protect electronic information. It use to be that you could
identify a secure website by looking for a little key or lock symbol that would appear in
your web browser. However, for a while that still appear now and then but usually did not
for a time. Instead, you looked for the URL (website address) in your browsers address
bar. If you saw HTTPS:// instead of HTTP:// then you knew that the site was a secure
website and did employ encryption to protect the information you send and receive from
that website. The modern TLS encryption standards discussed in Chapter 7 usually has
HTTPS when first loading the page, and once you log into the online account a lock
should appear to the left of the URL within the address bar. If a Key or Lock symbol does
not appear and there is no HTTPS:// at the start of the URL, than the site you are visiting
is most likely unsecure and does not ensure any information transferred is secure. Be wary
about transmitting personal information over the internet to unsecure websites.
Cryptography can be found being utilized in a great many things today. I will break them
down into the following categories commonly observed. Ciphers are woven into plots for
many Novels, Movies, and Television shows. Some examples of TV shows that have
depicted Ciphers include but are not limited to ABCs Alias, Disney Channels Gravity
Falls, TNTs Perception, PBSs Endeavour, and Foxs The following, Fringe, and Sleepy
Hollow. Several examples of movies with Ciphers include, Mercury Rising, National
Treasure, Windtalkers, The Da Vinci Code, Zodiac, U-571, Frozen, various Star Wars and
Star Trek episodes, and The Imitation Game. A few Novelist that have woven Ciphers into
their work include Terry Brennan, Dan Brown, Susan Page Davis, James Becker, Steve
Berry, and David Taylor.
Games: Amazon.coms Codes and Ciphers, a superpuzzle series for puzzle solvers or
those fascinated by puzzles or by solving difficult problems.
Ancient Egyptian Hieroglyphs are a common theme found in many popular movies and
video game series. While the glyph symbols are usually real Egyptian Hieroglyphs, when
found in Video games it is usually not actually the Ancient Egyptian written language, but
instead Ciphertext that can be directly converted into English. Game Designers sometimes
do this to allow the knowledgeable player to be able to read the text without actually
learning Egyptian Hieroglyphs. The ciphertext is often found sketched around wearable
novelty translator rings similar to the secret agent decoder rings of old. The ciphertext key
for this is explained with the accompanying translation in Chapter 4 Applications of

Cryptography.
The video game series Assassins Creed is one of the most popular game series to date.
Each edition attempts to immerse the player into another time where the only weapons
available consisted of the non-firearm variety. Within this game series were ciphers woven
into the stories plot. If you are familiar with the series, think of the ciphers used therein.
They closely resemble the masonic cipher system learned earlier in this book. In-fact it is
a variant of the masonic pigpen cipher the developer chose to weave into the games
storyline. Knowing this can allow the player to easily decode these secret messages
entirely on their own.
While some people can manage without, it is nearly impossible to exist today without a
Smartphone. Everywhere you look, heres someone on their phone. Their use no longer
consists of merely conversations with others, but texting, email, syncing all our multitudes
of social media accounts in a fruitless effort to stay up to date with all our friends activities
every moment of every day. It has gotten to the point for some that almost their entire
itinerary throughout the day concerns using their Smartphones. This means they contain
all our accounts, pictures, videos, texts, emails, web browsing histories, personalized
notes, and calendar of agendas planned for the upcoming future. While this is very
convenient, it posses a severe security risk. Smartphones have not had the same level of
focus by the security communities and developers as securing our personal computers
have had in the past few decades. Encryption is one area the security communities have
made good strides with when applying the technology to protect the data within our
Smartphones. Due to very poor firewall implementation and development for portable
electronic devices, encryption is the best line of defense currently available to us in order
to guard against hackers, identity thieves and other unauthorized individuals from stealing
the information within our Smartphones.
Information Technology has been a rapidly growing field for that past several decades.
Information Security was slower to develop, but now comprises of several specialized
disciplines within whats now called Cybersecurity. Cybersecurity is big business today. Its
implementation and use spans from ordinary citizens to corporate enterprises, strategic
military operations, or classified documents sent to a President, Prime Minister, King,
Emperor, Ambassador or Secretary of State as they all employ some form of cryptography
in the way of modern cryptosystems utilizing advanced cryptographic algorithms.
Virtual Private Networks or VPNs are another security measure that can be implemented
to help increase security. Enterprises, governments and others can predefine each location
their transmissions will follow throughout the transmissions route. These locations are
agreed upon by the parties and are considered as trusted locations. Once established, this
technology creates a virtual encrypted tunnel through the internet only using the agreed
upon trusted location along the route. This high level of protection attempts to ensure the
transmission cannot be intercepted by unauthorized entities. This technology is also used
when accessing information from sensitive networks remotely such as a Doctor accessing
patient information from hospital servers residing in NJ while on vacation abroad in Italy
while touring the city of Rome.

The US Military as well as other Military Forces worldwide utilize encryption for secure
communications. It is of such importance to them, that they officially created specialized
cryptographer positions for this task. For example, the US Navy refers to the men and
women skilled in this field as Cryptographic Technicians. Whatever they are called in their
military branch or whosever military they are employed within; their tasks are essentially
the same. That task is to encrypt message sent, decrypt message received, and break
encrypted ciphers used by foes. Without them, the nations foes would be able to intercept
all military communications. As surprise is often a tactical advantage, this would put
strategic plans in jeopardy, and put the men and women within our troop deployments,
especially those participating in active tactical operations in the gravest of risk. There are
many positions and personnel within the armed forces that receive little recognition. I
recognize these intellectually skilled individuals and thank them for their service. Their
efforts protect the lives of others as well as the lives of men and women they continue to
serve alongside.
Chapter Summary:
In this chapter we highlighted some things everyone should know about cryptography.
These technologies are implemented in all kinds of things most people do every day. From
surfing the web, access secure websites, to e-commerce, securing patient health
information, accessing sensitive or confidential information from work related networks
remotely while at home or on vacation abroad, and several scenarios where encryption
could protect information and ensure it remains privacy and inaccessible to unauthorized
individuals or entities.

Chapter 4: Applications of Cryptography

4.1 Investigative Applications:


Cryptography is frequently encountered in cases by those employed within criminal
investigation as well as various national security related investigative fields, intelligence
communities, enterprise security, banking industry, fraud and abuse, as well as private
investigation. The following examples are scenarios that show just how cryptography and
cryptanalysis can aid investigative services today.
Homicide Investigation:
Detective Adams works in the Hollywood Homicide Unit of the LAPD. She is called out
to the residence of a well known Agent for up and coming actors and actresses. Inside she
is briefed by first responders, and begins to interview the suspect. The back story.
Detective Adams is investigating several murders where a series of young women turn up
dead after being reported as disappearing from a popular LA Night Club they attended
with friends. Through surveillance cameras, witness statements and hard work, they
narrow in on a suspect. While they do not have enough evidence for an arrest warrant,
they acquired enough evidence to have the probable cause needed to issue a search
warrant for the residence of the only man that was discovered to be connected to the
disappearance of all 3 brutally beaten young women. After a thorough search, the crime
scene techs and detectives were able to determine the only item that could potentially have
evidence on it was an encrypted laptop computer. The investigators warrant was only for
physical searches, and did not include possible electronic evidence. However, given the
nature of the brutal murders, Detective Adams contacts the presiding Judge. She was able
to talk Judge Blake into agreeing to immediately issue another warrant for possible
electronic evidence. Now with warrant in hand they attempt to break the encryption on the
laptop. It should go without dispute that the absolute easiest way to break encryption is to
ask the suspect for the key. While many will obviously not cooperate with the request, you
may be surprised that it actually works from time to time. This will same valuable time
and expense otherwise needed to crack the encryption key. It should be noted that while
the investigating authorities can request the pass key to unlock the laptops encrypted files,
they cannot force the suspect to provide the pass key. However, they can request the
suspect provide them with an unencrypted version of the data within the laptops hard
drive.
Ritualistic Crime Investigation:
Deputy Greggor is a law enforcement veteran with 15 years of experience, working for a
small county Sheriffs Office in rural Maine. He has always enjoyed his work, and his
view is that nothing bad ever happened in his county. Until now that is! After reporting in,
getting briefed, and doing his normal daily checks for equipment and vehicle drivability,
he starts the morning as any other in his law enforcement career, by driving to 5th Street to
listen to Ms. Gymbols normal banter complaining about her neighbors dog barking.
However, before he steps out of his patrol car, the distressed voice of an urgent dispatcher
catches his ear. After answering, he is informed of a situation that requires his immediate
attention up at the old abandoned manner. When attempting to gain further information

from dispatch, he is simply informed that its best not to say over an open channel. Since
he has never had to deal with anything other then complaints and traffic tickets, Greggor
was intrigued and nervous all at the same time. When arriving at the manner, the Deputy
sees the Sheriff and several mischievous teenagers gathered around the front of the
decrepit old structure. After the Deputy follows the Sheriff inside, hes informed the case
started with the teens outside trespassing on restricted property. While exploring the
immense condemned derelicts crumbling dilapidated lower levels, the teens made a
startling discover in the adjacent room. Once he enters the room, the Deputy is met by the
most gruesome scene in his entire career. Inside were the bodies of three slain people. The
corpses were mutilated and eviscerated. Strange markings adorn the room leaving an even
greater sense of dread and tormented angst for what the victims must have suffered
through before departing this mortal coil. Once Deputy Greggor regains some
resemblance of composure he recognizes a pattern to the strange symbols at the crime
scene. Believing the markings are some kind of code, he contacts the Bureau of Justice
Assistance an official US based organization that assists state and local law enforcement
in justice matters they are not currently equipped to handle on their own. They arrange for
Dr. Bull, a Cryptanalyst and Linguist specializing in ancient unusual languages and
ciphers, to assist in deciphering the strange markings.
Serial Killer Investigation:
For this example I thought it was best to use real world cases for illustration. The example
used is the most infamous unsolved serial killer case in modern US history which involved
ciphers, the Zodiac. Although, the Zodiac claimed to have killed many more victims,
authorities could only successfully link 8 known deaths and 2 surviving victims with the
Zodiac Killer. One of the things that made the Zodiac different from other serial killers is
that Zodiac sent letters to various newspapers demanding they publish the letter. Some of
the letters came with pieces of the victims clothing to prove the author of the letters was
likely the killer. Several of these letters were also accompanied by mysterious
cryptograms. Some of the cryptograms were separated into several pieces and sent to
separate newspapers. Only one of the 4 cryptograms sent by the Zodiac have been
authenticated as being successfully decoded. While many have claimed to have solved the
others most notably the 340 character cryptogram, none of them were authenticated as
their methodologies were flawed. The remaining 3 cryptograms remain unsolved to this
day. The Zodiac is by no means the only killer to leave cryptographic ciphers behind, or
sent to authorities via the media or directly to detectives. As such, cryptanalysis is an
important field that law enforcement should endeavor to acquire expertise in.
Archeology Investigation:

An archeologist is on a dig site approximately 320 kilometers north of Mexico City and
about 200 kilometers due east of the city of San Lois Potosi. They located an ancient tomb
of structural designs consistent with Aztec architecture that appears to have been used far
more recently then the structure dates back to. In it they find several old documents with
seemingly random numbers on them. Originally they thought they werent of any value or
importance, but then they discover an artifact resembling a five ringed wooding wheel
with an outer track and four inner tracks. At that moment, they recognize the artifact as an
old Mexican Army cipher wheel. The cipher wheel used by the army had the intelligible
alphabet on the outer track with numbers on all the inner tracks. They understood the
significance of the numbers on the documents at that moment. They were in-fact coded
ciphertext messages left behind by the Mexican Army long ago. After decoding them they
make an enormous discovery. That is these messages were coded during the Mexican
American War. This is a significant find as these cipher discs were only thought to exist
around 100 years ago. This new evidence if authenticated would prove the Mexican Army
used such ciphers much earlier then historians ever previously considered possible.
National Security:
In National Security Investigations, cipher can take on more then just computer generated
encryption. Take ISIS and other groups operating throughout the world. The regional
culture they claim to derive from has an extremely rich history with cryptography and
cryptanalysis. Many cryptographic ciphers have been used throughout those lands even
before Biblical time. A number of ancient languages have begun to reappear arising from
the annals of time for use in modern day. This is a good example of possible correlation
between cryptanalyst and linguists. What many dont understand is that while a good
cryptographer can also be skilled in cryptanalysis, they are not the same thing.
Cryptographers encrypt and decrypt using known keys with established known
cryptosystems. Cryptanalyst work without knowing the cipher key or coding system and
attempt to analyze the ciphertext for patterns, character frequencies, logical combinations,
potential grammar, frequently used words and other linguistic patterns to aid in the
decoding of the ciphertext. Some cryptanalyst are so skilled, they can interpret the
ciphertext as if it was a foreign language to be translated. This parallels with many of the
same skills that linguists use when attempting to learn a new language they have no
knowledge of and may have never encountered before. The latter is frequently seen in

linguistically skilled archeologist uncovering ancient language thousands of years old that
no living person has ever seen before. So you see Cryptanalysts and Linguists have a lot in
common in regards to the skills that they possess.

4.2 Applying what youve learned:


Since this is an ebook, everyone should have the ability to zoom to get a better look at the
symbols used within several of these exercises. You may need to do so in order to practice
what youve learned thus far. I recommend taking a photo with a camera and zooming in
to see the cipher keys if they are not large enough or do not appear on the same page as the
ciphertext provided for you to practice your new decoding skills.
DIY Exercise 1: Coding and decoding messages made easy:
For anyone who wishes to try to employ a little cryptography themselves with their own
documents or messages, you may be surprised to learn that as long as you have a modern
word processor it is much easier then you ever thought. MS Word, Open Office, Libre
Office, Pages as well as any other modern word processor can accomplish this for you
without any real effort on your part. Allow me to explain, and if youre in front of your
computer, feel free to follow along by doing it yourself. Open your word processor and
write a brief message. Now highlight or select your text and change the font to something
else. What did you just observe happen? The text within your message changed
appearance didnt it. If you look through some of your fonts, some may look like symbols
instead of readable letters. At this moment, some of you are going, oh yeah, I get it now.
You see what people think of a font type like Times New Roman, Calibri, Arial, etc. are
actually referred to as typefaces. A typeface is an organized uniform look that can be
applied to all printable characters which changes their appearance. You can easily find
absolutely free typefaces available online. Ancient Languages, Cuneiform, Runes, through
to fictional languages, from fantasy and sci-fi can be located and used. Find one that
looks like a code youd like to use and install it. If needed, use YouTube for step by step
instructions on how to install typefaces on your device. Once its installed, reopen your
saved message you wrote earlier. Select all to select the entire message and now change
the typeface to the one you just installed or use a currently installed typeface that looks
like symbols if present. I chose to install a new one. The one I chose below changed the
message I wrote in English into Klingon.
Plaintext: Klingon Word Processor Translation.

Once applied, your plaintext will instantly be coded into your ciphertext. To decode it, you
could learn to read it as is.. or, simple select all again, and change the font typeface back
to something like Calibri, Arial or Times New Rome and the word processor will
instantaneously decode it back into readable plaintext for you. This is the absolute easiest
way to utilize a simple substitution cipher today that can make even the beginner feel like
a cryptographer or cryptanalyst.

DIY Exercise 2: Disney Frozens / Tolkien Dwarf Rune Translator:


Currently, the easiest way to code and decode the Troll Magic Runes as seen in the Disney
movie Frozen, is to buy a wearable novelty Frozen Troll Magic Rune Translator Ring.
However, if one developed a typeface for this Rune language, coding and decoding it
would be as easy as shown with Klingon in the previous DIY Exercise 1. If you or your
kid is adventurous, take a look at the cipher key below the next paragraph.
Frozen Runes are actually a version of the Futhark Runes. While you may have better luck
finding a closer match, I recommend trying a Tolkien Dwarf Runes typeface as they are
the closest match I have found to Disneys Frozen Troll Magic Runes. While the following
is not a complete translation that this typeface is capable of, there is enough to illustrate
the similarities to the delight of children of all ages everywhere. Note everything is typed
as lowercase except the double letters which are one of the other letters capitalized.

Translate the following to reveal a statement and web address. Once you have the web
address, go there and search for the Tolkien Dwarf typeface. The author was gracious
enough to provide it free of charge.

A note of disclaimer that should be made is that I do not own or operate this free font
website. While Ive used this and other free font websites to acquire typefaces numerous
times without issue or incident, use caution as any site including reputable ones can be
infected with malware. Your best protection from malware is good anti-virus software.
Therefore, if you download this or other fonts, always scan them before installing. For
those wishing to install this typeface, the keyboard mapping is as follows. The symbols for
all regular letters are typed as lowercase. Three of the double letters are one of the others
capitalized. EE is typed as capital E, ST is capital S, TH is capital T, and EA is lowercase
q. Use a c and w together in your ciphertext to represent the letter Q in your plaintext. If
you are not concerned with being completely true to the language, then you may also just
use the EA symbol for the plaintext letter q, as q is what youll type for that symbol. In
this respect, if you choose not to use the double letter symbols, and instead just type your
message and change between font types, then you can easily highlight the Runes and

choose Times New Roman, Arial or something else, and your Word Processor will easily
convert the entire messages between the Runes to English and back again making things
even easier for kids to play around with this typeface. I chose this route when encoding the
previous ciphertext Runes. Those who liked the Lord of the Rings and or Hobbit movies
may likewise find this typeface interesting to use.
All encrypted ciphertext within exercises from chapters 4 and 5 with the exception of DIY
Exercises 5 and 6 (which are translated within the chapter) are translated/decoded within
an Answer sheet found at the end of this book. Please wait until you have attempted to
decode the ciphertext yourself and if possible wait until you have read the entire book
first.

Exercise 3: Simple Egyptian Cipher Translation for Video Games:

A video game series such as Tomb Raider, often has ancient languages or ciphers
intricately woven within its plot. Ancient Egyptian is an example of a language similar to
what we have come to expect from this series. Lets say, in an upcoming new edition to
the series players come across a tomb on the 50 kilometers from the outskirts of the Giza
Plato during Laras Adventures. Inside the tomb, is the following script.

Use your new found cryptographic skills and decode the script above.

Exercise 4: Star Trek Klingon Translator:

For any Trekkie or future Trekkie reading this, this exercise is in two parts. First, using the
translation key above, please decipher the following.
Ciphertext:

After successfully decoding the above command, attempt to code your own short message
within the Klingon language using the cipher key above. Since there may be some
confusion with the above key, I will explain the basics. The following characters use the
same symbol. They are as follows: (c or the letters ch together are represented as the same
symbol) ; (g or gh have the same symbol.) For practical purposes you may use the symbol
for character tlh for the letter z, ng for letter f, and capital Q for the letter k. This should
help to aid you in successfully translating the English, Spanish, Italian, French or other
language using a similar alphabetic structure into Klingon.

Exercise 5:(Archeology Case) British Archeologist Lady Val Ancient Cipher in Italy:
British archeologist Lady Val is called in by the Italian Government. While the
government was digging in a remote area of the countryside seeking to expand their
transportation infrastructure, workers unearthed a cavern 10 feet beneath the surface.
Inside were enormous chambers each with great numbers of Ancient Roman Artifacts of
tremendous value, and a piece of parchment. The parchment adorn with gold edging
possessed writing which seemed to be written using some type of cipher to encode its
content. The Italian government immediately establishes the site as an important
archeological dig site. Since Lady Val is on vacation in Venice, and considering that she is
recognized as the most respected Field Archeologist specializing in Ancient
Mediterranean Ciphers, the government calls her into the dig site. Once there, Lady Val
sees the following ciphertext written on a piece of parchment. Assume for this example
that Latin is translated as English.
The ciphertext as found on the Parchment reads:
WUHDVXUH KROG RI JDLXV MXOLXV FDHVDU
Assume the role of Lady Val and decrypt the message. First, while there are numerous
ciphers used by Ancient Mediterraneans, this is from Ancient Rome. Having learned an
Ancient Roman Cipher earlier in this book, proceed and decode the message. Considering
Lady Val is the most respected Archeologist specializing in Ancient Mediterranean
Ciphers, while assuming her role, use due diligence to live up to your reputation.
To help, here is the ciphertext again.
WUHDVXUH KROG RI JDLXV MXOLXV FDHVDU
Remember Caesar Cipher is a substitution cipher that used a key that shifted (counted)
three characters over to the right to code. So, to decode the message simply count thee
characters back to the left. W in that case becomes T. Now keep going until youve
decoded the rest.
Once Lady Val (you) finish decoding the message, it reads as thus:
Treasure hold of Gaius Julius Caesar

Exercise 6: Analyzing Evolving Cryptographic Systems for Flaws:


Trying to create a cryptosystem yourself is a complicated endeavor. It is not enough to
come up with an idea you must also test the idea to ensure it works error free. Take a look
at this example of an alternative way to encipher Morse Code similar to Fractionated
Morse Code that we will call 3 Block. After coded the plaintext into Morse Code, use 3
Block to pair every three Morse Code symbols into one. Meaning, the letter A seen in the
ciphertext is not equal to the plaintext character A in the original plaintext message. For
example, if the cipher combined the Morse Code symbols for letters A (dit dah) and E (dit)
together, then converted that to an alphanumeric character represented by (dit dah dit) in
Morse Code, the resulting ciphertext would be (dit dah dit) which converts to the
ciphertext letter R. While you could see the letter R, you should not confuse it with being
the decoded plaintext letter R from the original plaintext message. In this sense, 3 Block
resembles a block cipher.
Can you see the possible problems with this system? If the plaintext message started with
letters D, G, K, O, R, S, U, or W, than the first ciphertext character in the coded message
would correspond to its plaintext character as each one of these letters are represented by a
three symbol combination made from dits and or dahs. This means our block system only
completely encipher all characters from the second ciphertext character on when the
plaintext message starts with one of these letters. Having said this, note that a message
beginning with one of these ciphertext letters does not mean it is for example the plaintext
of D. The letter D is represented as (dah dit dit). However, a message starting with letter D
could as easily represent the letters N (dah dit) and E (dit). Now you see this cryptosystem
has not just one but two big problems. These issues would result in a possible uncoded
first character, and numerous errors when decoding as there would be multiple possible
versions of decode plaintext to look through not just one. The latter with multiple versions
to sort through can also occur when attempting to decode Fractionated Morse Code. Were
you able to follow this? If so, congratulations you are now starting to think like a
cryptographer. For those who say no such flaw exists with Fractionated Morse Code, I say
to you think about when there are no discernible spaces in the text. Due to this flaw there
are times when two or more passes would be needed to reveal the correctly deciphered
plaintext. Lets assume we just used a customized Fractionated Morse Code table for our
ciphertext below.
annnnnpntrpw
In decoding our custom version of Fractionated Morse Code we get the following string of
dots and dashes.

Let us now attempt to translate the above to the original plaintext.


Looking at it can you tell whether the first character is an A, B, D, 6, or T as all of these
are possibilities with the Morse Code characters presented within the string of dots and
dashes above. Now you can see that at least several passes would be needed in order to

successfully decode an intelligible version resembling plaintext.


Two possible passes for this string of dots and dashes are below.
6eeeesspsppp
thisiswhatimean
Obviously the second makes more sense and translates to this is what I mean. This
shows my statement concerning the problem that exists when using either our made up 3
Block Cipher or Fractionated Morse Code does exist. Due to the time it would take to
perform several to many passes to achieve something intelligible, this is not a viable
solution when involving time sensitive conditions.

Chapter 5: Cryptanalysis Code Breaking Tips


There are many different ways to break code. I will teach you some of them now. One of
the easiest tips I can give when attempting to break ciphertext is to look for patterns that
fit one of the following.
Letter Frequency distribution:
The following English letter frequency distribution shows the most common to the least
common letters typically appearing in messages, passages, essays, papers or books. Note,
due to each passage, etc. Having different words each with different letters, the
frequency distribution may differ from text to text but will follow similar patterns as the
one represented below.

As you can see, E is the most common letter that appears within the English Language.
If it is the case of a simple substitution cipher being used to create ciphertext, than the
letter or symbol that appears most often will likely be letter E more often then not. If the
ciphertext has spaces that in relation to the ciphertext appears to be separation of words,
than follow this method. Look for single letter words. They will likely be the letters A
or I within a sentence.
Word Frequency:
Two letter words:
Look for two letter words, which will likely be the words to, it, is, if, of, no,
on, in, am, as, at, my, us, up, do, we, me, he, by, go, be,
etc..
Three letter words:
Some of the most common three letter words are the, and, for, are, any, can,
boy, see, new, now, man, you, men, him, her, she, etc.

Four letter words:


Several common four letter words include this, that, with, have, will, from,
they, them, know, very, time, many, well, such, were, only, take,
been,girl, and good.
Commonly used words:
Some of the most common words in the English Language include a, and, as, an,
at, all, are, about, after, by, be, but, best, boy, been, between,
can, come could, close, cloths, children, cat, day, down, draw,
dawn, dog, each, even, every, everything, everyone, for, far, from,
found, fair, further, go, got, get, good, great,girl, give, general,
her, he, here, had, have, happen, happy, I, is, it,in, just, joy,
jail, justice, kind, kid, kill, killer, kindle, kitten, like, look, left,
long, large, length, lift, level, lady, my, man, men, more, many,
may, much, move, no, now, new, not, night, nothing, of, on, or,
out, one, open, put, push, pull, people, public, private, puppy, ran,
run, right, ring, rather, see, some, so, saw, said, sound, side sea,
she, the, to, this, that, there, these their, than, then, thing, today,
take, time, use, up, upon, very, we, went, who, what, where,
why, when, was, were, would, with, will, woman, women, well,
war, while, you, your, and yesterday are but a few examples.
Double letters:
Next, we should look for repeating ciphertext. This can be taken one of two ways. First,
look for ciphertext characters that double themselves back to back. These could be the
letters e, t, o, n, l, m, r, d, f, or s. These are the most likely doubled letters in English. The
second way to look for doubles is if you see the same pattern of characters appear multiple
times throughout the document. This likely indicates it is the same word, or the new word
has the exact same letters within it.
The first twelve (E, T, A, O, I, N, S, R, H, L, D, C) letters in the letter frequency
distribution presented earlier within this chapter, are found within the majority of words in
the English language. Therefore, it is statistically probable that each possible word should
contain at least one or more of these letters. Yes, there are outliers to this rule, but
statistically most words will likely have at least one or more of these twelve letters within
them.
Cipher recognition:
Before you even attempt any of the above, you should look to see if the ciphertext is in
letter, symbol or number form. If the ciphertext characters are letters, just shift the letters
to predetermined cipher keys. The Caesar cipher shifted three, ROT1 and ROT13 shifted 1
and 13 respectively. Next try and Atbash decode method as discussed earlier in chapter 2.
If there are symbols or numbers for ciphertext, you can still follow the frequency
distribution attack method to attempt to regain the original plaintext.

Look for spaces. If the ciphertext actually has spaces in it this makes things much easier. If
this is the case, look for words that start with the same paring of characters. For example
thorough, this, that, the as well as other possible words matching patterns such as th
as seen within these words. If you decode one of them, apply the same plaintext to all
remaining occurrences.
If no spaces are readily observed, follow one of these suggestions. Look for a character
that consistently appears at the end of ciphertext groups. If the pattern seems to be about
what you have come to except from a separation of words, than that is probably the space
enciphered as a ciphertext character. Sometimes there are no spaces in the ciphertext
because the ciphertext has been condensed meaning the spaces were removed in an
attempt to guard against this possible method of pattern attack.
Anagram and Puzzle Solving Tips:
When dealing with cryptograms, one of the first things you should try is the see if it is an
anagram. Remember anagrams were defined in chapter 1 and are words, names, or phrases
that are made up of letters from other words, names for phrases. Obviously most people
would think of Sherlock Holmes, The Da Vinci Code or other books by Dan Brown, and
Harry Potter when thinking of anagrams seen in novels or movies. To help identify a
possible anagram I suggest learning techniques used by those who play Scrabble. Think of
the letters as in random order rather then already forming an existing word or phrase and
then applying Scrabble techniques should identify if the cryptogram is or is not an
anagram. Another thing that might help crack a code is thinking of it as a puzzle. Those
who love to solve puzzles look at thing differently then the average every day person.
They can make connections where others cannot due to a combination of mindset,
knowledge and experience. Also remember the solution to hard puzzles often comes from
putting it aside. Intentionally top working on it and do something else often allows the
mind to process the problem and provides the needed solution to the problem or in this
case puzzle. When applied correctly these have a good chance of working for the average
cryptogram.
Digital Forensics Key Identification:
For Digital Forensics Examiners, if you have located encrypted evidence on a drive I
would suggest the following. First, ask the individual for the key to decrypt it. If they are
not willing to provide it do not push them as it could be viewed as a form of self
incrimination. If they are uncooperative, begin looking for possible encryption keys.
Unless on Smartphones or similar portable devices, encryption keys will be longer then
what can typically be written on a post-it note. If your Digital Forensic Suite has the
option to look for encryption keys, using it to do so may result in locating the keys need to
decrypt evidence. If no option exists, start by manually Identifying known signatures
found within encryption keys and let them work to your advantage. Have your forensic
program search for any string of code that has similar characteristics to known Cipher
keys. This may on occasionally locate the required key needed to unlock the potential
evidence. Also try to determine if any digital certificates exists on the computer likely
stored by a cryptosystem when manually encrypting files or via an encrypted messaging

program or app. If you find a certificate that is unusual typically not found within a web
browser I suggest the following. Try to determine the specific Certificate Authority that
issued the digital certificate in question. Remember that digital certificates are usually
governed by a Certificate Authority. Providing them with a warrant should be enough to
get them to look and see if they can identify the matching key needed to decrypt the file or
message. Numerous bills concerning E-Privacy dating as far back as the 1990s Clinton
Administration have shown that even a more liberal approach to E-Privacy especially the
use of encryption would require Tech Companies to assist Law Enforcement in any way
possible including with decrypting encrypted evidence seized under current Wire Tap laws
and concerning physical technologies seized as evidence during active investigations.
Depending on the circumstances involved in the case, it may be possible for companies
presented with a warrant to provide the decryption key to your agency allowing you the
opportunity to decrypt the evidence. However, that will depend on the presiding Judges
interpretive Discretion on whether or not to sign such a warrant and the companies legal
stance on the issue since laws are vague in this area. If they are unwilling to provide the
decryption key or assist in decrypting the evidence for authorities, from a legal stand point
they may still be able to assist authorities in other ways. Specifically, Certificate
Authorities may be able to provide a list of all authorized entity(s) or individual(s) that
were granted access to the encrypted communication channel using the paired encryption
keys in question. This could provide new leads without getting into a debate on evidence
decrypting, and further your investigation in the process. In the US, for National Security
related cases invoking the Patriot Act Trumps all other arguments. However, the Patriot
Act should not be used frivolously and must only be invoked when the circumstances
surrendering the investigation warrants such an action. While the Patriot Act does not
specifically include encryption it does state that organizations, companies, corporations,
and other entities must cooperate with authorities and assist them during active ongoing
investigations involving National/Homeland Security.
Linguistic patterns:
The next suggestion I can give is to look for linguistic patterns. This is especially useful if
you have identified the individual the ciphertext was created by and have several plaintext
examples of their writing style. You can see which words they tend to use more often then
others. Even if you did not identify the individual or have any known writing samples in
which to compare it to, there are still typical patterns that can be expected to occur. At
times, periods, question marks, and exclamation points, are either removed or are encoded
with their own ciphertext. Looking for what appears to be the end of a sentence group can
help to identify if this is the case with your current ciphertext. Another note to point out, if
the individuals behavioral patterns can be observed such as at crime scenes, a technique
known as Criminal Behavioral Analysis can make some assumptions concerning the
individuals level of intelligence and or education. With this, additional linguistic patterns
generally associated with level of intellect can be seen to emerge as well.
Forensic Key Analysis:
Forensically analyzing encryption keys can prove a lengthy and tedious endeavor.

However, once could go about it by devising a system similar to the system already used
in Digital Forensic Suites such as The Forensics Took kit (FTK) and Encase. Both these
as well as other Forensic Suites have password cracking capabilities. Many of the ways
Cryptanalysts employ to crack codes are similar to how passwords are broke via password
cracking programs. The brute force attack method mentioned later in this chapter is
another of the approaches that can be used to break encryption that mirrors methods used
to crack passwords. An alternative approach is to remember encryption uses algorithms to
encrypt and decrypt data. Algorithms are utilized in many areas within our daily lives
including listening to music. In analyzing algorithms such as those used by a shuffle
function that rearranges music files to ensure the playlist never plays the music in exactly
the same order twice, we can make some observations. For example it has been shown that
while they use mathematical algorithms to theoretically randomize your playlists, specific
algorithms tend to pick certain songs over other which is why some play far more
frequently then others. Encryption algorithms can be analyzed for similar patterns and if
located exploited to assist authorities in breaking the security algorithm or encryption
employed on the evidence being analyzed.

Apply your knowledge with these two exercises:


Continue to practice your new found knowledge, and decode the following entirely on
your own.

A hint to help start the reader going is to use frequency distribution analysis to determine
the likely symbol for the letter E. Once located, continue to use frequency distribution
analysis until the entire cryptogram is solved. The answers to the ciphertext above and
below are at the end of this book within an Answer Sheet. Please wait until you are
finished the entire book and after you have attempted them before looking up the answers
to these two Ciphers.
Continuing with your practice, try to decode the next Cipher below. To help readers with
this cryptogram, I can tell you that this cryptogram uses both Shift and Transposition
Ciphers.
JRZ U
RGRN
Man in the Middle:
The Man in the Middle attack occurs when sending data from point A to point B. The old
fashioned early twentieth century spy way involved intercepting messages within postal
systems. In a Passive attack they viewed and or copied it, repackaged the message and
sent it to the intended destination. In Active attacks, they intercepted the message,
modified or replaced it with another misleading message and forwarded it to the intended
destination. In Cybersecurity the concepts are the same only applied when transmitting
data over networks instead of through postal services. If the message was in plaintext, the
intercepting third party would be able to understand its contents, as well as easily try to
forge a fake misleading message to forward on in its place. If the message is in ciphertext,
then it is unintelligible to the intercepting party unless they have the key needed to
successfully decode it. Additionally, without the key used to code the message they would
not be able to encode a fake message to forward on to the receiving party. In Man in the
Middle attacks, whether it is physical or electronic, if the message is not changed or
altered it is considered a Passive attack. If the message was changed or altered, it is
considered an Active Attack. Whether passive or active these Man in the Middle attacks

can occur illegally from criminal elements, as well as from law enforcement authorities
through a legally obtained wire tap warrant.
Brute Force Attack:
The Brute Force Attack is the most time consuming cryptanalysis attack method. Like
frequency distribution attacks it uses Statistics. Unlike frequency distribution which used
probabilities, Brute Force uses combinations. The process consists of generating all
possible combinations of characters that can be used for an encryption key, and then try
each separately one at a time as it attempts to find the possible encryption key needed to
decrypt the encrypted ciphertext targeted for attack. This process is nearly identical to
using Brute Force attacks when trying to crack passwords.
Chapter Summary:
This chapter focused on providing the reader with the opportunity to practice some of their
new found cryptographic skills. It accomplished this by providing exercises that not only
allowed the reader to practice their newly acquired skills, but also provided exercises with
scenarios that can assist the reader with ciphers found in movies and games today. I also
provided those scenarios that one might see in novels, as they could potentially mature
into a fully developed novel at a much later time. Several code breaking tips were
discussed including frequency distribution attack methods ranging from expected letter
occurrences to word frequency, and ended by briefly touching on applying linguist
patterns to code breaking efforts.

Chapter 6: Mechanical Ciphers


To understand what Mechanical Ciphers are, we need to define what constitutes something
to be defined as mechanical or as a device. According to several popular dictionaries
including Merriam-Webster, mechanical is defined as work produced or operated by
machinery or tools using applications of science. Machines are considered equipment with
moving parts that perform work when fueled with gasoline, diesel, coals, steam,
electricity, etc Examples of simple machines include the lever, pulley plane, screw,
wedge, and the wheel and axle that produce work as a result of operating. Devices are
defined as equipment, tools, or machinery that performs a specific function. Therefore,
mechanical ciphers can be defined as machines, simple machines, tools or devices using
applications of science to encipher or decipher messages. As a result, all of the cipher
cryptosystems included within this chapter are mechanical in nature and meet the
requirement to be considered mechanical ciphers.

6.1 Greek Scytale (First known appearance of a Cipher


Device):

In ancient times the Greeks were among the civilizations that employed cryptographic
ciphers. While there were several cryptosystems used during ancient times, the Ancient
Greeks and more specifically the Spartans are accredited with creating the worlds first
known cipher device called a Scytale. The Scytale was first used in the 5th century BC.
The Scytale device was in the shape of a wooden rod. This was not just any rod though.
You wove a strip of parchment similar to a thin leather strap around it, and wrote your
message along the length of the rod. When you reached the end, you simply turned it and
continued writing. Once finished, you sent the coded message to your correspondent. The
message wrote on the thin strap would appear discontinuous to anyone intercepting it.
After the correspondent received it, they wove the parchment around their rod of equal
length and diameter to the senders. Once around the rod, the messages continuity would
be reestablished and the secret message could be read as plaintext. The cipher this device
created is considered to be a type of transposition cipher. As such, cryptanalysis attack
methods used against substitution ciphers including frequency distribution will easily
crack this coding method especially when combining it with anagram techniques and or
pattern recognition.

6.2 Alberti Cipher Wheel:


The Italian polymath Alberti who lived between 1404-1472 is accredited as being one of
the inventors of the polyalphabetic cipher cryptosystem and the actual inventor of the
Vigenre cipher disk in 1467 as he invented it around six decades before Vigenre was
even born. Albertis cipher wheel had two tracks on it. The outer track was the plaintext
Italian Alphabet with several numbers attached to the end, while the inner track was
arranged out of order from the outer track. The way his system worked was to have the
parties agree on a letter, they would move the outer track to match the letter A on the inner
track. Once the tracks were properly aligned, the outer ring represents each character in
you plaintext message and the inner would be the ciphertext used in your secret message.
When the receiving party gained possession of the ciphertext message, they moved the
inner track on their cipher wheel to the agreed upon letter, and translated all ciphertext
from the inner track to the letters on the outer track thus successfully decoding the
plaintext message.

6.3 Vigenres Cipher Wheel:


Vigenre who lived from 1523-1596 was accredited with creating the Vigenre cipher
wheel. While he was not actually the first to use a cipher wheel, his contribution to the
field of cryptography is substantial. His cipher wheel was nearly identical to Albertis
wheel, except there were no numbers. His system to code however, made the Vigenre
system far stronger encryption than Albertis method. Like Alberti, the parties agreed
upon the first key letter. However, unlike Albertis method from the second character on
the inner track was rotated for each character letter of the message. The second character
of ciphertext was encoded by moving the inner track to the agreed upon index letter and
encoding the second letter of plaintext located on the outer track with the aligned inner
track character. You kept doing this for each letter of plaintext until the entire message was
enciphered. Because the inner track was continuously moving to encode each character of
plaintext, this made Vigenres cryptosystem far more secure compared to the system
Alberti devised.

6.4 16th Century Cipher Machine:


A book shaped cipher machine was used during the 16th century in France. If opened, the
book shaped machine became an early cipher machine. Inside, there were no pages to flip
through with text on them. Instead, when opened it became a two sided cipher machine.
The left side of the machine had one large dial roughly centered on the page. The right
side page consisted of 19 smaller dials, twelve in 4X3 formation along the top and the
remaining 7 arranged along the bottom. By arranging these dials within the correct
manner, one could create ciphertext messages. This book shaped cipher machine is said to
have belonged to King Henri II who ruled France between 1547 until his death in 1559.

6.5 Jefferson Cipher Cylinder:


Thomas Jefferson created a sophisticated cipher machine known as the Jefferson Cipher
Cylinder (also called Jefferson Cipher Wheel) around the 1790s. It consisted of 36
separate discs each with characters along the edge around them. They were all arranged on
an axle or rod in succession and each disc could be rotated along the axle independently
from the others. The encrypted ciphertext it created was considered exceptionally strong
compared to those created by other cryptosystems in his day. Jeffersons cipher wheel is
believed to be the inspiration for more modern cipher machines created during the early
20th century. These include but are not limited to the 25 wheel M-94 used by the US
Military from 1922-1943, as well as the Dutch made rotor cipher machine which was later
developed into the Lorenz and Enigma Machines used by the Nazis during World War II.

6.6 Wheatstone Wheel:


The Wheatstone wheel is much like other cipher wheels or disc used throughout the
centuries. However, where this one differs from the others discussed within this book is
that in addition to two tracks of keys on for plaintext and the other for ciphertext, there
was a new additional aid installed. This cipher wheel had two levers that looked very
much like hands on a clock. You moved each to their desired locations. The inner track
was used for plaintext, as such had a shorter hand like a clocks hour hand. The longer
minute hand was used to point to ciphertext. The other difference with this wheel is that it
gave the coder two possible ciphertext characters to choose from, making this cipher a
polyalphabetic cipher.

6.7 Mexican Army Cipher Wheel:

As previously mentioned during an earlier chapter in a descriptive archeological scenario,


the Mexican Army Cipher Wheel was generally made of wood and had five ringed tracks
of cipher keys. The outer track consisted of intelligible alphabetical letters. The remaining
four inner tracks consisted of numbers. Instead of moving just one of the tracks, each inner
track was moved to the correct alignment and the message was encoded according to the
key used. Due to the number string created by the ciphertext, this cipher illustrates
transposition and homophonic traits. Compared to other cipher wheels, the system
developed for the Mexican Army Cipher Wheel was very advanced especially considering
the time frame in which it was used during the early nineteen hundreds.

6.8 First known Rotor Cipher Machine:


The Germans were not the first to build a cipher machine like the Enigma and Lorenz
Machines. Two Dutch Naval Officers Hengel and Spengler are now accredited with
building the first rotor cipher machine in 1915. While they did build a functional prototype
of their device with the hopes that the Dutch Navy would adopt it, the Navy eventually
decided not to pursue their design and forced them to abandon their project.

6.9 Enigma & Lorenz:


The most famous mechanical cipher machine is the Enigma Machine and was used by
Nazi Germany during World War II. This was a machine similar in appearance to a
typewriter that employed a sophisticated rotor cipher method to encrypt and decrypt
messages. Throughout World War II, the Nazis build a number of different versions of
Enigma as they continued to improve upon its design. The Enigma cipher machine was
used as a field cipher and was utilized by Military Officers, the SS and some political
appointees. The Enigma cryptosystem was eventually crack by British Mathematicians
and Computer Scientists Alan Turing and Gordon Welchman now popularized in the
movie Imitation Game. It should be noted that Enigma was not the only cipher machine
used by the Nazi Third Reich. The Lorenz cipher machine was used by the German High
Command, and is considered to be an early form of stream cipher. These two cipher
machines worked by using a typewriter style interface. Once the machine was calibrated,
each press of a key activated a series of rotating wheels, pins, and lugs to encipher each
individual character of the message as you typed it out.

6.10 Bombe and Bomba:


While Alan Turing and Gordon Welchman are best known for breaking the Enigma code,
they were not the first to successfully decipher Enigma code. Polish mathematicians
Marian Rejewski, Henryk Zygalski and Jerzy Rzyk have that honor. They analyzed
recovered wiring from an Enigma Machine, used information from a German spy, and
later intercepted a military version of Enigma while in transit within the Polish Postal
Service. With all the pieces they needed to decipher Enigma, they created a machine
known as Bomba. This machine was able to decode military messages enciphered with
early Enigma variants. However, the Germans changed the mechanics of newer versions
of Enigma, making the Polish built decipher machine obsolete. As the war continued to
progress, the Germans were able to expand their influence with seemingly complete
confidence that their new and improved Enigma Machines were unbreakable. However,
the then newly created British code breaking center known as Bletchley Park with the aid
of Alan Turing and Gordon Welchman worked tirelessly towards breaking the seemingly
unbreakable Enigma code. They called their machine Bombe, as their design was based
on the Polish built Bomba design created approximately half a decade earlier. Once Turing
and Welchmans Bombe machine cracked Enigma, the tide of the war shifted in favor of
the Allies. This accomplishment contributed to the defeat of Nazi Germany, and is
consider one of the greatest advantages in the war against Nazi Germany and led to the
eventual Allied victory.

6.11 Swiss NEMA Cipher Machine:


The Swiss NEMA Cipher Machine was built during World War II and was at least partly
based on the German Enigma Machine which the Swiss Army used until they discovered
the Allies as well as the Germans were both listening to their secure communications.
After this discovery, they decided to create their own cipher machine the NEMA which
was sometimes called the Swiss K after the Enigma K machine they based their design on.
The Swiss NEMA Cipher Machine was developed sometime between 1941-43. A
functional prototype was available in early 1944 although actual working models did not
enter service until 1947 after World War II had ended.

6.12 Later Cipher Machines:


As time went on, cipher machines continued to develop and gained popular use. Some of
the later devices included the punch cards used at work for clocking your hours on the job,
and other used some type of tape or paper ciphertext output and some even allowed for
input via paper or type. These are just some of the ways these devices continued to be
employed for decades after the war.
Chapter Summary:
Chapter six discussed Mechanical Ciphers. We defined Mechanical Ciphers as
cryptosystems that utilize a ranged of machines from simple machines which include
devices, and ending with key rotating cipher machines. The first device discussed was the
Scytale. This device was developed by the Ancient Greeks and is specifically accredited to
the Spartans. We then discussed the Alberti, Vigenre, and Mexican Army Cipher Wheels.
Mechanical Machine ciphers with mechanical rotating parts used for cipher keys were also
mentioned. They included the Jefferson Cipher Cylinder, the sixteenth century cipher
machine used by King Henri II, the German made Enigma and Lorenz Cipher Machines as
well as the Polish built Bomba and British Built Bombe code breaking machines. The
chapter gave a good overview of various mechanical ciphers used throughout history.

Chapter 7: Modern Ciphers


Until now, we have discussed classical and mechanical cryptosystems. These are essential
in understanding exactly how cryptography works, and allows the novice cryptographer
and cryptanalyst to hone their cryptanalysis skill sets. However, in a modern computing
world where supercomputers and cloud computing process mathematical algorithms faster
then ever before, simple ciphers are not enough to secure your information. This is where
modern computerized encryption cryptosystems come in, and why they are so important to
protect our personal, private, financial, and health information against potential misuse
from criminals looking to commit Financial Fraud, Identity Theft, Cyber-Stalking,
Extortion or any number of other criminal activities with our valuable information. This
books focus is on introducing the reader to cryptography. The classical ciphers provided a
good basic knowledge of how cryptography works and illustrated that it is important to
have knowledgeable Cryptanalyst skill in the classical forms of cryptography as well as
the attack methods to analyze and break codes when appropriate such as in modern
movies, video games, and far more importantly such knowledge will greatly aid
investigators if cryptic cipher messages are left behind by serial killers, terrorists,
murderers or other felonious parties. Shifting the focus to highlight several modern
cryptosystems will continue to add to the breath of cryptographic knowledge readers now
possess.

7.1 Symmetric Ciphers:


Symmetric Cipher include most classical cryptographic ciphers as well as earlier forms of
modern cryptography. It uses a single key known as a secret key. Apply the key to
encrypt your data into ciphertext. Reapplying the key in the reverse order will decode the
data back into plaintext. While this provides some level of security and confidentiality,
most symmetric ciphers are easily broken by knowledgeable cryptanalyst.
The Math: A general mathematical notion for Symmetric Cryptography using a single
Secret Key where a sender transmits encrypted messages to a recipient is as follows:
where A=sender, B=recipient, X=message, Y=Secret Key, and {X} denotes the set of
content within message X.
A:{X}YB:{X}Y

7.2 Binary:
All modern computing technologies since the creation of the electronic computer with the
exception of quantum computers work by converting data into 1s and 0s. This system is
mathematically known as Base 2, meaning there are only two possibilities a 1 or a 0. All
computer processors convert our data into binary, perform their calculations and the
computer returns its results as intelligible output we see on our devices, monitors, screens,
via print out, or hear through speakers. Every single printable character and even
characters that are not represented on keyboards are converted to Binary. While this was
not intended to be used as a cipher just as Morse Code was not intended as such, for
anyone unfamiliar with how to interpret it, intentionally converting data to binary to hide
the content of the message, data, or document can be viewed as a form of substitution
cipher when implemented in this way.

7.3 Hexadecimal:
Once computing technologies evolved, there was a need to represent data as more then
merely binary. Hexadecimal is the system that arose to fill this need. Unlike binary that
uses Base 2, Hexadecimal uses Base 16 math to represent up to 16 characters instead of
just 2. Note, many students say F in Hexadecimal is 15, so a common mistake students
make is thinking of Hexadecimal as Base 15 instead of Base 16. I will attempt to clarify
for them why it is Base 16. The characters in the Hexadecimal system include
0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F. As you can see F does in-fact represent 15, but there is
also a 0 present in the hexadecimal system making it Base 16 to represent all 16
possibilities within its keyspace.

7.4 Block Ciphers:


Methods used by these ciphers act differently then those previously discussed. Take a 5
sentence long message. Instead of applying a single cipher to the entire message at once,
the message is broken up into blocks or in this case sentences. Each block or sentence
would have the cipher applied to it as a whole instead of each single bit or character. This
system is sometimes used in modern Cryptography but has its origins in classical
cryptography. When implemented in modern encryption algorithms, the blocks are
essentially groups of bits. Typical sizes of these bit blocks include 32, 64, 128, 256, 512,
1024, 2048, and 4096

7.5 Public Key Cryptography:


As learned in chapter 1, Public Key Cryptography employs encryption methods that use
asymmetric ciphers comprising of two separate and distinct cipher keys instead of one
Secret Key as typically seen in symmetric cryptography. These keys are known as the
Public Key and Private Key. Public Keys are used to encrypt plaintext into ciphertext,
while the Private keys function is to decrypt the ciphertext back into readable plaintext.
Several types of encryption utilizing Public Key Cryptography include RSA, PGP, and
PKI.
The Math: When senders use Public Key Cryptography to send secure messages to
correspondents, a general mathematical notion for Public Key Cryptography is as follows:
where A=sender, B=recipient, C=message, D=Public key encrypting message C,
E=Private key decrypting message C, and {C} denotes the set of content within message
C.
A:{C}DB:{C}E

7.6 RSA:
Named after its inventors Revest, Shamir, and Adleman RSA cryptography is one of the
most widely used ciphers in the world today. Considered to be a form of Public Key
Cryptography it utilizes asymmetric ciphers. However it is unfair to only consider it
asymmetric as it also employs symmetric cryptography as well. It uses asymmetric
cryptography via Public Key encryption to encrypt data using public keys and decrypt data
using private keys. However, both keys themselves public and private are generated
utilizing symmetric cryptography. This means RSA should be represented as utilizing
both, as both are needed for RSA to perform its desired function.
The Math: As RSA is Public Key Encryption, without explaining exactly how RSA
algorithms differ from other public key cryptosystems, RSA can be express the same as
Public Key above in 7.5.
A:{C}DB:{C}E

7.7 DES (Data Encryption Standard):


Standing for Data Encryption Standard (DES), it was developed by IBM in the 1970s. It
was one of the first encryption standards widely used. The cipher it employs uses
symmetric cryptography and requires a secret key. However, unlike various forms of
substitution ciphers, DES uses a Block Cipher method to both encrypt and decrypt its
ciphertext. In any event, only a single secret key exists, and whether encrypting or
decrypting with it, only one single pass of the cipher occurs in this system.
The Math: DES is a symmetric algorithm and can be expressed the same as seen in the
explanation of symmetric Cipher above in 7.1
A:{X}YB:{X}Y

7.8 3DES (Triple Data Encryption Standard):


Flaws were found within the original design of DES. This prompted the standard of 3DES
which can be thought of as triple DES to be developed. The concept of this system was
not to completely redesign the existing DES model, but to improve upon its existing
cryptosystem. The way devised to accomplish this consisted of having not just one secret
key, but three separate symmetric secret keys. Just like in the original DES cryptosystem,
use the first key to encode your first layer of ciphertext. After that, apply the second key to
the first string of ciphertext to create a new version of ciphertext. Apply the third key just
as the second, to create the third and final version of ciphertext. The sequence the three
cipher keys were applied is essential and needs to be noted or remembered. Its importance
is seen when attempting to decrypt the final ciphertext created by 3DES. To decrypt
3DES, you must reverse the operation of each cipher keys within the exact opposite order
they were applied to decrypt the ciphertext back into plaintext. So Lets say the sequence
was key (1), key (2) and key (3) in that order. Just as in classical substitution ciphers, you
must reverse the operation of the keys to decode the message. However, just reversing the
operation is not enough. Revising the operations and applying the keys in the same order
used to encrypt the final ciphertext will not return the ciphertext to plaintext. You must
also reverse the order the ciphers were applied to successfully decode the message. The
order of the original sequence above was keys 1,2,and 3. Therefore, you must reverse the
operations of each key, and apply them in the order of key #3, key #2, and key #1. Once
completed, the original plaintext will re-emerge from behind its veil of ciphertext.
The Math: 3DES is three DES Cipher keys layered one on top of the other. The expression
below depicts this where A=sender, B=recipient, M=message, Y=Secret Key#1, Z=Secret
Key#2, K=Secret Key#3,{M} denotes the set of content within message M, and * denotes
a calculation between variables.
A:{M}Y * Z * KB:{M}K*Z*Y

7.9 Multipurpose Internet Mail Extensions


(MIME):
MIME stands for Multipurpose Internet Mail Extensions. It provided enhancements to
existing mail capabilities. It can be considered to be among the first attempts to apply
partial implementations of encryption to email communications. However, it should be
noted that MIME did not encrypt an entire email message as the standard required all
message content to be in ASCII text format. Instead, it encrypted specific fields within the
mail header. This standard is no longer currently relevant from an encryption perspective
as it was replaced by Privacy Enhanced Messaging (PEM) and is considered obsolete by
todays standards.

7.10 Secure Multipurpose Internet Mail Extensions


(S/MIME):
The standard of Secure Multipurpose Internet Mail Extensions (S/MIME) expands upon
the capabilities of MIME. As we saw in MIME, only specific fields within the mail header
were encrypted. S/MIME adds additional security measures via digital signatures. These
digital signatures utilize public key cryptosystems, adding an addition level of encryption
and authentication to better secure email communications. Overall, the encryption
algorithms that it employs provide more assured security measures than its predecessor.
The ciphers used in S/MINE are RSA and 3DES.

7.11 Privacy Enhanced Messaging (PEM):


The Private Enhanced Messaging encryption standard provides a stronger level of security
for email communications. The technologies PEM utilizes increases the number of critical
characteristics of information it handles compared to email sent using MIME. These
improvements better address party information confidentiality, sender authentication, and
data integrity. This encryption standard secures email communications with an asymmetric
cipher for key exchange, an asymmetric cipher for originator authentication, and a
symmetric cipher via Data Encryption Standard (DES) for message encryption.

7.12 AES:
This cryptosystem stands for Advanced Encryption Standard. This is a fairly strong
symmetric algorithm. While it is not secure enough to protect classified information, it is
considered secure enough to protect sensitive government or confidential enterprise data.
While it uses symmetric cryptographic algorithms, it also utilizes block lengths to encrypt
and decrypt its ciphertext. The block lengths for this algorithm are 128, 192, or 256 bits.
AES can be implemented within hardware or software to secure data. Firewalls and
routers including most newer consumer wireless routers have AES as an option if enabling
router security. The technology may also be used in Secure Socket Layer (SSL), Transport
Layer Security (TLS), as well as other forms of modern electronic devices employing
encryption.

7.13 IDEA:
Standing for International Data Encryption Algorithm, IDEA is a symmetric block cipher
and is available for use within Pretty Good Privacy and S/MIME. Since IDEAs block
cipher uses symmetric algorithms, it was intended to replace both DES and 3DES as the
new symmetric cipher algorithm of choice. This block cipher uses an algorithm that uses
64bit blocks of plaintext and a 128bit cipher key. IDEA can operate in several modes.
They are Electronic Code Book (ECB), Cipher Feedback (CFB), and Cipher Block
Chaining or CBC.

7.14 Digital Signatures:


When entities need to ensure that the messages or documents it shares between one or
more correspondents online are secured, technologies to authenticate the sender must be
utilized. A Digital Signature provides this authentication, and reassures the recipient that
the documents received do originate from the sender, and have not been forged or altered
during transit. Digital Signatures are created and encrypted using Public Key
Infrastructure (PKI) cryptosystems. The public keys used for digital signatures are issued
by a certificate authority within the form of digital certificates. The sender then combines
the public key contained within the certificate with their digital signature private key to
create a hash value which they attach to the message or document being sent. Once the
message arrives at its destination, the recipient uses the senders digital signature public
key to validate that the message did originate from the sender. Note these keys are not the
same used for message encryption and are only used for digital signatures. If message
encryption is also implemented, you would have two sets of paired keys. One set for
message content, and the other for the digital signature. For whole message or document
encryption Public Keys are used to encrypt, and Private Keys are used to decrypt. In
whole message or document encryption the public key used to encrypt messages is not
shared with the correspondent, only the private key is shared. For digital signatures,
senders use both Public and Private Keys to generate encrypted hash values, while the
recipient uses a Public Key to authenticate signatures. Due to the standards surrounding
digital signatures, when you electronically sign documents with a digital signature
governed by a Certificate Authority, the electronic signature on those documents are
legally as enforceable as hand-written signatures on paper based contractual agreements.
Digital Certificates are also assigned an expiration date. Once that expiration date has
been reached, the certificate will no longer be authenticated and will be deemed invalid.
Unless websites renew or replace the certificate with another valid certificate the
encrypted communications with that website can no longer be trusted.
The Math: Using PKI to encode digital signatures can simplistically be expressed as
follows: where A=sender, B=recipient, S=digital signature, Z=Public key, P=Private key,
X denotes a calculate function, and {S} denotes the set of content within digital signature
S.
A:{S}=(Z X P)B:{S}Z
In the above {S}=(Z X P) is read as the contents of digital signature S are the results of a
calculation between keys Z and P.

7.15 Certificate Authority (CA):


Individuals or entities that need to employ digital signatures within their communications
to provide an additional layer of security must have a digital signature provider. Certificate
Authorities are the ones that provide the digital signatures to parties on a temporary basis.
Different Certificate Authorities require parties to provide certain information concerning
the documents being signed. They may further limit the number of parties you can send a
signed document to with their digital signature technology. This is a security precaution to
help further ensure the digital signatures they offer remain secure. Since the digital
signatures are created using PKI encryption, the keys need to be securely kept. The
Certificate Authorities are accepted as trusted third parties to ensure the keys are kept
secure.

7.16 Digital Certificates:


To further secure electronic communication, the certificate authority must assign a digital
certificate to the party requesting the digital signature. Since Public Key Infrastructure is
used to create the digital signatures, the requesting organizations public key is placed
within a digital certificate. These certificates also contain identifiable information about
the requesting organization or entity, this attempts to ensure that the user of the digital
signature attached to documents, is the entity in which it belongs to. The public keys these
certificates contain are needed to encrypt the organizations requested digital signature. As
a result, digital signatures cannot be created without their corresponding digital
certificates, both of which are governed by the chosen certificate authority. The process
can be seen as the reverse of used Public Key encryption to encrypt messages. When
encrypting messages, the sender used their public key to encrypt and the recipient used the
senders Private Key to decrypt the message. Keys used for digital signatures work in the
opposite direction. The owner of the digital signature encrypts a hash value with their
private key and attaches the encrypted hash to the document being sent. Once the recipient
receives document, they validate the digital signatures hash value with the senders public
key. Digital Certificates are also used in regular Cryptography through message
encryption and or key exchange. This is seen in the discussion on SSL/TLS later in this
chapter.

7.17 Paired-keys:
In public key cryptography, two keys are generated. One is the public key and the other
the private key. These key are matched or paired with each other. The public key encrypts
data and the private key decrypts data. The only exception to this being digital signatures.
While digital signatures use paired keys, their functions are different. See descriptions for
Public Key, Private Key, and Digital Signatures for addition information about each.

7.18 Pretty Good Privacy (PGP):


The encryption type PGP stands for Pretty Good Privacy. Contrary to its soft sounding
name, it was fairly tough encryption. PGP was originally open source and freely available
to all to download and use. This encryption was best used for email communications for
file storage especially remote cloud storage or file sharing services. The Hash value
created uses the SHA-1 algorithm. The algorithm for PGP has since been cracked.
Sometime after it was broke, the company Symantec acquired the appropriate rights and
has commercialized it. A number of these vulnerabilities have since been patched. While
Symantec owns the rights to commercially produce PGP, the original free version as well
as OpenPGP which is employed within GNU Privacy Guard (GPG) are still available free
of charge for both personal and organizational use. It is not recommended to use the
original version with its vulnerabilities. However, GNU Privacy Guard is an ongoing open
source project that strives to plug any and all vulnerabilities as they arise. To give the
reader a little background, at one time, Terrorist Groups around the world often utilized
Pretty Good Privacy (PGP) to covertly communicate online. Others involved in criminal
activities as well as decent upstanding individual and businesses also made use of Pretty
Good Privacy (PGP) as their encryption of choice. As I will touch on in the next chapter,
this wide range of users seeking to employ cryptographic measures to protect their privacy
is derived from all walks of life imaginable from the best of us, to the worst of us. As a
result, this creates a dilemma faced by those employed in positions charged with
protecting our National Security.
The Math: PGP is Public Key Encryption, without explaining exactly how PGP algorithms
different from other public key cryptosystems, PGP can be express the same as Public Key
as shown earlier in this chapter.
A:{C}DB:{C}E
If digital signatures are used for PGP, than following the variable descriptions as explained
for digital signature mentioned previously, and where & represents the Propositional
AND conjunction:
add without quotes & {S}=(Z X P) after D and before implies, and add & {S}Z after
E. The new expression is the same as represented in PKI below and reads as follows.
A:{C}D & {S}=(Z X P)B:{C}E & {S}Z
Please note while the ^ symbol does represent the AND conjunction in Proposition
mathematics, it also represents exponents within arithmetic. Therefore, to avoid reader
confusion the & symbol was chosen. For those unfamiliar with AND conjunction, if a
propositional expression reads A&B, this is read as A and B. Within algorithms this means
that both A and B must be true. So in the expression provided above, for A: both {C}D
and {S}=(Z X P) must be true to send the encrypted document. Additionally, for B: in
this expression, both{C}E and {S}Z must be true to successfully decrypt the document
and authenticate the sender. This explanation was provided to clarify the & symbols use
in the expressions for PGP with digital signatures, and PKI below in the hopes of helping
readers avoid any confusion.

7.19 Public Key Infrastructure (PKI):


Public key Infrastructure (PKI) is a new form of encryption. This standard employs
asymmetric algorithmic ciphers. It is a form a Public Key Cryptography as discussed
previously. However, Public Key Infrastructure adds additional measure. Most notably is
the addition of digital signatures and digital certificates. The Public Key Infrastructure
standard uses two sets of paired keys. One set is used to encrypt whole messages or
documents, while the other is used for digital signature creation and validation. The
recipient uses the senders public key to validation the digital signature and confirms that
the party successfully received the message or document and has legally accepted it
originated from the digital signature owner and had not been forged or altered during
transit. This confirms proof of origin and proof of successful delivery. This two way
confirmation is the concept known as nonrepudiation. The critical characteristics of
information talked about during chapter 1 included Confidentiality, Integrity, Availability,
Authentication and Nonrepudiation. Compared to the other cryptosystems discussed thus
far, PKI is the only one that addresses all 5 of these critical characteristics of information.
This makes it among the most secure types of encryption wildly used today. In 1996, when
the Healthcare Insurance Portability and Accountability Act (HIPAA) was established, it
required all electronic healthcare transactions be encrypted to protect patient privacy. The
encryption chosen was Public Key Infrastructure. Therefore, knowledge of Public Key
Infrastructure is an essential prerequisite for all Information Technology Security
Specialists employed within the healthcare industry.
The Math: PKI is Public Key Encryption that includes the use of digital signatures for
authentication and nonrepudiation. Without explaining exactly how PKI algorithms
different from other public key cryptosystems, PKI can be express by combining the
mathematical notations for public key encryption with that of digital signatures. Following
how each were explained previously in this chapter, the expression is represented as:
A:{C}D & {S}=(Z X P)B:{C}E & {S}Z

7.20 Diffie-Hellman Key Exchange:


As seen in public key cryptography, the sender encrypts the message being sent with a
public key. However, in order for the recipient to decrypt the message, they need the
senders private key. In the old days the only way to securely share encryption keys was
with the tried and true cloak and dagger method of hand delivering it to the party in which
you wish to have correspondence. However, this is not the case anymore. Today, the
Diffie-Hellman Key Exchange is used to securely share your private key over public
domain spaces such as the internet with your correspondent. This is accomplished by
creating a one-time session for the purpose of sharing encryption keys between parties
wishing to securely communicate via the internet.

7.21 Elliptical Curve Cipher Algorithms:


Elliptical curves comprised of a theory within mathematics that represents a curve along a
plain or region of space within a 3 dimensional torus shaped (doughnut shaped)
geometrical structure. While elliptical curve algorithms can be used for whole message
encryption, the cryptographic implementation of these curves for use with digital
signatures is known as Elliptic Curve Digital Signature Algorithm or (ECDSA) for short.
In either event, the discrete mathematics used is similar and generates strong encryption
keys. Most cryptographic standards generate their keys based on bit length. Keys with
higher bit lengths are viewed as stronger encryption keys. The bit lengths for generating
keys within public key cryptography are typically between 1024 bits to 2048 bits in
length. Due to advances in computing technologies 1024 bit strings are no longer
considered secure. Therefore, most organizations or entities dealing with sensitive
information have begun the process of moving to utilizing 2048 bit key generation. With
continued advances within the fields of computing technologies, and the ability to mass
produce chips designed on smaller and smaller nanometer construction, 2048 bit keys will
soon be easily broken as well. However, elliptical curve equations do not use typical
traditional logarithmic expressions, instead uses discrete logarithmic expressions. At this
time there are no known attack methods capable of dissecting elliptic curve discrete
logarithms to reconstruct cipher keys. While this may be true at present, as we are nearing
the onset of the quantum computing era, the 2048 bit keys will likely be as easily cracked
as WEP wireless router encryption is today. For now though, elliptic curves represent a
means to gain stronger encryption with shorter length keys and quicker time for key
generation.
The Math: In general, (where ^ in this instance represents exponents) cryptographic
elliptical curses are expressed as:
y^2=x^3+ax+b

7.22 Secure Socket Layer (SSL) & Transport Layer


Security (TLS):
When people wish to connect to website to securely access their accounts, Secure Socket
Layer technology (SSL) or Transport Layer Security (TLS) is implemented to accomplish
this goal. TLS and SSL are they same encryption standard just different versions. SSL
consists of versions 1.0, 2.0, 3.0, and 3.1. From version 3.1 on SSL was renamed as
Transport Layer Security or TLS. So TLS consists of the newest versions of the SSL
encryption standard. The difference in name caused confusion in some thinking they were
two completely different encryption standards. Due to this, many now list it as SSL/TLS
and present it as one SSL standard with the newest versions from 3.1 on having the TLS
name. To explain how SSL functions, we need to understand the particulars that happen
when we log into a website. First, the internet functions on servers, routers and modern
switches that can direct internet traffic similar to how routers route traffic. Of these,
routers and modern switches basically route internet traffic from point A to point B. Web
servers, are the computers where websites are hosted or stored on. The web server also
performs computational functions or operations for websites it hosts. When you access a
specific website, you are accessing the web server the website is hosted on. The web
server directs you to the exact location of the domain name you are accessing such as
facebook.com and the sites pages begin loading within your web browser allowing you to
interact with the website. Since web traffic can be intercepted and is usually transmitted in
plaintext, to ensure your information is secure, a request is made asking the web server to
establish a secure connection. Think of these process as a handshake. The request above
is the client extending their hand for the server to take hold of to commence the
handshake. The secure connection begins with this handshake between the client and the
web server. I will attempt to explain this further. The client offers their hand in the form of
a Client Hello request. This request tells the web server, it would like to make a secure
connection and tells the web server what secure encryption standards and versions of them
it is able to use. This list of standards is referred to as Cipher Suites and is generally listed
in the order from newest to oldest. When the web server receives the Client Hello request,
it looks at the Cipher Suites it is capable of, and will usually pick the newest one that both
the Client Web Browser and the web server are capable of utilizing. Once the server
chooses the encryption standard to use, it offers their hand to complete the handshake,
which is referred to as the Server Hello. Within the Server Hello is the chosen encryption
standard that the client and servers will begin to use to securely communicate, followed by
the servers digital certificate. The digital certificate provides the servers public key, and
attempt to prove to the client that the public key and domain (for example facebook.com)
residing on that web server are correctly associated and that the domain you are
attempting to securely communicate with is not a fake, forged or spoofed third party. This
attempt to prove the domain and public key are correctly associated addresses the critical
characteristic of authentication. All of this is just the first step in the SSL/TLS encryption
process and is used for key exchange. After the Server Hello is sent, the web server sends
a done message stating the transmission was completed, and it is now awaiting the clients

response. Everything sent and received thus far has been transmitted entirely in plaintext.
The clients next response is to exchanges the encryption keys used to encryption the
connection. The client generates a symmetric key and sends it to the server securely via
Diffie-Hellman Key Exchange using the domains public key found within the digital
certificate to encrypt the symmetric key the client is sharing with the server and sends it as
ciphertext. Once the ciphertext is received, the server uses its private key to decrypt the
symmetric key sent by the client. At this time, both client and server signal each other that
they are about to switch from plaintext to ciphertext exclusively. This is the process
known as Change Cipher Spec. Once done, the secure session has been successfully
establish allowing information sent and received between the client and server to be
encrypted using the agreed upon symmetric key ensuring the information shared will
remain confidential. This secure session will continue until the user logs off or the
connection times out. At which time, if the user wishes to continue to securely
communicate with the domain, a new session will need to be created and the entire
encryption process will begin from scratch once again.
The SSL/TLS sessions use a hybrid or combination of cryptosystems. Public key
cryptography is used for the key exchange while symmetric cryptography is used to
encrypt the information being securely sent and received between the client and server.
Today, current encryption technologies used for access a website securely will typically
show HTTPS instead of HTTP in the web browsers URL address bar. HTTP stands for
Hypertext Transfer Protocol and communicates via unencrypted plaintext. However,
HTTPS or Hypertext Transfer Protocol Secure uses encrypted sessions to ensure data
transmitted and received is secure. Whenever the user sees the HTTPS in their address bar,
they know that SSL or TLS encryption technology is being used to secure the information
they send or receive from that site. If the previously explain process to initial SSL or TLS
secure connections is successful, there should be a lock symbol that appears before your
url in the browsers address bar. If one does not, your connection with that server might not
be secure. Note, if using an extremely old web browser, you may need to update it to
utilize the newest SSL or TLS variants. This encryption technology focuses on three
specific Critical Characteristics of Information. These three characteristics are
Confidentiality, Integrity, and Authenticity.
Once the SSL session has been implemented, it creates a secure encrypted environment or
link between the server and your client web browser. This allows for the sharing of
encrypted data between the web server and your web browser thus protecting your privacy
and the companys assets. Anyone intercepting the encrypted traffic will be unable to
intelligibly understand the content being sent or received. It should be noted that there are
several types of SSL certificates. Some are owner generated without a Certificate
Authority, and others are domain generated which use Certificate Authorities to
authenticate the association between the domain and public key is correct.
Open connections are a problem that needs to be addressed. For example, if you logged
into a website, and you only click the X to close the browser without singing off or
logging out first, the connection is not instantly terminated and remains open. In these
situations, a skilled hacker could locate such an open connection and establish a

piggybacked connection from your opened one. If successful, they would be able to access
your account information just as if they were you. If you work with confidential, sensitive
or classified information, this would be the same as if you were logged into your network
account at work, and walked away from your computer while you were still logged in.
Anyone walking by could access information they are not authorized to access via your
access privileges. Therefore, additional security mechanisms may also be implemented to
guard against opened connections. One mechanism to guard against opened connections
are automatic log offs. The automatic log off function looks for inactivity during current
access sessions. If inactivity is located and remains inactive for a predefined amount of
time, the current access session is terminated. Once terminated, the user will need to log
back into the network in order to access information. The same concept also applies to
accessing secure websites from home. This is why you sometimes need to sign back into
sites after getting a drink from the kitchen, or briefly answering the phone. After it detects
inactivity for say two minutes or less if defined as less, to continue accessing information
on that site you will need to sign back in. This auto log off function is a way secured
websites can further protect your account from being accessed by unauthorized
individuals.
While SSL/TLS technology makes it harder for hackers to piggyback on open connections
as described above, or impede attempts to establish a man-in-the-middle attack, it is still
theoretically possible for them to gain enough information to access your information or
online account. Remember, no security is entirely impenetrable.

7.23 Virtual Private Networks (VPNs) and Internet


Protocol Security (IPSec):
When enterprises, governments and businesses need to secure a direct link between
multiple locations they possess, they often use a technology called Virtual Private
Networks (VPNs) to accomplish this. To help the reader understand this, I first need to
explain how the internet works. When we download or upload a file, it is not sent as one
whole file. Instead, it is broken down into many tiny pieces called packets. Each packet is
sent through the internet as if they were separate cars on a vast global infrastructure of
virtual roads ranging from massive interstate highways to single lane dirt roads. Due to
how the routing technology in which the internet is based on works, it tries to calculate the
fastest route for each individual packet to get from point A to point B. Due to this each
packet in the file you are uploading or downloading does not take the same path to reach
its intended destination. Each individual packet likely takes an entirely different path
before all reach their destination. Once all arrive at their destination, they then need to be
combined back into the useable file. To accomplish this, each packet includes an order of
segmentation. Lets say the file was broken down into 50 individual packets. Each packet
has an order of segmentation such as 1 of 50,.. 26 of 50, ..50 of 50. This provides the
order or sequence of operation needed to correctly reconstruct the packets back into a
usable file. During the transmission of packets, every network device a packet flows
through during its route through networks such as the internet is called a hop. However,
within normal routing protocols there is little control over specifying or defining hop
locations. In other word, you cannot determine exactly which route each packet will take
throughout their transit from point A to B. All 50 individual packets could literally flow in
completely different directions from the others before arriving at their intended
destination. This creates a very unsecure environment to access, send or otherwise
transmit confidential or sensitive information. This is where Virtual Private Networks
come in. They create a virtual tunnel through networks such as the internet. VPN
technology, allows you to identify safe hop locations, and predefine a route through the
internet similar to how many create custom routes for use with their GPS devices.
Thinking of it like that, it is like saying start by going to this internet server directly for
hop 1. Next, from hop 1s location proceed to this one for hop 2, than etc until your last
specified hop takes you directly to your intended destination. VPN technology not only
creates the virtual path, it actually creates virtual walls around the tunnel so no one can
enter it without authorization. They accomplish this by implementing encryption
technology specifically the use of Internet Protocol Security or IPSec for short. Both SSL
and VPN technologies use asymmetric and symmetric cipher to implement their security
protocols. They use public key cryptography to create a secure environment to exchange
keys, and symmetric cryptography to create the keys that will actually encrypt parts of
data transmissions. However, where they differ is whats most notable. SSL is designed to
encrypt the actual data being transmitted. However, IPSec does not encrypt the actual data
being sent, but the walls of the virtual tunnel through the internet created by the VPN. The
encrypted tunnel walls along with the ability to predefine exact routes the data will take

from points A to B and back again, makes VPN technology by far the most secure method
used for the sending and receiving of confidential or sensitive data through the internet
today. As such, it is best used for securing remote access points, and securing office
connectivity between branch locations.

7.24 Quantum Ciphers:


Quantum Ciphers, although not new are techniques that are gaining popularity slowly.
Think of the natural sciences and how they work. Think back to chemistry and physics
classes nearly all of us have had during grade school, higher education or both. Even in
grade school, we learned about microscopic particles such as atoms, nuclei, protons,
neutrons, and electrons. There are several possible ways to measure these microscopic
particles depending on the exact aspects you are focusing on. Pick one, and use the
mathematical system behind it to generate encryption keys. So another way of looking at
it, is that quantum ciphers or encryption work by using characteristics of microscopic
particles to generate encryption keys. In theory, quantum encryption generates potentially
more secure encryption keys, ensuring the cryptanalyst will have a much harder time
attempting to break them.

7.25 Using Encryption With Your Devices:


In this section we will briefly discuss the issues surrounding encrypting Smartphones,
Wireless Routers, and discuss problems that can occur from invalid certificates when
attempting to accessing websites. Section 7.25 will end with a discussion on using
OpenPGP and walk readers through the installation and basic setup process of Gpg4win.
Smartphones:
For those who wish to mess around with encrypting their Smartphones, YouTube has very
good tutorials on how to accomplish this. These tutorials walk the user through the step by
step procedures that are needed to encrypt Smartphones using Windows 10, iOS, Samsung
and other Android based Smartphones as well as other Linux based operating system
variants. If you are unable to find a tutorial that works for your model, a simple internet
search will likely locate the correct procedure for your phone. A word of caution, some
Smartphone manufactures state that once you encrypt your Smartphone, you cannot
unencrypt it. While you can decrypt the phone to access your data, this means you cannot
return your smartphone to a state where no encryption is used once the phone has been
encrypted. Once encrypted, you will always need to decrypt it each time you wish to
access your information or data. Remember your password, pass phrase or secure gesture
if choosing to encrypt your phones. All these listed can be considered your encryption key.
If your key is lost, restoring your phone (a factory reset) to factory default settings,
basically returning the phone to the state it was when it was purchased may be your only
option if the encryption key is lost. However, doing so will cause all the information on
the phone to be lost unless your data was backed up before resetting your phone. While
there are some workarounds that can allow some encrypted phone to return to an
unencrypted state, they are complicated and too confusing for most to follow. Most people
believe they have no need to encrypt their phone. For the most part they are probably right
in most cases. Whether you choose to encrypt or not to encrypt is a personal choice each
person will make on their own. Regardless of whichever you choose, make sure the
decision is the one that is best for you.
People that wish to use encryption with their email communications should consider the
following carefully. First, identify the specific individuals you wish to have secure
correspondence with and show your secret or private key with them and only them. Next,
decide which form of encryption is best for you and your correspondent to use when
securely communicating via email. Also realize that some email providers will not allow
any ciphertext to be sent via their mail server or will require the contents of the ciphertext
be converted into ASCII format before they will allow you to send the encrypted email to
your correspondent.
Wireless Routers:
All the encryption just mention is optional and entirely your choice to implement or not to
implement. However, if the reader does nothing else encryption-wise, I highly recommend
enabling encryption of your wireless routers. Many people just leave their wireless routers
open and entirely unsecure. This is a mistake. You may think you are being nice to your

neighbors. However whether its them or anyone else that just happens to drive by and
stumbles upon your unsecure router (the latter being the more likely scenario), they could
perform unlawful activities through your open unsecure router and the investigating
authorities will come knocking at your door under the assumption that you are the
perpetrator of the illicit activities. A thorough investigation may eventually clear you from
any illegal wrong doing, but how many people really want to go through all that hassle
and subsequent community rumor-mill gossip when it could have all been avoided. The
best way to avoid this from happening is to enable encryption of your wireless routers.
Consult your wireless routers user manual for instruction on how to enable wireless
security. The possible security measures your wireless router offers may differ, but will
likely consist of Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA) or WiFi Protected Access 2 (WPA2) security standards. This author recommends not using
WEP security as it is easily broken within minutes. The WPA standard is stronger and
more secure then WEP encryption. However, while it is still adequate for today, it has
flaws. WPAs encryption standard can be broken by a more complex and lengthier attack.
At present WPA2 is the most secure and best choice to protect your wireless routers and
all devices connected to it. One thing many people do not realize is that once a party has
access to your wireless signal they can access all devices connected to it unless other
security procedures are implemented to guard against such unauthorized access.
Encryption is one method to guard against unauthorized access, although there are others
such a firewalls, port blocking, MAC address filtering as well as other methods to reduce
the risk of unauthorized access. These procedures do not fall within the scope of this book,
but can be found within other Cybersecurity books or via quick internet searches.
Problems arising from invalid certificates:
When accessing a website, you may at times be presented with a message similar to the
one provided below.

Please note the light gray text NET:ERR_CERT_AUTHORITY_INVALID. This


message is very important and states that there was a problem with the encryption used to
securely connect your web browser with that website. In other words the connection
established is unsecure. While there is no one reason for this error message, there are
several likely reasons why you could have received a similar message. I will attempt to
explain several of these likely causes. In scenario 1, the websites encryption technology
used to protect data people transmit between their browser and that site has been
compromised and is unsecure. In these cases a third party could steal information for the
purpose of committing Identity Theft, or for other illegal purposes. If the website is legit
and typically considered trustworthy this could indicate they have been hacked. In
scenario 2, the web site is legitimate and deemed trustworthy, but the digital certificate
they use for secure encrypted connections has expired. Remember that SSL/TLS digital
certificates are governed by Certificate Authorities. As discussed earlier, these authorities
authenticate certificates as valid and assign expiration dates. The certificates are can no
longer be authenticated and are rendered invalid once the expiration date has been
reached. In order for the connection to be trustworthy the website/domain must either
renew or replace the certificate with another valid one. If neither of the above are the case,
them sometimes this message means the site is fairly new and your web browser may need
to be updated to accept the new certificate as older browsers only accepting SSL versions
1.0-3.0 will not allows properly accept SSL/TLS 3.1 or above protocols. In this case,
simply trying another web browser can give a good indication if its due to an outdated
web browser. If it is due to an outdated browser, simply updating it should stop the issue
from reoccurring. On the other hand, if the issue persists with two or more browser, I
would be wary of sharing or transmitting personal information with such sites.

Using OpenPGP:
For those who wish to play around with GNU Privacy Guard, it is available for the
following operating systems. Windows, OSX, Debian, RPM, Android, VMS and RISC
OS. If interested, you may download it at the following URL: www.gnupg.org/download
Unless you wish to play around with the source code, be sure to download the GNUPG
Binary releases.
You may also try this version at www.gpg4win.org as you may prefer its graphical user
interface.
Since the graphical user interface is easier for the average user to work with, I suggest
trying gpg4win if you are interested in trying OpenPGP encryption.
Gpg4win installation:
Although you should choose the version that best fits your needs, for the purpose of this
example I downloaded Gpg4win with GnuPG Component only for this demonstration.
After downloading, double click the file (in windows) to begin the installation process.
The following several images will take you through the normal installation of gpg4win.

On this window it tells you the version of Gpg4win you are about to install. Click the next
button to continue.

Read the License Agreement, and if you agree to it click next to continue.

If you chose another version of Gpg4win there will be different options listed here. In that
case close the one you want and then click next to continue.

Chose a custom installation destination or leave the default as C:\Program Files


(x86)\GNU\GnuPG and click next to continue.

Chose the options that best fit your needs. I recommend not adding to the Quick Launch
Bar. When ready, click next to continue.

If you chose the option to add to Start Menu, this window will appear. Just leave it as is
and click next.

If all goes well you will see this window appear informing you that the installation
completed successfully. Click Next, and Click Next again on the last screen to complete
the installation and return to desktop.
You should see a desktop Icon entitled Kleopatra. Double click the icon to start the
program. The following pictures will explain the next steps.

At the main Kleopatra window click the file menu in the upper left.

Here click the option that best fits your needs. Note a Certificate Authority will govern the
certificates made by selecting the second option. I do not recommend using the second
option until you are more comfortable in using encryption and understand how it works.
Until then, there is no need to involve a CA especially when its just for learning purposes
as in this example. Therefore, for this example select the option to Create a personal
OpenPGP key pair.

Once Create a personal OpenPGP key par is clicked the window above appears. Fill in all

required fields in this form. Note as its just a personal key locally used and generated any
name or email address will work. However, if using a Certificate Authority, your real
name and actual email address must be provided. I also recommend this if creating a
personal key pair that you intend to share with another youll communicate with via email
or by some other online means. Although that is up to you as it may work fine without.
Clicking Advanced will allow you to choose the encryption algorithm such as RSA to use
with the certificate. You can also just leave it along and click next to continue.

With all necessary information now provided, just click the create key button to
continue.

This window will prompt you to enter a passphrase that will be needed and used for the
keys which you will need to remember. It will inform you if your passphrase is too weak.
In that case ensure it is at least 8 characters in length and has letters numbers and a special
character. Once it accepts the passphrase continue to the last step below.

This window will appear informing you that the keys were successfully created. I
recommend making a backup of your key pair. However, you chose whichever option fits
your needs and then click finish.
As I do not wish to include additional pictures needlessly, for further information on using
Gpg4win there are numerous step by step tutorials that can be found on YouTube that
walk users through how to use and successfully implement Gpg4win as well as Gnu
Privacy Guard to encrypt and decrypt data.
Chapter Summary:
Within chapter 7 we discussed a number of different Modern Ciphers that have been used
since the 1950s. The main categories of modern ciphers consist of symmetric ciphers,
asymmetric ciphers, block ciphers, and a combination of them used within a single
cryptosystem. RSA was the first Public Key Encryption used that gained widely accepted
use throughout the world. It is still used today, although usually within certain
cryptosystems that used it in conjunction with asymmetric cryptographic algorithms. Data
Encryption Standard (DES) as well as its immediate successor Triple Data Encryption
Standard (3DES) use symmetric algorithms to encode and decode data and were industry
accepted standards which are also still in use today. Several varieties of email encryption
to send electronic mail securely ensuring the content of a message is kept confidential and
unintelligible to unauthorized parties intercepting the messages. Additionally, this chapter
also discussed other Public Key cryptosystem including Pretty Good Privacy (PGP) and
Public Key Infrastructure (PKI) as well as Secure Socket Layer IPSec, and Diffie-Hellman
Key Exchange. Concepts involved within Public Key Infrastructure focusing on Digital
Certificate and Digital Signatures as well as PKIs emphases on Confidentiality, Integrity,
Authorization, Authentication and Nonrepudiation were touched upon. Several examples
of implementing encryption for use with email communications, and things people should
consider before making a decision on whether or not to encrypt their Smartphones data.

The chapter ended with a discussion on wireless router security. Standards discussed were
WEP, WPA, and WPA2. Flaws to Wired Equivalent Privacy as well as its successor Wi-Fi
Protected Access that make them vulnerable to attack methods were mention. After
reading this chapter the reader should be versed with several types of modern
computerized encryption algorithms utilized today to ensure our private information stays
private.

Chapter 8: The Future of Cryptography


This chapter is a discussion of new social and legal developments arising from the use of
encryption technologies. Arguments from both Privacy Advocates and National Security
Advocate will be presented. The chapter will touch on a few recent US cases, and
highlight a sweeping trend internationally with multiple nations passing new surveillance
legislation focusing on banning or limiting the use of encryption. As such the political side
of this issue will be briefly touched upon. This chapter ends with a discussion on court
decisions, and a few author insights. Following the end of this chapter the book ends with
general closing thoughts, book summary and recommended supplemental readings from
other authors readers might find of interest.

8.1 Legal Developments in cryptography:


There are currently two sides to this prevalent discussion today. They comprise of Privacy
Advocates, and National Security Advocates. While Politicians currently debate this issue
until futility, I will discuss arguments by Privacy Advocates including the individuals
rights to privacy, and against unreasonable search and seizure, followed by arguments
from advocates on the National Security end of this discussion.

8.2 Privacy Advocate:


There are currently two sides to this prevalent argument today. I will discuss the
individuals right to privacy at this time. Although the laws differ from country to country,
in the United States, the Bill or Rights comprises the first 10 amendments of our
Constitution. These amendments specifically state individuals have certain inalienable
rights. Some of particular importance to cryptography includes the following. The Fourth
Amendment of the United States Constitution provides individuals with an expectation of
privacy, and protections against unreasonable search and seizures. The only exception to
this is upon probably cause. This directly impacts discussions within this book as
individuals expect that their electronic information will be private and secure. This is done
today by the use of encryption. The Ninth Amendment, states no enumeration in the
Constitution of certain rights shall not be construed to deny or disparage others retained by
the people. One could interpret this as it applies to electronic information, as no future
laws may infringe upon the essential inalienable rights of the people as found within the
Bill of Right of this US Constitution. Privacy advocates have a righteous argument when
they argue for our continued expectation of privacy and right against unreasonable search
and seizure of our electronic data. This is especially true as they continuously oppose
various Government Sanctioned intrusions that infringe upon those rights. Anyone that
has read George Orwells 1984 knows the futuristic surveillance society he depicted
within his book had not arrived when the year 1984 did arrive. However, the majority of
his nightmarish surveillance society accounts as depicted within his book 1984 have since
become our reality as we continue to live within this turmoiled world of ours. One could
argue his fictional account was a prediction of the human behavior he witnessed occurring
within society during his time. In writing 1984 he may have been warning us in the hopes
we would hold off the rise of becoming a surveillance society that has now arisen within
not only national borders, but within all international borders globally as well.

8.3 National Security Advocates:


National Security or as it is now generally dubbed Homeland Security today, is one of the
most important endeavors a nation must undertake to secure not only its borders, but more
importantly the greater well being of all its citizens. Law Enforcement and Federal agents,
especially those involved in Homeland Security efforts have valid concerns that should be
addresses. In a technological world where nearly everyone has everything digitized,
logged, accessed, uploaded, downloaded, streamed, and or broadcasted electronically most
notably through modern social media, the vast amount of digital footprints people leave
behind daily can greatly aid investigators. Towards the end of the Information Age and
especially after the onset of the Digital Age, investigators began to realize this and sought
ways to identify, document, collect, and analyze electronic evidence in the hopes the
evidence would aid in the successful resolution of cases. However, as technology
advances so does the capabilities of nefarious entities ranging from criminal organizations
through terrorist groups. Especially when focusing on anti-terrorism, several terrorist
groups that were once exceedingly disorganized have become extremely well organized.
As they employ greater organization and achieve greater levels of sophistication in their
wicked endeavors, their ability to mask their electronic activities also increases. This has
included the use of encryption. Modern encryption is continuously increasing in strength
and it is proving harder and harder for officials to break to obtain the evidence they seek.
So you see there are sound arguments on both sides of this issue. This is the dilemma that
all those in pursuit of peace within our Society now face within the digital and physical
worlds we live within today.

8.4 Global Trends Leaning Toward Evasive


Surveillance Legislation:
One of the legal developments being argued by some security advocates states that all
forms of encryption must be banned. Others argue that instead of banning encryption,
companies developing tech products should provide the Government with encryption
Master Keys. In other words, governmentally controlled Master Encryption Keys for each
form or type of encryption currently in use as well as all new forms of encryption the
future may hold. This was seen after the San Bernardino mass shooting case involving the
suspects encrypted iPhone. Chiefs from Law Enforcement and Security Agencies now
call for talks on encryption verses safety and urge legislators to take action on this issue.
Everyone needs to understand that this is not just a concern to be argued within the United
States legislation. Various countries are in the process of developing surveillance laws that
directly affect the use of encryption technologies needed to secure data.
According to Patrick Howell ONeil of The Daily Dot as well as other sources, sometime
in June 2016, Russia passed sweeping legislation establishing new surveillance laws.
Among the contents within the legislation established to increase Russias intelligence
gathering spy operations are specified rules that requires encryption backdoors be
implemented and provided to the Russian government. Companies that operate apps or
services within Russia, must provide the government with all encryption keys their
companies and customers utilize allowing Russias FSB the ability to look through all
internet based traffic encrypted or unencrypted that flows through their countrys
information infrastructure.
Russia is not the alone entity in their pursuit to adopt new surveillance legislation. The UK
is currently pursuing their own surveillance legislation. Their surveillance bill according
to reports has the power to limit end-to-end data encryption also called point-to-point
encryption. This would essentially undermine the use of Virtual Private Networks (VPNs)
that many companies, governments, and people rely upon when accessing sensitive data
online. France continues to examine possible changes within their existing anti-terrorism
legislation. Their current concerns seem to be during active anti-terrorism investigations.
This appears to involve increased penalties against any company or individual corporate
executives who refuse to aid the government in cracking encryption algorithms during
active investigations. These penalties include harsh fines, and imprisonment. Hungry has
introduced its new surveillance legislation which partially focuses on companies not to
limit end-to-end encrypted, but to conduct their own private in-house surveillance
operations on all users of the electronic services provided by their company, and disclose
their findings to government officials. Failure to do so will result in excessive penalties.
The United States has conducted its own surveillance operations for years now. More
recently, another attempt by legislators is to pass laws that require all e-commerce
companies including social media services to create easily accessible backdoors. Unlike
previously mentioned, they would not provide the government with encryption keys
directly. Instead, if authorities request access to a users encrypted data, the companies

would open it and provided the unencrypted intelligible versions to authorities promptly. I
happen to agree with this view partially. Being forced to provide authorities with any and
all requested information without probable cause should not be allowed. If probable cause
can be established and a warrant conveyed to companies presented with such requests, I
believe it is their duty to humanity to cooperate with the authorities submitting the request.
On the other hand, creating an easy to access backdoor is really not a solution to better
protect anyone.

8.5 The Political side of this issue:


Regardless of the legislations country of origin, with all the terror related attacks
occurring worldwide, legislators are under immense pressure to do sometime. However,
with such pressure on legislators, if they allow fear to dictate their actions, they tend to act
rashly without thinking things through thoroughly. They do so just to be seen by voters as
having done something. However, this tends to infringe upon the rights of their citizens
under the camouflage of a necessity for security. Since legislatures are not experts on the
fields they tend to create and impose laws upon, they do so without truly comprehending
all aspects of issues or the resulting fallout and mayhem from poorly drafted legislation.
Giving credit to some legislators, some do seek advice from experts within given fields.
Many of these legislators even choose to follow good advice. Although many also either
choose not to follow the advice or the advice given was haplessly supplied. Keep in mind
that even in Academia, internationally recognized experts often have drastic differences in
opinion concerning how best to handle certain issues even with their well informed wealth
of knowledge on the subject matter being discussed. As such, it is difficult to make good
legislation without in-depth knowledge on the given subject matter being acquired prior to
the drafting of legislation. With the biggest tech lobbyists from Silicon Valley firmly
opposed to creating encryption backdoor and other such potential legislation warning that
such action would have consequences resulting in making Americans even more unsecure
and vulnerable to attacks then the risks currently present today. Giving the greater risk of
victimization, Silicon Valleys stance on this issue seems to firmly stand on solid ground.
It should be noted that although not usually the case, there are some good ideas being
developed for legislative consideration. Some of these include acknowledging the right for
citizens to use encryption to secure data and information stored or transmitted
electronically; prohibit governmentally compelled key escrows or key recovery databases
which force companies to provided the government with all encryption keys similar to
Russias current legislation; Require corporations and organizations to provide any
reasonable assist if possible to aid investigative authorities with encrypted evidence upon
receipt of a lawful warrant; as well as Prohibit the use of encryption for purposes of
authenticating or identifying civilians when they are electronically connected to
government networks as this could be considered an electronic identification card.
Although these are good ideas that have been seen in proposed bills, other sections of the
same bills contain lots of poorly thought out ideas which could make matters even worse
and citizens more unsecure and vulnerable to victimization than ever before. These are
just some of the many concerns and issues politicians and legislators face and grapple with
today when proposing new legislation.

8.6 US Court decisions:


An extremely important decision from the US Supreme Court came on Wednesday June
25, 2014. In their landmark decision, they discussed an individuals right to privacy
specifically concerning the information within their Smartphones. The Court recognized
the intricate role that our Smartphones play in our modern life when they gave their ruling.
It can be interpreted as stating that a persons information within their Smartphones has
the same reasonable expectation of privacy as the property contained within their home by
saying authorities cannot search through the information within the Smartphones or cell
phone of people that they arrest without first obtaining a warrant by showing probable
cause that the information within the phones are vital for a successful prosecution or an
ongoing investigation. In their ruling, Chief Justice Roberts wrote that the possibility that
evidence contained within the incarcerated individuals phones could be remotely wiped
or encrypted was remote, speculative and essentially capable of being address without
infringing on their privacy. The ruling stated that police may search the physical phone for
dangerous items just as hidden razors or other items that could potentially cause physical
harm to others, but data within the phones could not potentially physically threaten or
endanger anyone. Chief Justice Roberts went on to say, to address the concern of remote
wiping or post encryption applications, the police could simply turn off the phone and
remove its battery thus preventing any remote manipulation from occurring. Before
ending their decision the Court also stated that if exigent circumstances were present in
the case at hand than the police would at that time be allowed to legally search the
contents within a phone of a person. Exigent circumstances simply means that the police
have probable cause but do not have sufficient time to obtain a warrant due to an
immediate urgency to prevent physical harm to the authorities or others, prevent
destruction of relevant evidence, suspects attempting to flee, or to prevent other immediate
action being taken in an attempt to thwart law enforcement efforts. The bottom line is that
with this Supreme Court decision, one could realistically conclude the information within
all our modern computing technologies are held to the same protections against
unreasonable routine searches and seizures that have been upheld concerning the data
within our phones. In another case, the defendant Ramona Fricosu was ordered to
cooperate with authorities by providing them with the unencrypted contents of her
encrypted hard drive. The judge argued that since the prosecution was already aware of
the specific evidence on the drive, it was no different then the prosecution asking her to
produce a specific paper document the prosecution has identified is crucial to their
investigation. Other cases may involve more urgent need such as situations involving
stalking, threats, or other scenarios where exigent circumstances exist to prevent imminent
or continuing harm to others from occurring. Terrorism cases are definitely among those
where exigent circumstances pertains to obtaining encrypted evidence. In yet another case,
the US Eleventh Circuit Court of Appeals ruled that authorities could not force a
defendant to decrypt the contents of a hard drive in a case where no probable cause has
been shown to secure a search warrant for electronic evidence and the contents of the
drive are unknown to the prosecution. While existing case law upheld the use of
encryption, that does not mean suspects do not have to provide the encrypted files

authorities request. The law states that you must furnish the information upon request
provided the authorities have met the essential requirements needed to show that probable
cause has been met to secured a lawful search warrant and have it in hand to present to the
person of interest. However in interpreting these rulings, we see that if no probable cause
could be justified to secure a lawful warrant, than authorities have no grounds to have
access to any encrypted data within an individuals electronic device.

8.7 Authors Insights:


It is my belief that banning the use of encryption, limiting its implementation so
excessively to utterly insecure levels, or requiring encryption developers to provide
officials with governmentally control Master Keys are extremely unrealistic solutions and
will prove utterly fruitless. First, when has banning something ever stopped people from
doing a thing. If their intentions are to do it, they will find a way to do it. Encryption is no
exception in this respect. Does that make it right? No, especially not when their intentions
are to maliciously harm others, or themselves through substance abuse. However, that is
the way of things in the world we live within. Almost all investigators worldwide will
attest to that statement basing it on their own experiences to back it up. If criminals are
already finding ways through existing encryption algorithms, if encryption is banned or
weakened to insecure levels, it will be even easier for them to steal your information, data,
and identities then ever before. Additionally, if they go the Master Key route, government
officials will exceedingly go out of their way to reassure citizens the keys are securely
kept and will only be used when appropriate. Even if people believe such statements, with
the government having them, the criminals will soon find a way to obtain them too. This
can also be said concerning creating easily accessible backdoors. If created, the
procedures needed to access these backdoors will fall into the hands of criminal elements.
Subsequently, the criminal elements would also likely veer from using established
encryption algorithms themselves. In this event, it is foreseeable they would develop their
own much stronger encryption algorithms which the government would have no master
key they could utilize or easily accessible backdoor companies could utilize to decrypt
potential evidence to aid the authorities with their ongoing investigations. In the end, this
line of thinking will only make their own efforts to gain valuable electronic evidence even
harder than before. Since absolute security is an impossibility in the physical world, it is
also impossible within the digital world. With worldwide legislation being passed
concerning the implementation and use of encryption on such vast levels, I thought this
was the best time to release this book, as potential new legislation could foreseeability ban
even writing about cryptography unless previously authorized to do so in advance by a
government authority. Many legislators might say to this that they are not interested in
banning all cryptography only modern computerized encryption as hand written codes are
easily cracked by todays modern computing technologies. However, this thinking is
illogical. While there are other examples to choose from, I present the one that will likely
make my point loud and clear. How many people and advanced computers have tackled
the remaining 3 over 40 year old still unsolved hand written Zodiac Ciphers to no avail.
Cryptosystems do not need to be computer generated to be extreme hard to break after all
it took archeologist several thousand years to break the code used for Ancient Egyptian
Hieroglyphs which was only achieved with the aid of the Rosetta Stone. You see, once
legislation start down a path to restrict encryption on this level globally, it is foreseeable
that all forms of cryptography will follow soon thereafter. Therefore, I do not support the
notion of providing the government with master keys, placing restrictions on encryption
limiting it to utterly unsecure levels, forcing companies to create easily accessible
backdoors to user encrypted data, or banning encryption technologies which will only

serve to provide criminals with carte blanche access to everyones electronic information
whenever they want, to do with whatever they desire unabated. Developing legislation
leaning towards creating surveillance states will only result in an artificial sense of
security, completely erode any countries law abiding citizens remaining expectation of
privacy, and will likely result in little to no real world tangible proof that surveillance
legislation has better secured any countries national boarders from criminal activities
beyond the capabilities in which they had already possessed prior to passing such evasive
legislation. However, I do support the development of improved cryptanalysis training
programs, increase funding to improve cryptanalysis technologies that investigative
authorities can utilize to aid in their investigations, as well as legislation and other
technologies that when implemented correctly aid investigators in gaining access to the
encrypted evidence they need for their investigations without infringing upon the
individual citizens reasonable expectation of privacy especially not when imposing such
legislation would promote environments criminals can exploit to steal personal
information essentially make every citizens digital information more unsecure in the
process. From an intelligence gathering perspective, the idea of such legislation sounds
great. However, from a law enforcement perspective, it will prove to be nightmarish.
Criminals already have easy enough access in which to steal private information or misuse
technologies to advance their criminal endeavors such as Identity Theft, Malicious
Hacking, Insurance or Financial Fraud, Extortion, Embezzlement, Corporate Espionage,
Cyber-Stalking, Cyber-Defamation, Cyber-Terrorism and the proliferation of malware
usage to name but a few. Passing poorly drafted legislation will only aid these criminal
elements by making it even easier for them to do so in the future. How does this better
protect anyone from being victimized?

General Closing thoughts:


Id like to close this book in a unique way. Contrary to how the arguments in the last
chapter sound, Im the eternal optimist. As such, I leave you all with this thought. I have
great hopes that people will see how trends within their own communities and how many
currently see things are contributing to societal chaos. Constantly stating you want to talk,
but in-fact only wanting to be in a state of continuously yelling at each other with earplugs
in so you cannot hear, or needlessly killing, maiming, or harming each others, as well as
rioting or destroying your own communities or historical/cultural heritage accomplishes
nothing but perpetual havoc. Only when individuals within each community worldwide
recognize they must first start looking within themselves to fix problems rather than
keeping the statuesque shadowing deceptive leaders who continually blame external
sources rather then take responsibility for their own actions can progress truly begin. Only
when we break from this alarming trend, and begin to adopt a better outlook within our
own lives and then apply it to how we interact with others as we deal with those from
other communities, can genuine cooperation, understanding, mutual respect and true
peaceful relations be achieved within both the digital world and especially within the
physical world in which we are all part of, share and live within.
In keeping with the traditions of the Franciscan Order of the Roman Catholic Church, I
leave you by saying the following to each and every one of you reading this book.
The contents of this table were translated into multiple languages:

Thank you for taking your valuable time to read this book! It is appreciated!

Summary:
This book provides a brief introduction of Cryptography. It emphasizes a multidisciplinary approach as it introduces the reader to this field. This approach utilizes fields
within Computer Science, Cybersecurity, Forensic Analysis, and various branches of
Mathematics. Ciphers discussed range from those used in Ancient Times through Modern

Computerized Encryption Algorithms. Topics include Classical Ciphers, Mechanical


Ciphers, Modern Encryption, DIY exercises, real-world professional applications as well
as cryptography that everyone in our modern world encounters on a daily basis. The book
ends with a discussion on Legal Issues touching on arguments from Privacy Advocates,
National Security Advocates, the Political side of this issues as well as recent international
legislation, court decisions, and author insights. In attempting to highlight the applications
of Cryptography within the fields of Law Enforcement, Archeological, National Security,
and Cybersecurity as well as securing household wireless technologies, Smartphone and
email security, e-commerce, and Ciphers people encounter daily within Movies,
Television Shows, and Modern Video Games illustrate the need for everyone to have at
least a basic understanding of how Cryptographic technologies are employed within their
daily lives to protect their identity, and ensure their electronic information remains
confidential and secure.

Answer sheet:
Chapter 4 DIY Exercise 2 Frozen/Tolkien Runes:

Translates to:
Elsa and Hans like myfontfree.com
Chapter 4 DIY Exercise 3 Ancient Egyptian:

translates to:
THIS IS THE TOMB OF
SETH-PERIBSEN
PHARAOH OF THE 2ND
DYNASTY OF EGYPT
Chapter 4 DIY Exercise 4 Klingon:

translates to:
Gowrons orders are to engage the cloak!
The answers to the coded messages located in Chapter 5 are as follows:

Translates to:
I wanted to see if a single person was still awake. Additionally, if they paid attention when
looking through this text.
and the mixed Shift and Transposition Cipher
JRZU
RGRN
Translates to:
using Caesar Cipher to first decode pass one, and rail fence read diagonally, the message
reads:
Good Work

Recommended Supplemental Reading:


This list of books is provided for those interested in learning more about Cryptography,
Cryptanalysis, and Cybersecurity. It is not presented in any specific order: Also, note if
purchasing or renting for a class, to avoid acquiring the wrong book check with the
instructor/professor as they may require a specific edition and or web access.
1. M. Whitman and H. Mattord. Principles of Information Security, (Course
Technology, 5th Edition 2015) https://www.amazon.com/Principles-Information-SecurityMichael-Whitman-ebook/dp/B00MEPCWDC/ref=mt_kindle?
_encoding=UTF8&me=#nav-subnav
2. C. Swenson. Modern Cryptanalysis, (Wiley Publishing, Inc., 1st Edition, 2008)
https://www.amazon.com/Modern-Cryptanalysis-Techniques-Advanced-Breakingebook/dp/B008NBZ59E/ref=mt_kindle?_encoding=UTF8&me=#nav-subnav
3. P. Dey, T. Raj and A. Singh. Classical Cryptography, (Amazon Digital Services LLC,
2016)https://www.amazon.com/Classical-Cryptography-Prashant-Kumar-Deyebook/dp/B01FY8AXX6/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1470772281&sr=11&keywords=Classical+Cryptography#nav-subnav
4. M. Ciampa. Security+ Guide to Network Security Fundamentals, (Course
Technology, 4th Edition or Higher)https://www.amazon.com/Security-Guide-NetworkFundamentals-ebook/dp/B00B7KLKRE/ref=sr_1_1?s=digitaltext&ie=UTF8&qid=1470772991&sr=11&keywords=Ciampa+Security%2B+Guide+to+Network+Security+Fundamentals#navsubnav
5. M. Whitman, H. Mattord. Guide to Network Security, (Course Technology, 1st
Edition, 2013)https://www.amazon.com/Guide-Network-Security-Michael-Whitmanebook/dp/B00B6FKT9A/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1470773411&sr=11&keywords=Guide+to+Network+Security+whitman#nav-subnav
6. H. John. Cryptography Demystified, (McGraw-Hill Education, 1st Edition,
2002)https://www.amazon.com/Cryptography-Demystified-John-Hersheyebook/dp/B0060JOINU/ref=sr_1_1?s=digital-text&ie=UTF8&qid=1470773708&sr=11&keywords=Cryptography+Demystified#nav-subnav

Das könnte Ihnen auch gefallen