Assignment 2

1. Case Study: Identify and discuss in brief a recent Case Study of any modern
information system, application or organization where any Asymmetric Key
Cryptography Algorithm (e.g. RSA, Diffie-Hellman Key Exchange, Elliptic
Curve Cryptography etc.) is used.

Asymmetric key Cryptography also known as the Public-key cryptography

refers to a cryptographic system requiring two separate keys, one of which is
secret and one of which is public. Although different, the two parts of the key
pair are mathematically linked. One key lock or encrypts the plaintext, and the
other unlocks or decrypts the cipher text. Neither key can perform both
functions by itself. The public key may be published without compromising
security, while the private key must not be revealed to anyone not authorized
to read the messages. Public-key cryptography uses asymmetric key
algorithms (such as RSA), and can also be referred to by the more generic
term "asymmetric key cryptography." The algorithms used for public key
cryptography are based on mathematical relationships that presumably have
no efficient solution. Although it is computationally easy for the intended
recipient to generate the public and private keys, to decrypt the message
using the private key, and easy for the sender to encrypt the message using
the public key, it is extremely difficult (or effectively impossible) for anyone to
derive the private key, based only on their knowledge of the public key.
Therefore, unlike symmetric key algorithms, a public key algorithm does not
require a secure initial exchange of one (or more) secret keys between the
sender and receiver. The use of these algorithms also allows the authenticity
of a message to be checked by creating a digital signature of the message
using the private key, which can then be verified by using the public key. In
practice, only a hash of the message is typically encrypted for signature
verification purposes.

In real world asymmetric key is mostly used in bitcoin or cryptocurrency.

Bitcoin (₿) is a cryptocurrency. It is a decentralized digital currency without
a central bank or single administrator that can be sent from user to user on
the peer-to-peer bitcoin network without the need for intermediaries. It uses
public-key cryptography, in which two cryptographic keys, one public and
one private, are generated. At its most basic, a wallet is a collection of these
keys. There are several modes which wallets can operate in.

First is public key cryptography. Each coin is associated with its current owner's
public ECDSA key. When you send some bitcoins to someone, you create a
message (transaction), attaching the new owner's public key to this amount of
coins, and sign it with your private key. When this transaction is broadcast to
the bitcoin network, this lets everyone know that the new owner of these coins
is the owner of the new key. Your signature on the message verifies for
everyone that the message is authentic. The complete history of transactions
is kept by everyone, so anyone can verify who is the current owner of any group
of coins.
This complete record of transactions is kept in the block chain, which is a
sequence of records called blocks. All computers in the network have a copy of
the block chain, which they keep updated by passing along new blocks to each
other. Each block contains a group of transactions that have been sent since
the previous block. In order to preserve the integrity of the block chain, each
block in the chain confirms the integrity of the previous one, all the way back to
the first one, the genesis block. Record insertion is costly because each block
must meet certain requirements that make it difficult to generate a valid block.
This way, no party can overwrite previous records by just forking the chain.
To make generating bitcoins difficult the Hash cash cost-function is used. Hash
cash is the first secure efficiently verifiable cost-function or proof-of-work
function. The beauty of hash cash is that is non-interactive and has no secret
keys that must be managed by a central server or relying party; hash cash is
as a result fully distributed and infinitely scalable. (Hash cash uses symmetric
key cryptography, namely a one-way hash cash function - typically either SHA1
or SHA-256).
In bitcoin, integrity, block-chaining, and the hash cash cost-function all
use SHA256 as the underlying cryptographic hash function.
A cryptographic hash function essentially takes input data which can be of
practically any size, and transforms it, in an effectively impossible to reverse or
to predict way, into a relatively compact string (in the case of SHA-256 the hash
is 32 bytes). Making the slightest change to the input data changes its hash
unpredictably, so nobody can create a different block of data that gives the
same hash. Therefore, by being given a compact hash, you can confirm that it
matches only an input datum, and in bitcoin the input data being a block-chain
is significantly larger than the SHA-256 hash. This way, Bitcoin blocks don't
have to contain serial numbers, as blocks can be identified by their hash, which
serves the dual purpose of identification as well as integrity verification. An
identification string that also provides its own integrity is called a self-certifying
identifier.
The hash cash difficulty factor is achieved by requiring that the hash output has
a number of leading zeros. Technically, to allow more fine-grained control than
Hash cash number of leading 0-bits method, Bitcoin extends the hash cash
solution definition by treating the hash as a large big-endian integer and
checking that the integer is below a certain threshold. The hash cash cost-
function iterates by perturbing data in the block by a nonce value, until the data
in the block hashes to produce an integer below the threshold - which takes a
lot of processing power. This low hash value for the block serves as an easily-
verifiable proof of work - every node on the network can instantly verify that the
block meets the required criteria.
With this framework, we can achieve the essential functions of the Bitcoin
system. We have verifiable ownership of bitcoins, and a distributed database
of all transactions, which prevents double spending.
2. Case Study: Identify and discuss in brief a recent Case Study of any modern
information system, application or organization where any Symmetric Key
Cryptography Algorithm (e.g. DES, 3-DES, AES etc.) is used.

Symmetric-key cryptography refers to encryption methods in which both the

sender and receiver share the same key. Symmetric key ciphers are
implemented as either block ciphers or stream ciphers. A block cipher
enciphers input in blocks of plaintext as opposed to individual characters, the
input form used by a stream cipher. The data Encryption Standard(DES) and
the Advanced Encryption Standard(AES) are block cipher designs which
have been designated cryptography standards by the US government
Despite its deprecation as an official standard, DES remains quite popular, it
is used across a wide range of applications, from ATM encryption to email
privacy and secure remote access. Many other block ciphers have been
designed and released, either considerable variation in quality. Many have
been thoroughly broken, such as FEAL. Stream ciphers, in contrast to the
‘block’ type, create an arbitrarily long stream of key material, which is
combined with the plaintext bit-by-bit or character –by-character, somewhat
like the one-time pad. In a stream cipher, the output stream based on a
hidden state which changes as the cipher operates. In present day
cryptography, AES is widely adopted and supported in both hardware and
software. Till date, no practical cryptanalytic attacks against AES has been
discovered. Additionally, AES has built-in flexibility of key length, which allows
a degree of ‘future-proofing’ against progress in the ability to perform
exhaustive key searches. However, just as for DES, the AES security is
assured only if it is correctly implemented and good key management is
employed.
The Advanced Encryption Standard, or AES, is a symmetric block
cipher chosen by the U.S. government to protect classified information and is
implemented in software and hardware throughout the world to encrypt
sensitive data.
Working - AES comprises three block ciphers: AES-128, AES-192 and AES-
256. Each cipher encrypts and decrypts data in blocks of 128 bits using
cryptographic keys of 128-, 192- and 256-bits, respectively.

Usage - AES is implemented in secure file transfer protocols like FTPS,

HTTPS, SFTP, AS2, WebDAV’s, and OFTP. But what exactly is its role?

Because symmetric and asymmetric encryption algorithms each have their own
strengths, modern secure file transfer protocols normally use a combination of
the two. Asymmetric key ciphers a.k.a. public key encryption algorithms are
great for key distribution and hence are used to encrypt the session key used
for symmetric encryption.

Advantage of AES - Cracking a 128-bit AES key with a state-of-the-art

supercomputer would take longer than the presumed age of the universe. And
Box Cryptor even uses 256-bit keys. As of today, no practicable attack against
AES exists. Therefore, AES remains the preferred encryption standard for
governments, banks and high security systems around the world.