A2.4.4 Describe the process of encryption and digital certificates.

Big Idea
Encryption transforms readable data into an unintelligible format, preserving confidentiality and integrity as information traverses untrusted networks. Digital certificates bind cryptographic keys to real-world identities, enabling parties to authenticate each other and establish encrypted channels. Together, these mechanisms underpin secure communication protocols such as TLS, ensuring that data in transit remains private and tamper-proof.

---

1. Symmetric vs. Asymmetric Cryptography

1.1 Symmetric Cryptography

• Single Shared Key: One secret key is used for both encryption and decryption.
• Algorithm Examples: AES (Advanced Encryption Standard), 3DES (Triple Data Encryption Standard).
• Process:
  1. Key Generation: A random key, typically 128 bits or longer, is generated.
  2. Encryption: Plaintext is processed in fixed-size blocks (e.g., 128 bits for AES) using the key and a mode of operation (CBC, GCM) to produce ciphertext.
  3. Decryption: The receiver applies the same key and mode to reverse the process.
• Strengths & Weaknesses:
  • Fast & Efficient: Hardware and software implementations can encrypt data at line speed.
  • Key Distribution Problem: Securely sharing the secret key between parties requires a separate trusted channel.

1.2 Asymmetric Cryptography

• Key Pair: Each entity has a public key (widely disseminated) and a private key (kept secret).
• Algorithm Examples: RSA, ECC (Elliptic-Curve Cryptography).
• Process:
  1. Key Generation: An asymmetric algorithm produces a mathematically linked public/private key pair.
  2. Encryption: Data encrypted with the recipient’s public key can only be decrypted with its private key.
  3. Digital Signature: The sender can sign a message hash using their private key; verification with the sender’s public key ensures authenticity and integrity.
• Strengths & Weaknesses:
  • Key Distribution Solved: Only public keys need wide distribution; private keys remain secure.
  • Computationally Intensive: Slower than symmetric methods, so often used to secure the exchange of a symmetric session key rather than bulk data.

---

2. The Role of Digital Certificates

A digital certificate is a data structure—most commonly conforming to the X.509 standard—that binds an entity’s public key to its identity (domain name, organization, etc.) via a trusted third party, the Certificate Authority (CA).

1. Certificate Contents
   • Subject identifier (e.g., “www.example.com”)
   • Public key
   • Validity period (start and end dates)
   • Issuer (CA name)
   • CA’s digital signature over the certificate fields
2. Certificate Chain
   • Root CA certificates are self-signed and distributed with operating systems or browsers.
   • Intermediate CAs sign end-entity certificates, creating a trust path back to a root.
3. Establishing Secure Connections (e.g., TLS Handshake)
   1. ClientHello: Client proposes supported cipher suites and TLS version.
   2. ServerHello & Certificate: Server selects parameters and sends its certificate chain.
   3. Certificate Verification: Client verifies each signature in the chain up to a trusted root and checks validity dates and revocation status.
   4. Key Exchange: Client uses the server’s public key (or parameters from ephemeral Diffie-Hellman) to establish a shared symmetric session key.
   5. Secure Channel: Both sides switch to symmetric encryption for bulk data.

By trusting the CA’s signature, the client ensures it is communicating with the legitimate server and not an imposter.

---

3. Public and Private Keys in Asymmetric Cryptography

• Public Key
  • Advertised openly (e.g., embedded in a certificate).
  • Used by anyone to encrypt data destined for the key owner or to verify signatures made by the private key.
• Private Key
  • Must remain confidential; its compromise breaks all security guarantees.
  • Used to decrypt data encrypted with the public key and to generate digital signatures.

Key Usage Patterns

• Hybrid Encryption: Asymmetric methods protect the exchange of a high-entropy symmetric key, combining the efficiency of symmetric ciphers with the distribution advantages of public-key cryptography.
• Digital Signatures: Ensures non-repudiation—only the private-key holder could have produced a given signature.

---

4. Encryption Key Management

Effective security depends as much on how keys are managed as on the strength of the algorithms. Key management encompasses:

1. Key Generation
   • Use hardware security modules (HSMs) or FIPS-validated libraries to generate cryptographically strong keys.
2. Key Storage
   • Private Keys: Store in encrypted form, preferably within an HSM or secured keystore protected by access controls and multi-factor authentication.
   • Public Keys & Certificates: Can reside in directories (LDAP) or be distributed via standard mechanisms.
3. Key Distribution
   • Symmetric Keys: Often distributed via secure key-exchange protocols (e.g., Diffie-Hellman within TLS).
   • Public Keys: Distributed in certificates; their validity is assured by CA signatures.
4. Key Rotation and Expiration
   • Regularly replace keys to limit the window of vulnerability if a key is compromised.
   • Certificate lifetimes are typically kept to one year or less to minimize risk.
5. Key Revocation
   • When a private key is suspected of compromise, its certificate must be revoked.
   • Revocation Mechanisms:
     • Certificate Revocation Lists (CRLs)
     • Online Certificate Status Protocol (OCSP)
6. Audit and Compliance
   • Maintain logs of key usage and administrative actions.
   • Periodically audit key-management procedures against standards (e.g., ISO 27001, NIST SP 800-57).

Below is a step-by-step worked example of how asymmetric (public/private key) encryption works in practice. We’ll use small numbers for clarity, but in real systems the primes are hundreds of digits long.

---

1. Key Generation

1. Choose two primes
   Let

   $p = 3,\quad q = 11$

2. Compute $n$ and $\varphi(n)$

   $n = p \times q = 3 \times 11 = 33$ $\varphi(n) = (p-1)\,(q-1) = 2 \times 10 = 20$

3. Pick the public exponent $e$
   Choose $e$ such that $1 < e < \varphi(n)$ and $\gcd(e,\varphi(n))=1$.
   Let

   $e = 3\quad (\gcd(3,20)=1)$

4. Compute the private exponent $d$
   Find $d$ satisfying

   $e \, d \equiv 1 \pmod{\varphi(n)}$

   Here, $3 \times 7 = 21\equiv1\pmod{20}$, so

   $d = 7$

5. Publish keys
   • Public key: $(e,n) = (3,33)$
   • Private key: $(d,n) = (7,33)$

---

2. Encrypting a Message

Suppose Alice wants to send the integer message

$m = 4$

to Bob. She uses Bob’s public key $(e,n)=(3,33)$ and computes the ciphertext $c$ as:

$c \;=\; m^e \bmod n \;=\; 4^3 \bmod 33 \;=\; 64 \bmod 33 \;=\; 31$

Alice sends $c=31$ over the network.

---

3. Decrypting the Ciphertext

Bob receives $c=31$. To recover $m$, he uses his private key $(d,n)=(7,33)$:

$m \;=\; c^d \bmod n \;=\; 31^7 \bmod 33$

Compute $31^7 \bmod 33$ efficiently by noting:

• $31 \bmod 33 = 31$
• $31^2 \bmod 33 = 961 \bmod 33 = 4$

• Then

  $31^7 = 31 \times (31^2)^3 \equiv 31 \times 4^3 = 31 \times 64 = 1984 \bmod 33 = 4$

Thus Bob recovers $m=4$, the original message.

---

4. Summary of the Flow

Step	Operation	Result
Key generation	$\,n=33,\;\varphi(n)=20;\;e=3;\;d=7$	Public $(3,33)$, Private $(7,33)$
Encryption (A→B)	$c=4^3\mod33$	$c=31$
Decryption (B)	$m=31^7\mod33$	$m=4$

This simple numeric example illustrates the core of RSA-style asymmetric encryption:

1. Public key $(e,n)$ encrypts—anyone can use it.
2. Private key $(d,n)$ decrypts—only the key holder can recover the message.

Conclusion
Encryption—both symmetric and asymmetric—secures data confidentiality, integrity and authentication, while digital certificates and rigorous key-management practices establish and maintain trust in networked communications. Mastery of these processes is essential for designing and operating secure systems in any environment where data flows over potentially untrusted networks.