The Evolution Of Cryptography Information Technology Essay

The widespread use of computer technology for information handling resulted in the need for higher data protection whether stored in memory or communicated over the network. Particularly with the advent of Internet, more and more companies tend to bring their businesses over this global public network. This results in high exposure to threats such as theft of identities, unauthorized and unauthenticated access to valuable information. The need for protecting the communicating parties is evident not just from third parties but also from each other. Therefore high security requirements are important.

The usage of high profile cryptographic protocols and algorithms do not always necessarily guarantee high security. They are needed to be used according to the needs of the organization depending upon certain characteristics and available resources. The effective assessment of security needs of an organization largely depends upon evaluation of various security algorithms and protocols. In addition, the role of choosing security products, tools and policies can’t be ignored. The most important aspect of protection is the role of security consultant who defines the security requirements and characterizes the approaches to satisfy those requirements.

The communication system in a cryptographic environment may become vulnerable to attacks if the cryptographic packages don’t meet their intended goals. This master’s thesis is targeted towards the goal of evaluating contemporary cryptographic algorithms and protocols collectively named as cryptographic packages as per security needs of the organization with the available resources. The security requirements are characterized according to the standard model TCP/IP Protocol Suit which is then mapped upon the cryptographic packages with respect to available resources. The role responsible for this evaluation is the security consultant of the organization. I have used this theoretical model for the evaluation.

Introduction

2.1 Background

Information security has emerged as a demanding requirement in the recent years dramatically due to a high trend in communication of sensitive data. People use critical services over the insecure global communication infrastructure of Internet such as e-commerce, banking, ticketing etc. This has led to exposing the communicating parties to severe threats such as confidentiality breaking, data and identity theft, integrity violations and lack of confidence between communicating parties. This is one of the main reasons of putting high demand on the security of information and communication systems.

Cryptography provides solution to the problems of confidentiality, integrity, authentication and key management. The solutions can be implemented in different kinds of applications. These applications may be standalone or running on the World Wide Web, the Internet. The major problem is the selection of a cryptographic package according to the needs and available resources of the organization. The best cryptographic package doesn’t always prove to be a good solution. If the package doesn’t meet its intended goal of providing security with given available resources then it certainly is going to lead to severe problems. One of the approaches is to evaluate the cryptographic solution in a simulated environment according to the available resources and given security parameters. Based on the performance results, the solution should be deployed in the operational environment. The problem with this approach is that, currently the simulation software is limited to traditional protocols, having lack of support for cryptography. Work is in progress but currently it is not possible to simulate an environment for performance. Therefore this approach is not taken into account in this thesis.

The other approaches to solve the problem of package selection and evaluation are to assign the role to a dedicated person. The person uses a systematic way to define the security requirements and the approaches to satisfy those requirements, given with the available resources of the organization. This is the theoretical model which I have selected to use in this report. The primary benefit of this approach is not only its cost-effectiveness but it also keeps the responsible security officer well aware of the available resources and security requirements of the organization. Hence the method can be very effective to select the right combination of packages. The limitations of this approach are somewhat practical i.e. to verify that the given solution gives best results etc. For verification and testing purpose, some simulation environment is required which is not applicable currently due to the problems mentioned earlier. The process is completely dependent upon the responsible security officer which makes it a one man show and can be dangerous from a security point of view. The important thing is that the benefit of the proposed model bypasses the limitations and hence is selected as a basic task for this dissertation.

This thesis will looks at some of these problems and tries to evaluate some of the currently proposed protocols.

Aims and Objectives of the Study

The objective for this master thesis is to:

Evaluate contemporary cryptographic algorithms and protocols for communication systems.

The evaluation is based upon the performance of security parameters chosen in a given package such as key length. The evaluation was done theoretically. It was also desirable to compare the results with each other with respect to the given security criteria and security requirements.

The goal of this master’s thesis is to:

Get a general understanding of the security requirements of an organization.

Based on the requirements, propose the cryptographic solution.

Understand the pros and cons of the proposed solution.

Analyze and evaluate the protocols and algorithms from the proposed solution theoretically.

Produce a classification of the protocols with respect to performance.

Recommend a package for general communication systems to the organization.

Research Question:

What is the impact of cryptographic technology on different organizations?

What are the needs for adopting Cryptography in large organizations?

Literature Review

Computer Security

4.1.1 General

The advent of computers has given new horizons to the scope of security. The need for security solutions to provide authentication and integrity of data is evident. Particularly communication over the Internet such as e-commerce imposes high demands for security. The collection of tools, algorithms and protocols, which help to protect the data and insure secure communication of information during transit, is called information security, computer security or network security in general. There are no clear boundaries between these terms [1, pg 2] and hence we can use them interchangeably. All security service requirements relevant here are summed up in the CI + A criteria. Actually this stands for confidentiality, integrity and authentication which resemble to the CIA criteria which stand for confidentiality, integrity and availability. Since cryptography does not tackle the availability service, I disregard it from the CI + A criteria and replace it by authentication. This term is going to be used throughout this report.

The remaining part of this subsection is devoted to elaborating the CI + A criteria and the related security parameters.

Confidentiality:

Confidentiality means prevention of unauthorized disclosure of information [11, ch 1]. The disclosure may happen in a computer having stored information or during transmission over a network between hosts. Hence confidentiality tackles both stationary data and data during transit. The data during transit also includes control information such as TCP/IP communication or routing information. Confidentiality has few prerequisites. The first and far more important one is the physical protection of unprotected data. The second requirement is encryption of physically unprotected data. Access control has to be implemented in the computer systems. And the last one is the secure and correct implementation of protection mechanisms. Resource holding is another aspect of confidentiality, which is not dealt with in this report primarily. The solutions to the confidentiality problem are encryption and access control mechanisms, which is the basic subject of this report. I have separated the access control part and named it authentication which is elaborated in the subsections subsequently. Privacy and secrecy are other terms used in the same context but with very small difference. Here, the emphasis is on the user. Privacy usually is the protection of personal data while secrecy usually is the protection of organizational data.

Integrity:

Integrity means prevention of unauthorized modification of information [11, ch 1] or the trustworthiness of data or sources. The source integrity is as crucial as data integrity. We must be sure about the source of the data provider. If that is not trustworthy then it’s worthless to believe in the integrity of the data in hand. Integrity includes both data integrity and origin integrity. Data integrity means that the content of the information must be secured, while origin integrity refers to the source of data. The later is sometimes referred to as authentication. Integrity mechanisms fall in two categories namely prevention and detection mechanisms.

Prevention mechanisms maintain the integrity of the data by blocking unauthorized attempts to change the data or any attempts to change the data in unauthorized ways. The first occurs when a user tries to change the data which he/she has no authority to, while the later occurs when a user authorized to make certain changes tries to change the data in other ways.

Detection mechanisms do not try to prevent violations of integrity. They simply report that the data is no longer trustworthy. It is done by analyzing systems events, logs or data to detect anomalies. Evaluation of integrity is based on assumptions about the source of data and about trust in that source.

Integrity also refers to the assurance that received data is exactly as sent by an authorized entity and contained no modification, insertion, deletion or replay [1, pg 10]. The integrity services can be divided in to two areas. Connection-oriented integrity service deals with stream of messages and assures integrity during transit while connectionless integrity deals with individual messages’ modification only.

Authentication:

Authentication in the context of communication between two parties means, the assurance that the communicating entity is the one that it claims to be [1, pg 8]. It is concerned with assuring that a communication is authentic. There are two kinds of authentication services. Peer entity authentication means to provide confidence that an entity is not attempting either to masquerade as another entity or do an unauthorized replay of a previous connection [1, pg 9]. This process is carried out in the connection establishment phase of communications between two parties by exchanging some secret information unique to both parties. During the data transfer phase, the same associations are maintained to thwart the risk of replay of a previous connection. Data origin authentication means providing the assurance that the source or sender of received data is the one that claims to be.

This is a specific explanation of authentication, but the term also refers to the process of verifying an individual’s identity. The individual is asked to provide some form of proof of identity and the person provides proof for the stated identity. Authentication of users is based on what you know like password, what you have like ID cards and what you are like biometrics e.g. finger prints.

4.1.2 Threats

A potential violation of security is called a threat. The action that could cause the violation is called an attack and those who execute such actions are called attackers [11, ch 1]. Security attacks can be classified as active and passive. Passive attacks work without affecting the systems resources and using some system information to breach the security; while active attacks alter the system resources or cause the operation to be disturbed. Release of message contents is a type of passive attack in which the intruder learns the message contents by hijacking an active session. The content may have sensitive or confidential information, for example a file or email. Traffic analysis is a passive attack in which traffic patterns are analyzed to deduct important information. These attacks can be prevented by encryption but can’t be detected when they occur. Eavesdropping is another form in which the attacker uses some sniffer software to keep an eye on the communication. Wiretapping means direct physical reading of signals during communications.

Active attacks try to compromise the security by doing some modification to the data stream or by creating false streams. These attacks can be divided into different categories [1, pg 12]. Masquerading or spoofing is an impersonation of one entity by another. Or one entity pretends to be another. Delegation is a form of spoofing in which the second entity is authorized to function on behalf of other. The difference is that all communicating parties are aware of the identity of delegated person. Replay functions by capturing the data unit and retransmitting it to other parties. Denial of Service is another form in which the attacker prevents the use of resources. Smurf is an attack against availability, which is not treated in this report.

Cryptography

4.2.1 Basic Characteristics

It is evident from the history that people have always been trying to keep information away from their adversaries in one way or another. For example military officers tried to communicate with their troops by some means of secret writing so that the enemy could not get the sensitive information. In this information era, where the world is connected and information communication over non secure infrastructures is growing, more and more sophisticated methods are needed. These techniques of secure communication fall under the fascinating category of security which is named cryptography. Cryptography means secret writing. There are other terms such as cryptology and cryptanalysis which are used interchangeably but there is a small difference. Cryptology is a Greek word composed of two parts. Crypto means secret and logy means study. Hence cryptology means the study of secret writing. Cryptanalysis means the field of breaking a cryptographic algorithm. The cryptology term includes both cryptography and cryptanalysis, which means the study of secret writing and its analysis. Previously cryptography has been thought of as simply encryption but it has many services and huge application areas. Cryptography based solutions are increasing rapidly.

There are four main objectives of cryptography namely [10, pg 9], confidentiality, data integrity, authentication and non-repudiation. The later two are very much related topics and hence are combined in this report. This report takes into consideration only a few, but there are other key application areas of cryptography, which are encryption, digital signatures, hashing, authentication, secret sharing, key management and security protocols. There are basically two types of cryptosystems; one is classical cryptosystems that include both old age encryption techniques and conventional or symmetric key cryptography. The second one is called public key cryptography. Classical encryption techniques include different types such as substitution techniques, transposition techniques and a combination of both. The substitution and transposition techniques are building blocks of current modern block ciphers. The old age ciphers such as the Caesar cipher and others are very simple encryption techniques and hence not used in modern age. Therefore they are not considered for investigation in this master thesis. I just give a small introduction to these ciphers here.

In substitution technique, the letters of plain text are replaced by other letters or by numbers or symbols [1, pg 24]. The oldest of this kind is Caesar. The OTP (one time pad) is the strongest of this category, which is impossible to break but have some infeasibility. In transposition technique, we perform some sort of permutation on the plain text letters.

Cryptographic systems can be characterized in three ways [1, pg 27],

1. Method used to transform the plain text into cipher text such as substitution or transposition.

2. The number of keys used in the encryption or decryption algorithm such as single key which is also called secret key shared by sender and receiver in symmetric encryption scheme. The sender and receiver both use different keys in public-key encryption.

3. The plain text processing such as in block ciphers, where the whole plain text is divided into blocks of the same size. These blocks are then transformed to cipher text one by one at a time. In stream ciphers, the plain text is continuously transformed to output a stream one character at a time. The character is a general term which may be a single bit, byte or any small value.

4.2.2 Conventional OR Symmetric key Cryptography

Conventional encryption, symmetric encryption or single key encryption is by far the most widely used scheme and it was the only one which was used prior to the development of public-key encryption. There are five ingredients of symmetric encryption [1, pg 24].

Plain Text: The original message is called plain text.

Encryption Algorithm: The function that performs the transformation or substitution on the plain text. The process is known as encryption or enciphering.

Secret Key: The value independent of the plain text used as input to the encryption algorithm. The output is dependent on this key, and the security requires that it remains secret.

Cipher Text: This is the output of the encryption algorithm, which uses some form of alphabet but is not understandable. This is actually the transformed form of plain text after applying the encryption algorithm with a secret key.

Decryption Algorithm: This is the reverse of encryption algorithm. It transforms back the cipher text to the original plain text with the secret key as input. The general approach to break the symmetric encryption is cryptanalysis that also includes brute force.

·€ Cryptanalysis: The attacker uses the nature of the algorithm or some knowledge of the plaintext or some plain text-cipher text pairs. The ultimate goal is to find the key or deduct some plain text from the cipher text.

·€ Brute-Force Attack: All possible keys from the set of keys is tried to get some intelligible plain text from the cipher text.

There are five kinds of attacks on encrypted messages, cipher text only, known plain text, chosen plain text, chosen cipher text and chosen text. For detailed discussion one may refer to [1, pg 28]. Symmetric encryption schemes have different applications. Encryption not only provides confidentiality but can also provide authentication and integrity.

4.2.3Public-Key Cryptography

Public-key cryptography is the greatest revolution in the history of cryptography. It is also referred to as asymmetric cryptosystems. It has given new horizons to the concepts of confidentiality, integrity and authentication. The algorithms in this scheme are based on mathematical functions such as number theory, discrete logarithms or factorization rather than substitution and permutation. There are six ingredients in this scheme.

1. Plain text

2. Encryption algorithm

3. Public key

4. Private key

5. Cipher text

6. Decryption algorithm

The public-key cryptography offers three services and its applications can be categorized under these services, namely confidentiality or data secrecy through encryption/decryption, authentication through digital signatures and certificates, and key exchange. These can also be used to maintain the integrity. The short description of these services is as follows,

· Encryption/decryption: the sender uses the recipient’s public key to encrypt the message and the receiver uses his private key to decrypt the message.

· Digital Signature: the sender uses his private key to encrypt the message. i.e sign the message and the receiver uses his public key to decrypt the message.

· Key Exchange: A secret key is exchanged or a new key is established for further communication. Cryptanalysis: Like any other cryptographic scheme, public-key cryptography is vulnerable to brute force attacks and algorithm analysis. The mathematical nature of the algorithm is used to thwart the attacks, which can be based upon number theory, factorization or calculating discrete logarithms.

Research Methodology

The term research philosophy relates to the development of knowledge and the nature of that knowledge, it contains some important assumption about the way in which you view the world (Saunders et al., 2007).

Methodology is essentially the way in which the research will be undertaken. It includes which methods will be employed for data collection, what kind of data will be collected and a valid explanation of how the approach will correctly give an answer to the research questions. (Cameran, 2005)

(http://www.infolitics.com/images/br3.gif 13/01/10)

There are basically two types of research methodologies are used. One of them is qualitative research and the other one is quantitative. The qualitative research based on the statements like data it means that the data is not so figurative. But on the other hand, the quantitative research is more concerned with the numeric figures. “A Quantitative approach is one in which an investigator primarily uses post positivist claims for developing knowledge (i.e., cause-effect thinking, reduction to specific variables and hypothesis and questions, use of measurement and observation, and the test of theories), employs strategies of inquiry such as experiments and surveys and collects data on predetermined instruments that yield statistic data.” (Creswell, 2003)

Qualitative approaches includes interviews, surveys, diary methods, etc. but In-depth interviews are the most fundamental of all qualitative methods and are often claimed to be the best method for gathering information. Interviews can be structured, semi structured, focused, problem-centred, expert and so on. Questionnaires and statistical surveys are the most common quantitative approaches.

In this research, I will use qualitative research.

Collection of Data

There are two types of data that can be collected for the research, the primary data and secondary data. Primary data is the data that is original and has not been interpreted, whereas secondary data is the one which is already available and is collected after interpreting the primary data.

The source of primary data will be the data generated from the interviews and the answered questionnaires. This will be supported and complimented with sufficient and relevant secondary data from sources like market research reports, news articles, journals and publications, company press releases, company annual and quarterly reports and certain recognized websites.

To collect the primary data, I have planned to collect data from the different organizations. This collection of data will be done by questionnaires, surveys, and telephonic interviews.

Analysis

After the collection of data, I have planned to analyze the data. As I am doing qualitative research, the analysis methods are content analysis and grounded analysis methods. I will be using content analysis or grounded analysis methods to analyze the data collected by interview and questionnaires. All collected data will be analyzed according to their types and finally conclusion will be made. The data will also be presented in the form of graphs, charts and tables etc.6. References

[1] William Stallings, “Cryptography and Network Security- Principles and Practices – Third Edition”. Pearson Education, Indian Subcontinent, ISBN 81-7808-902-5.

[2] Jain R, “The Art of Computer Systems Performance Analysis: Technique for Experimental Design,

Measurement, Simulation and Modelling”, New York Wiley, 1991.

[3] Simovits M, “The DES: An Extensive Documentation and Evaluation”. Laguna Hills, CA: Aegean Park Press, 1995.

[5] Nechvatal J., et al, “Report on the Development of the Advanced Encryption, National Institute of Standards and Technology”, October 2, 2000.

[6] Nechvatal J, “Public Key Cryptography”. Piscataway, New Jersey: IEEE Press, 1992.

[7] Ford W, “Advances in Public-Key Certificate Standards”. ACM SIGSAC Review, July 1995.

[8] Akl S, “Digital Signatures: A Tutorial Survey”. Computer, February 1983.

[9] Diffie W and Hellman M, “Privacy and Authentication: An Introduction to Cryptography”. Proceedings of the IEEE, March 1979.

[10] Wade Trappe, Lawrence C. Washington, “Introduction to Cryptography with Coding Theory- 2nd Edition”. Pearson Education, ISBN 81-317-1476-4.

[11] Matt Bishop, “Introduction to Computer Security”, Addison-Wesley, 2004, ISBN-10: 0321247442, ISBN-13: 978-0321247445.

[12] R. Rivest, M.J.B. Robshaw, R. Sidney, and Y.L. Yin, “The RC6 Block Cipher,” Technical Report of RSA Laboratory, 1998.