Cryptography and authentication
Cryptography protects data in storage and in transit, and authentication confirms who someone is. Together they underpin online banking, shopping, and messaging.
Encryption basics
Encryption transforms readable plaintext into unreadable ciphertext using an algorithm and a key; decryption reverses it. Julius Caesar's cipher shifted letters by a fixed amount, which is easy to break. Modern algorithms are public and well studied; their security depends on keeping keys secret, not the method, an idea known as Kerckhoffs's principle.
Symmetric encryption
In symmetric encryption, the same key encrypts and decrypts. The Advanced Encryption Standard (AES), adopted by the US government in 2001, is used worldwide and is very fast. The challenge is key distribution: both sides need the same secret key without an eavesdropper learning it.
Public-key cryptography
Public-key (asymmetric) cryptography uses a pair of keys: a public key anyone can know and a private key kept secret. Data encrypted with the public key can be decrypted only with the private key. Whitfield Diffie and Martin Hellman published the idea in 1976, and RSA, named after Rivest, Shamir, and Adleman, followed in 1977. Its security rests on mathematical problems such as factoring huge numbers.
Hashing
A cryptographic hash function turns any input into a fixed-size output, such as 256 bits for SHA-256. It is one-way, so the input cannot be recovered from the hash, and even a tiny change in input completely changes the output. Hashes verify that files have not been altered. Passwords should be stored as salted hashes using slow algorithms, so a stolen database does not reveal them.
Digital signatures and certificates
A digital signature uses a private key to sign data; anyone with the public key can verify who signed it and that it has not changed. Websites prove their identity with certificates signed by trusted certificate authorities. When a browser connects over HTTPS, the TLS protocol uses public-key cryptography to agree on a symmetric session key, then encrypts the traffic quickly with it.
Authentication
Authentication verifies identity using something you know (a password or PIN), something you have (a phone or security key), or something you are (a fingerprint or face). Multi-factor authentication (MFA) combines two or more, so a stolen password alone is not enough. Passkeys, which use public-key cryptography stored on a device, are increasingly replacing passwords.
Passwords and quantum threats
Long, unique passwords, ideally managed by a password manager, resist guessing; reusing passwords lets one breach unlock many accounts. Looking ahead, large quantum computers could break RSA and similar public-key methods. In 2024, the US National Institute of Standards and Technology (NIST) published its first post-quantum cryptography standards to prepare.
Worked example
A Caesar cipher with shift 3 turns HELLO into KHOOR: H becomes K, E becomes H, L becomes O, and O becomes R. With only 25 possible shifts, an attacker can try them all in seconds. By contrast, AES-256 has 2^256 possible keys, about 1.2 x 10^77, so trying them all is impossible with any foreseeable conventional computer.
Key takeaways
Encryption turns plaintext into ciphertext with a key; security depends on secret keys, not secret methods. Symmetric encryption such as AES is fast but needs shared keys. Public-key cryptography (Diffie-Hellman 1976, RSA 1977) uses public and private key pairs. Hashes are one-way fingerprints; passwords should be salted and hashed. Digital signatures and certificates prove identity; TLS secures HTTPS. MFA and passkeys strengthen authentication. NIST published post-quantum standards in 2024.
Flashcard
Readable original data
Check your understanding
Why is multi-factor authentication safer than a password alone?