Threats and cryptographic building blocks
Networks carry everything from love letters to bank transfers, and attackers can sit anywhere along the path. Security starts with understanding the threats and the cryptographic tools that counter them.
What secure communication needs
Secure communication aims for confidentiality (only the intended parties can read messages), integrity (messages are not altered undetected), authentication (each party is who it claims to be), and availability (the service keeps working). The classic cast is Alice and Bob, who want to communicate, and Trudy, an intruder who may eavesdrop, modify, insert, replay, or block messages.
Common network attacks
Eavesdropping, or sniffing, captures traffic on shared links or compromised devices. Spoofing forges source addresses or identities. Man-in-the-middle attacks relay and possibly alter traffic between two parties. Denial-of-service (DoS) attacks overwhelm targets; distributed DoS (DDoS) attacks use botnets of compromised devices and have exceeded several terabits per second. Malware spreads through networks to steal data or join botnets.
Symmetric-key cryptography
With symmetric encryption, the same secret key encrypts and decrypts. The Advanced Encryption Standard (AES), chosen by the US National Institute of Standards and Technology in 2001, uses 128-, 192-, or 256-bit keys and is fast enough to encrypt traffic at line rate; ChaCha20 is a fast alternative in software. The problem is distributing keys: Alice and Bob need a shared secret before they can communicate securely.
Public-key cryptography
Public-key cryptography, introduced by Whitfield Diffie and Martin Hellman in 1976, gives each party a key pair: a public key anyone may know and a private key kept secret. RSA (1977) and elliptic-curve methods allow encryption to a public key and digital signatures with a private key. Diffie-Hellman key exchange lets two parties agree on a shared secret over a public channel, solving key distribution.
Hashes and message authentication
A cryptographic hash function, such as SHA-256, maps any message to a fixed-size digest; it is infeasible to find two messages with the same digest. A message authentication code (MAC), such as HMAC, combines a hash with a shared key so the receiver can check both integrity and origin. Modern encryption modes such as AES-GCM provide confidentiality and integrity together.
Digital signatures and certificates
A digital signature is created with a private key and verified with the matching public key, proving who signed a message and that it is unchanged. But how does Alice know a public key really belongs to Bob? Certificates, issued by certificate authorities (CAs), bind public keys to identities such as domain names; browsers and operating systems ship with a set of trusted root CAs, forming a public key infrastructure (PKI).
Quantum threats
Large quantum computers could break RSA and elliptic-curve cryptography using Shor's algorithm, which would undermine today's key exchanges and signatures. In August 2024, NIST published its first post-quantum cryptography standards, including ML-KEM for key exchange, and major browsers and messaging apps have begun deploying hybrid key exchanges combining classical and post-quantum methods.
Worked example
Diffie-Hellman with tiny numbers: Alice and Bob publicly agree on prime p = 23 and base g = 5. Alice picks secret a = 6 and sends 5^6 mod 23 = 8; Bob picks secret b = 15 and sends 5^15 mod 23 = 19. Alice computes 19^6 mod 23 = 2; Bob computes 8^15 mod 23 = 2. Both share the secret 2, while an eavesdropper who saw only 23, 5, 8, and 19 must solve a discrete logarithm, which is infeasible with real key sizes of thousands of bits or elliptic curves.
Key takeaways
Security goals are confidentiality, integrity, authentication, and availability, defended against eavesdropping, spoofing, man-in-the-middle, DoS, and malware. Symmetric ciphers such as AES (2001) are fast but need shared keys. Public-key cryptography (Diffie and Hellman, 1976; RSA, 1977) provides key pairs, signatures, and key exchange. Hashes such as SHA-256 and MACs such as HMAC protect integrity; AES-GCM combines encryption and integrity. Certificates from CAs bind keys to identities in a PKI. Quantum computers threaten RSA and elliptic curves; NIST's 2024 post-quantum standards such as ML-KEM are being deployed.
Flashcard
Only intended parties can read data
Check your understanding
Why do secure protocols combine public-key and symmetric cryptography rather than using public-key encryption for everything?