Lecture 5 of Computing Security 1 Course for 4th class

Lecture 5 overview:
• Asymmetric Algorithms.
• Kerckhoff’s Principles.
• Cryptanalysis.
• Cryptographic Attacks.
13.2 Asymmetric Algorithms
Asymmetric Algorithms are designed so that the key used for encryption is different from the key used for decryption. Furthermore, the decryption key cannot (at least in any reasonable amount of time) be calculated from the encryption key.
Theses algorithms are called “Public Key Algorithm” when the encryption key can be made public that called the public key, and the decryption key is often called the private key (or secret key).
Sometimes, messages will be encrypted with the private key and decrypted with the public key; this is used in Digital Signatures.
Asymmetric Key Encryption was invented in the 20th century to come over the necessity of pre-shared secret key between communicating persons. So, it is noted the concept of public-key cryptography is relatively new.
The main features of this encryption scheme are as follows:
1. Every user in this system needs to have a pair of dissimilar keys, private key and public key. These keys are mathematically related – when one key is used for encryption, the other can decrypt the ciphertext back to the original plaintext.
2. It requires to put the public key in public repository and the private key as a well-guarded secret.
Computing Security 1 Lecture 5
Page 2
3. Though public and private keys of the user are related, it is computationally not feasible to find one from another. This is a strength of this scheme.
4. When Host1 needs to send data to Host2, he obtains the public key of Host2 from repository, encrypts the data, and transmits.
5. Host2 uses his private key to extract the plaintext.
6. Length of Keys (number of bits) in this encryption is large and hence, the process of encryption-decryption is slower than symmetric key encryption.
7. Processing power of computer system required to run asymmetric algorithm is higher.
Public-key cryptosystems have one significant challenge: the user needs to trust that the public key that he is using in communications with a person really is the public key of that person and has not been spoofed by a malicious third party. This is usually accomplished through a Public Key Infrastructure (PKI) consisting a trusted third party. The third party securely manages and attests to the authenticity of public keys. When the third party is requested to provide the public key for any communicating person X, they are trusted to provide the correct public key.
Finally, due to the advantages and disadvantage of both the systems, symmetric key and public-key cryptosystems are often used together in the practical information security systems.