InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Deep dive into public key cryptography covering RSA, ECC, Diffie-Hellman key exchange, digital signatures, and how asymmetric algorithms solve the key distribution problem.
Overview
Asymmetric cryptography (also called public key cryptography) uses a mathematically related key pair — a public key and a private key. Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. This revolutionary concept, introduced by Diffie and Hellman in 1976, solved the key distribution problem that plagued symmetric cryptography.
Asymmetric Key Model
=======================
Key Generation
[Algorithm] → Public Key (share freely)
→ Private Key (keep SECRET)
Encryption (Confidentiality)
Alice's Public Key + Plaintext → [Encrypt] → Ciphertext
Alice's Private Key + Ciphertext → [Decrypt] → Plaintext
Signing (Authentication + Non-repudiation)
Alice's Private Key + Message → [Sign] → Signature
Alice's Public Key + Signature → [Verify] → Valid/Invalid
Mathematical Foundations
Asymmetric cryptography relies on trapdoor one-way functions — operations that are easy to compute in one direction but computationally infeasible to reverse without special knowledge (the private key).
| Algorithm | Hard Problem | Security Basis |
|---|---|---|
| RSA | Integer Factorization | Difficult to factor product of two large primes |
| Diffie-Hellman | Discrete Logarithm | Difficult to find exponent in modular arithmetic |
| ECC | Elliptic Curve Discrete Log | Discrete log on elliptic curve groups |
| ElGamal | Discrete Logarithm | Extension of Diffie-Hellman |
Diffie-Hellman Key Exchange
The first published public key protocol, allowing two parties to establish a shared secret over an insecure channel:
| 1. Choose secret a | 1. Choose secret b |
|---|---|
| Compute A = g^a mod p | Compute B = g^b mod p |
| 2. Compute shared secret: | 2. Compute shared secret: |
| s = B^a mod p | s = A^b mod p |
| s = (g^b)^a mod p | s = (g^a)^b mod p |
| s = g^(ab) mod p | s = g^(ab) mod p |
python example
import random
def diffie_hellman_demo():
"""Demonstrate Diffie-Hellman key exchange."""
# Public parameters (small values for demonstration)
p = 23 # Prime number
g = 5 # Generator
print(f"Public parameters: p={p}, g={g}")
print()
# Alice generates her private/public values
a = random.randint(2, p-2) # Alice's private key
A = pow(g, a, p) # Alice's public value
print(f"Alice: private key a={a}, public value A=g^a mod p = {g}^{a} mod {p} = {A}")
# Bob generates his private/public values
b = random.randint(2, p-2) # Bob's private key
B = pow(g, b, p) # Bob's public value
print(f"Bob: private key b={b}, public value B=g^b mod p = {g}^{b} mod {p} = {B}")
print(f"\nExchanged over public channel: A={A}, B={B}")
# Both compute the shared secret
alice_secret = pow(B, a, p) # B^a mod p = g^(ba) mod p
bob_secret = pow(A, b, p) # A^b mod p = g^(ab) mod p
print(f"\nAlice computes: B^a mod p = {B}^{a} mod {p} = {alice_secret}")
print(f"Bob computes: A^b mod p = {A}^{b} mod {p} = {bob_secret}")
print(f"\nShared secret: {alice_secret} (match: {alice_secret == bob_secret})")
# What Eve sees
print(f"\nEve sees: p={p}, g={g}, A={A}, B={B}")
print(f"Eve cannot determine: a={a} or b={b} or shared secret={alice_secret}")
diffie_hellman_demo()RSA Algorithm
python example
def rsa_demo():
"""Simplified RSA demonstration (educational, not production!)."""
# Key Generation
p = 61 # Prime 1
q = 53 # Prime 2
n = p * q # Modulus = 3233
phi_n = (p - 1) * (q - 1) # Euler's totient = 3120
e = 17 # Public exponent (coprime to phi_n)
# Find d such that d*e ≡ 1 (mod phi_n)
d = pow(e, -1, phi_n) # Private exponent = 2753
print("RSA Key Generation:")
print(f" p={p}, q={q}")
print(f" n = p*q = {n}")
print(f" φ(n) = (p-1)*(q-1) = {phi_n}")
print(f" Public key: (e={e}, n={n})")
print(f" Private key: (d={d}, n={n})")
# Encryption: C = M^e mod n
message = 65 # Numeric message (ASCII 'A')
ciphertext = pow(message, e, n)
print(f"\nEncryption: M={message} → C = M^e mod n = {message}^{e} mod {n} = {ciphertext}")
# Decryption: M = C^d mod n
decrypted = pow(ciphertext, d, n)
print(f"Decryption: C={ciphertext} → M = C^d mod n = {ciphertext}^{d} mod {n} = {decrypted}")
print(f"\nOriginal message recovered: {decrypted} = '{chr(decrypted)}'")
rsa_demo()Symmetric vs Asymmetric Comparison
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared key | Key pair (public + private) |
| Speed | Very fast (1000x faster) | Slow (computationally expensive) |
| Key distribution | Difficult (requires secure channel) | Easy (public key shared freely) |
| Key size for equivalent security | 128-256 bits | 2048-4096 bits (RSA) / 256-384 (ECC) |
| Scalability | N(N-1)/2 keys for N users | 2N keys for N users |
| Use case | Bulk data encryption | Key exchange, signatures, small data |
| Examples | AES, ChaCha20 | RSA, ECC, DH |
Elliptic Curve Cryptography (ECC)
ECC provides equivalent security to RSA with much smaller key sizes:
| Security Level | RSA Key Size | ECC Key Size | Ratio |
|---|---|---|---|
| 80-bit | 1024 bits | 160 bits | 6:1 |
| 112-bit | 2048 bits | 224 bits | 9:1 |
| 128-bit | 3072 bits | 256 bits | 12:1 |
| 192-bit | 7680 bits | 384 bits | 20:1 |
| 256-bit | 15360 bits | 521 bits | 30:1 |
Hybrid Encryption (TLS Approach)
| Client | Server: Client's ECDH public key |
| Server | Client: Server's ECDH public key |
| Shared secret | Session keys (AES-256-GCM keys) |
| Result | Asymmetric solves key exchange, symmetric handles speed |
Interview Questions
- Why is asymmetric encryption not used for bulk data encryption?
- Asymmetric algorithms are approximately 1000x slower than symmetric ones due to complex mathematical operations. They also have message size limitations (RSA can only encrypt data smaller than the key size). The hybrid approach uses asymmetric for key exchange and symmetric for data encryption.
- Explain how Diffie-Hellman solves the key distribution problem.
- DH allows two parties to establish a shared secret over an insecure channel without ever transmitting the secret. Each party generates a private value and derives a public value. By exchanging public values and combining with their private value, both arrive at the same shared secret.
- What is the difference between RSA and ECC?
- RSA is based on the difficulty of factoring large integers; ECC is based on the elliptic curve discrete logarithm problem. ECC provides equivalent security with much smaller keys (256-bit ECC ≈ 3072-bit RSA), making it more efficient for mobile/IoT and modern TLS connections.
- What happens if a private key is compromised?
- All data encrypted with the corresponding public key can be decrypted. All signatures made with that private key are no longer trustworthy. The certificate must be immediately revoked via CRL/OCSP. If perfect forward secrecy (ephemeral DH) was used, past sessions remain protected.
- What is perfect forward secrecy and why does TLS 1.3 require it?
- PFS ensures that compromising long-term keys doesn't compromise past session keys. Each session uses ephemeral DH keys that are discarded after use. Even if the server's private key is later stolen, previously recorded encrypted traffic cannot be decrypted.
Summary
Asymmetric cryptography solved the fundamental key distribution problem and enabled secure communication between strangers on the internet. While too slow for bulk encryption, its combination with symmetric algorithms (hybrid encryption) forms the backbone of secure internet communication. ECC is increasingly preferred over RSA due to its efficiency at equivalent security levels.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Asymmetric Key Cryptography.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, cryptography, asymmetric, key, asymmetric key cryptography
Related Information Security Topics
Continue learning this concept
CryptographyPublic Key Infrastructure (PKI)Understanding PKI components including Certificate Authorities, digital certificates, certificate lifecycle, revocation, and how PKI enables trust on the internet.CryptographySymmetric Key CryptographyComplete guide to symmetric key cryptography covering block ciphers, stream ciphers, modes of operation, key management, and practical implementations with AES and ChaCha20.CryptographyAES - Advanced Encryption StandardComplete guide to the AES algorithm covering its structure, rounds, key expansion, modes of operation, implementation in Python, and why AES replaced DES as the global encryption standard.CryptographyDES - Data Encryption StandardUnderstanding the Data Encryption Standard (DES), its Feistel structure, historical significance, vulnerabilities, evolution to 3DES, and why it was replaced by AES.CryptographyDigital SignaturesComplete guide to digital signatures covering RSA and ECDSA signing, verification process, certificate chains, applications in code signing and documents, with Python implementations.CryptographyEncryption vs DecryptionUnderstanding the fundamental processes of encryption and decryption, their differences, step-by-step operations, and practical applications in modern information security.