Cryptography and Society

Question 1

Cryptography Definition

Answer 1

“Secret writing” (crypto + graphy).
* Secures digital information, systems, and computations from adversarial attacks.

Question 2

Key Concepts

Answer 2

• Encryption: Transforming plaintext into ciphertext.
• Decryption: Reversing ciphertext to plaintext using a key.
• Kerckhoffs’ Principle:
• The security of a system should not rely on secrecy of the algorithm, only the key.
• Key-Space Principle:
• The key space must be large enough to resist brute-force attacks.

Question 3

Symmetric Cryptography

Answer 3

Same key for encryption and decryption.

Examples
Stream Cipher:
* Encrypts data bit-by-bit.
* Based on One-Time Pad (OTP) using pseudo-random key streams.
* XOR operation for encryption/decryption.

Block Cipher:
* Encrypts fixed-size data blocks (e.g., AES).

Question 4

Asymmetric Cryptography

Answer 4

Different keys: Public (encryption) and Private (decryption).

Example: RSA Algorithm (based on modular exponentiation)

Question 5

Notable Ciphers

Answer 5

• Caesar Cipher:
  
  • Simple substitution cipher shifting letters by 3 places.
• Mono-Alphabetic Substitution Cipher:
  
  • Maps plaintext to a substitution alphabet.

Question 6

Digital Signature

Answer 6

Provides: Authentication, Integrity, Non-repudation(accountability)

Often paired with hashing for integrity verification

Question 7

Digital Certificate

Answer 7

Issued by a Certificate Authority (CA) to verify ownership of public keys.

Question 8

Potential Threats

Answer 8

• Brute Force:
  * Systematically trying all keys.
• Differential Cryptanalysis:
  * Exploits relationships between plaintext and ciphertext.
• Side-Channel Attacks:
  
  • Observes physical implementation (e.g., timing, power usage).

Question 9

Future Challenges

Answer 9

Quantum Computing:
* Shor’s Algorithm could break RSA by efficiently factoring large numbers.

Question 10

Heartbleed Bug (Attack on Cryptographic Systems)

Answer 10

Exploited OpenSSL’s implementation flaw
* Affected major websites: Yahoo!, Imgur, Stack Overflow, Reddit, etc.
* Impacted systems: Debian, Red Hat Linux, and Android.
* Users were asked to reset passwords due to potential data exposure.

Question 11

DROWN Attack (Decrypting RSA with Obsolete and Weakened eNcryption):

(Attack on Cryptographic Systems)

Answer 11

• Exploits obsolete SSLv2 protocol.
• Highlights risks of using outdated cryptographic protocols.

Question 12

Privacy Tools and Protocols

Answer 12

• Tor (The Onion Router):
  
  • Protects user privacy and combats censorship.
  • Enables anonymous communication through multiple encryption layers.
• HTTP and HTTPS:
  
  • HTTP:
    
    • Unencrypted protocol, vulnerable to interception.
  • HTTPS:
    
    • Adds encryption for secure communication.
    • Not immune to implementation flaws.
  • Combination: Using HTTPS with Tor enhances privacy.

Question 13

Access to Strong Encryption Pros

Answer 13

• Empowers individuals against government control.
• Facilitates secure communication for law-abiding users.

Question 14

Access to Strong Encryption Cons

Answer 14

Enables malicious actors to operate covertly.
* Difficult to regulate criminal activity.

Question 15

Pretty Good Privacy (PGP)

Answer 15

Created by Phil Zimmermann in 1991 for secure email communication.
* Promoted widespread adoption of personal encryption.

Question 16

Zimmerman’s Law

Answer 16

Technology trends make surveillance easier.
* Computers’ ability to track doubles every 18 months.

Question 17

Suveillance and End-to-End Encryption

Answer 17

• Edward Snowden’s Revelations:
  
  • Exposed global surveillance programs (e.g., PRISM, MUSCULAR, Tempora, Stellar Wind).
  • Sparked increased adoption of HTTPS and end-to-end encryption.
• End-to-End Encryption:
  
  • Encrypts data on the sender’s device and decrypts only on the recipient’s device.
  • Used in messaging apps (e.g., WhatsApp, Signal).
  • Controversy:
    
    • Enables privacy but can obscure criminal activities.
  • Debates on banning end-to-end encryption to prevent misuse.