Computer Science (9618) | Security

Welcome to A-Level Security: Encryption and Trust (9618 Content)

Hi! This chapter is vital for understanding how we keep our digital world safe and private. You are now stepping into the realm of A-Level content, which means we will dive deep into the mechanisms that protect data transmissions—specifically, encryption, protocols, and digital certificates.

Don't worry if cryptography seems complicated. We will break down the concepts of keys and ciphers into simple, digestible steps using easy-to-understand analogies. Let's make sure you nail this advanced theory section!

17.1 Encryption Fundamentals

17.1.1 Essential Terminology

Before diving into the complex mathematics of security, we need to understand four core terms:

• Plain Text: The original, readable message or data (e.g., "Send $100").
• Encryption: The process of scrambling Plain Text into an unreadable format.
• Cipher Text: The scrambled, unreadable message (the output of encryption).
• Decryption: The process of converting Cipher Text back into Plain Text using a key.

17.1.2 Symmetric Key Cryptography

This is the simplest form of modern encryption, sometimes called Secret Key Cryptography.

A Symmetric Key system uses only one key for both encryption and decryption.

Analogy: Imagine a shared safe with a single key. If Alice wants to send a secret message to Bob, they must both possess the exact same key. Alice locks the message using the key (encrypts), and Bob uses the same key to open it (decrypts).

Benefits:

• It is generally very fast and efficient for encrypting large amounts of data.

Drawbacks:

• The biggest challenge is key distribution. How do Alice and Bob securely share the key in the first place? If the key is intercepted, all communications are compromised.

17.1.3 Asymmetric Key Cryptography (Public Key Infrastructure)

This method solves the key distribution problem and is essential for secure internet communication. It uses a pair of mathematically linked keys.

• Public Key: This key is made public. Anyone can use it.
• Private Key: This key must be kept secret and only known by the owner.

Key Rule: Data encrypted with the Public Key can only be decrypted by the corresponding Private Key, and vice versa.

Analogy: Think of an old-fashioned mailbox. The slot (Public Key) is open to everyone—they can put messages in. But only the postman (who has the Private Key) can open the door and read the messages.

How Keys are Used to Send a Private Message (Confidentiality)

If Alice wants to send a private (confidential) message to Bob:

1. Alice uses Bob's Public Key to encrypt the Plain Text into Cipher Text.
2. Alice sends the Cipher Text over the network.
3. Since only Bob's Private Key can decrypt the message, only Bob can read the original Plain Text.

Key Takeaway: To ensure confidentiality, you encrypt with the recipient’s Public Key.

How Keys are Used to Send a Verified Message (Authenticity & Integrity)

Sometimes, the sender needs to prove *who* they are, rather than just keeping the message secret. This is done using a Digital Signature (we will look at the full process later).

1. Alice encrypts a part of the message (or a hash of the message) using Alice's Private Key. This is the digital signature.
2. Alice sends the message and the signature.
3. Bob receives the message and uses Alice's Public Key to decrypt the signature.

If Alice's Public Key successfully decrypts the signature, Bob knows two things:

• Authenticity: It must have come from Alice, because only she possesses the Private Key.
• Non-repudiation: Alice cannot later deny sending the message.

17.1.4 Encryption Protocols (SSL/TLS)

Understanding SSL and TLS

When you see HTTPS in your browser bar, you are seeing SSL/TLS in action.

SSL (Secure Socket Layer) and its successor, TLS (Transport Layer Security), are cryptographic protocols designed to provide communication security over a computer network.

• Purpose: They establish a secure, encrypted link between a client (your browser) and a server (the website).
• They sit just above the Transport layer (TCP) and below the Application layer (HTTP).

Use of SSL/TLS in Client-Server Communication

The process, known as the TLS Handshake, involves several steps, usually mixing asymmetric and symmetric encryption:

1. The Client sends a "Hello" to the Server and lists its supported ciphers and protocols.
2. The Server responds with its chosen protocols, its Digital Certificate, and its Public Key.
3. The Client checks the Digital Certificate to ensure the server is authentic (we’ll cover this next!).
4. The Client generates a fast, one-time Symmetric Session Key.
5. The Client encrypts this new Session Key using the Server’s Public Key (Asymmetric encryption) and sends it to the server.
6. The Server decrypts the Session Key using its Private Key.
7. Now, both parties possess the same Session Key. All subsequent data transfer is encrypted using this fast Symmetric Key.

Situations where SSL/TLS is Appropriate:

• Online banking and payments (protecting financial details).
• Login forms (protecting usernames and passwords).
• Any communication requiring proof of server identity (ensuring you are talking to the correct website).

17.1.5 Digital Certification

What is a Digital Certificate?

A Digital Certificate acts like a verified digital ID card for a website or individual. It proves that the public key you are using actually belongs to the claimed owner.

How a Digital Certificate is Acquired

Certificates are issued by a trusted third party called a Certificate Authority (CA), such as Let's Encrypt or DigiCert.

The process:

1. The individual/organisation generates a Public Key / Private Key pair.
2. They send their Public Key and proof of identity to the CA.
3. The CA verifies the identity and then issues a certificate that contains the organisation’s details and their Public Key.
4. The CA then digitally signs the entire certificate using the CA's own Private Key.

This CA signature is crucial because your browser already trusts the CA. If the signature is valid, your browser trusts the website's certificate, which means it trusts the website's Public Key.

Digital Signatures and Certificates

A Digital Signature guarantees the authenticity and integrity of a digital document or piece of software.

How a Digital Certificate is Used to Produce Digital Signatures:

When signing data (like a software update or a certificate itself):

1. The sender runs the data through a hashing algorithm to create a unique, fixed-length hash value (a digital fingerprint).
2. The sender encrypts this hash value using their own Private Key (Asymmetric encryption). This encrypted hash is the Digital Signature.
3. The receiver calculates the hash of the received data themselves.
4. The receiver uses the sender's Public Key (found in their Digital Certificate) to decrypt the Digital Signature, revealing the original hash value.

If the two hash values match, the data is verified: it came from the correct sender (authenticity) and has not been tampered with since signing (integrity).

17.1.6 Quantum Cryptography (A Future Challenge)

Did you know that many of our current encryption methods (especially asymmetric ones like RSA) rely on the fact that it is mathematically very difficult for classical computers to factor large prime numbers?

A Quantum Computer could potentially solve these complex mathematical problems almost instantly, rendering today’s asymmetric encryption systems useless.

Purpose of Quantum Cryptography

Quantum Cryptography aims to use the principles of quantum physics (rather than classical mathematics) to secure communication, making it intrinsically resistant to attacks by both classical and quantum computers.

Benefits of Quantum Cryptography

• Unbreakable Keys: Quantum key distribution (QKD) can detect eavesdropping immediately, because observing a quantum state fundamentally changes it.
• Future-Proof Security: Provides protection against theoretical large-scale quantum computers.

Drawbacks of Quantum Cryptography

• Cost and Complexity: Requires highly specialised hardware (often fibre-optic links) and is currently very expensive to implement.
• Distance Limitations: Quantum signals weaken rapidly over distance, requiring repeaters or trusted nodes.
• Development Stage: It is still an emerging technology and not yet widespread.