Public-key Cryptography Strengths and Weaknesses Matt Blumenthal

Cryptography Definition – the art of writing or solving codes Origins in ancient Egypt Use in religious writings in times of persecution Important military role in both World Wars Rise of modern cryptography in last half- century

Secret-key Cryptography Also known as symmetric cryptography Users have unique public keys, but identical private keys Public keys are used to encrypt a message Private keys are used to decrypt a message

Secret-key Cryptography Not ideal because it requires a secure exchange of private keys, which is not always possible Problematic as the compromise of one private key results in all private keys being compromised

Public-key Cryptography Also called asymmetric cryptography Participants have both unique private and public keys Two divisions of public-key cryptography –Public-key encryption –Digital signatures

Public-key encryption Intended recipient gives sender his or her public key Sender encrypts a message with the recipient’s public key Only the recipient’s private key can be used to decrypt a message encrypted with that public key

Digital Signatures Serves as a verifiable seal or signature to confirm the authenticity of sender and integrity of the message Sender encrypts a message with his or her private key for authentication purposes Recipient can decrypt the message with the sender’s public key to confirm the sender’s identity and the message’s integrity

Digital Signatures Provide no time stamping The compromise of a sender’s private key throws all of the sender’s digital signatures into doubt Because of the lack of time stamping, all messages signed with that key are thrown into doubt

Vulnerabilities Public-key algorithms require longer key sizes than secret-key algorithms, and can be vulnerable to brute-force attacks Man in the middle attack –Third party intercepts message –After decrypting, modifying, and encrypting message, third party passes message along to intended recipient without suspicion

Certificate Authorities Trusted third party that verifies identity of sender and issues digital certificate indicating authorization Has been implemented in web browsing security such as SSL Helps prevent man in the middle attacks