1. CS201 Tech-Talk Two: Cryptography Michael Hsu CSULA

2. What is Cryptography?  The study of secure communications between two parties in the presence of “adversaries” (bad people)  An intersection of multiple disciplines  Mathematics, computer science, electrical engineering, information technology, etc.  CS480, CS580 covers the topic in detail  You use cryptography almost every single moment of your life  SSL  Encrypted cell phone communications  Computer passwords  E-Commerce

3. Old Cryptography vs Modern Cryptography  Old Cryptography relies on encryption and the secrecy of the encryption process  Translate content into gibberish using secret methods using ciphers  Encryption  Only people who know how it’s done can decrypt the message  As computers and mathematics progress, through techniques such as frequency analysis, any cipher that relies on secrecy is insecure.  Modern Cryptography  Computationally Secure  Based on the assumptions that some things are hard to do (such as integer factorization)  Cannot be practically broken with practical means even if you know how it works

4. Example of an Simple Cipher: Caesar Cipher Each letter is replaced by a letter some fixed number of positions down the alphabet Completely insecure

5. Example of a Complicated Cipher: The Enigma Machine Easily broken using modern computers just by brute-force (trying every single solution) with a 77 bit key, without even considering the human errors made during WW2

6. Example of a Secure Modern Cryptosystem(For Now): RSA  Widely used  A Public key cryptosystem  The encryption key is public  The decryption key is secret  Based on the assumption that it is difficult to factor the product of two large prime numbers  Key Size up to 4096 bit  Use a cryptographically secure random number generator to generate the prime numbers  More in detail here:  http://en.wikipedia.org/wiki/RSA_%28cryptosystem%29 http://en.wikipedia.org/wiki/RSA_%28cryptosystem%29

7. DO NOT Use Your Own Cryptography Scheme In Real World Applications  There are many things you can do that will make your encryption insecure. Use Algorithms/implementations that are reviewed by experts.  Java has a cryptography library  https://docs.oracle.com/javase/8/docs/api/javax/crypto/package-summary.html https://docs.oracle.com/javase/8/docs/api/javax/crypto/package-summary.html  Use NIST certified Implementations:  NIST is a federal agency that develop/apply/review various standards  Example:  http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html  Interesting news: NSA backdoor in a NIST random number generator  http://en.wikipedia.org/wiki/Dual_EC_DRBG http://en.wikipedia.org/wiki/Dual_EC_DRBG

8. Security is Only as Strong as Your Weakest Link