Cracking the Code — Algorithms to Quantum

Concept Focus

A detailed pass over the algorithms behind symmetric and asymmetric cryptography, then hybrid crypto, quantum key distribution, and the key management that holds it all together.

Symmetric algorithms

DES, why it mattered and why it's gone

• One of the earliest symmetric algorithms, developed in the 1970s.
• The input block is split in two halves; one half modifies the other through a series of rounds, each applying XOR, substitutions, and permutations.
• Uses a 56-bit key on 64-bit blocks.
• Strength: a strong standard for its time. Weakness: computing advances made the 56-bit key brute-forceable, leading to AES.

Block modes

2DES and the Meet-in-the-Middle problem

2DES applies DES twice with two different keys: plaintext is encrypted with Key 1 to an intermediate ciphertext, then encrypted again with Key 2. The Meet-in-the-Middle attack targets this by matching intermediate results from both ends, reducing the effective security far below the expected 112 bits.

AES and RC4

AES was standardized by NIST in 2001 to replace DES. It works on 128-bit blocks with key sizes of 128, 192, or 256 bits, applying 10, 12, or 14 rounds of substitution, permutation, and mixing.

• Low processing overhead, efficient and fast in hardware and software.
• Highly secure key lengths make brute force infeasible.
• The standard for VPNs, SSL / TLS, disk encryption, and wireless security (WPA2).

RC4 is a fast, simple stream cipher with a variable-length key. With a key of at least 128 bits there are no practical attacks on the algorithm itself; the WEP attacks came from poor implementation, key reuse, and short, predictable IVs, not from RC4 alone.

Asymmetric algorithms

Asymmetric algorithms rely on one-way functions: easy to compute forward, computationally infeasible to reverse. Multiplying two large primes is easy; factoring the product back is extremely hard (the basis for RSA). Generating a public key from a private key is simple; deriving the private key from the public key is hard.

RSA

• Created in 1978 at MIT by Rivest, Shamir, and Adleman; still widely used.
• Security rests on the difficulty of factoring large integers and on key size (2048 bits or more today).
• RSA vs ECC: RSA needs much larger keys for the same strength. DH vs ElGamal: DH for key exchange, ElGamal extends it with larger ciphertexts.
• Uses: encryption (confidentiality), digital signatures (authenticity and integrity), and key exchange.
• Attacks: brute force (impractical at 2048 bits+), mathematical factorization (a future quantum threat), and timing / side-channel attacks (mitigated by constant-time implementations).

Diffie–Hellman and ElGamal

• Establish a shared symmetric key between two parties over an insecure channel; DH itself does not encrypt messages.
• Security rests on the Discrete Logarithm Problem: given the public value, base, and prime modulus, deriving the private key is infeasible.
• Applications: TLS / SSL, IPSec VPN tunnels, secure key agreement.
• Limitation: no authentication, so it is vulnerable to man-in-the-middle unless combined with RSA / ECC signatures or certificates. It negotiates keys, not confidentiality.

Elliptic Curve Cryptography (ECC)

• Same security as RSA with much smaller keys: 256-bit ECC is roughly equivalent to 3072-bit RSA.
• Less compute and bandwidth, ideal for mobile, IoT, and constrained environments.
• Shorter keys save CPU, battery, and network, perfect for TLS on mobile, certificates, and IoT crypto.

Hybrid cryptography

Symmetric encryption is fast for large data; asymmetric is secure for key exchange. Hybrid uses both: the message is encrypted with a symmetric key (SK), the SK is encrypted with the receiver's public key, and both the encrypted message and the encrypted SK are transmitted. The receiver decrypts the SK with their private key, then decrypts the message with the SK. This is how SSL / TLS, PGP, S/MIME, and online banking work: asymmetric to move the key, symmetric for the bulk data.

Quantum cryptography

A set of protocols that use quantum mechanics to create and distribute secret keys. Traditional cryptography rests on mathematical hardness (factoring, discrete logs); quantum crypto rests on the laws of physics, the Heisenberg Uncertainty Principle (measuring a quantum state disturbs it) and the No-Cloning Theorem (quantum information cannot be copied exactly).

Quantum Key Distribution (QKD). Alice generates a key encoded in photons and sends it over a quantum channel; any eavesdropping by Eve disturbs the photons and is detectable. Bob receives with a detector, and if there is no interference he holds the same key. The actual ciphertext travels over normal channels; the security comes from the quantum-protected key.

• Benefits: eavesdropping can't go undetected; resistant to quantum computers because it doesn't rely on factoring or discrete logs; tampering makes Alice and Bob discard and retry.
• Limitations: still largely experimental; used only for key exchange, not bulk encryption; infrastructure-heavy (quantum channels and detectors).

Key management

A cryptosystem must remain secure even if everything about it is public except the key. Security depends only on the secrecy of the key, not the secrecy of the algorithm.

• Challenges: secure generation (random, strong), distribution (only to intended recipients), storage (HSM or secure KMS), rotation (periodic), and revocation (replace compromised keys immediately).
• Manual vs automatic: manual handling is error-prone; automated lifecycle management is scalable and consistent.

Operational controls.

• Dual control: two people act together to use a key.
• Split knowledge: no single person holds the full key; fragments must be combined.
• Separation of duties: no single person controls all steps of a sensitive process.
• Key escrow: keys held in trust for recovery or compliance.

Together, split knowledge and dual control reduce insider threat and enforce least privilege.

Brain Ticklers