u

UNIT -3 B-TECH VI SEM ISS

UNIT-3
LECTURE-1

Public Key Cryptosystems with Applications:

A look at the encryption algorithm and its securitybenefits
Public-key cryptography, or asymmetric cryptography, is an encryption scheme
that uses two mathematically related, but not identical, keys - a public key and a
private key. Unlike symmetric key algorithms that rely on one key to both encrypt
and decrypt, each key performs a unique function. The public key is used to
encrypt and the private key is used to decrypt.

It is computationally infeasible to compute the private key based on the public key.
Because of this, public keys can be freely shared, allowing users an easy and
convenient method for encrypting content and verifying digital signatures, and
private keys can be kept secret, ensuring only the owners of the private keys can
decrypt content and create digital signatures.

Since public keys need to be shared but are too big to be easily remembered, they
are stored on digital certificates for secure transport and sharing. Since private keys
are not shared, they are simply stored in the software or operating system you use,
or on hardware (e.g., USB token, hardware security module) containing drivers
that allow it to be used with your software or operating system.

Digital certificates are issued by entities known as Certificate Authorities (CAs).

For more information on CAs, please see our related article - What are Certificate
Authorities?.

Business Applications
The main business applications for public-key cryptography are:
 Digital signatures - content is digitally signed with an individual’s private
key and is verified by the individual’s public key
 Encryption - content is encrypted using an individual’s public key and can
only be decrypted with the individual’s private key

NOTES BY: sanjay Page 1

u

Security Benefits of Digital Signatures

Assuming the private key has remained secret and the individual it was issued to is
the only person with access to it, digitally signing documents and emails offers the
following benefits.
 Authentication – since the individual’s unique private key was used to apply
the signature, recipients can be confident that the individual was the one to
actually apply the signature
 Non-repudiation – since the individual is the only one with access to the
private key used to apply the signature, he/she cannot later claim that it wasn’t
him/her who applied the signature
 Integrity - when the signature is verified, it checks that the contents of the
document or message match what was in there when the signature was applied.
Even the slightest change to the original document would cause this check to
fail.

Security Benefits of Encryption

Assuming the individual’s private key has not been compromised, encrypting
data and messages offers the following security benefits.
 Confidentiality - because the content is encrypted with an individual’s public
key, it can only be decrypted with the individual’s private key, ensuring only the
intended recipient can decrypt and view the contents/li>
 Integrity - part of the decryption process involves verifying that the contents of
the original encrypted message and the new decrypted match, so even the
slightest change to the original content would cause the decryption process to
fail

NOTES BY: sanjay Page 2

u

LECTURE-2

Requirements and Cryptanalysis:

Cryptanalyst

The primary responsibility of a cryptanalyst is to develop mathematical formulas

and codes that protect data from prying eyes including cybercriminals and
computer hackers. Public and private sector organizations hire cryptanalyst to
ensure that any information/ data shared through their network is completely
secure and encrypted. Computational number schemes and number theories are
majorly used for writing codes to encrypt data or information. In simple words,
cryptanalysts are expert mathematicians who are able to design, develop, and
evaluation algorithms that can be used to decipher various number theory
problems. Moreover, the responsibility of a cryptanalyst involves writing new
encryption codes to secure data if a hacker or cybercriminal manages to decipher
the existing codes. The responsibilities on the shoulder of a cryptanalyst are huge
as their organization’s image and financial stability depend on their expertise.

Generally, cryptanalysts have completed their undergraduate degrees in either

mathematics or computer science and are said to possess excellent knowledge or
math, economics, computer science, and English. However, to advance in the field
and most cryptanalysts at senior positions have master’s degree or Ph.D. in
mathematics or computer science.

Individuals who are passionate about research and development activities and wish
to advance their careers in the field can opt to become a university teacher, but this
career choice would require them to have Ph.D. in the field.

What is Cryptanalysis?

You came here with the wish to know how to become a cryptanalyst, so it would
be unfair if we don’t dive into details about what cryptanalysis is in order to help
you better understand what lies ahead – should you choose to become a
cryptanalyst. It the science of decrypting coded data and turn it into plain text that
is easy to understand. Cryptanalysis is usually the best way to transmit data over
insecure networking channels. Cryptanalysis also entails encryption of data into
codes so that unauthorized access to data can be prevented.

NOTES BY: sanjay Page 3

u

Should you choose to become a cryptanalyst, you will be expected by your

employer to write or decipher secret codes, which cybercriminals and hackers
cannot crack. Cryptanalysts are professionals with the ability to analyze and
decode secret messages. Whereas, they are also expected (in case if they are
working for a government agency) to design coding systems that are immune to
any potential threat. A cryptanalyst role in a private organization is to ensure the
security of data and systems while protecting the privacy of the organization and
its clients.

Differences in Cryptanalyst, Cryptographer or Cryptologist?

These terms can confuse a beginner as they all appear to focus on encryption and
decryption of communication. But, let us explain it to you in a way that their
difference becomes visible to you. Cryptology is the art and science of creating
algorithms to protect confidential information/ data, whereas cryptanalysis deals
with breaking the cryptographic algorithms. The mixture of these two terms is
known as cryptology.

So what’s the difference between a cryptographer, cryptanalyst, and cryptologists?

This question may also pop up in your mind, thus to educate our readers about how
to become a cryptanalyst, it is imperative to explain the differences of roles. A
cryptographer is expected to design algorithms, develop encryption codes, and
create impenetrable security systems so that confidential information that their
employers wish to protect can be protected. Cryptologists are responsible for both
i.e. creating codes and solving them. In layman terms, cryptography refers to the
art and science of creating codes, whereas cryptanalysis is the art and science of
breaking them and turning them into useful information.

Simply put, a cryptanalyst is required to perform analysis and decryption of the

encrypted information. As a cryptanalyst, you may be required to decipher
encrypted data in different cryptographic security systems.

Encrypted messages or data have two aspects one is internals and the other is
externals. It is the responsibility of a cryptanalyst to identify the internals – a
process of identifying how the message has been encrypted and this can be done by
utilizing the externals of the message. A cryptanalyst is considered good if that
person has the knowledge of applying analysis tools to identify externals, extract
the key and subsequently decrypt the message. Once done with this process, the
person should also be able to reconstruct the process of encryption applied to
encrypt that message.

NOTES BY: sanjay Page 4

u

To become a cryptanalyst, you should have adequate knowledge about ciphers,

cryptosystems, ciphertexts and should develop the capability to identify and
enhance techniques that can be considered as vulnerabilities of the system. A
cryptanalyst has to decode a message or decrypt the data without having prior
knowledge of the encryption key, plain text or the algorithm used during the
process of encryption. Moreover, a cryptanalyst has to get the job done by
targeting digital signatures, cryptographic algorithms, and secure hashing.

Definitions of Common Cryptanalysis Terms

Plaintext: This term in cryptography refers to a message in its original form –

before encryption and after decryption.

Ciphertext: This term refers to a message that has been encrypted via a code.
Ciphertext in simple words is the coded message or the result you get after
encryption. However, cipher has been used interchangeably with the term
ciphertext, which is inaccurate as it refers to the encryption process, not the
encrypted message.

Hashing: It is another common term you would encounter if you wish to become a
cryptanalyst, which basically refers to the process of changing of a string of
characters into a fixed-length key, which becomes the representation of an actual
string.

What does a Cryptanalyst do?

Having covered the basics of cryptanalysis, let’s discuss what the responsibilities
of cryptanalysts are. They are generally expected to develop mathematical models
and write encryption codes to protect data from cybercriminals. They are also
tasked to decipher codes and decrypt encrypted data for companies or government
agencies. The job requirements of a cryptanalyst vary from employer to employer,
but the basic responsibilities of encrypting and decrypting data remain the same. In
a data-driven business environment, data protection has become one of the major
concerns of government agencies and private corporations, hence they hire
cryptanalysts to ensure that their networks, computer systems, and data remain safe
and secure.

A cryptanalyst is needed by almost every company in every industry including

retail, telecom, banks, e-commerce, government agencies, and others. Cryptanalyst
can decide to develop expertise for any specific industry as well to further their

NOTES BY: sanjay Page 5

u

career. For instance, in the banking industry, a cryptanalyst can develop expertise
in securing the entire banking operations including automatic teller machines
(ATMs), emails, credit cards, online banking, and consumer data. In the banking
industry, cryptanalysts use ciphers to protect all the sensitive data including bank
account numbers and credit card numbers. Cryptanalysts are also required by
certain organizations to write codes and develop programs that secure
communication channels and protect the network from any unauthorized access.

Computational number theories and number schemes are mainly used to write most
of the encryption codes. Cryptanalysts are expected to have excellent command
over mathematics since they have to solve a variety of problems using their
expertise in mathematics.

Educational Requirements

The responsibilities mentioned above make it clear that the job of a cryptanalyst
entails computer science and mathematics. Cryptanalysts mostly have a bachelor’s
degree in computer engineering, computer science or mathematics. However, some
also have a master’s degree in these fields as well.

When it comes to mathematics expertise required to become a cryptanalyst, the list

is quite an extensive one and covers everything from linear algebra, elementary
number theory, Calculus (I, II, & III), differential equations, mathematical
cryptography, and methods of complex analysis among others.

Cryptanalysts have to rely on mathematics to fulfill a number of responsibilities

including:

 Examine & test concepts as well as alternative theories

 Write encryption codes and encrypt data, databases, and systems
 Do cryptic computation and utilize numerical analysis methods
 Follow mathematical modules, formulas, and theorems

There are a number of responsibilities that cryptanalysts have to fulfill using

computer engineering or computer science including:

 Design and develop robust computer systems that hackers cannot penetrate
 Recommend security protocols that the company should follow to protect
its data
 Prepare data charts, tables, & graphs

NOTES BY: sanjay Page 6

u

To be considered by an organization for the post of cryptanalyst, you have to have

a degree in computer science, computer engineering, mathematics, or other related
subjects. However, you can also become a cryptanalyst by doing some online
certifications training available at QuickStart.

However, you don’t need any technical degree or certification if you have a degree
in mathematics, computer engineering or computer science along with necessary
experience and training, since this is what employers seek when considering
someone for the position of cryptanalyst. Moreover, there are companies and
government agencies who would consider your profile as a cryptanalyst even if
you don’t have a technical or non-technical degree, since they only need skills,
knowledge, and expertise. However, some organizations would prefer only
graduates with over 5 years of experience to handle the privacy and security of
their sensitive data. To be considered for an entry-level position, you may be
required to demonstrate skills and expertise only along with a bachelor’s or
master’s degree, needless to say, that you may have to compromise on your
expected salary figures initially. If you wish to apply for a mid-level role, you may
need to acquire at least 3 years of experience, otherwise, your profile won’t be
considered. Simply put, where you land a job depends on your hard work 90% of
the times and luck has only 10% shares in it.

If you wish to pursue a degree in computer science or computer engineering, then

your focus should be on the following subjects, should you choose to start your
career as a cryptanalyst:

 C, Python, C++, Java or similar languages

 Computer Algorithms
 Computer Architecture
 Computer Data structures

To add attraction to your CV, QuickStart offers a number of information security

courses & training that may further your knowledge about encryption, decryption,
data security and others. Explore the courses available to see which skill you need
the most. There are training and courses for everyone – so whether you are just a
beginner or a professional, you’ll find a course/ training that suits your needs. As a
beginner, you may need to strengthen your knowledge about basic cryptographic
algorithms, computational number theories, programming languages and more. If
you successfully finish any of the course or training then the certificate you’ll
receive for it can be presented as a proof of acquired skills and may increase the
probability of you getting your dream job. These specialized courses equip you

NOTES BY: sanjay Page 7

u

with the knowledge you may need to work with a particular employer and may get
the understanding to design and develop systems that are beneficial for the
organization.

QuickStart is one of the leading platforms for getting reliable online certifications
and knowledge to expand your area of expertise.

NOTES BY: sanjay Page 8

u

LECTURE-3

RSA cryptosystem:
RSA Algorithm in Cryptography
RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used
for secure data transmission. It is also one of the oldest. The acronym RSA comes
from the surnames of Ron Rivest, Adi Shamir, and Leonard Adleman, who
publicly described the algorithm in 1977. An equivalent system was developed
secretly, in 1973 at GCHQ (the British signals intelligence agency), by the English
mathematician Clifford Cocks. That system was declassified in 1997.[1]
In a public-key cryptosystem, the encryption key is public and distinct from
the decryption key, which is kept secret (private). An RSA user creates and
publishes a public key based on two large prime numbers, along with an auxiliary
value. The prime numbers are kept secret. Messages can be encrypted by anyone,
via the public key, but can only be decoded by someone who knows the prime
numbers.[2]
The security of RSA relies on the practical difficulty of factoring the product of
two large prime numbers, the "factoring problem". Breaking RSA encryption is
known as the RSA problem. Whether it is as difficult as the factoring problem is an
open question.[3] There are no published methods to defeat the system if a large
enough key is used.
RSA is a relatively slow algorithm. Because of this, it is not commonly used to
directly encrypt user data. More often, RSA is used to transmit shared keys
for symmetric key cryptography, which are then used for bulk encryption-
decryption.

RSA algorithm is asymmetric cryptography algorithm. Asymmetric actually means

that it works on two different keys i.e. Public Key and Private Key. As the name
describes that the Public Key is given to everyone and Private key is kept private.
An example of asymmetric cryptography :
1. A client (for example browser) sends its public key to the server and
requests for some data.
2. The server encrypts the data using client’s public key and sends the
encrypted data.
3. Client receives this data and decrypts it.
Since this is asymmetric, nobody else except browser can decrypt the data even if a
third party has public key of browser.

NOTES BY: sanjay Page 9

u

The idea! The idea of RSA is based on the fact that it is difficult to factorize a
large integer. The public key consists of two numbers where one number is
multiplication of two large prime numbers. And private key is also derived from
the same two prime numbers. So if somebody can factorize the large number, the
private key is compromised. Therefore encryption strength totally lies on the key
size and if we double or triple the key size, the strength of encryption increases
exponentially. RSA keys can be typically 1024 or 2048 bits long, but experts
believe that 1024 bit keys could be broken in the near future. But till now it seems
to be an infeasible task.
Let us learn the mechanism behind RSA algorithm :

>> Generating Public Key :

 Select two prime no's. Suppose P = 53 and Q = 59.
 Now First part of the Public key : n = P*Q = 3127.

 We also need a small exponent say e :
 But e Must be

 An integer.

 Not be a factor of n.

 1 < e < Φ(n) [Φ(n) is discussed below],
 Let us now consider it to be equal to 3.


 Our Public Key is made of n and e

>> Generating Private Key :
 We need to calculate Φ(n) :
 Such that Φ(n) = (P-1)(Q-1)
 so, Φ(n) = 3016

 Now calculate Private Key, d :
 d = (k*Φ(n) + 1) / e for some integer k
 For k = 2, value of d is 2011.
Now we are ready with our – Public Key ( n = 3127 and e = 3) and Private Key(d =
2011)

NOTES BY: sanjay Page 10

u

Now we will encrypt “HI” :

 Convert letters to numbers : H = 8 and I = 9

 Thus Encrypted Data c = 89e mod n.
 Thus our Encrypted Data comes out to be 1394

 Now we will decrypt 1394 :

Decrypted Data = cd mod n.
Thus our Encrypted Data comes out to be 89
8 = H and I = 9 i.e. "HI".

NOTES BY: sanjay Page 11

u

LECTURE-4

Rabin cryptosystem:
The Rabin cryptosystem is an asymmetric cryptographic technique, whose
security, like that of RSA, is related to the difficulty of integer factorization.
However the Rabin cryptosystem has the advantage that it has been mathematically
proven to be computationally secure against a chosen-plaintext attack as long as
the attacker cannot efficiently factor integers, while there is no such proof known
for RSA. It has the disadvantage that each output of the Rabin function can be
generated by any of four possible inputs; if each output is a ciphertext, extra
complexity is required on decryption to identify which of the four possible inputs
was the true plaintext.

Rabin Cryptosystem is an public-key cryptosystem invented by Michael Rabin. It

uses asymmetric key encryption for communicating between two parties and
encrypting the message.
The security of Rabin cryptosystem is related to the difficulty of factorization. It
has the advantage over the others that the problem on which it banks has proved
to be hard as integer factorization. It has the disadvantage also, that each output
of the Rabin function can be generated by any of four possible inputs. if each
output is a ciphertext, extra complexity is required on decryption to identify
which of the four possible inputs was the true plaintext.
Steps in Rabin
cryptosystem Key
generation
Generate two very large prime numbers, p and q, which satisfies the condition
p ≠ q → p ≡ q ≡ 3 (mod 4)
For example:
p=139 and q=191
Calculate the value of
n n = p.q
Publish n as public key and save p and q as private key
Encryption

1. Get the public key n.

2. Convert the message to ASCII value. Then convert it to binary and extend
the binary value with itself, and change the binary value back to decimal m.
NOTES BY: sanjay Page 12
u

Encrypt with the formula:

C = m2 mod n
Send C to recipient.
Decryption
Accept C from sender.
Specify a and b with Extended Euclidean GCD such that, a.p + b.q = 1
Compute r and s using following formula:
r = C(p+1)/4 mod p s = C(q+1)/4 mod q
Now, calculate X and Y using following formula:
X = ( a.p.r + b.q.s ) mod p
Y = ( a.p.r – b.q.s ) mod q
The four roots are, m1=X, m2=-X, m3=Y, m4=-Y
Now, Convert them to binary and divide them all in half.
1. Determine in which the left and right half are same. Keep that binary’s one half and conve

NOTES BY: sanjay Page 13

u

LECTURE-5

Elgamal cryptosystem:
"ElGamal" redirects here. For signature algorithm, see ElGamal signature
scheme.
In cryptography, the ElGamal encryption system is an asymmetric key
encryption algorithm for public-key cryptography which is based on the Diffie–
Hellman key exchange. It was described by Taher Elgamal in 1985. ElGamal
encryption is used in the free GNU Privacy Guard software, recent versions
of PGP, and other cryptosystems. The Digital Signature Algorithm (DSA) is a
variant of the ElGamal signature scheme, which should not be confused with
ElGamal encryption.

ElGamal encryption can be defined over any cyclic group , like multiplicative
group of integers modulo n. Its security depends upon the difficulty of a certain
problem in related to computing discrete logarithms.

ElGamal encryption is an public-key cryptosystem. It uses asymmetric key

encryption for communicating between two parties and encrypting the message.
This cryptosystem is based on the difficulty of finding discrete logarithm in a
cyclic group that is even if we know g a and gk, it is extremely difficult to compute
gak.
Idea of ElGamal cryptosystem
Suppose Alice wants to communicate to Bob.
1. Bob generates public and private key :
 Bob chooses a very large number q and a cyclic group Fq.
 From the cyclic group Fq, he choose any element g
and an element a such that gcd(a, q) = 1.
a
 Then he computes h = g .
a
 Bob publishes F, h = g , q and g as his public key and retains a as
private key.
2. Alice encrypts data using Bob’s public key :
 Alice selects an element k from cyclic group F
such that gcd(k, q) = 1.
k k ak.
 Then she computes p = g and s = h = g
 She multiples s with M.

NOTES BY: sanjay Page 14

u

 Then she sends (p, M*s) = (gk, M*s).

3. Bob decrypts the message :
a ak
 Bob calculates s′ = p = g .
 He divides M*s by s′ to obtain M as s = s′.

NOTES BY: sanjay Page 15

u

LECTURE-6

Elliptic curve:
Elliptic curves are curves defined by a certain type of cubic equation in two
variables. The set of rational solutions to this equation has an extremely interesting
structure, including a group law. The theory of elliptic curves was essential in
Andrew Wiles' proof of Fermat's last theorem. Computational problems involving
the group law are also used in many cryptographic applications, and in algorithms
for factoring large integers.

ECC, an alternative technique to RSA, is a powerful cryptography approach. It

generates security between key pairs for public key encryption by using the
mathematics of elliptic curves.

RSA does something similar with prime numbers instead of elliptic curves, but
ECC has gradually been growing in popularity recently due to its smaller key size
and ability to maintain security. This trend will probably continue as the demand
on devices to remain secure increases due to the size of keys growing, drawing on
scarce mobile resources. This is why it is so important to understand elliptic curve
cryptography in context.

In contrast to RSA, ECC bases its approach to public key cryptographic systems on
how elliptic curves are structured algebraically over finite fields. Therefore, ECC
creates keys that are more difficult, mathematically, to crack. For this reason, ECC
is considered to be the next generation implementation of public key cryptography
and more secure than RSA.

It also makes sense to adopt ECC to maintain high levels of both performance and
security. That’s because ECC is increasingly in wider use as websites strive for
greater online security in customer data and greater mobile optimization,
simultaneously. More sites using ECC to secure data means a greater need for this
kind of quick guide to elliptic curve cryptography.

An elliptic curve for current ECC purposes is a plane curve over a finite field
which is made up of the points satisfying the equation:
y²=x³ + ax + b.

NOTES BY: sanjay Page 16

u

In this elliptic curve cryptography example, any point on the curve can be mirrored
over the x-axis and the curve will stay the same. Any non-vertical line will
intersect the curve in three places or fewer.

Elliptic Curve Cryptography vs RSA

The difference in size to security yield between RSA and ECC encryption keys is
notable. The table below shows the sizes of keys needed to provide the same level
of security. In other words, an elliptic curve cryptography key of 384 bit achieves
the same level of security as an RSA of 7680 bit.

RSA Key Length (bit)

1024
2048
3072
7680
15360

ECC Key Length (bit)

160
224
256
384
521

There is no linear relationship between the sizes of ECC keys and RSA keys. That
is, an RSA key size that is twice as big does not translate into an ECC key size
that’s doubled. This compelling difference shows that ECC key generation and
signing are substantially quicker than for RSA, and also that ECC uses less
memory than does RSA.

Also, unlike in RSA, where both are integers, in ECC the private and public keys
are not equally exchangeable. Instead, in ECC the public key is a point on the
curve, while the private key is still an integer.

A quick comparison of the advantages and disadvantages of ECC and RSA

algorithms looks like this:

ECC features smaller ciphertexts, keys, and signatures, and faster generation of
keys and signatures. Its decryption and encryption speeds are moderately fast. ECC
enables lower latency than inverse throughout by computing signatures in two

NOTES BY: sanjay Page 17

u

stages. ECC features strong protocols for authenticated key exchange and support
for the tech is strong.

The main disadvantage of ECC is that it isn’t easy to securely implement.

Compared to RSA, which is much simpler on both the verification and encryption
sides, ECC is a steeper learning curve and a bit slower for accumulating actionable
results.

However, the disadvantages of RSA catch up with you soon. Key generation is
slow with RSA, and so is decryption and signing, which aren’t always that easy to
implement securely.

Advantages of Elliptic Curve Cryptography

Public-key cryptography works using algorithms that are easy to process in one
direction and difficult to process in the reverse direction. For example, RSA relies
on the fact that multiplying prime numbers to get a larger number is easy, while
factoring huge numbers back to the original primes is much more difficult.

However, to remain secure, RSA needs keys that are 2048 bits or longer. This
makes the process slow, and it also means that key size is important.

Size is a serious advantage of elliptic curve cryptography, because it translates into

more power for smaller, mobile devices. It’s far simpler and requires less energy to
factor than it is to solve for an elliptic curve discrete logarithm, so for two keys of
the same size, RSA’s factoring encryption is more vulnerable.

Using ECC, you can achieve the same security level using smaller keys. In a world
where mobile devices must do more and more cryptography with less
computational power, ECC offers high security with faster, shorter keys compared
to RSA.

How Secure is Elliptic Curve Cryptography?

There are several potential vulnerabilities to elliptic curve cryptography, including

side-channel attacks and twist-security attacks. Both types aim to invalidate the
ECC’s security for private keys.

Side-channel attacks including differential power attacks, fault analysis, simple

power attacks, and simple timing attacks, typically result in information leaks.
Simple countermeasures exist for all types of side-channel attacks.

NOTES BY: sanjay Page 18

u

An additional type of elliptic curve attack is the twist-security attack or fault

attack. Such attacks may include invalid-curve attacks and small-subgroup attacks,
and they may result in the private key of the victim leaking out. Twist-security
attacks are typically simply mitigated with careful parameter validation and curve
choices.

Although there are certain ways to attack ECC, the advantages of elliptic curve
cryptography for wireless security mean it remains a more secure option.

NOTES BY: sanjay Page 19

u

LECTURE-7

Cryptosystem:
A cryptosystem is an implementation of cryptographic techniques and their
accompanying infrastructure to provide information security services. A
cryptosystem is also referred to as a cipher system.
Let us discuss a simple model of a cryptosystem that provides confidentiality to the information

The illustration shows a sender who wants to transfer some sensitive data to a receiver in such a
The objective of this simple cryptosystem is that at the end of the process, only the sender and t

Components of a Cryptosystem
The various components of a basic cryptosystem are as follows −
 Plaintext. It is the data to be protected during transmission.
 Encryption Algorithm. It is a mathematical process that produces a
ciphertext for any given plaintext and encryption key. It is a cryptographic

NOTES BY: sanjay Page 20

u

algorithm that takes plaintext and an encryption key as input and produces a
ciphertext.
 Ciphertext. It is the scrambled version of the plaintext produced by the
encryption algorithm using a specific the encryption key. The ciphertext is
not guarded. It flows on public channel. It can be intercepted or
compromised by anyone who has access to the communication channel.
 Decryption Algorithm, It is a mathematical process, that produces a unique
plaintext for any given ciphertext and decryption key. It is a cryptographic
algorithm that takes a ciphertext and a decryption key as input, and outputs
a plaintext. The decryption algorithm essentially reverses the encryption
algorithm and is thus closely related to it.
 Encryption Key. It is a value that is known to the sender. The sender inputs
the encryption key into the encryption algorithm along with the plaintext in
order to compute the ciphertext.
 Decryption Key. It is a value that is known to the receiver. The decryption
key is related to the encryption key, but is not always identical to it. The
receiver inputs the decryption key into the decryption algorithm along with
the ciphertext in order to compute the plaintext.
For a given cryptosystem, a collection of all possible decryption keys is called
a key space.
An interceptor (an attacker) is an unauthorized entity who attempts to determine
the plaintext. He can see the ciphertext and may know the decryption algorithm.
He, however, must never know the decryption key.
Types of Cryptosystems
Fundamentally, there are two types of cryptosystems based on the manner in
which encryption-decryption is carried out in the system −

 Symmetric Key Encryption

 Asymmetric Key Encryption
The main difference between these cryptosystems is the relationship between the
encryption and the decryption key. Logically, in any cryptosystem, both the keys
are closely associated. It is practically impossible to decrypt the ciphertext with
the key that is unrelated to the encryption key.

Symmetric Key Encryption

NOTES BY: sanjay Page 21

u

The encryption process where same keys are used for encrypting and
decrypting the information is known as Symmetric Key Encryption.
The study of symmetric cryptosystems is referred to as symmetric cryptography.
Symmetric cryptosystems are also sometimes referred to as secret key
cryptosystems.
A few well-known examples of symmetric key encryption methods are − Digital
Encryption Standard (DES), Triple-DES (3DES), IDEA, and BLOWFISH.

Prior to 1970, all cryptosystems employed symmetric key encryption. Even today,
its relevance is very high and it is being used extensively in many cryptosystems.
It is very unlikely that this encryption will fade away, as it has certain advantages
over asymmetric key encryption.
The salient features of cryptosystem based on symmetric key encryption are −
 Persons using symmetric key encryption must share a common key prior to
exchange of information.
 Keys are recommended to be changed regularly to prevent any attack on the
system.
 A robust mechanism needs to exist to exchange the key between the
communicating parties. As keys are required to be changed regularly, this
mechanism becomes expensive and cumbersome.
 In a group of n people, to enable two-party communication between any
two persons, the number of keys required for group is n × (n – 1)/2.
 Length of Key (number of bits) in this encryption is smaller and hence,
process of encryption-decryption is faster than asymmetric key encryption.

NOTES BY: sanjay Page 22

u

 Processing power of computer system required to run symmetric algorithm

is less.

Challenge of Symmetric Key Cryptosystem

There are two restrictive challenges of employing symmetric key cryptography.

 Key establishment − Before any communication, both the sender and the
receiver need to agree on a secret symmetric key. It requires a secure key
establishment mechanism in place.
 Trust Issue − Since the sender and the receiver use the same symmetric
key, there is an implicit requirement that the sender and the receiver ‘trust’
each other. For example, it may happen that the receiver has lost the key to
an attacker and the sender is not informed.
These two challenges are highly restraining for modern day communication.
Today, people need to exchange information with non-familiar and non-trusted
parties. For example, a communication between online seller and customer. These
limitations of symmetric key encryption gave rise to asymmetric key encryption
schemes.

Asymmetric Key Encryption

The encryption process where different keys are used for encrypting and
decrypting the information is known as Asymmetric Key Encryption. Though
the keys are different, they are mathematically related and hence, retrieving the
plaintext by decrypting ciphertext is feasible. The process is depicted in the
following illustration −

NOTES BY: sanjay Page 23

u

Asymmetric Key Encryption was invented in the 20 th century to come over the
necessity of pre-shared secret key between communicating persons. The salient
features of this encryption scheme are as follows −
 Every user in this system needs to have a pair of dissimilar keys, private
key and public key. These keys are mathematically related − when one key
is used for encryption, the other can decrypt the ciphertext back to the
original plaintext.
 It requires to put the public key in public repository and the private key as a
well-guarded secret. Hence, this scheme of encryption is also called Public
Key Encryption.
 Though public and private keys of the user are related, it is computationally
not feasible to find one from another. This is a strength of this scheme.
 When Host1 needs to send data to Host2, he obtains the public key
of Host2 from repository, encrypts the data, and transmits.
 Host2 uses his private key to extract the plaintext.
 Length of Keys (number of bits) in this encryption is large and hence, the
process of encryption-decryption is slower than symmetric key encryption.
 Processing power of computer system required to run asymmetric algorithm
is higher.
Symmetric cryptosystems are a natural concept. In contrast, public-key
cryptosystems are quite difficult to comprehend.
You may think, how can the encryption key and the decryption key are ‘related’,
and yet it is impossible to determine the decryption key from the encryption
key? The answer lies in the mathematical concepts. It is possible to design a
cryptosystem whose keys have this property. The concept of public-key
cryptography is relatively new. There are fewer public-key algorithms known than
symmetric algorithms.

NOTES BY: sanjay Page 24