In this section of the course,
we are going to discuss cryptographic types.
The cryptographic type section of the course
focuses on Domain 3, Security Engineering,
specifically Objective 3.8,
which states that given a scenario,
you must be able to apply
an appropriate cryptographic use case and/or technique.
In enterprise management and security,
understanding the tools that protect our data is critical.
If we don't fully understand a tool,
then we won't be able to fully employ it.
One of the most important tools
we use in enterprise security is cryptography.
Cryptography is the practice of securing information
by turning it into an unreadable format,
accessible only to those with a valid decryption key.
Different cryptographic types
serve different cryptographic purposes in the network.
For example, symmetric encryption may be used for fast,
bulk encryption and decryption.
In this way, we can protect our data at rest.
Conversely, asymmetric encryption may be used
for secure key exchange and digital signatures.
In this way, asymmetric encryption is used to ensure
that data remains confidential, authentic,
and resistant to tampering.
In any case, cryptographic techniques are fundamental
to maintaining trust within the network.
This foundation of trust
is built on how we handle encryption, key management,
and managing the authenticity
and integrity of our communications.
As we go through this section,
we will cover many topics related to cryptographic types,
including symmetric cryptography, symmetric algorithms,
symmetric cryptography considerations,
asymmetric cryptography, asymmetric algorithms,
digital signatures, and asymmetric cryptography use cases.
First, we will look at symmetric cryptography.
Symmetric cryptography is a type of encryption
where the same key is used
for both encrypting and decrypting data.
Symmetric cryptography concepts include techniques
such as one-time pad and lightweight cryptography.
Symmetric cryptography commonly utilizing algorithms
such as the Advanced Encryption Standard or AES
is widely used for its efficiency in securing data quickly
and in bulk.
Techniques such as the one-time pad
may even offer theoretically unbreakable encryption.
Theoretically unbreakable encryption is possible
because the one-time pad encryption technique
uses a random key, which is as long as the message itself.
When the long random key is combined with the message,
it produces a ciphertext that is so complex,
it is theoretically unbreakable.
Lightweight cryptography, on the other hand,
is designed for environments with limited power
and cryptographic processing resources such as IoT devices.
Lightweight cryptography can provide
an adequate level of security,
while consuming a minimal amount of computational power.
For example, a smart device
may use lightweight symmetric encryption
to securely communicate with a central server,
ensuring data protection
without overwhelming the smart device's resources.
Next, we will explore symmetric algorithms.
Symmetric algorithms are encryption methods
that result in the creation of a single key.
The result in symmetric key is used for both encrypting
and decrypting data.
Symmetric encryption algorithms
include the Data Encryption Standard or DES,
the Triple Data Encryption Standard or 3DES,
Rivest Cipher 4 or RC4,
Blowfish, and the Advanced Encryption Standard or AES.
Let's take a minute to discuss each of these.
The Data Encryption Standard was one of the earliest used
symmetric encryption algorithms.
Over time, its short key length
made it vulnerable to attack, leading to the development
of the Triple Data Encryption Standard.
The Triple Data Encryption Standard
applies the data encryption standard three times
for added security.
The Data Encryption Standard
and the Triple Data Encryption Standard
are considered block ciphers.
A block cipher transforms fixed size blocks of data
into ciphertext using a symmetric key.
A stream cipher, on the other hand, encrypts data one bit
or byte at a time using a key stream
generated from a symmetric key.
Stream ciphers are often used
for voice and video communications.
Rivest Cipher 4 or RC4 is a symmetric stream cipher
known for its simplicity and speed,
though it has been largely deprecated
due to inherent vulnerabilities.
Blowfish offers a flexible symmetric key length
and has been widely used in software encryption.
The Advanced Encryption Standard
is the current standard for symmetric encryption
and is known for its strong security and efficiency.
After that, we will look
at symmetric cryptography considerations.
Symmetric cryptography considerations
include resource considerations,
as well as comparing centralized
versus decentralized key management techniques.
Big picture symmetric cryptography considerations
involve evaluating the efficiency, security,
and practicality of using symmetric encryption.
One important cryptographic consideration
is the number of resources
that are needed to apply the encryption.
Resource considerations focus on the computational power
required for encryption and decryption.
Resource requirements are generally low
for symmetric algorithms,
making them ideal for environments with limited resources.
Next, let's compare centralized
and decentralized key management.
Centralized key management involves a single entity
controlling all the encryption keys.
This centralization simplifies key management,
but creates a single point of failure.
Decentralized key management
distributes control across multiple entities.
This decentralization increases security
at the cost of increased complexity.
For example, in a large enterprise,
centralized key management might be preferred
to streamline the encryption process across all devices.
While on a separate scenario,
decentralized key management may be used
in a more complex multi-cloud environment
to ensure that no single cloud provider
holds all the encryption keys.
Next, we will explore asymmetric cryptography.
Asymmetric cryptography,
also known as public key cryptography,
uses a pair of keys, one public and one private,
to encrypt and decrypt the data.
In application, one key is used for encryption
and the other is used for decryption.
The same public or private key cannot be used
for both encryption and decryption.
Asymmetric cryptography is widely used
for secure communications, digital signatures,
and the key exchange process.
The computational overhead of asymmetric encryption
is higher than for symmetric encryption.
In application, an organization may use
asymmetric cryptography to sign in-house developed code
to validate its authenticity and integrity.
When a client downloads the code,
they can decrypt the signature
and be confident the code has not been tampered with
and has originated from a trusted source.
Following that, we will look at asymmetric algorithms.
Asymmetric encryption algorithms
are cryptographic techniques
that result in the generation of key pairs,
one public and one private key.
These key pairs are used for encryption and decryption.
Asymmetric encryption algorithms
include the Digital Signature Algorithm or DSA,
Rivest-Shamir-Adleman or RSA,
Diffie-Hellman or DH,
and Elliptic Curve Cryptography or ECC.
Let's explore each of these algorithms in further detail.
The Digital Signature Algorithm
is used for creating digital signatures,
ensuring data authenticity.
RSA is named for the creators of the algorithm,
Rivest-Shamir-Adleman,
and is widely used for secure data transmission
and digital signatures.
Diffie-Hellman is also named for its creators,
Diffie and Hellman,
and is used for secured key exchange
over an insecure channel.
Finally, Elliptic Curve Cryptography
offers similar security to the RSA algorithm,
but with smaller key sizes,
making it more efficient and desirable.
Next, we will explore digital signatures.
A digital signature is a cryptographic technique
that ensures the authenticity
and integrity of a message or document.
It uses a pair of keys, a private key to sign the data
and the corresponding public key to verify the signature.
With the sender's public key, the signature recipient
can confirm the identity of the sender
to ensure the content of the message has not been altered.
For example, in application,
an organization can digitally sign a contract.
Upon receipt, the contract recipient
can verify that the signature is valid
and that the contract has not been tampered with.
Along with this authenticity and integrity,
a digital signature can also provide non-repudiation.
Non-repudiation in this case
means that the sender cannot deny
having signed the contract.
They cannot deny it
because the contract was signed with their private key,
and they keep their private key private.
Finally, we will look at asymmetric cryptography use cases.
Asymmetric cryptography use cases involve scenarios
where a public and private key pair is utilized
to secure communications and authenticate users.
Asymmetric cryptography use cases
include certificate-based authentication,
passwordless authentication, and secure email.
Certificate-based authentication
uses digital certificates to validate identities.
Passwordless authentication uses cryptographic keys
to eliminate the need for passwords.
Secure email employs asymmetric encryption
to ensure that email communications
are confidential from end to end
and can only be read by the intended recipient.
For example, when a user sends an encrypted email
using the recipient's public key,
only the recipient with their own private key
can decrypt and read the email.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive into cryptographic types
in this section of the course.