In this lesson,
we will learn about Asymmetric Algorithms.
Asymmetric Encryption Algorithms are cryptographic
techniques that result in the generation of key pairs,
one public and one private key.
These key pairs are used for encryption and decryption.
Asymmetric encryption algorithms include
the Digital Signature algorithm, or DSA;
RSA known for its creators,
Rivest, Shamir, and Adleman;
Diffie-Hellman, or DH
and Elliptic Curve Cryptography, or ECC.
Let's learn more about RSA, DSA,
DH and ECC asymmetric encryption algorithms.
First, we have RSA.
The RSA algorithm named after its inventors,
Ron Rivest, Adi Shamir, and Leonard Adleman
is one of the most widely used asymmetric
encryption methods.
RSA is secure because it relies
on the mathematical challenge
of factoring large prime numbers.
The process starts by generating two large prime numbers,
which are then multiplied together.
The product of these two large prime numbers
is a critical part of the public key
and is extremely difficult to factor back
into its original primes
if an attacker is trying to reverse engineer the encryption.
This is because the original prime numbers are very large,
typically hundreds of digits long.
The security of RSA depends on this factoring problem,
because while multiplying primes together is simple,
reversing this process is computationally infeasible
for large numbers with the current technology.
This setup ensures only the private key owner
can decrypt messages encrypted with the public key
making RSA effective for secure SSL/TLS communications,
key exchanges and digital signatures.
RSA also supports various key sizes
ranging from 1024 to 4,096 bits
with larger key sizes offering stronger security
at the cost of increased computational requirements.
This balance of security and flexibility
makes RSA a cornerstone
of modern cryptographic processes.
Second, we have the Digital Signature Algorithm,
or DSA.
DSA is an asymmetric cryptographic algorithm,
specifically designed for digital signatures,
providing a secure way to verify the authenticity
and integrity of data.
Unlike RSA, which is used both for encryption
and signatures, DSA is tailored solely for signing,
focusing on proving that a message
comes from a legitimate sender
and has not been altered.
DSA's security relies on the complexity
of discreet logarithmic problems.
DSA was developed independently to address the need
for efficient digital signatures,
offering faster signature generation compared to RSA.
However, DSA is slower than RSA in verifying signatures,
highlighting the typical trade-off in cryptography,
where improvements in one area like speed of signing
may lead to lower performance in another area,
such as signature verification.
Overall, DSA's design ensures data authenticity
and integrity,
making it an important tool
in secure digital communications.
Third, we have Diffie-Hellman, or DH.
The Diffie-Hellman method was one of the first solutions
for symmetric key exchange problems.
It plays an important role in secure communications,
particularly in VPN tunnels
and other encryption protocols
that require exchanging a shared secret key.
Diffie-Hellman allows two parties
to establish a common symmetric key
over an unsecured channel without ever exchanging
that secured key between parties,
relying instead on a complex mathematical process
involving discreet logarithms and a shared secret.
To understand this complex mathematical process,
imagine Diffie-Hellman as a secure way of mixing colors
to create a shared secret
or color without directly sharing that secret itself.
Here's how the process works using colors.
Alice and Bob, who want to communicate securely
start by agreeing on a common base color
such as yellow.
This yellow color is public
and visible to everyone,
including any malicious eavesdroppers.
Next, Alice and Bob each secretly choose
their own private colors.
Let's say Alice picks red and Bob picks blue.
They keep these colors private
and they do not share them with anyone.
Next, Alice mixes her private red color
with the public yellow color to create a unique orange,
and Bob mixes his private blue color
with the public yellow color to create a unique green.
They then each send their mixed colors,
orange and green, to each other over an open channel,
which anyone can see.
This is possible because mathematically,
even if a malicious eavesdropper captures
the orange and green colors,
they cannot extract the public yellow color
to reveal Alice and Bob's private color.
The math just doesn't allow it.
Now, the secret to Diffie-Hellman lies in the next step.
When Alice receives Bob's green color,
she mixes it with her private red color,
creating a secret color that only she knows.
Similarly, when Bob receives Alice's orange color,
he mixes it with his private blue color
to create a color that only he knows.
And because the combination of colors that both Alice
and Bob used was the same,
they both create the exact same color.
So Diffie-Hellman has enabled both Alice and Bob
to independently derive the same symmetric key
without ever sharing that symmetric key across the network.
However, Diffie-Hellman does not provide authentication
on its own, meaning it cannot verify the identity
of communicating parties.
This lack of authentication makes it vulnerable
to certain attacks, such as a logjam attack,
where attackers can pre-compute the steps
of the Diffie-Hellman exchange
to break keys up into 1024 bits.
To mitigate this risk, it's recommended to use key sizes
of 2048 bits or more,
or switch to the more secure Elliptic-Curve
Diffie-Hellman method.
Additionally, Diffie-Hellman is susceptible to on-path
or man-in-the-middle techniques
where an attacker could intercept
and manipulate the key exchange.
To counter this vulnerability,
digital certificates should be used
at the start of the key exchange process
to authenticate the two parties involved.
Overall, Diffie-Hellman allows securely setting up
encryption sessions between two parties
who have never previously exchanged keys,
making it fundamental in applications like
in VPN connections.
Fourth and last, we have Elliptic Curve Cryptography,
or ECC.
ECC is an advanced form of encryption
that uses unique mathematical properties
of elliptic curves to provide high security
with smaller key sizes.
ECC's strength comes from the difficulty
of the elliptic curve discreet logarithm problem.
In simple terms, the Elliptic Curve Discreet Logarithm
problem involves finding a specific point on a curve
starting from a known point,
and then repeatingly adding it to itself.
This is a process known as scalar multiplication.
This operation is easy to perform in one direction,
but extremely difficult to reverse
making it nearly impossible for an attacker
to derive the private key
even if the public key is known.
ECC is particularly well suited for mobile devices,
IOT devices and other systems
with limited processing power
because it offers strong security
with relatively small key sizes.
Unlike RSA, which requires a large key size
to maintain that high security,
ECC achieves similar or even greater security
with much smaller keys
reducing computational demands
and improving speed.
For example, a 256-bit key in ECC
provides comparable security
to a 3072-bit RSA key
making ECC not only faster,
but also less resource intensive.
This efficiency extends to digital signatures as well,
where Elliptic Curve Digital Signature Algorithm
or ECDSA, uses elliptic curves
to provide robust security without the heavy resource
requirements of RSA or DSA on their own.
So ECDSA, like DSA, focuses on signing data
and verifying its authenticity,
but it leverages the efficiency
and security benefits of elliptic curves,
making it a go-to choice for secure communications
in a resource-constrained environments.
Next, the Elliptic-Curve Diffie-Hellman method,
which combines ECC cryptography
with the Diffie-Hellman method,
uses elliptic curves to facilitate secure key exchanges.
In the Elliptic-Curve Diffie-Hellman method two parties
use points on an elliptic curve
to generate a shared secret key
over an insecure channel.
Each party generates a public and private key pair
based on their chosen point on the curve,
and they exchange the public key
with the other party.
Using their own private key and the received public key,
both parties can independently compute the same
shared secret without directly sharing that secret
between themselves, keeping it secure from eavesdropers.
So remember, asymmetric cryptography,
also known as public key cryptography,
uses a pair of keys, one public
and one private to encrypt and decrypt data
enhancing security by eliminating the need
to share a secret key.
Common asymmetric algorithms include:
RSA; DSA, the Digital Signature Algorithm;
Diffie-Hellman; and Elliptic Curve Cryptography,
or ECC.
RSA relies on the difficulty of factoring
large prime numbers, making it highly secure
and widely used for secure data transmission
and digital signatures.
DSA, the Digital Signature Algorithm,
specifically designed for digital signatures,
focuses on verifying data authenticity and integrity
using discrete logarithmic problems for security,
but trading off slower signature verification speeds
as compared to RSA.
Diffie-Hellman primarily used for secure key exchanges
allows two parties to establish a shared secret
over an unsecured channel
without ever directly sharing the key.
Though Diffie-Hellman does lack authentication,
making it vulnerable to certain attacks
unless supplemented with additional security measures
such as digital certificates.
Next, ECC, or Elliptic Curve Cryptography,
leverages the unique properties of elliptic curves
to provide strong security with smaller keys,
making it highly efficient for devices
with limited resources like mobile phones
and IOT devices.
This is increasingly favored for secure communications,
digital signatures, and key exchanges.
Together these asymmetric encryption algorithms
are the backbone of modern asymmetric cryptography,
each with its specific strengths, applications,
and considerations.