With the most recognizable form of crypto, we have symmetric ciphers. Symmetric ciphers are called symmetric because we can consider the key to be symmetric. If you imagine the key that is used to encrypt a message is held in front of a mirror. The mirror image key used to decrypt the message is the same key. The key is symmetrical. The key that is used to encrypt is the same key that is used to decrypt. If you've ever encrypted an Office document, is a symmetric encryption. You enter a password or a key, the document is encrypted. The person unlocking the document uses the same key. It's symmetric because the same key is used to encrypt, as is used to decrypt. Symmetric because the two operations use the same key. They're symmetry. That's what it means. That's the idea of symmetric, the same. Symmetric ciphers. Some things we need to remember about symmetric ciphers. They are really fast. What they're doing is exactly what we talked about in the Caesar cipher. They are substituting one character, but now in numerical form, one numerical value for another. They are permutating, they're changing the order of the plaintext, mixing it up, and they're doing that on a massive scale. Although this is some of the older ways of encrypting data, there is a mathematical algorithm that is used to enhance this. Relatively, this is pretty straightforward for computers to do. Two take away terms for symmetric ciphers, they are fast, and they are strong. You can see on the bottom right, we have substitution. We have the plaintext of cat. We've applied a plus one shift to cat. The c becomes d, the a becomes b, and the t becomes u. Then we've applied permutation. Cat now becomes tca. What if we applied both of those? Cat becomes dbu, and then we change the order of the dbu, and then we do another round of substitution, and another round of permutation. It's not uncommon to see symmetric ciphers doing 16 rounds of processing on plaintext blocks. Two very well-known symmetric ciphers, the data encryption standard. This is a NIST, older encryption standard. It had a key length of 64 bits. It's not considered secure anymore. It was replaced ultimately after several intermediary steps. It was replaced by the Advanced Encryption Standard using a different algorithm. AES is arguably the most commonly used algorithm today. It is clusters being secure, and it has three accepted key sizes. Just compare that to DES's key size. DES was 64 bits. The minimum AES key size now is 128 bits. That is still cluster strong. But you can enhance that by adopting 192 bits, or 256 bits for the key size. The larger the key, the more difficult it is to compromise. The size would be dependent on protection needed. Let's think about what we said when we were talking about retention. If you wanted to keep an item for a long period of time, maybe 100 years, it may be appropriate to look at one of those larger key sizes, maybe 256 bits. Why? Well, because processing power increases year on year. While DES at one point was very strong as computers became more capable, DES became relatively weaker. Looking at how long you might want to retain information for, applies directly to how we approach crypto. Interesting. That's why we have the information management piece alongside crypto. Because one, it has a strong interplay against the other. This mathematics, then the symmetric process to decrypt the algorithm would be run in reverse order, but using the same key. What you would do forward in one direction, you would do opposite in the opposite direction to decrypt back to plaintext. That's the process you see in the top right. The plaintext is processed using a key which results in a ciphertext, a message that is no longer readable. A ciphertext should be statistically unbiased. It should be random to help prevent any mathematical analysis. When the recipient has the file and receives it, they can decrypt it by reversing the process in which the algorithm is applied. One key is needed. Pretty simple, very popular, very easy to use. Again, this is the dominant form of crypto we've seen. If you think of the Caesar cipher having a plus three shift to enable the encryption and the decryption, that was a symmetric process. This is the common crypto that we've seen historically, right the way up to World War II. Then we discovered a different approach, asymmetric encryption. Although this was discovered in the 1940s, it wasn't used practically beyond governments until the 1980s. Why is it called asymmetric? Well, it is called asymmetric because we have two keys. The key used to encrypt is different to the key that is used to decrypt the message. Either one of the two keys could be used to encrypt, but whichever one you use the other key must be used to decrypt. In the process of encryption and decryption, each of our two keys would be used once and only once. If you encrypt with one key, you cannot use that key again to decrypt. We call these two keys public and private. The idea is that the key holder keeps a private key and they keep it private only they have the private key. The public key we consider to be compromised. It is shared, it shared everywhere. The public key is shared, it gives us a new capability, and this capability helps us to overcome some of the key distribution issues we talked about the symmetric encryption had. These two keys then are mathematically linked. In the diagram, on the right, you see a sender and a recipient. Each of the two parties has their own private key. Each of the two parties has their own public key. As the public keys are shared, we can start to overcome those key distribution issues. How do we share the public keys? Well, we can share them in directories. User directories, for example, we can share them in certificates if you visit any website and you see a green padlock click, look at the view certificate. Somewhere you'll see a View Certificate option. If you view the certificate somewhere in that, you'll see lots of information in the certificate. One of the things you will see in the certificate is that website's public key. The website is sharing its own public key. As we said, each key can be used once in an operation. If a file is encrypted with a subject's public key, the only key that can decrypt it is the other part of that key pair, the subjects private key. How does this apply in practice then? Well, let's take a look. If we want to send an encrypted message to somebody, let's say Alice wanted to send an encrypted message to Bob. Alice would use Bob's public key as we see down there in the bottom left. The key material would be encrypted with the public key of the recipient. In this case, we're sending the message to Bob, so we encrypt it using Bob's public key. Now the great thing about this is as long as Bob has shared his public key somewhere, Alice can use that public key, encrypt the plaintext with it, and send it to Bob. Now, that ciphertext cannot be decrypted using Bob's public key. It was encrypted using Bob's public key, it cannot be decrypted using Bob's public key. The only key that can decrypt this now is the corresponding private key. Bob's private key and the only person with Bob's private key should be Bob. Through this, we see that we can overcome key distribution. It's okay for us to share our public keys. Everybody can have our public keys, and then using these public keys, people can send us encrypted messages that only we can decrypt with our corresponding private keys. Some asymmetric encryption ciphers, these include RSA. RSA is mathematically the approach of our asymmetric ciphers is very different. Instead of substitution permutation and so on, what they're doing is creating these two key pairs using a mathematical algorithm. The private key is generated and then some algorithm creates a corresponding public key. RSA is based on the factoring of the product of two large prime numbers. Diffie-Hellman is based on discrete logarithms, very different mathematical approaches for asymmetric. In fact, each of those two ciphers use different mathematical approaches as well. But the approaches that are used, prime numbers and logarithms, mathematically are much more complex. They are slower for computers to process in terms of encryption and decryption, not as easy for them to process. They are mathematically weaker as well. If you are using an asymmetric cipher, bear in mind that you will need a much larger key size. Pretty much all symmetric ciphers, the key sizes are comparable depending on which cipher use. With asymmetric, you need much larger key sizes and the key size will vary, for example, between RSA or Diffie-Hellman or any of the other types. It gives us this new capability that overcomes key distribution, key sharing, but it comes at a price.
